@chitmark/sdk 0.6.2 → 0.6.4

package/dist/index.cjs

@@ -61,7 +61,16 @@ var DEFAULT_BASE_URLS = {
   development: "http://127.0.0.1:8787"
 };
 var DEFAULT_TIMEOUT_MS = 800;
-var SDK_VERSION = "0.6.0";
+var LOCAL_TIMEOUT_MS = 2e3;
+var SDK_VERSION = "0.6.4";
+function defaultTimeoutMs(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1" ? LOCAL_TIMEOUT_MS : DEFAULT_TIMEOUT_MS;
+  } catch {
+    return DEFAULT_TIMEOUT_MS;
+  }
+}
 function resolveBaseUrl(env = "production", baseUrl) {
   return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\/$/, "");
 }
@@ -186,6 +195,7 @@ function flattenHeaders(headers) {
 }
 
 // src/verify-token.ts
+var VERDICT_TOKEN_ISSUER = "https://api.chitmark.com";
 var VerdictTokenError = class extends ChitmarkError {
   name = "VerdictTokenError";
   constructor(code, message) {
@@ -194,7 +204,7 @@ var VerdictTokenError = class extends ChitmarkError {
 };
 var DEFAULT_JWKS_URL = "https://api.chitmark.com/.well-known/jwks.json";
 var DEFAULT_LEEWAY_SECONDS = 30;
-async function verifyVerdictToken(token, options = {}) {
+async function verifyVerdictToken(token, options) {
   const nowMs = options.nowMs ?? Date.now();
   const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;
   const parts = token.split(".");
@@ -235,15 +245,20 @@ async function verifyVerdictToken(token, options = {}) {
   if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {
     throw new VerdictTokenError("not_yet_valid", "verdictToken iat is in the future");
   }
-  const expectedSession = options.session;
-  if (expectedSession !== void 0 && payload["sub"] !== expectedSession) {
+  const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;
+  if (payload["iss"] !== expectedIssuer) {
+    throw new VerdictTokenError(
+      "wrong_issuer",
+      "verdictToken was not issued by Chitmark"
+    );
+  }
+  if (payload["sub"] !== options.session) {
     throw new VerdictTokenError(
       "wrong_session",
       "verdictToken was minted for a different session"
     );
   }
-  const expectedTenantId = options.tenantId;
-  if (expectedTenantId !== void 0 && payload["tid"] !== expectedTenantId) {
+  if (payload["tid"] !== options.tenantId) {
     throw new VerdictTokenError(
       "wrong_tenant",
       "verdictToken was minted for a different tenant"
@@ -350,7 +365,7 @@ var Chitmark = class {
     }
     this.apiKey = options.apiKey;
     this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());
-    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.timeoutMs = options.timeoutMs ?? defaultTimeoutMs(this.baseUrl);
     this.piiMode = options.piiMode ?? "hashed";
     this.onDegraded = "challenge";
     this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
@@ -358,9 +373,15 @@ var Chitmark = class {
   }
   /**
    * Score + route an inbound action (signup / trial / …).
-   * Hot path at the edge; client budget defaults to 800ms.
-   * On timeout/transport error, or a malformed verdict shape from the API,
-   * returns a degraded challenge verdict (never allow, never crashes).
+   * Client budget defaults to 800ms (2000ms for local base URLs).
+   *
+   * Store-outage degradation arrives as **HTTP 200** with a Verdict body
+   * (`degraded: true`, `decision: "challenge"`). The SDK deserializes that
+   * like any other Verdict. Verify never returns HTTP 503.
+   *
+   * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport
+   * timeout / network failure (or a malformed 200 body) synthesizes a local
+   * degraded challenge Verdict (never allow, never crashes).
    *
    * Persist `v.eventId` on the account row: feedback joins only on that id.
    */
@@ -401,7 +422,17 @@ var Chitmark = class {
   }
   /**
    * Report a downstream outcome joined on the stored eventId from verify.
-   * This is the data moat: attribution is a schema contract, not a fuzzy match.
+   *
+   * Security invariant: feedback cannot create attribution. It only attaches
+   * an outcome to an existing verify event for this tenant. Unknown or
+   * cross-tenant eventIds return 404. Never invent a join from email/IP.
+   *
+   * Append-only (not latest-wins): multiple outcomes may attach to one
+   * eventId. Exact duplicates share one feedbackId. Compatible labels
+   * coexist; conflicting pairs quarantine the new observation without
+   * deleting prior evidence. HTTP `{ ok: true }` still acknowledges
+   * quarantined ingest.
+   *
    * `idempotencyKey` is sent as both the Idempotency-Key header and body field
    * (header takes precedence server-side) so exact retries replay the original
    * acknowledgement.
@@ -424,8 +455,8 @@ var Chitmark = class {
   }
   /**
    * Complete a challenge by submitting its solved proof. Clears only the bound
-   * session, once. Re-verify with `context.challengeId` to have the next
-   * verify honor the cleared session.
+   * session, once. Does not authorize the action: re-verify with
+   * `context.challengeId` and proceed only on non-degraded allow.
    */
   async completeChallenge(request) {
     return this.request("/v1/challenge", {
@@ -435,12 +466,13 @@ var Chitmark = class {
   }
   /**
    * Verify a verdictToken's signature against the API's JWKS and its session /
-   * tenant binding. Rejects expired tokens, unknown kids, and
-   * invalid signatures with `VerdictTokenError`. Pass `session` and `tenantId`
-   * to enforce session and tenant binding (recommended); `aud` enforces the
-   * origin hint only.
+   * tenant binding. Prefers a cached `jwks` (refresh periodically and on
+   * unknown `kid`); do not fetch on every call. Rejects expired tokens,
+   * unknown kids, and invalid signatures with `VerdictTokenError`. Always
+   * pass `session` and `tenantId` (required security boundary); `aud`
+   * optionally enforces the origin hint only.
    */
-  async verifyVerdictToken(token, options = {}) {
+  async verifyVerdictToken(token, options) {
     return verifyVerdictToken(token, {
       ...options,
       jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,
@@ -537,18 +569,31 @@ var CHITMARK_HTTP_STATUS_MEANING = {
   unauthorized: "API key is missing or invalid.",
   forbidden: "Verify returned deny; block the action.",
   notFound: "Referenced Chitmark resource was not found.",
-  conflict: "Idempotency key was reused with a materially different payload.",
-  preconditionRequired: "Verify returned challenge or degraded; require friction before continuing.",
+  conflict: "Idempotency key is already associated with a different payload fingerprint.",
+  preconditionRequired: "428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.",
   tooManyRequests: "Request was rate limited."
 };
+function isEligibleAllow(verdict) {
+  return verdict.decision === "allow" && !verdict.degraded;
+}
 function verdictToHttpStatus(verdict) {
   if (verdict.degraded || verdict.decision === "challenge") {
     return CHITMARK_HTTP_STATUS.preconditionRequired;
   }
   if (verdict.decision === "deny") return CHITMARK_HTTP_STATUS.forbidden;
+  if (!isEligibleAllow(verdict)) {
+    return CHITMARK_HTTP_STATUS.preconditionRequired;
+  }
   return CHITMARK_HTTP_STATUS.ok;
 }
 
+// src/trusted-ip.ts
+function getTrustedClientIp(req) {
+  const platform = req.headers.get("cf-connecting-ip")?.trim() || req.headers.get("x-real-ip")?.trim() || req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim() || "";
+  if (platform) return platform;
+  return req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "";
+}
+
 // src/middleware/express.ts
 function chitmarkGate(client, action, options = {}) {
   return async (req, res, next) => {
@@ -576,6 +621,10 @@ function chitmarkGate(client, action, options = {}) {
         res.status(CHITMARK_HTTP_STATUS.forbidden).json({ error: "blocked", eventId: v.eventId });
         return;
       }
+      if (!isEligibleAllow(v)) {
+        res.status(CHITMARK_HTTP_STATUS.preconditionRequired).json({ challenge: true, eventId: v.eventId });
+        return;
+      }
       next();
     } catch (err) {
       next(err);
@@ -592,7 +641,7 @@ async function verifyNextRequest(client, req, options) {
     session: options.session,
     subject: {
       email: options.body?.email,
-      ip: req.headers.get("x-forwarded-for") ?? "",
+      ip: getTrustedClientIp(req),
       userAgent: req.headers.get("user-agent") ?? "",
       headers: Object.fromEntries(req.headers),
       formData: options.body
@@ -605,11 +654,14 @@ exports.CHITMARK_HTTP_STATUS_MEANING = CHITMARK_HTTP_STATUS_MEANING;
 exports.Chitmark = Chitmark;
 exports.ChitmarkApiError = ChitmarkApiError;
 exports.ChitmarkError = ChitmarkError;
+exports.VERDICT_TOKEN_ISSUER = VERDICT_TOKEN_ISSUER;
 exports.VerdictTokenError = VerdictTokenError;
 exports.chitmarkGate = chitmarkGate;
 exports.degradedChallengeVerdict = degradedChallengeVerdict;
 exports.enforceDegradedNeverAllow = enforceDegradedNeverAllow;
+exports.getTrustedClientIp = getTrustedClientIp;
 exports.hashEmailSha256 = hashEmailSha256;
+exports.isEligibleAllow = isEligibleAllow;
 exports.minimizeFormData = minimizeFormData;
 exports.truncateIp = truncateIp;
 exports.verdictToHttpStatus = verdictToHttpStatus;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/middleware/express.ts","../src/middleware/next.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,WAAA,GAAc,OAAA;AAEpB,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;AClBA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACxCO,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AAqBA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAE/B,eAAsB,kBAAA,CACpB,KAAA,EACA,OAAA,GAAqC,EAAC,EACT;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,KAAA,EAAO;AAC3B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,YAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,kBAAkB,OAAA,CAAQ,OAAA;AAChC,EAAA,IAAI,eAAA,KAAoB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,eAAA,EAAiB;AACvE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,mBAAmB,OAAA,CAAQ,QAAA;AACjC,EAAA,IAAI,gBAAA,KAAqB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,gBAAA,EAAkB;AACzE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;ACzLO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,GAAgE,EAAC,EACpC;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;AC5RO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,iEAAA;AAAA,EACV,oBAAA,EACE,4EAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAEO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACSO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;ACvEA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,IAAK,EAAA;AAAA,MAC1C,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH","file":"index.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n  override name = \"ChitmarkError\";\n  readonly status?: number;\n  readonly code?: string;\n  readonly body?: ChitmarkErrorBody | string;\n\n  constructor(\n    message: string,\n    options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n  ) {\n    super(message);\n    this.status = options?.status;\n    this.code = options?.code;\n    this.body = options?.body;\n  }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n  override name = \"ChitmarkApiError\";\n\n  constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n    const msg =\n      message ??\n      (typeof body === \"string\"\n        ? body\n        : body.message || body.error || `Chitmark API error (${status})`);\n    super(msg, {\n      status,\n      code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n      body,\n    });\n  }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n  return {\n    decision: \"challenge\" satisfies Decision,\n    actorType: \"unknown\",\n    confidence: 0,\n    reasons: [reason],\n    principal: {\n      resolved: false,\n      identityBasis: [\"degraded\"],\n    },\n    verdictToken: \"\",\n    eventId: `evt_degraded_${session ?? \"unknown\"}`,\n    degraded: true,\n    enforcementMode: \"enforce\",\n  };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n  if (verdict.degraded && verdict.decision === \"allow\") {\n    return {\n      ...verdict,\n      decision: \"challenge\",\n      reasons: [\n        ...verdict.reasons,\n        \"Client enforced: degraded decision must not be allow\",\n      ],\n    };\n  }\n  return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n  production: \"https://api.chitmark.com\",\n  staging: \"https://api.staging.chitmark.com\",\n  development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.6.0\";\n\nexport function resolveBaseUrl(\n  env: ChitmarkEnv = \"production\",\n  baseUrl?: string,\n): string {\n  return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const value = process.env?.CHITMARK_BASE_URL;\n  return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n  const normalized = email.trim().toLowerCase();\n  const data = new TextEncoder().encode(normalized);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n  const trimmed = ip.trim();\n  // IPv4 (optionally from x-forwarded-for first hop)\n  const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n  if (first.includes(\".\") && !first.includes(\":\")) {\n    const parts = first.split(\".\");\n    if (parts.length === 4) {\n      return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n    }\n  }\n  // IPv6: keep first 3 hextets (~/48)\n  if (first.includes(\":\")) {\n    const hextets = first.split(\":\").filter(Boolean);\n    const head = hextets.slice(0, 3).join(\":\");\n    return `${head}::/48`;\n  }\n  return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n  formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!formData) return undefined;\n  const allowed = new Set([\n    \"companyDomain\",\n    \"company_domain\",\n    \"domain\",\n    \"plan\",\n    \"referrer\",\n    \"utm_source\",\n    \"utm_medium\",\n    \"utm_campaign\",\n  ]);\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(formData)) {\n    if (allowed.has(key) && value != null) {\n      out[key] = value;\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let hex = \"\";\n  for (const b of bytes) {\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n  subject: Subject,\n  piiMode: PiiMode,\n): Promise<Subject> {\n  if (piiMode === \"raw\") {\n    return subject;\n  }\n\n  if (piiMode === \"none\") {\n    return {\n      userAgent: subject.userAgent,\n      headers: pickWebBotAuthHeaders(subject.headers),\n    };\n  }\n\n  // hashed (default)\n  const prepared: Subject = {\n    userAgent: subject.userAgent,\n    headers: subject.headers,\n  };\n\n  if (subject.emailSha256) {\n    prepared.emailSha256 = subject.emailSha256;\n  } else if (subject.email) {\n    prepared.emailSha256 = await hashEmailSha256(subject.email);\n  }\n\n  if (subject.ipTrunc) {\n    prepared.ipTrunc = subject.ipTrunc;\n  } else if (subject.ip) {\n    prepared.ipTrunc = truncateIp(subject.ip);\n  }\n\n  const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n  if (hashedForm) {\n    prepared.formDataHashed = hashedForm;\n  }\n\n  return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n  headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    const lower = k.toLowerCase();\n    if (keys.includes(lower) && typeof v === \"string\") {\n      out[lower] = v;\n    } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n      out[lower] = v[0];\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n  headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  if (headers instanceof Headers) {\n    const out: Record<string, string> = {};\n    headers.forEach((value, key) => {\n      out[key.toLowerCase()] = value;\n    });\n    return out;\n  }\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v === \"string\") out[k.toLowerCase()] = v;\n    else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n  }\n  return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and `jti`\n * with a short `exp`. This module validates shape, signature (against the JWKS\n * served from GET /.well-known/jwks.json), expiry, session binding, and, when\n * expected values are supplied, tenant and origin binding. `aud` reflects\n * request headers and is attacker influenced: always verify `session` and\n * `tenantId`, never `aud` alone. Rejection reasons are surfaced as\n * `VerdictTokenError.code`.\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\nexport interface VerdictTokenClaims {\n  eventId: string;\n  decision: Decision;\n  actorType: ActorType;\n  confidence: number;\n  aud: string;\n  sub: string;\n  /** Issuing tenant, server-derived from the API key used at verify time. */\n  tid: string;\n  jti: string;\n  iat: number;\n  exp: number;\n  degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n  | \"malformed_token\"\n  | \"wrong_algorithm\"\n  | \"wrong_type\"\n  | \"jwks_unavailable\"\n  | \"unknown_kid\"\n  | \"invalid_signature\"\n  | \"expired\"\n  | \"not_yet_valid\"\n  | \"wrong_session\"\n  | \"wrong_aud\"\n  | \"wrong_tenant\";\n\nexport class VerdictTokenError extends ChitmarkError {\n  override name = \"VerdictTokenError\";\n\n  constructor(code: VerdictTokenErrorCode, message: string) {\n    super(message, { code });\n  }\n}\n\nexport interface VerifyVerdictTokenOptions {\n  /** Expected session: token `sub` must equal this or verification fails. */\n  session?: string;\n  /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n  tenantId?: string;\n  /** Expected origin hint: token `aud` must equal this or verification fails. */\n  aud?: string;\n  /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n  jwksUrl?: string;\n  /** Pre-fetched JWKS; skips the network fetch when provided. */\n  jwks?: { keys: Array<Record<string, unknown>> };\n  /** Injectable fetch (Node 24+/browsers have a global). */\n  fetch?: typeof fetch;\n  /** Clock override for tests. */\n  nowMs?: number;\n  /** Clock skew tolerance in seconds; defaults to 30. */\n  leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\nexport async function verifyVerdictToken(\n  token: string,\n  options: VerifyVerdictTokenOptions = {},\n): Promise<VerdictTokenClaims> {\n  const nowMs = options.nowMs ?? Date.now();\n  const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n  }\n  const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n    payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n  } catch {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n  }\n\n  if (header[\"alg\"] !== \"ES256\") {\n    throw new VerdictTokenError(\n      \"wrong_algorithm\",\n      `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n    );\n  }\n  // RFC 8725 §3.11: explicit typing keeps this receipt distinct from any\n  // other JWT a tenant might accept. The edge always mints typ \"JWT\".\n  if (header[\"typ\"] !== \"JWT\") {\n    throw new VerdictTokenError(\n      \"wrong_type\",\n      `verdictToken must be a JWT, got ${String(header[\"typ\"])}`,\n    );\n  }\n  const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n  if (!kid) {\n    throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n  }\n\n  const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n  const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n  const nowSeconds = Math.floor(nowMs / 1000);\n  if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n    throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n  }\n  if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n    throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n  }\n\n  const expectedSession = options.session;\n  if (expectedSession !== undefined && payload[\"sub\"] !== expectedSession) {\n    throw new VerdictTokenError(\n      \"wrong_session\",\n      \"verdictToken was minted for a different session\",\n    );\n  }\n  const expectedTenantId = options.tenantId;\n  if (expectedTenantId !== undefined && payload[\"tid\"] !== expectedTenantId) {\n    throw new VerdictTokenError(\n      \"wrong_tenant\",\n      \"verdictToken was minted for a different tenant\",\n    );\n  }\n  const expectedAud = options.aud;\n  if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n    throw new VerdictTokenError(\n      \"wrong_aud\",\n      \"verdictToken was minted for a different origin\",\n    );\n  }\n\n  const jwk = await findJwk(kid, options);\n  if (!jwk) {\n    throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n  }\n\n  let publicKey: CryptoKey;\n  try {\n    publicKey = await crypto.subtle.importKey(\n      \"jwk\",\n      jwk as unknown as JsonWebKey,\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"JWKS key is not a valid P-256 public key\",\n    );\n  }\n\n  const signatureBytes = decodeBase64UrlBytes(signatureB64);\n  const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n  new Uint8Array(signatureBuffer).set(signatureBytes);\n\n  const valid = await crypto.subtle.verify(\n    { name: \"ECDSA\", hash: \"SHA-256\" },\n    publicKey,\n    signatureBuffer,\n    new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n  );\n  if (!valid) {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"verdictToken signature failed verification\",\n    );\n  }\n\n  return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n  kid: string,\n  options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n  let jwks = options.jwks;\n  if (!jwks) {\n    const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n    try {\n      const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n      const res = await fetchImpl(jwksUrl);\n      if (!res.ok) {\n        throw new Error(`JWKS fetch failed with ${res.status}`);\n      }\n      jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n    } catch (err) {\n      throw new VerdictTokenError(\n        \"jwks_unavailable\",\n        `Failed to load JWKS from ${jwksUrl}: ${\n          err instanceof Error ? err.message : \"unknown error\"\n        }`,\n      );\n    }\n  }\n  if (!Array.isArray(jwks.keys)) {\n    throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n  }\n  return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n","import {\n  ChitmarkApiError,\n  ChitmarkError,\n  degradedChallengeVerdict,\n  enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n  DEFAULT_TIMEOUT_MS,\n  SDK_VERSION,\n  envBaseUrl,\n  resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n  verifyVerdictToken,\n  type VerdictTokenClaims,\n  type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n  ChallengeRequest,\n  ChallengeResponse,\n  ChallengeCompletionResponse,\n  ChallengeProof,\n  ChitmarkOptions,\n  FeedbackRequest,\n  FeedbackResponse,\n  OnDegraded,\n  PiiMode,\n  Verdict,\n  VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger): three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n *   action: \"signup\",\n *   subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n  private readonly apiKey: string;\n  private readonly baseUrl: string;\n  private readonly timeoutMs: number;\n  private readonly piiMode: PiiMode;\n  private readonly onDegraded: OnDegraded;\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientName: string;\n\n  constructor(options: ChitmarkOptions) {\n    if (!options.apiKey) {\n      throw new ChitmarkError(\"Chitmark apiKey is required\");\n    }\n    if (options.onDegraded && options.onDegraded !== \"challenge\") {\n      throw new ChitmarkError(\n        'onDegraded must be \"challenge\": fail to challenge, never to allow',\n      );\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.piiMode = options.piiMode ?? \"hashed\";\n    this.onDegraded = \"challenge\";\n    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n  }\n\n  /**\n   * Score + route an inbound action (signup / trial / …).\n   * Hot path at the edge; client budget defaults to 800ms.\n   * On timeout/transport error, or a malformed verdict shape from the API,\n   * returns a degraded challenge verdict (never allow, never crashes).\n   *\n   * Persist `v.eventId` on the account row: feedback joins only on that id.\n   */\n  async verify(request: VerifyRequest): Promise<Verdict> {\n    const subject = await prepareSubject(\n      {\n        ...request.subject,\n        headers: flattenHeaders(request.subject.headers),\n      },\n      this.piiMode,\n    );\n\n    const body: VerifyRequest = {\n      ...request,\n      subject,\n    };\n\n    try {\n      const verdict = await this.request<Verdict>(\"/v1/verify\", {\n        method: \"POST\",\n        body,\n        idempotencyKey: request.idempotencyKey,\n      });\n      if (!isWellFormedVerdict(verdict)) {\n        return degradedChallengeVerdict(\n          \"Degraded: verify returned a malformed verdict shape\",\n          request.session,\n        );\n      }\n      return enforceDegradedNeverAllow(verdict);\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) {\n        throw err;\n      }\n      return degradedChallengeVerdict(\n        err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n        request.session,\n      );\n    }\n  }\n\n  /**\n   * Report a downstream outcome joined on the stored eventId from verify.\n   * This is the data moat: attribution is a schema contract, not a fuzzy match.\n   * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n   * (header takes precedence server-side) so exact retries replay the original\n   * acknowledgement.\n   */\n  async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n    return this.request<FeedbackResponse>(\"/v1/feedback\", {\n      method: \"POST\",\n      body: request,\n      idempotencyKey: request.idempotencyKey,\n    });\n  }\n\n  /**\n   * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n   */\n  async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n    return this.request<ChallengeResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Complete a challenge by submitting its solved proof. Clears only the bound\n   * session, once. Re-verify with `context.challengeId` to have the next\n   * verify honor the cleared session.\n   */\n  async completeChallenge(request: {\n    eventId: string;\n    challengeId: string;\n    session: string;\n    proof: ChallengeProof;\n  }): Promise<ChallengeCompletionResponse> {\n    return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Verify a verdictToken's signature against the API's JWKS and its session /\n   * tenant binding. Rejects expired tokens, unknown kids, and\n   * invalid signatures with `VerdictTokenError`. Pass `session` and `tenantId`\n   * to enforce session and tenant binding (recommended); `aud` enforces the\n   * origin hint only.\n   */\n  async verifyVerdictToken(\n    token: string,\n    options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\"> = {},\n  ): Promise<VerdictTokenClaims> {\n    return verifyVerdictToken(token, {\n      ...options,\n      jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n      fetch: this.fetchImpl,\n    });\n  }\n\n  /**\n   * Low-level HTTP helper. Prefer verify / feedback / challenge.\n   */\n  async request<T>(\n    path: string,\n    init: {\n      method: string;\n      body?: unknown;\n      idempotencyKey?: string;\n    },\n  ): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    try {\n      const headers: Record<string, string> = {\n        Authorization: `Bearer ${this.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        \"User-Agent\": this.clientName,\n        \"X-Chitmark-Client\": this.clientName,\n      };\n      if (init.idempotencyKey) {\n        headers[\"Idempotency-Key\"] = init.idempotencyKey;\n      }\n\n      const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n        method: init.method,\n        headers,\n        body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n        signal: controller.signal,\n      });\n\n      const text = await res.text();\n      let parsed: unknown = undefined;\n      if (text) {\n        try {\n          parsed = JSON.parse(text) as unknown;\n        } catch {\n          parsed = text;\n        }\n      }\n\n      if (!res.ok) {\n        const errBody =\n          typeof parsed === \"object\" && parsed !== null\n            ? (parsed as { error?: string; message?: string; code?: string })\n            : text;\n        const normalized =\n          typeof errBody === \"string\"\n            ? errBody\n            : {\n                error: errBody.error ?? `http_${res.status}`,\n                message: errBody.message,\n                code: errBody.code,\n              };\n        throw new ChitmarkApiError(res.status, normalized);\n      }\n\n      return parsed as T;\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n          code: \"timeout\",\n        });\n      }\n      throw err instanceof Error\n        ? new ChitmarkError(err.message, { code: \"transport\" })\n        : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  /** Public accessors for inspection / tests. */\n  get config(): {\n    baseUrl: string;\n    timeoutMs: number;\n    piiMode: PiiMode;\n    onDegraded: OnDegraded;\n  } {\n    return {\n      baseUrl: this.baseUrl,\n      timeoutMs: this.timeoutMs,\n      piiMode: this.piiMode,\n      onDegraded: this.onDegraded,\n    };\n  }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Verdict>;\n  return (\n    typeof v.decision === \"string\" &&\n    VERDICT_DECISIONS.has(v.decision) &&\n    typeof v.eventId === \"string\" &&\n    v.eventId.length > 0 &&\n    typeof v.degraded === \"boolean\"\n  );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n  ok: 200,\n  created: 201,\n  badRequest: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  notFound: 404,\n  conflict: 409,\n  preconditionRequired: 428,\n  tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n  (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n  ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n  created: \"Resource was created after an explicit non-degraded allow.\",\n  badRequest: \"Required request fields are missing or malformed.\",\n  unauthorized: \"API key is missing or invalid.\",\n  forbidden: \"Verify returned deny; block the action.\",\n  notFound: \"Referenced Chitmark resource was not found.\",\n  conflict: \"Idempotency key was reused with a materially different payload.\",\n  preconditionRequired:\n    \"Verify returned challenge or degraded; require friction before continuing.\",\n  tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n  if (verdict.degraded || verdict.decision === \"challenge\") {\n    return CHITMARK_HTTP_STATUS.preconditionRequired;\n  }\n  if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n  return CHITMARK_HTTP_STATUS.ok;\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n  hostname?: string;\n  path?: string;\n  ip?: string;\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n  headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n  status: (code: number) => ExpressLikeResponse;\n  json: (body: unknown) => unknown;\n  locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n  /** Optional session binder. */\n  session?: (req: ExpressLikeRequest) => string | undefined;\n  /** Custom surface string. */\n  surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * - deny → 403\n * - challenge (incl. degraded) → 428\n * - allow → next()\n *\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n  client: Chitmark,\n  action: Action,\n  options: GateOptions = {},\n): (\n  req: ExpressLikeRequest,\n  res: ExpressLikeResponse,\n  next: ExpressNext,\n) => Promise<void> {\n  return async (req, res, next) => {\n    try {\n      const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n      const session = options.session?.(req);\n\n      const v: Verdict = await client.verify({\n        action,\n        surface,\n        session,\n        subject: {\n          email: req.body?.email,\n          ip: req.ip,\n          userAgent:\n            (typeof req.headers[\"user-agent\"] === \"string\"\n              ? req.headers[\"user-agent\"]\n              : undefined) ?? \"\",\n          headers: req.headers,\n          formData: req.body,\n        },\n      });\n\n      res.locals.chitmark = v;\n\n      if (v.degraded || v.decision === \"challenge\") {\n        res\n          .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n          .json({ challenge: true, eventId: v.eventId });\n        return;\n      }\n      if (v.decision === \"deny\") {\n        res\n          .status(CHITMARK_HTTP_STATUS.forbidden)\n          .json({ error: \"blocked\", eventId: v.eventId });\n        return;\n      }\n      next();\n    } catch (err) {\n      next(err);\n    }\n  };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\nexport interface NextVerifyOptions {\n  action: Action;\n  surface?: string;\n  session?: string;\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n  client: Chitmark,\n  req: Request,\n  options: NextVerifyOptions,\n): Promise<Verdict> {\n  const url = new URL(req.url);\n  return client.verify({\n    action: options.action,\n    surface: options.surface ?? `${url.host}${url.pathname}`,\n    session: options.session,\n    subject: {\n      email: options.body?.email,\n      ip: req.headers.get(\"x-forwarded-for\") ?? \"\",\n      userAgent: req.headers.get(\"user-agent\") ?? \"\",\n      headers: Object.fromEntries(req.headers),\n      formData: options.body,\n    },\n  });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/trusted-ip.ts","../src/middleware/express.ts","../src/middleware/next.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,WAAA,GAAc,OAAA;AAGpB,SAAS,iBAAiB,OAAA,EAAyB;AACxD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA,CAAE,WAAA,EAAY;AAC3E,IAAA,OAAO,IAAA,KAAS,WAAA,IACd,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,SAAA,IACT,IAAA,KAAS,KAAA,GACP,gBAAA,GACA,kBAAA;AAAA,EACN,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,kBAAA;AAAA,EACT;AACF;AAEO,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;ACpCA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACtDO,IAAM,oBAAA,GAAuB;AAkC7B,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AA+BA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAQ/B,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,KAAA,EAAO;AAC3B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,YAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,cAAA,GAAiB,QAAQ,MAAA,IAAU,oBAAA;AACzC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,cAAA,EAAgB;AACrC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,OAAA,EAAS;AACtC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AClOO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,gBAAA,CAAiB,KAAK,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;AC7SO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,6EAAA;AAAA,EACV,oBAAA,EACE,0IAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAeO,SAAS,gBAAgB,OAAA,EAAmD;AACjF,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAClD;AAMO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAO,CAAA,EAAG;AAC7B,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACnDO,SAAS,mBAAmB,GAAA,EAAsB;AACvD,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,EAAG,IAAA,EAAK,IAC1C,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG,MAAK,IACnC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAC/D,EAAA;AACF,EAAA,IAAI,UAAU,OAAO,QAAA;AAIrB,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAA;AACtE;;;AC+BO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAA,CAAgB,CAAC,CAAA,EAAG;AAEvB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;AChFA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,mBAAmB,GAAG,CAAA;AAAA,MAC1B,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH","file":"index.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n  override name = \"ChitmarkError\";\n  readonly status?: number;\n  readonly code?: string;\n  readonly body?: ChitmarkErrorBody | string;\n\n  constructor(\n    message: string,\n    options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n  ) {\n    super(message);\n    this.status = options?.status;\n    this.code = options?.code;\n    this.body = options?.body;\n  }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n  override name = \"ChitmarkApiError\";\n\n  constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n    const msg =\n      message ??\n      (typeof body === \"string\"\n        ? body\n        : body.message || body.error || `Chitmark API error (${status})`);\n    super(msg, {\n      status,\n      code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n      body,\n    });\n  }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n  return {\n    decision: \"challenge\" satisfies Decision,\n    actorType: \"unknown\",\n    confidence: 0,\n    reasons: [reason],\n    principal: {\n      resolved: false,\n      identityBasis: [\"degraded\"],\n    },\n    verdictToken: \"\",\n    eventId: `evt_degraded_${session ?? \"unknown\"}`,\n    degraded: true,\n    enforcementMode: \"enforce\",\n  };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n  if (verdict.degraded && verdict.decision === \"allow\") {\n    return {\n      ...verdict,\n      decision: \"challenge\",\n      reasons: [\n        ...verdict.reasons,\n        \"Client enforced: degraded decision must not be allow\",\n      ],\n    };\n  }\n  return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n  production: \"https://api.chitmark.com\",\n  staging: \"https://api.staging.chitmark.com\",\n  development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** A cold local edge can take longer than the production budget to start. */\nexport const LOCAL_TIMEOUT_MS = 2_000;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.6.4\";\n\n/** Pick the client budget from the resolved base URL. */\nexport function defaultTimeoutMs(baseUrl: string): number {\n  try {\n    const host = new URL(baseUrl).hostname.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n    return host === \"localhost\" ||\n      host.endsWith(\".localhost\") ||\n      host === \"127.0.0.1\" ||\n      host === \"0.0.0.0\" ||\n      host === \"::1\"\n      ? LOCAL_TIMEOUT_MS\n      : DEFAULT_TIMEOUT_MS;\n  } catch {\n    return DEFAULT_TIMEOUT_MS;\n  }\n}\n\nexport function resolveBaseUrl(\n  env: ChitmarkEnv = \"production\",\n  baseUrl?: string,\n): string {\n  return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const value = process.env?.CHITMARK_BASE_URL;\n  return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n  const normalized = email.trim().toLowerCase();\n  const data = new TextEncoder().encode(normalized);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n  const trimmed = ip.trim();\n  // IPv4 (optionally from x-forwarded-for first hop)\n  const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n  if (first.includes(\".\") && !first.includes(\":\")) {\n    const parts = first.split(\".\");\n    if (parts.length === 4) {\n      return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n    }\n  }\n  // IPv6: keep first 3 hextets (~/48)\n  if (first.includes(\":\")) {\n    const hextets = first.split(\":\").filter(Boolean);\n    const head = hextets.slice(0, 3).join(\":\");\n    return `${head}::/48`;\n  }\n  return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n  formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!formData) return undefined;\n  const allowed = new Set([\n    \"companyDomain\",\n    \"company_domain\",\n    \"domain\",\n    \"plan\",\n    \"referrer\",\n    \"utm_source\",\n    \"utm_medium\",\n    \"utm_campaign\",\n  ]);\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(formData)) {\n    if (allowed.has(key) && value != null) {\n      out[key] = value;\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let hex = \"\";\n  for (const b of bytes) {\n    hex += b.toString(16).padStart(2, \"0\");\n  }\n  return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n  subject: Subject,\n  piiMode: PiiMode,\n): Promise<Subject> {\n  if (piiMode === \"raw\") {\n    return subject;\n  }\n\n  if (piiMode === \"none\") {\n    return {\n      userAgent: subject.userAgent,\n      headers: pickWebBotAuthHeaders(subject.headers),\n    };\n  }\n\n  // hashed (default)\n  const prepared: Subject = {\n    userAgent: subject.userAgent,\n    headers: subject.headers,\n  };\n\n  if (subject.emailSha256) {\n    prepared.emailSha256 = subject.emailSha256;\n  } else if (subject.email) {\n    prepared.emailSha256 = await hashEmailSha256(subject.email);\n  }\n\n  if (subject.ipTrunc) {\n    prepared.ipTrunc = subject.ipTrunc;\n  } else if (subject.ip) {\n    prepared.ipTrunc = truncateIp(subject.ip);\n  }\n\n  const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n  if (hashedForm) {\n    prepared.formDataHashed = hashedForm;\n  }\n\n  return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n  headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    const lower = k.toLowerCase();\n    if (keys.includes(lower) && typeof v === \"string\") {\n      out[lower] = v;\n    } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n      out[lower] = v[0];\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n  headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  if (headers instanceof Headers) {\n    const out: Record<string, string> = {};\n    headers.forEach((value, key) => {\n      out[key.toLowerCase()] = value;\n    });\n    return out;\n  }\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v === \"string\") out[k.toLowerCase()] = v;\n    else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n  }\n  return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and a unique\n * `jti` (correlation id) with a short `exp` (5 minutes). Every signed token\n * requires a `kid` in the JWT header. Signature verification proves\n * authenticity and integrity; it does not make the JWT single-use. This module\n * always enforces `session` and `tenantId` (security boundary), validates\n * `iss` against the Chitmark issuer, and optionally `aud`. `aud` reflects\n * request headers and is attacker influenced: never enforce `aud` alone.\n * Rejection reasons are surfaced as `VerdictTokenError.code`.\n *\n * JWKS: respect `Cache-Control` and, when present, `ETag` /\n * `Last-Modified` via conditional requests (instead of a hard-coded\n * refresh interval). Refresh immediately on unknown `kid`. Do not fetch on\n * every verification; never permanently pin a single signing key. Each JWKS\n * key is EC P-256 for ES256: require JWT `alg === \"ES256\"` before verifying\n * (`wrong_algorithm` otherwise); never trust the token-requested algorithm.\n * Rotation overlaps old and new keys; keep the retiring key until tokens under it\n * expire (≥ 5 minutes + 60 seconds). Pass a cached `jwks` option to skip\n * the network call. An empty JWKS (`keys: []`) means no token can be\n * cryptographically verified: fail closed; never treat an empty set as\n * evidence that a token is valid (local/CI may emit `unsigned.<eventId>`).\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\n/** Canonical issuer claim on every signed verdictToken. */\nexport const VERDICT_TOKEN_ISSUER = \"https://api.chitmark.com\";\n\nexport interface VerdictTokenClaims {\n  /** Issuer: https://api.chitmark.com. */\n  iss: string;\n  eventId: string;\n  decision: Decision;\n  actorType: ActorType;\n  confidence: number;\n  aud: string;\n  sub: string;\n  /** Issuing tenant, server-derived from the API key used at verify time. */\n  tid: string;\n  /** Unique token identifier (correlation). Not single-use unless you track it. */\n  jti: string;\n  iat: number;\n  exp: number;\n  degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n  | \"malformed_token\"\n  | \"wrong_algorithm\"\n  | \"wrong_type\"\n  | \"jwks_unavailable\"\n  | \"unknown_kid\"\n  | \"invalid_signature\"\n  | \"expired\"\n  | \"not_yet_valid\"\n  | \"wrong_issuer\"\n  | \"wrong_session\"\n  | \"wrong_aud\"\n  | \"wrong_tenant\";\n\nexport class VerdictTokenError extends ChitmarkError {\n  override name = \"VerdictTokenError\";\n\n  constructor(code: VerdictTokenErrorCode, message: string) {\n    super(message, { code });\n  }\n}\n\nexport interface VerifyVerdictTokenOptions {\n  /** Expected session: token `sub` must equal this or verification fails. */\n  session: string;\n  /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n  tenantId: string;\n  /** Expected origin hint: token `aud` must equal this or verification fails. */\n  aud?: string;\n  /**\n   * Expected issuer (`iss`). Defaults to {@link VERDICT_TOKEN_ISSUER}.\n   * Override only in tests.\n   */\n  issuer?: string;\n  /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n  jwksUrl?: string;\n  /**\n   * Pre-fetched / cached JWKS; skips the network fetch when provided.\n   * Prefer caching via HTTP headers (`Cache-Control`, `ETag`, and\n   * `Last-Modified` when present) with conditional refresh and immediate\n   * refresh on unknown `kid`, rather than fetching on every verification.\n   */\n  jwks?: { keys: Array<Record<string, unknown>> };\n  /** Injectable fetch (Node 24+/browsers have a global). */\n  fetch?: typeof fetch;\n  /** Clock override for tests. */\n  nowMs?: number;\n  /** Clock skew tolerance in seconds; defaults to 30. */\n  leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\n/**\n * Verify a verdictToken signature and binding.\n *\n * `session` and `tenantId` are required: they are the security boundary for\n * cross-service authorization, not optional hints.\n */\nexport async function verifyVerdictToken(\n  token: string,\n  options: VerifyVerdictTokenOptions,\n): Promise<VerdictTokenClaims> {\n  const nowMs = options.nowMs ?? Date.now();\n  const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n  }\n  const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n    payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n  } catch {\n    throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n  }\n\n  if (header[\"alg\"] !== \"ES256\") {\n    throw new VerdictTokenError(\n      \"wrong_algorithm\",\n      `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n    );\n  }\n  // RFC 8725 §3.11: explicit typing keeps this receipt distinct from any\n  // other JWT a tenant might accept. The edge always mints typ \"JWT\".\n  if (header[\"typ\"] !== \"JWT\") {\n    throw new VerdictTokenError(\n      \"wrong_type\",\n      `verdictToken must be a JWT, got ${String(header[\"typ\"])}`,\n    );\n  }\n  const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n  if (!kid) {\n    throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n  }\n\n  const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n  const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n  const nowSeconds = Math.floor(nowMs / 1000);\n  if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n    throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n  }\n  if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n    throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n  }\n\n  const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;\n  if (payload[\"iss\"] !== expectedIssuer) {\n    throw new VerdictTokenError(\n      \"wrong_issuer\",\n      \"verdictToken was not issued by Chitmark\",\n    );\n  }\n  if (payload[\"sub\"] !== options.session) {\n    throw new VerdictTokenError(\n      \"wrong_session\",\n      \"verdictToken was minted for a different session\",\n    );\n  }\n  if (payload[\"tid\"] !== options.tenantId) {\n    throw new VerdictTokenError(\n      \"wrong_tenant\",\n      \"verdictToken was minted for a different tenant\",\n    );\n  }\n  const expectedAud = options.aud;\n  if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n    throw new VerdictTokenError(\n      \"wrong_aud\",\n      \"verdictToken was minted for a different origin\",\n    );\n  }\n\n  const jwk = await findJwk(kid, options);\n  if (!jwk) {\n    throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n  }\n\n  let publicKey: CryptoKey;\n  try {\n    publicKey = await crypto.subtle.importKey(\n      \"jwk\",\n      jwk as unknown as JsonWebKey,\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"JWKS key is not a valid P-256 public key\",\n    );\n  }\n\n  const signatureBytes = decodeBase64UrlBytes(signatureB64);\n  const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n  new Uint8Array(signatureBuffer).set(signatureBytes);\n\n  const valid = await crypto.subtle.verify(\n    { name: \"ECDSA\", hash: \"SHA-256\" },\n    publicKey,\n    signatureBuffer,\n    new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n  );\n  if (!valid) {\n    throw new VerdictTokenError(\n      \"invalid_signature\",\n      \"verdictToken signature failed verification\",\n    );\n  }\n\n  return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n  kid: string,\n  options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n  let jwks = options.jwks;\n  if (!jwks) {\n    const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n    try {\n      const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n      const res = await fetchImpl(jwksUrl);\n      if (!res.ok) {\n        throw new Error(`JWKS fetch failed with ${res.status}`);\n      }\n      jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n    } catch (err) {\n      throw new VerdictTokenError(\n        \"jwks_unavailable\",\n        `Failed to load JWKS from ${jwksUrl}: ${\n          err instanceof Error ? err.message : \"unknown error\"\n        }`,\n      );\n    }\n  }\n  if (!Array.isArray(jwks.keys)) {\n    throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n  }\n  return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n","import {\n  ChitmarkApiError,\n  ChitmarkError,\n  degradedChallengeVerdict,\n  enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n  SDK_VERSION,\n  defaultTimeoutMs,\n  envBaseUrl,\n  resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n  verifyVerdictToken,\n  type VerdictTokenClaims,\n  type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n  ChallengeRequest,\n  ChallengeResponse,\n  ChallengeCompletionResponse,\n  ChallengeProof,\n  ChitmarkOptions,\n  FeedbackRequest,\n  FeedbackResponse,\n  OnDegraded,\n  PiiMode,\n  Verdict,\n  VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger): three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n *   action: \"signup\",\n *   subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n  private readonly apiKey: string;\n  private readonly baseUrl: string;\n  private readonly timeoutMs: number;\n  private readonly piiMode: PiiMode;\n  private readonly onDegraded: OnDegraded;\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientName: string;\n\n  constructor(options: ChitmarkOptions) {\n    if (!options.apiKey) {\n      throw new ChitmarkError(\"Chitmark apiKey is required\");\n    }\n    if (options.onDegraded && options.onDegraded !== \"challenge\") {\n      throw new ChitmarkError(\n        'onDegraded must be \"challenge\": fail to challenge, never to allow',\n      );\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n    this.timeoutMs = options.timeoutMs ?? defaultTimeoutMs(this.baseUrl);\n    this.piiMode = options.piiMode ?? \"hashed\";\n    this.onDegraded = \"challenge\";\n    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n  }\n\n  /**\n   * Score + route an inbound action (signup / trial / …).\n   * Client budget defaults to 800ms (2000ms for local base URLs).\n   *\n   * Store-outage degradation arrives as **HTTP 200** with a Verdict body\n   * (`degraded: true`, `decision: \"challenge\"`). The SDK deserializes that\n   * like any other Verdict. Verify never returns HTTP 503.\n   *\n   * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport\n   * timeout / network failure (or a malformed 200 body) synthesizes a local\n   * degraded challenge Verdict (never allow, never crashes).\n   *\n   * Persist `v.eventId` on the account row: feedback joins only on that id.\n   */\n  async verify(request: VerifyRequest): Promise<Verdict> {\n    const subject = await prepareSubject(\n      {\n        ...request.subject,\n        headers: flattenHeaders(request.subject.headers),\n      },\n      this.piiMode,\n    );\n\n    const body: VerifyRequest = {\n      ...request,\n      subject,\n    };\n\n    try {\n      const verdict = await this.request<Verdict>(\"/v1/verify\", {\n        method: \"POST\",\n        body,\n        idempotencyKey: request.idempotencyKey,\n      });\n      if (!isWellFormedVerdict(verdict)) {\n        return degradedChallengeVerdict(\n          \"Degraded: verify returned a malformed verdict shape\",\n          request.session,\n        );\n      }\n      return enforceDegradedNeverAllow(verdict);\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) {\n        throw err;\n      }\n      return degradedChallengeVerdict(\n        err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n        request.session,\n      );\n    }\n  }\n\n  /**\n   * Report a downstream outcome joined on the stored eventId from verify.\n   *\n   * Security invariant: feedback cannot create attribution. It only attaches\n   * an outcome to an existing verify event for this tenant. Unknown or\n   * cross-tenant eventIds return 404. Never invent a join from email/IP.\n   *\n   * Append-only (not latest-wins): multiple outcomes may attach to one\n   * eventId. Exact duplicates share one feedbackId. Compatible labels\n   * coexist; conflicting pairs quarantine the new observation without\n   * deleting prior evidence. HTTP `{ ok: true }` still acknowledges\n   * quarantined ingest.\n   *\n   * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n   * (header takes precedence server-side) so exact retries replay the original\n   * acknowledgement.\n   */\n  async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n    return this.request<FeedbackResponse>(\"/v1/feedback\", {\n      method: \"POST\",\n      body: request,\n      idempotencyKey: request.idempotencyKey,\n    });\n  }\n\n  /**\n   * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n   */\n  async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n    return this.request<ChallengeResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Complete a challenge by submitting its solved proof. Clears only the bound\n   * session, once. Does not authorize the action: re-verify with\n   * `context.challengeId` and proceed only on non-degraded allow.\n   */\n  async completeChallenge(request: {\n    eventId: string;\n    challengeId: string;\n    session: string;\n    proof: ChallengeProof;\n  }): Promise<ChallengeCompletionResponse> {\n    return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n      method: \"POST\",\n      body: request,\n    });\n  }\n\n  /**\n   * Verify a verdictToken's signature against the API's JWKS and its session /\n   * tenant binding. Prefers a cached `jwks` (refresh periodically and on\n   * unknown `kid`); do not fetch on every call. Rejects expired tokens,\n   * unknown kids, and invalid signatures with `VerdictTokenError`. Always\n   * pass `session` and `tenantId` (required security boundary); `aud`\n   * optionally enforces the origin hint only.\n   */\n  async verifyVerdictToken(\n    token: string,\n    options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\">,\n  ): Promise<VerdictTokenClaims> {\n    return verifyVerdictToken(token, {\n      ...options,\n      jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n      fetch: this.fetchImpl,\n    });\n  }\n\n  /**\n   * Low-level HTTP helper. Prefer verify / feedback / challenge.\n   */\n  async request<T>(\n    path: string,\n    init: {\n      method: string;\n      body?: unknown;\n      idempotencyKey?: string;\n    },\n  ): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    try {\n      const headers: Record<string, string> = {\n        Authorization: `Bearer ${this.apiKey}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        \"User-Agent\": this.clientName,\n        \"X-Chitmark-Client\": this.clientName,\n      };\n      if (init.idempotencyKey) {\n        headers[\"Idempotency-Key\"] = init.idempotencyKey;\n      }\n\n      const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n        method: init.method,\n        headers,\n        body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n        signal: controller.signal,\n      });\n\n      const text = await res.text();\n      let parsed: unknown = undefined;\n      if (text) {\n        try {\n          parsed = JSON.parse(text) as unknown;\n        } catch {\n          parsed = text;\n        }\n      }\n\n      if (!res.ok) {\n        const errBody =\n          typeof parsed === \"object\" && parsed !== null\n            ? (parsed as { error?: string; message?: string; code?: string })\n            : text;\n        const normalized =\n          typeof errBody === \"string\"\n            ? errBody\n            : {\n                error: errBody.error ?? `http_${res.status}`,\n                message: errBody.message,\n                code: errBody.code,\n              };\n        throw new ChitmarkApiError(res.status, normalized);\n      }\n\n      return parsed as T;\n    } catch (err) {\n      if (err instanceof ChitmarkApiError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n          code: \"timeout\",\n        });\n      }\n      throw err instanceof Error\n        ? new ChitmarkError(err.message, { code: \"transport\" })\n        : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  /** Public accessors for inspection / tests. */\n  get config(): {\n    baseUrl: string;\n    timeoutMs: number;\n    piiMode: PiiMode;\n    onDegraded: OnDegraded;\n  } {\n    return {\n      baseUrl: this.baseUrl,\n      timeoutMs: this.timeoutMs,\n      piiMode: this.piiMode,\n      onDegraded: this.onDegraded,\n    };\n  }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Partial<Verdict>;\n  return (\n    typeof v.decision === \"string\" &&\n    VERDICT_DECISIONS.has(v.decision) &&\n    typeof v.eventId === \"string\" &&\n    v.eventId.length > 0 &&\n    typeof v.degraded === \"boolean\"\n  );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n  ok: 200,\n  created: 201,\n  badRequest: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  notFound: 404,\n  conflict: 409,\n  preconditionRequired: 428,\n  tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n  (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n  ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n  created: \"Resource was created after an explicit non-degraded allow.\",\n  badRequest: \"Required request fields are missing or malformed.\",\n  unauthorized: \"API key is missing or invalid.\",\n  forbidden: \"Verify returned deny; block the action.\",\n  notFound: \"Referenced Chitmark resource was not found.\",\n  conflict: \"Idempotency key is already associated with a different payload fingerprint.\",\n  preconditionRequired:\n    \"428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.\",\n  tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\n/**\n * Explicit non-degraded allow. Use this (or `isEligibleAllow`) before any\n * protected action so unknown / malformed decisions cannot fall through.\n */\nexport type EligibleAllowVerdict = Verdict & {\n  decision: \"allow\";\n  degraded: false;\n};\n\n/**\n * Type guard for the only verdict that may continue a gated action.\n * Fail closed: anything that is not an explicit non-degraded allow is ineligible.\n */\nexport function isEligibleAllow(verdict: Verdict): verdict is EligibleAllowVerdict {\n  return verdict.decision === \"allow\" && !verdict.degraded;\n}\n\n/**\n * Map a verify verdict to an HTTP status for framework drop-ins.\n * Unknown or malformed decisions fail to challenge (428), never to allow (200).\n */\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n  if (verdict.degraded || verdict.decision === \"challenge\") {\n    return CHITMARK_HTTP_STATUS.preconditionRequired;\n  }\n  if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n  if (!isEligibleAllow(verdict)) {\n    return CHITMARK_HTTP_STATUS.preconditionRequired;\n  }\n  return CHITMARK_HTTP_STATUS.ok;\n}\n","/**\n * Resolve a client IP for verify subject signals from a Fetch Request.\n *\n * Prefer platform-set headers (`cf-connecting-ip`, `x-real-ip`,\n * `x-vercel-forwarded-for`). `X-Forwarded-For` is only safe when a trusted\n * proxy boundary strips or rewrites client-supplied values. Do not read XFF\n * on a directly reachable origin. On Cloudflare Workers, prefer\n * `verifyRequest` from `@chitmark/sdk/edge`, which owns this lookup.\n */\nexport function getTrustedClientIp(req: Request): string {\n  const platform =\n    req.headers.get(\"cf-connecting-ip\")?.trim() ||\n    req.headers.get(\"x-real-ip\")?.trim() ||\n    req.headers.get(\"x-vercel-forwarded-for\")?.split(\",\")[0]?.trim() ||\n    \"\";\n  if (platform) return platform;\n\n  // Last resort: first XFF hop. Only valid behind a trusted proxy that\n  // overwrites this header at the edge.\n  return req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"\";\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS, isEligibleAllow } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n  hostname?: string;\n  path?: string;\n  ip?: string;\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n  headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n  status: (code: number) => ExpressLikeResponse;\n  json: (body: unknown) => unknown;\n  locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n  /** Optional session binder. */\n  session?: (req: ExpressLikeRequest) => string | undefined;\n  /** Custom surface string. */\n  surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a\n * boolean operational flag (when true, decision is always challenge).\n * HTTP mapping:\n * - `decision === \"deny\"` → 403\n * - `decision === \"challenge\"` or `degraded` → 428\n * - anything else that is not an explicit non-degraded allow → 428 (fail closed)\n * - explicit non-degraded allow → next()\n *\n * 428 means the request is not rejected permanently; a required verification\n * precondition must be satisfied before the action can proceed.\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n  client: Chitmark,\n  action: Action,\n  options: GateOptions = {},\n): (\n  req: ExpressLikeRequest,\n  res: ExpressLikeResponse,\n  next: ExpressNext,\n) => Promise<void> {\n  return async (req, res, next) => {\n    try {\n      const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n      const session = options.session?.(req);\n\n      const v: Verdict = await client.verify({\n        action,\n        surface,\n        session,\n        subject: {\n          email: req.body?.email,\n          ip: req.ip,\n          userAgent:\n            (typeof req.headers[\"user-agent\"] === \"string\"\n              ? req.headers[\"user-agent\"]\n              : undefined) ?? \"\",\n          headers: req.headers,\n          formData: req.body,\n        },\n      });\n\n      res.locals.chitmark = v;\n\n      if (v.degraded || v.decision === \"challenge\") {\n        res\n          .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n          .json({ challenge: true, eventId: v.eventId });\n        return;\n      }\n      if (v.decision === \"deny\") {\n        res\n          .status(CHITMARK_HTTP_STATUS.forbidden)\n          .json({ error: \"blocked\", eventId: v.eventId });\n        return;\n      }\n      if (!isEligibleAllow(v)) {\n        // Unknown / malformed decision: fail to challenge, never to allow.\n        res\n          .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n          .json({ challenge: true, eventId: v.eventId });\n        return;\n      }\n      next();\n    } catch (err) {\n      next(err);\n    }\n  };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\nimport { getTrustedClientIp } from \"../trusted-ip.js\";\n\nexport interface NextVerifyOptions {\n  action: Action;\n  surface?: string;\n  session?: string;\n  body?: {\n    email?: string;\n    [key: string]: unknown;\n  };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * IP comes from {@link getTrustedClientIp}: platform headers first, then\n * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n  client: Chitmark,\n  req: Request,\n  options: NextVerifyOptions,\n): Promise<Verdict> {\n  const url = new URL(req.url);\n  return client.verify({\n    action: options.action,\n    surface: options.surface ?? `${url.host}${url.pathname}`,\n    session: options.session,\n    subject: {\n      email: options.body?.email,\n      ip: getTrustedClientIp(req),\n      userAgent: req.headers.get(\"user-agent\") ?? \"\",\n      headers: Object.fromEntries(req.headers),\n      formData: options.body,\n    },\n  });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\nexport { getTrustedClientIp } from \"../trusted-ip.js\";\n"]}

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { C as Chitmark, A as Action, b as Verdict } from './http-status-BHYL507g.cjs';
-export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-BHYL507g.cjs';
+import { C as Chitmark, A as Action, b as Verdict } from './trusted-ip-Ngrp6dUP.cjs';
+export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EligibleAllowVerdict, s as EnforcementMode, F as FeedbackRequest, t as FeedbackResponse, u as FeedbackSource, v as FeedbackUnit, O as OnDegraded, w as Outcome, P as PiiMode, x as Principal, S as Subject, y as VERDICT_TOKEN_ISSUER, z as VerdictTokenClaims, B as VerdictTokenError, G as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, H as VerifyVerdictTokenOptions, I as degradedChallengeVerdict, J as enforceDegradedNeverAllow, K as getTrustedClientIp, L as hashEmailSha256, M as isEligibleAllow, N as minimizeFormData, Q as truncateIp, R as verdictToHttpStatus, T as verifyVerdictToken } from './trusted-ip-Ngrp6dUP.cjs';
 
 /**
  * Minimal Express-compatible types (no express dependency).
@@ -29,10 +29,16 @@ interface GateOptions {
 /**
  * Express middleware factory: verify on the hot path, attach verdict to res.locals.
  *
- * - deny → 403
- * - challenge (incl. degraded) → 428
- * - allow → next()
+ * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a
+ * boolean operational flag (when true, decision is always challenge).
+ * HTTP mapping:
+ * - `decision === "deny"` → 403
+ * - `decision === "challenge"` or `degraded` → 428
+ * - anything else that is not an explicit non-degraded allow → 428 (fail closed)
+ * - explicit non-degraded allow → next()
  *
+ * 428 means the request is not rejected permanently; a required verification
+ * precondition must be satisfied before the action can proceed.
  * @example
  * ```ts
  * app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
@@ -53,6 +59,9 @@ interface NextVerifyOptions {
  * Helper for Next.js App Router route handlers.
  * Returns the verdict; caller maps decision → Response.
  *
+ * IP comes from {@link getTrustedClientIp}: platform headers first, then
+ * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.
+ *
  * @example
  * ```ts
  * const v = await verifyNextRequest(chitmark, req, { action: "signup", body });

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as Chitmark, A as Action, b as Verdict } from './http-status-BHYL507g.js';
-export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-BHYL507g.js';
+import { C as Chitmark, A as Action, b as Verdict } from './trusted-ip-Ngrp6dUP.js';
+export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EligibleAllowVerdict, s as EnforcementMode, F as FeedbackRequest, t as FeedbackResponse, u as FeedbackSource, v as FeedbackUnit, O as OnDegraded, w as Outcome, P as PiiMode, x as Principal, S as Subject, y as VERDICT_TOKEN_ISSUER, z as VerdictTokenClaims, B as VerdictTokenError, G as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, H as VerifyVerdictTokenOptions, I as degradedChallengeVerdict, J as enforceDegradedNeverAllow, K as getTrustedClientIp, L as hashEmailSha256, M as isEligibleAllow, N as minimizeFormData, Q as truncateIp, R as verdictToHttpStatus, T as verifyVerdictToken } from './trusted-ip-Ngrp6dUP.js';
 
 /**
  * Minimal Express-compatible types (no express dependency).
@@ -29,10 +29,16 @@ interface GateOptions {
 /**
  * Express middleware factory: verify on the hot path, attach verdict to res.locals.
  *
- * - deny → 403
- * - challenge (incl. degraded) → 428
- * - allow → next()
+ * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a
+ * boolean operational flag (when true, decision is always challenge).
+ * HTTP mapping:
+ * - `decision === "deny"` → 403
+ * - `decision === "challenge"` or `degraded` → 428
+ * - anything else that is not an explicit non-degraded allow → 428 (fail closed)
+ * - explicit non-degraded allow → next()
  *
+ * 428 means the request is not rejected permanently; a required verification
+ * precondition must be satisfied before the action can proceed.
  * @example
  * ```ts
  * app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
@@ -53,6 +59,9 @@ interface NextVerifyOptions {
  * Helper for Next.js App Router route handlers.
  * Returns the verdict; caller maps decision → Response.
  *
+ * IP comes from {@link getTrustedClientIp}: platform headers first, then
+ * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.
+ *
  * @example
  * ```ts
  * const v = await verifyNextRequest(chitmark, req, { action: "signup", body });