@cloudware-de/gatekeeper-widget 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,17 @@
+Gatekeep
+Copyright (C) 2026 Gatekeep contributors
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, see <https://www.gnu.org/licenses/>.
+
+SPDX-License-Identifier: GPL-2.0-or-later

package/dist/client/instance.d.ts

@@ -0,0 +1,35 @@
+/**
+ * POST challenge und redeem gegen die gesetzte Instanz-URL.
+ * Spec: specs/001-protocol-core/contracts/protocol-v1.md
+ * Spec: specs/002-widget/tasks.md T-206
+ * Redeem-Body (Option A): challenge + solution + hostname.
+ */
+import { type Transport } from "./transport.js";
+export interface ChallengeIssueRequest {
+    readonly hostname: string;
+    readonly action?: string;
+    readonly cdata?: string;
+}
+export interface RedeemSuccess {
+    readonly token: string;
+    readonly expires_in: number;
+}
+export declare class InstanceClientError extends Error {
+    readonly status: number;
+    readonly errorCodes: readonly string[];
+    readonly retryAfter: number | undefined;
+    constructor(message: string, status: number, errorCodes: readonly string[], retryAfter?: number);
+}
+export interface InstanceClient {
+    readonly challengeUrl: string;
+    readonly redeemUrl: string;
+    requestChallenge(body: ChallengeIssueRequest): Promise<unknown>;
+    redeem(body: unknown): Promise<RedeemSuccess>;
+}
+export interface InstanceClientOptions {
+    readonly baseUrl: string;
+    readonly siteKey: string;
+    readonly transport?: Transport;
+}
+export declare function createInstanceClient(options: InstanceClientOptions): InstanceClient;
+//# sourceMappingURL=instance.d.ts.map

package/dist/client/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAkB,KAAK,SAAS,EAA0B,MAAM,gBAAgB,CAAC;AAGxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,UAAU,CAAC,EAAE,MAAM;CAQtB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAyCD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAgDnF"}

package/dist/client/instance.js

@@ -0,0 +1,93 @@
+/**
+ * POST challenge und redeem gegen die gesetzte Instanz-URL.
+ * Spec: specs/001-protocol-core/contracts/protocol-v1.md
+ * Spec: specs/002-widget/tasks.md T-206
+ * Redeem-Body (Option A): challenge + solution + hostname.
+ */
+import { fetchTransport } from "./transport.js";
+import { instanceRouteUrl } from "./urls.js";
+export class InstanceClientError extends Error {
+    status;
+    errorCodes;
+    retryAfter;
+    constructor(message, status, errorCodes, retryAfter) {
+        super(message);
+        this.name = "InstanceClientError";
+        this.status = status;
+        this.errorCodes = errorCodes;
+        this.retryAfter = retryAfter;
+    }
+}
+function readErrorCodes(body) {
+    if (body === null || typeof body !== "object" || !("error-codes" in body)) {
+        return [];
+    }
+    const codes = body["error-codes"];
+    if (!Array.isArray(codes)) {
+        return [];
+    }
+    return codes.filter((item) => typeof item === "string");
+}
+function readRetryAfter(body) {
+    if (body === null || typeof body !== "object" || !("retry-after" in body)) {
+        return undefined;
+    }
+    const value = body["retry-after"];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function requireHostname(body) {
+    if (typeof body.hostname !== "string" || body.hostname.trim() === "") {
+        throw new InstanceClientError("hostname is required", 0, ["malformed_encoding"]);
+    }
+}
+function requireRedeemSuccess(body) {
+    if (body === null || typeof body !== "object") {
+        throw new InstanceClientError("redeem response is not an object", 200, ["malformed_encoding"]);
+    }
+    const record = body;
+    if (typeof record.token !== "string" || record.token.length === 0) {
+        throw new InstanceClientError("redeem response missing token", 200, ["malformed_encoding"]);
+    }
+    if (typeof record.expires_in !== "number" || !Number.isFinite(record.expires_in)) {
+        throw new InstanceClientError("redeem response missing expires_in", 200, ["malformed_encoding"]);
+    }
+    return { token: record.token, expires_in: record.expires_in };
+}
+export function createInstanceClient(options) {
+    const challengeUrl = instanceRouteUrl(options.baseUrl, options.siteKey, "challenge");
+    const redeemUrl = instanceRouteUrl(options.baseUrl, options.siteKey, "redeem");
+    const transport = options.transport ?? fetchTransport;
+    async function post(url, body) {
+        return transport({
+            url,
+            method: "POST",
+            body,
+            headers: {},
+        });
+    }
+    return {
+        challengeUrl,
+        redeemUrl,
+        async requestChallenge(body) {
+            requireHostname(body);
+            const payload = {
+                hostname: body.hostname,
+                ...(body.action !== undefined ? { action: body.action } : {}),
+                ...(body.cdata !== undefined ? { cdata: body.cdata } : {}),
+            };
+            const response = await post(challengeUrl, payload);
+            if (response.status === 200) {
+                return response.body;
+            }
+            throw new InstanceClientError("challenge request failed", response.status, readErrorCodes(response.body), readRetryAfter(response.body));
+        },
+        async redeem(body) {
+            const response = await post(redeemUrl, body);
+            if (response.status === 200) {
+                return requireRedeemSuccess(response.body);
+            }
+            throw new InstanceClientError("redeem request failed", response.status, readErrorCodes(response.body), readRetryAfter(response.body));
+        },
+    };
+}
+//# sourceMappingURL=instance.js.map

package/dist/client/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAA0C,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAa7C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,UAAU,CAAoB;IAC9B,UAAU,CAAqB;IAExC,YACE,OAAe,EACf,MAAc,EACd,UAA6B,EAC7B,UAAmB;QAEnB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAeD,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAI,IAAmC,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAI,IAAmC,CAAC,aAAa,CAAC,CAAC;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,IAA2B;IAClD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,IAAiD,CAAC;IACjE,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;IAEtD,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,IAAa;QAC5C,OAAO,SAAS,CAAC;YACf,GAAG;YACH,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,KAAK,CAAC,gBAAgB,CAAC,IAA2B;YAChD,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,OAAO,GAA0B;gBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,EAC1B,QAAQ,CAAC,MAAM,EACf,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC7B,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAa;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,QAAQ,CAAC,MAAM,EACf,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC7B,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/transport.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Injizierbarer Transport. Default: fetch. Verify-Route nicht genutzt.
+ * Spec: specs/002-widget/tasks.md T-206
+ * Spec: specs/002-widget/spec.md §Adressierung
+ * Kein @cloudware-de/gatekeeper-protocol-Import — Fixture lädt dist/ ohne Import-Map.
+ */
+export interface TransportRequest {
+    readonly url: string;
+    readonly method: "POST";
+    readonly body: unknown;
+    readonly headers: Readonly<Record<string, string>>;
+}
+export interface TransportResponse {
+    readonly status: number;
+    readonly body: unknown;
+}
+export type Transport = (request: TransportRequest) => Promise<TransportResponse>;
+export declare function fetchTransport(request: TransportRequest): Promise<TransportResponse>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/client/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/client/transport.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkBH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAElF,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB1F"}

package/dist/client/transport.js

@@ -0,0 +1,41 @@
+/**
+ * Injizierbarer Transport. Default: fetch. Verify-Route nicht genutzt.
+ * Spec: specs/002-widget/tasks.md T-206
+ * Spec: specs/002-widget/spec.md §Adressierung
+ * Kein @cloudware-de/gatekeeper-protocol-Import — Fixture lädt dist/ ohne Import-Map.
+ */
+function encodeBase64Url(bytes) {
+    let bin = "";
+    for (const byte of bytes) {
+        bin += String.fromCharCode(byte);
+    }
+    return btoa(bin).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function jsonBody(body) {
+    return JSON.stringify(body, (_key, value) => {
+        if (value instanceof Uint8Array) {
+            return encodeBase64Url(value);
+        }
+        return value;
+    });
+}
+export async function fetchTransport(request) {
+    const response = await fetch(request.url, {
+        method: request.method,
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json",
+            ...request.headers,
+        },
+        body: jsonBody(request.body),
+    });
+    let body = null;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = null;
+    }
+    return { status: response.status, body };
+}
+//# sourceMappingURL=transport.js.map

package/dist/client/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/client/transport.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,CAAC,OAAO;SACnB;QACD,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7B,CAAC,CAAC;IACH,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/client/urls.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Modul-1-Adressierung: {base}/{siteKey}/challenge|redeem.
+ * Spec: specs/001-protocol-core/spec.md §Adressierung
+ * Spec: specs/002-widget/spec.md §Adressierung
+ * Spec: specs/002-widget/tasks.md T-206
+ */
+export type InstanceRoute = "challenge" | "redeem";
+export declare class InstanceUrlError extends Error {
+    constructor(message: string);
+}
+export declare function instanceRouteUrl(baseUrl: string, siteKey: string, route: InstanceRoute): string;
+//# sourceMappingURL=urls.d.ts.map

package/dist/client/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/client/urls.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEnD,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,GACnB,MAAM,CAkBR"}

package/dist/client/urls.js

@@ -0,0 +1,27 @@
+export class InstanceUrlError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InstanceUrlError";
+    }
+}
+export function instanceRouteUrl(baseUrl, siteKey, route) {
+    if (siteKey.trim() === "") {
+        throw new InstanceUrlError("site-key is required");
+    }
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw new InstanceUrlError("base-url is not a valid URL");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new InstanceUrlError("base-url must be http: or https:");
+    }
+    const basePath = url.pathname.replace(/\/+$/, "");
+    url.pathname = `${basePath}/${encodeURIComponent(siteKey)}/${route}`;
+    url.search = "";
+    url.hash = "";
+    return url.href;
+}
+//# sourceMappingURL=urls.js.map

package/dist/client/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/client/urls.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAAe,EACf,KAAoB;IAEpB,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,QAAQ,GAAG,GAAG,QAAQ,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;IACrE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC"}

package/dist/copy/load-notice.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Sichtbarer Rechenlast-Hinweis (Artikel 5).
+ * Spec: specs/002-widget/tasks.md T-205
+ * Spec: specs/002-widget/spec.md §Pflichtumfang
+ * Gleicher Zweck wie README.md §Rechenlast.
+ */
+export declare const LOAD_NOTICE = "Ihr Browser l\u00F6st eine speicher- bzw. iterationsgebundene Aufgabe. Das ist Absicht (Kosten pro Angriffsversuch), kein Mining.";
+//# sourceMappingURL=load-notice.d.ts.map

package/dist/copy/load-notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-notice.d.ts","sourceRoot":"","sources":["../../src/copy/load-notice.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sIACwG,CAAC"}

package/dist/copy/load-notice.js

@@ -0,0 +1,8 @@
+/**
+ * Sichtbarer Rechenlast-Hinweis (Artikel 5).
+ * Spec: specs/002-widget/tasks.md T-205
+ * Spec: specs/002-widget/spec.md §Pflichtumfang
+ * Gleicher Zweck wie README.md §Rechenlast.
+ */
+export const LOAD_NOTICE = "Ihr Browser löst eine speicher- bzw. iterationsgebundene Aufgabe. Das ist Absicht (Kosten pro Angriffsversuch), kein Mining.";
+//# sourceMappingURL=load-notice.js.map

package/dist/copy/load-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-notice.js","sourceRoot":"","sources":["../../src/copy/load-notice.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GACtB,8HAA8H,CAAC"}

package/dist/element/honeypot.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Adapter honeypot field. Not part of the instrumentation envelope.
+ */
+export declare const HONEYPOT_FIELD = "gatekeep-hp";
+//# sourceMappingURL=honeypot.d.ts.map

package/dist/element/honeypot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"honeypot.d.ts","sourceRoot":"","sources":["../../src/element/honeypot.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,cAAc,gBAAgB,CAAC"}

package/dist/element/honeypot.js

@@ -0,0 +1,5 @@
+/**
+ * Adapter honeypot field. Not part of the instrumentation envelope.
+ */
+export const HONEYPOT_FIELD = "gatekeep-hp";
+//# sourceMappingURL=honeypot.js.map

package/dist/element/honeypot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../../src/element/honeypot.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC"}

package/dist/element/session.d.ts

@@ -0,0 +1,32 @@
+/**
+ * CE-Session: Attribute → Client, WASM-URL, Envelope.
+ * Spec: specs/002-widget/spec.md §Adressierung §WASM §Pflichtumfang
+ * T-212 Drift D1 D2 D3. Kein @cloudware-de/gatekeeper-protocol-Import.
+ */
+import { type InstanceClient } from "../client/instance.js";
+import type { Transport } from "../client/transport.js";
+import { type DeliveredProgram, type IsolatedRunner } from "../envelope/run.js";
+export interface AttributeHost {
+    getAttribute(name: string): string | null;
+}
+export declare function readSiteKey(host: AttributeHost): string;
+export declare function readBaseUrl(host: AttributeHost): string;
+export declare function readWasmUrl(host: AttributeHost, moduleUrl?: string): string;
+export declare function createBoundClient(host: AttributeHost, transport?: Transport): InstanceClient | null;
+export declare function programFromChallenge(challenge: unknown): DeliveredProgram | null;
+export declare function attestChallenge(challenge: unknown, runner?: IsolatedRunner): Promise<Uint8Array | null>;
+/**
+ * Option A: Redeem sendet Challenge + Solution + hostname (stateless MAC).
+ * Spec: specs/001-protocol-core/contracts/protocol-v1.md
+ * Spec: packages/server/src/handler.ts redeem
+ */
+export interface RedeemIssueContext {
+    readonly challenge: unknown;
+    readonly hostname: string;
+    readonly action?: string;
+    readonly cdata?: string;
+    /** Widget KDF wall time. Not PII. Server logs it only when GATEKEEP_POW_LOG=1. */
+    readonly solveMs?: number;
+}
+export declare function mergeRedeemBody(solution: unknown, attestation: Uint8Array | null, context: RedeemIssueContext): unknown;
+//# sourceMappingURL=session.d.ts.map

package/dist/element/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/element/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEvD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEvD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,GAAE,MAAwB,GAAG,MAAM,CAE5F;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,aAAa,EACnB,SAAS,CAAC,EAAE,SAAS,GACpB,cAAc,GAAG,IAAI,CAWvB;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAwBhF;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EACjB,WAAW,EAAE,UAAU,GAAG,IAAI,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CA6BT"}

package/dist/element/session.js

@@ -0,0 +1,90 @@
+/**
+ * CE-Session: Attribute → Client, WASM-URL, Envelope.
+ * Spec: specs/002-widget/spec.md §Adressierung §WASM §Pflichtumfang
+ * T-212 Drift D1 D2 D3. Kein @cloudware-de/gatekeeper-protocol-Import.
+ */
+import { createInstanceClient } from "../client/instance.js";
+import { runDeliveredProgram, } from "../envelope/run.js";
+import { resolveWasmUrl } from "../pow/wasm-url.js";
+export function readSiteKey(host) {
+    return host.getAttribute("site-key")?.trim() ?? "";
+}
+export function readBaseUrl(host) {
+    return host.getAttribute("base-url")?.trim() ?? "";
+}
+export function readWasmUrl(host, moduleUrl = import.meta.url) {
+    return resolveWasmUrl(host.getAttribute("wasm-url") ?? "", moduleUrl);
+}
+export function createBoundClient(host, transport) {
+    const siteKey = readSiteKey(host);
+    const baseUrl = readBaseUrl(host);
+    if (siteKey.length < 1 || baseUrl.length < 1) {
+        return null;
+    }
+    return createInstanceClient({
+        baseUrl,
+        siteKey,
+        ...(transport !== undefined ? { transport } : {}),
+    });
+}
+export function programFromChallenge(challenge) {
+    if (challenge === null || typeof challenge !== "object") {
+        return null;
+    }
+    const record = challenge;
+    const nested = record.instrumentationProgram ?? record.program;
+    if (nested !== null && typeof nested === "object") {
+        const program = nested;
+        if (typeof program.source === "string" && program.source.length > 0) {
+            return {
+                programId: String(program.programId ?? record.instrumentationProgramId ?? ""),
+                programVersion: String(program.programVersion ?? "v1"),
+                source: program.source,
+            };
+        }
+    }
+    if (typeof record.instrumentationSource === "string" && record.instrumentationSource.length > 0) {
+        return {
+            programId: String(record.instrumentationProgramId ?? ""),
+            programVersion: String(record.instrumentationProgramVersion ?? "v1"),
+            source: record.instrumentationSource,
+        };
+    }
+    return null;
+}
+export async function attestChallenge(challenge, runner) {
+    const program = programFromChallenge(challenge);
+    if (program === null) {
+        return null;
+    }
+    return runDeliveredProgram(program, runner !== undefined ? { runner } : {});
+}
+export function mergeRedeemBody(solution, attestation, context) {
+    if (typeof context.hostname !== "string" || context.hostname.trim() === "") {
+        throw new Error("hostname is required");
+    }
+    const extra = {
+        challenge: context.challenge,
+        hostname: context.hostname,
+    };
+    if (typeof context.action === "string" && context.action.length > 0) {
+        extra.action = context.action;
+    }
+    if (typeof context.cdata === "string" && context.cdata.length > 0) {
+        extra.cdata = context.cdata;
+    }
+    if (attestation !== null) {
+        extra.instrumentationEnvelope = { attestation };
+    }
+    if (typeof context.solveMs === "number" &&
+        Number.isInteger(context.solveMs) &&
+        context.solveMs >= 0 &&
+        context.solveMs <= 120_000) {
+        extra.solveMs = context.solveMs;
+    }
+    if (solution !== null && typeof solution === "object" && !Array.isArray(solution)) {
+        return { ...solution, ...extra };
+    }
+    return { solution, ...extra };
+}
+//# sourceMappingURL=session.js.map

package/dist/element/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/element/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AAElF,OAAO,EACL,mBAAmB,GAGpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMpD,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAmB,EAAE,YAAoB,MAAM,CAAC,IAAI,CAAC,GAAG;IAClF,OAAO,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAmB,EACnB,SAAqB;IAErB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC;QAC1B,OAAO;QACP,OAAO;QACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACrD,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,SAAoC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,sBAAsB,IAAI,MAAM,CAAC,OAAO,CAAC;IAC/D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAiC,CAAC;QAClD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;gBAC7E,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;gBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChG,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;YACxD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,6BAA6B,IAAI,IAAI,CAAC;YACpE,MAAM,EAAE,MAAM,CAAC,qBAAqB;SACrC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAkB,EAClB,MAAuB;IAEvB,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAgBD,MAAM,UAAU,eAAe,CAC7B,QAAiB,EACjB,WAA8B,EAC9B,OAA2B;IAE3B,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAA4B;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,uBAAuB,GAAG,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IACD,IACE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QACjC,OAAO,CAAC,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,OAAO,IAAI,OAAO,EAC1B,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/element/start.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Startzeitpunkt und Hard-Timeout (ADR-008, 10 s).
+ * Spec: specs/002-widget/tasks.md T-210
+ * Spec: specs/002-widget/spec.md Pflichtumfang Start / Timeout
+ * Nicht aus @cloudware-de/gatekeeper-protocol importieren (T-204-Fixture).
+ */
+export declare const HARD_TIMEOUT_MS = 10000;
+/** Artikel 6; nicht aus @cloudware-de/gatekeeper-protocol importieren (T-204-Fixture). */
+export declare const TOKEN_TTL_MS = 300000;
+export type StartMode = "interaction" | "auto" | "click";
+export declare function parseStartMode(value: string | null): StartMode;
+/**
+ * T-212 Submit-Hold: Attribut → window.GATEKEEP_SUBMIT_HOLD → true.
+ * Aus = kein requestSubmit nach Erfolg; Validity blockiert leeren Submit weiter.
+ */
+export declare function parseBoolFlag(value: string | boolean | null | undefined): boolean | undefined;
+export declare function parseSubmitHold(attribute: string | null, env: string | boolean | undefined): boolean;
+export declare function readSubmitHold(host: {
+    getAttribute(name: string): string | null;
+}): boolean;
+export declare function expiresAtOf(value: unknown): number | null;
+export declare function isChallengeExpired(value: unknown, nowMs: number): boolean;
+export declare function issuedAtOf(challenge: unknown, fallbackMs: number): number;
+export declare function isAbortError(err: unknown): boolean;
+//# sourceMappingURL=start.d.ts.map

package/dist/element/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/element/start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,0FAA0F;AAC1F,eAAO,MAAM,YAAY,SAAU,CAAC;AAEpC,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAQ9D;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAY7F;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAG3F;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAczD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQzE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIlD"}

package/dist/element/start.js

@@ -0,0 +1,85 @@
+/**
+ * Startzeitpunkt und Hard-Timeout (ADR-008, 10 s).
+ * Spec: specs/002-widget/tasks.md T-210
+ * Spec: specs/002-widget/spec.md Pflichtumfang Start / Timeout
+ * Nicht aus @cloudware-de/gatekeeper-protocol importieren (T-204-Fixture).
+ */
+export const HARD_TIMEOUT_MS = 10_000;
+/** Artikel 6; nicht aus @cloudware-de/gatekeeper-protocol importieren (T-204-Fixture). */
+export const TOKEN_TTL_MS = 300_000;
+export function parseStartMode(value) {
+    if (value === "auto") {
+        return "auto";
+    }
+    if (value === "click") {
+        return "click";
+    }
+    return "interaction";
+}
+const FALSEY_FLAG = /^(0|false|off|no)$/i;
+/**
+ * T-212 Submit-Hold: Attribut → window.GATEKEEP_SUBMIT_HOLD → true.
+ * Aus = kein requestSubmit nach Erfolg; Validity blockiert leeren Submit weiter.
+ */
+export function parseBoolFlag(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value === "boolean") {
+        return value;
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        return true;
+    }
+    return !FALSEY_FLAG.test(trimmed);
+}
+export function parseSubmitHold(attribute, env) {
+    const fromAttr = parseBoolFlag(attribute);
+    if (fromAttr !== undefined) {
+        return fromAttr;
+    }
+    const fromEnv = parseBoolFlag(env);
+    if (fromEnv !== undefined) {
+        return fromEnv;
+    }
+    return true;
+}
+export function readSubmitHold(host) {
+    const env = typeof window !== "undefined" ? window.GATEKEEP_SUBMIT_HOLD : undefined;
+    return parseSubmitHold(host.getAttribute("submit-hold"), env);
+}
+export function expiresAtOf(value) {
+    if (value === null || typeof value !== "object") {
+        return null;
+    }
+    if ("expiresAt" in value) {
+        const raw = value.expiresAt;
+        if (typeof raw === "number" && Number.isInteger(raw) && raw >= 0) {
+            return raw;
+        }
+    }
+    if ("challenge" in value) {
+        return expiresAtOf(value.challenge);
+    }
+    return null;
+}
+export function isChallengeExpired(value, nowMs) {
+    const expiresAt = expiresAtOf(value);
+    return expiresAt !== null && nowMs >= expiresAt;
+}
+export function issuedAtOf(challenge, fallbackMs) {
+    if (challenge !== null && typeof challenge === "object" && "issuedAt" in challenge) {
+        const value = challenge.issuedAt;
+        if (typeof value === "number" && Number.isInteger(value) && value >= 0) {
+            return value;
+        }
+    }
+    return fallbackMs;
+}
+export function isAbortError(err) {
+    return err instanceof DOMException
+        ? err.name === "AbortError"
+        : err instanceof Error && err.name === "AbortError";
+}
+//# sourceMappingURL=start.js.map

package/dist/element/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/element/start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAIpC,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAA0C;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAwB,EACxB,GAAiC;IAEjC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmD;IAChF,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAI,KAAgC,CAAC,SAAS,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,WAAW,CAAE,KAAgC,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,SAAS,KAAK,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAkB,EAAE,UAAkB;IAC/D,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QACnF,MAAM,KAAK,GAAI,SAAmC,CAAC,QAAQ,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,YAAY;QAChC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;QAC3B,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;AACxD,CAAC"}

package/dist/element/states.d.ts

@@ -0,0 +1,26 @@
+/**
+ * T-204 UI-Zustände und getrennte ARIA-Labels (Artikel 10).
+ * Spec: specs/002-widget/tasks.md T-204
+ * Spec: specs/002-widget/spec.md §Öffentliches Custom-Element-API
+ */
+export declare const WIDGET_UI_STATES: readonly ["idle", "working", "success", "error", "timeout"];
+export type WidgetUiState = (typeof WIDGET_UI_STATES)[number];
+export declare const ARIA_LABELS: Readonly<Record<WidgetUiState, string>>;
+export declare function isWidgetUiState(value: string): value is WidgetUiState;
+export declare function labelForState(state: WidgetUiState): string;
+/** T-204-Default. Attribut `missing-token` überschreibt (leer = Default). */
+export declare const TOKEN_MISSING_MESSAGE = "Cloudware Gatekeeper: Bitte zuerst die Pr\u00FCfung abschlie\u00DFen.";
+export interface CopyHost {
+    getAttribute(name: string): string | null;
+}
+/**
+ * Idle/success dürfen per Attribut überschrieben werden.
+ * working / error / timeout bleiben T-204.
+ * Spec: specs/002-widget/spec.md §Öffentliches Custom-Element-API
+ */
+export declare function labelForHost(host: CopyHost, state: WidgetUiState): string;
+export declare function missingTokenMessage(host: CopyHost): string;
+/** Challenge-TTL (300 s), nicht T-210 Hard-Timeout. Attribut `expired-challenge`. */
+export declare const CHALLENGE_EXPIRED_MESSAGE = "Cloudware Gatekeeper: Challenge abgelaufen \u2014 bitte erneut versuchen";
+export declare function challengeExpiredMessage(host: CopyHost): string;
+//# sourceMappingURL=states.d.ts.map

package/dist/element/states.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"states.d.ts","sourceRoot":"","sources":["../../src/element/states.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6DAMnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAM/D,CAAC;AAEF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,aAAa,CAErE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,0EAC6B,CAAC;AAEhE,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,CAczE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAG1D;AAED,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,6EACiC,CAAC;AAExE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAG9D"}