@nawa-captcha/server 0.0.0-stage → 0.1.1

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAc,MAAM,cAAc,CAAC;AACrH,OAAO,EAA4B,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAMvF,OAAO,EAWL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAuG,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACxJ,OAAO,EAA0B,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,IAAI,EAAyB,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE5I,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAAE,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEzI,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3I;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrJ;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,GACnK;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnH;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,6GAA6G;IAC7G,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACvF,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,aAAa,EAAE,CAAC,EAAE,CAAC;IACxD,kGAAkG;IAClG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,0HAA0H;IAC1H,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,gBAAgB,GAAG,aAAa,CAAC;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,eAAe,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,kGAAkG;IAClG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,eAAe;IACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,cAAc,CAAC;AAE9D,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,eAAe,GACf,SAAS,GACT,iBAAiB,GACjB,UAAU,GACV,mBAAmB,GACnB,UAAU,GACV,cAAc,GACd,YAAY,CAAC;AAEjB,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE1G,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE;AACvJ,yGAAyG;GACvG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GACtB,eAAe,GACf,WAAW,GACX,aAAa,GACb,eAAe,GACf,SAAS,GACT,eAAe,GACf,SAAS,GACT,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,UAAU,CAAC;AAEf,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3G,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC;IAC3D,sHAAsH;IACtH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAwBD,qBAAa,WAAW;IAWV,QAAQ,CAAC,OAAO,EAAE,kBAAkB;IAVhD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuG;IACjI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEd,OAAO,EAAE,kBAAkB;IA4BhD,6FAA6F;IAC7F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc;IAuBtC,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,WAAW;YAIL,OAAO;YAQP,QAAQ;IActB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,UAAU;IAIlB,0FAA0F;YAC5E,MAAM;IAkBpB,OAAO,CAAC,KAAK;IAsCP,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,iBAAiB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC;IA8BlI,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA6FvD,4EAA4E;IAC5E,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;CAGjJ;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE1E;AAqCD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CA8B5G"}

package/dist/engine.js

@@ -0,0 +1,407 @@
+import { bindingHash, clientKey as deriveClientKey, BIND_MODES } from './binding.js';
+import { createKeyring, safeEqual } from './crypto.js';
+import { createAccessible } from './puzzles/accessible.js';
+import { createAudio } from './puzzles/audio.js';
+import { createRegistry } from './puzzles/index.js';
+import { createPow } from './puzzles/pow.js';
+import { cryptoRng } from './rng.js';
+import { checkSteps, checkTypes, DEFAULT_LADDER, DEFAULT_POOL, drawable, effectivePool, isChallengeType, ladderPool, parseClientTypes, weightedPick, } from './selection.js';
+import { MemoryStore } from './store.js';
+import { MAX_TOKEN_LENGTH, openChallenge, parsePassToken, sealChallenge, signPassToken } from './tokens.js';
+import { CHALLENGE_TYPES, LANGS } from './types.js';
+const SITE_KEY_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const ACTION_RE = /^[A-Za-z0-9_.:-]{1,48}$/;
+const MODES = ['random', 'sequence', 'adaptive'];
+const DEFAULT_RATE = { windowSec: 60, challenge: 30, verify: 60 };
+const DEFAULT_ADAPTIVE = { windowSec: 900, failuresPerLevel: 2, maxLevel: 3 };
+const CLOCK_SKEW_MS = 5000;
+const SEQUENCE_TTL_MS = 24 * 3600 * 1000;
+export class NawaCaptcha {
+    options;
+    keys;
+    store;
+    registry;
+    powByBits = new Map();
+    base;
+    explicitTypes;
+    policies = new Map();
+    bind;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.keys = createKeyring(options.secret);
+        this.store = options.store ?? new MemoryStore();
+        this.registry = createRegistry(options.powBits ?? 16);
+        this.bind = options.bind ?? 'ip+ua';
+        if (!BIND_MODES.includes(this.bind))
+            throw new Error(`nawa-captcha: invalid bind mode "${this.bind}"`);
+        this.now = options.now ?? Date.now;
+        for (const kind of ['challengeTtlSec', 'passTtlSec']) {
+            const v = options[kind];
+            if (v !== undefined && (!Number.isFinite(v) || v < 10 || v > 3600))
+                throw new Error(`nawa-captcha: ${kind} must be 10..3600`);
+        }
+        if (options.mode !== undefined && !MODES.includes(options.mode))
+            throw new Error(`nawa-captcha: mode must be one of ${MODES.join(', ')}`);
+        const types = checkTypes(options.types, 'types');
+        if (types && types.length === 0)
+            throw new Error('nawa-captcha: types must list at least one challenge type');
+        this.explicitTypes = types !== undefined;
+        const ladder = (options.ladder ?? DEFAULT_LADDER).map((rung, i) => checkTypes(rung, `ladder[${i}]`));
+        this.base = {
+            types: types ?? [...CHALLENGE_TYPES],
+            weights: { ...options.weights },
+            mode: options.mode ?? 'adaptive',
+            steps: checkSteps(options.steps, 'steps') ?? 1,
+            ladder: options.invisibleFirst ? [['pow'], ...ladder] : ladder,
+            powBits: options.powBits ?? 16,
+        };
+        // Validate every per-action override up front so mistakes fail at startup, not per request.
+        for (const action of Object.keys(options.perAction ?? {}))
+            this.policy(action);
+    }
+    /** The effective selection policy for an action (global options merged with `perAction`). */
+    policy(action) {
+        const cached = this.policies.get(action);
+        if (cached)
+            return cached;
+        const raw = Object.prototype.hasOwnProperty.call(this.options.perAction ?? {}, action) ? this.options.perAction[action] : undefined;
+        const p = Array.isArray(raw) ? { types: raw } : (raw ?? {});
+        const where = `perAction["${action}"]`;
+        if (p.mode !== undefined && !MODES.includes(p.mode))
+            throw new Error(`nawa-captcha: ${where}.mode must be one of ${MODES.join(', ')}`);
+        const types = checkTypes(p.types, `${where}.types`);
+        if (types && types.length === 0)
+            throw new Error(`nawa-captcha: ${where}.types must list at least one challenge type`);
+        const mode = p.mode ?? this.base.mode;
+        const resolved = {
+            // Without any allow-list, random/sequence draw from the visual types (not pow/accessible).
+            types: types ?? (this.explicitTypes || mode === 'adaptive' ? this.base.types : DEFAULT_POOL),
+            weights: { ...this.base.weights, ...p.weights },
+            mode,
+            steps: checkSteps(p.steps, `${where}.steps`) ?? this.base.steps,
+            ladder: p.ladder ? p.ladder.map((rung, i) => checkTypes(rung, `${where}.ladder[${i}]`)) : this.base.ladder,
+            powBits: p.powBits ?? this.base.powBits,
+        };
+        this.policies.set(action, resolved);
+        return resolved;
+    }
+    emit(event) {
+        try {
+            this.options.onEvent?.(event);
+        }
+        catch {
+            // Observability must never break verification.
+        }
+    }
+    clientKeyOf(client) {
+        return deriveClientKey(this.keys.key(this.keys.activeKid, 'client-binding'), client);
+    }
+    async allowed(kind, ck, client) {
+        const rl = this.options.rateLimit ?? DEFAULT_RATE;
+        if (rl === false)
+            return true;
+        if (typeof rl === 'function')
+            return rl({ kind, clientKey: ck, client });
+        const count = await this.store.increment(`rl:${kind}:${ck}`, rl.windowSec * 1000);
+        return count <= (kind === 'challenge' ? rl.challenge : rl.verify);
+    }
+    async levelFor(ck, client, action) {
+        const adaptive = this.options.adaptive ?? DEFAULT_ADAPTIVE;
+        let level = 0;
+        if (adaptive !== false) {
+            const failures = await this.store.count(`fail:${ck}`);
+            level = Math.min(adaptive.maxLevel, Math.floor(failures / Math.max(1, adaptive.failuresPerLevel)));
+        }
+        if (this.options.assessRisk) {
+            const extra = Number(await this.options.assessRisk({ client, action, clientKey: ck }));
+            if (Number.isFinite(extra) && extra > 0)
+                level += Math.floor(extra);
+        }
+        return Math.min(level, 6);
+    }
+    definition(type, powBits) {
+        if ((type !== 'pow' && type !== 'accessible' && type !== 'audio') || powBits === (this.options.powBits ?? 16))
+            return this.registry[type];
+        let defs = this.powByBits.get(powBits);
+        if (!defs) {
+            defs = { pow: createPow(powBits), accessible: createAccessible(powBits), audio: createAudio(powBits) };
+            this.powByBits.set(powBits, defs);
+        }
+        return defs[type];
+    }
+    maxAttempts(type) {
+        return Math.max(1, this.options.maxAttempts?.[type] ?? this.registry[type].maxAttempts);
+    }
+    minSolveMs(type) {
+        return Math.max(0, this.options.minSolveMs?.[type] ?? this.registry[type].minSolveMs);
+    }
+    /** Picks a type from `pool` according to the policy, avoiding `exclude` when possible. */
+    async choose(policy, pool, level, ck, action, exclude = []) {
+        const all = drawable(pool);
+        const fresh = all.filter((t) => !exclude.includes(t));
+        const lastDone = exclude[exclude.length - 1];
+        const notRepeat = all.filter((t) => t !== lastDone);
+        const candidates = fresh.length ? fresh : notRepeat.length ? notRepeat : all;
+        switch (policy.mode) {
+            case 'random':
+                return weightedPick(cryptoRng, candidates, policy.weights);
+            case 'sequence': {
+                const n = await this.store.increment(`seq:${ck}:${action}`, SEQUENCE_TTL_MS);
+                return candidates[(n - 1) % candidates.length];
+            }
+            default:
+                return weightedPick(cryptoRng, ladderPool(policy.ladder, level, candidates), policy.weights);
+        }
+    }
+    issue(i) {
+        const generated = this.definition(i.type, i.policy.powBits).generate({ level: i.level, lang: i.lang, rng: cryptoRng });
+        const iat = this.now();
+        const exp = iat + (this.options.challengeTtlSec ?? 120) * 1000;
+        const cb = bindingHash(this.keys.key(this.keys.activeKid, 'client-binding'), this.bind, i.client);
+        const chain = i.policy.steps > 1 ? { stp: i.step, of: i.policy.steps, done: i.done, pool: i.pool } : {};
+        const claims = {
+            v: 1,
+            id: cryptoRng.id(16),
+            typ: i.type,
+            sk: i.siteKey,
+            act: i.action,
+            lang: i.lang,
+            iat,
+            exp,
+            lvl: i.level,
+            // If the binding material is unavailable (e.g. no UA header) the token is simply unbound.
+            cbm: cb ? this.bind : 'none',
+            ...(cb ? { cb } : {}),
+            sol: generated.solution,
+            ...chain,
+        };
+        this.emit({ type: 'challenge-issued', challengeType: i.type, level: i.level, clientKey: i.ck, action: i.action, ...(i.policy.steps > 1 ? { step: i.step, steps: i.policy.steps } : {}) });
+        return {
+            token: sealChallenge(this.keys, claims),
+            type: i.type,
+            view: this.registry[i.type].view,
+            lang: i.lang,
+            prompt: generated.prompt,
+            data: generated.publicData,
+            level: i.level,
+            step: i.step,
+            steps: i.policy.steps,
+            expiresAt: exp,
+            expiresInMs: exp - iat,
+        };
+    }
+    async createChallenge(req) {
+        const siteKey = req.siteKey ?? 'default';
+        const action = req.action ?? 'default';
+        if (typeof siteKey !== 'string' || !SITE_KEY_RE.test(siteKey))
+            return { ok: false, error: 'invalid-input' };
+        if (typeof action !== 'string' || !ACTION_RE.test(action))
+            return { ok: false, error: 'invalid-input' };
+        if (this.options.siteKeys && !this.options.siteKeys.includes(siteKey))
+            return { ok: false, error: 'invalid-input' };
+        if (this.options.actions && !this.options.actions.includes(action))
+            return { ok: false, error: 'invalid-input' };
+        if (req.type !== undefined && req.type !== null && !isChallengeType(req.type))
+            return { ok: false, error: 'invalid-input' };
+        if (req.types !== undefined && req.types !== null && typeof req.types !== 'string' && !Array.isArray(req.types))
+            return { ok: false, error: 'invalid-input' };
+        const lang = LANGS.includes(req.lang) ? req.lang : (this.options.defaultLang ?? 'en');
+        const ck = this.clientKeyOf(req.client);
+        if (!(await this.allowed('challenge', ck, req.client))) {
+            this.emit({ type: 'rate-limited', kind: 'challenge', clientKey: ck });
+            return { ok: false, error: 'rate-limited' };
+        }
+        const level = await this.levelFor(ck, req.client, action);
+        const policy = this.policy(action);
+        const pool = effectivePool(policy, this.options.clientNarrowing === false ? undefined : parseClientTypes(req.types));
+        const requested = isChallengeType(req.type) ? req.type : undefined;
+        // The browser does not get to pick the easiest puzzle; only the accessible alternatives (text, audio) are always available.
+        let type;
+        if ((requested === 'accessible' || requested === 'audio') && (this.options.allowAccessible !== false || pool.includes(requested)))
+            type = requested;
+        else if (requested && this.options.allowClientType && pool.includes(requested))
+            type = requested;
+        else
+            type = await this.choose(policy, pool, level, ck, action);
+        return { ok: true, challenge: this.issue({ type, level, lang, siteKey, action, client: req.client, ck, policy, step: 1, done: [], pool }) };
+    }
+    async verify(req) {
+        const ck = this.clientKeyOf(req.client);
+        const fail = async (reason, opts = {}) => {
+            if (reason !== 'rate-limited' && reason !== 'invalid-input') {
+                const adaptive = this.options.adaptive ?? DEFAULT_ADAPTIVE;
+                if (adaptive !== false)
+                    await this.store.increment(`fail:${ck}`, adaptive.windowSec * 1000);
+            }
+            this.emit({ type: 'verify-failed', reason, clientKey: ck, ...(opts.claims ? { challengeType: opts.claims.typ } : {}), ...(opts.detail ? { detail: opts.detail } : {}) });
+            return { ok: false, error: publicError(reason), reason, ...(opts.detail ? { detail: opts.detail } : {}), retry: opts.retry ?? false };
+        };
+        if (typeof req.token !== 'string' || req.token.length === 0 || req.token.length > MAX_TOKEN_LENGTH)
+            return fail('invalid-input');
+        if (req.answer === undefined || req.answer === null || typeof req.answer !== 'object')
+            return fail('invalid-input');
+        if (!(await this.allowed('verify', ck, req.client))) {
+            this.emit({ type: 'rate-limited', kind: 'verify', clientKey: ck });
+            return { ok: false, error: 'rate-limited', reason: 'rate-limited', retry: false };
+        }
+        const opened = openChallenge(this.keys, req.token);
+        if (!opened)
+            return fail('invalid-token');
+        const claims = opened.claims;
+        if (!isChallengeType(claims.typ))
+            return fail('invalid-token');
+        const now = this.now();
+        if (claims.iat > now + CLOCK_SKEW_MS)
+            return fail('invalid-token', { claims });
+        if (now > claims.exp)
+            return fail('expired', { claims });
+        if (claims.cbm !== 'none') {
+            const expected = bindingHash(this.keys.key(opened.kid, 'client-binding'), claims.cbm, req.client);
+            if (!expected || !claims.cb || !safeEqual(expected, claims.cb))
+                return fail('client-mismatch', { claims });
+        }
+        const ttl = Math.max(1000, claims.exp - now + CLOCK_SKEW_MS);
+        if ((await this.store.count(`used:${claims.id}`)) > 0)
+            return fail('replayed', { claims });
+        const attempts = await this.store.increment(`att:${claims.id}`, ttl);
+        const max = this.maxAttempts(claims.typ);
+        if (attempts > max)
+            return fail('attempts-exceeded', { claims });
+        const retry = attempts < max;
+        const solveMs = now - claims.iat;
+        if (solveMs < this.minSolveMs(claims.typ))
+            return fail('too-fast', { claims, retry });
+        const result = this.registry[claims.typ].check(claims.sol, req.answer, { level: claims.lvl, elapsedMs: solveMs });
+        if (!result.ok)
+            return fail(result.reason, { claims, retry: retry && result.reason !== 'invalid-answer', ...(result.detail ? { detail: result.detail } : {}) });
+        // Atomic one-time redemption: of two concurrent correct submissions only one wins.
+        if (!(await this.store.setIfAbsent(`used:${claims.id}`, ttl)))
+            return fail('replayed', { claims });
+        const steps = claims.of ?? 1;
+        const step = claims.stp ?? 1;
+        const solved = [...(claims.done ?? []), claims.typ];
+        if (step < steps) {
+            // Multi-step: hand out the next (different) puzzle instead of a pass token.
+            const policy = this.policy(claims.act);
+            const pool = (claims.pool ?? [claims.typ]).filter(isChallengeType);
+            const type = await this.choose(policy, pool, claims.lvl, ck, claims.act, solved);
+            this.emit({ type: 'step-solved', challengeType: claims.typ, level: claims.lvl, clientKey: ck, action: claims.act, step, steps, solveMs });
+            const next = this.issue({
+                type,
+                level: claims.lvl,
+                lang: LANGS.includes(claims.lang) ? claims.lang : 'en',
+                siteKey: claims.sk,
+                action: claims.act,
+                client: req.client,
+                ck,
+                policy: { ...policy, steps },
+                step: step + 1,
+                done: solved,
+                pool,
+            });
+            return { ok: true, next };
+        }
+        const iat = Math.floor(now / 1000);
+        const exp = iat + (this.options.passTtlSec ?? 120);
+        const cb = claims.cbm === 'none' ? undefined : bindingHash(this.keys.key(this.keys.activeKid, 'client-binding'), claims.cbm, req.client);
+        const passToken = signPassToken(this.keys, {
+            v: 1,
+            jti: cryptoRng.id(16),
+            sk: claims.sk,
+            act: claims.act,
+            typ: claims.typ,
+            lvl: claims.lvl,
+            iat,
+            exp,
+            cbm: cb ? claims.cbm : 'none',
+            ...(cb ? { cb } : {}),
+            ...(steps > 1 ? { stp: solved } : {}),
+        });
+        this.emit({ type: 'verify-success', challengeType: claims.typ, level: claims.lvl, clientKey: ck, action: claims.act, solveMs, ...(steps > 1 ? { solvedTypes: solved } : {}) });
+        return { ok: true, passToken, expiresAt: exp * 1000, expiresInMs: (exp - iat) * 1000, type: claims.typ, solvedTypes: solved };
+    }
+    /** Server-side pass-token check using this instance's secrets and store. */
+    verifyPassToken(token, opts) {
+        return verifyPassToken(token, { now: this.now, ...opts, secret: this.keys, store: opts.store ?? this.store });
+    }
+}
+export function createNawaCaptcha(options) {
+    return new NawaCaptcha(options);
+}
+function publicError(reason) {
+    switch (reason) {
+        case 'invalid-input':
+        case 'invalid-answer':
+            return 'invalid-input';
+        case 'invalid-token':
+        case 'client-mismatch':
+            return 'invalid-token';
+        case 'expired':
+        case 'replayed':
+            return 'expired';
+        case 'rate-limited':
+            return 'rate-limited';
+        default:
+            return 'failed';
+    }
+}
+// ------------------------------------------------------------------ pass-token verification
+let defaultStore;
+const keyringCache = new Map();
+function keyringFrom(secret) {
+    if (typeof secret === 'object' && 'activeKid' in secret)
+        return secret;
+    const cacheKey = typeof secret === 'string' ? secret : JSON.stringify(secret);
+    let ring = keyringCache.get(cacheKey);
+    if (!ring) {
+        ring = createKeyring(secret);
+        if (keyringCache.size > 32)
+            keyringCache.clear();
+        keyringCache.set(cacheKey, ring);
+    }
+    return ring;
+}
+/**
+ * Verifies a pass token on your backend (the equivalent of reCAPTCHA siteverify, but local):
+ * signature, expiry, max age, action, site key, allowed types, steps, client binding, and single use.
+ */
+export async function verifyPassToken(token, opts) {
+    if (typeof token !== 'string' || token.length === 0)
+        return { ok: false, error: 'missing-token' };
+    const keys = keyringFrom(opts.secret);
+    const parsed = parsePassToken(keys, token);
+    if (!parsed.ok)
+        return { ok: false, error: parsed.error };
+    const { claims, kid } = parsed;
+    const nowSec = Math.floor((opts.now ?? Date.now)() / 1000);
+    const skew = opts.clockSkewSec ?? 5;
+    if (claims.iat > nowSec + skew)
+        return { ok: false, error: 'not-yet-valid' };
+    if (nowSec >= claims.exp)
+        return { ok: false, error: 'expired' };
+    if (opts.maxAgeSec !== undefined && nowSec - claims.iat > opts.maxAgeSec)
+        return { ok: false, error: 'too-old' };
+    const actions = typeof opts.expectedAction === 'string' ? [opts.expectedAction] : opts.expectedAction;
+    if (!actions.includes(claims.act))
+        return { ok: false, error: 'action-mismatch' };
+    if (opts.expectedSiteKey !== undefined && claims.sk !== opts.expectedSiteKey)
+        return { ok: false, error: 'site-mismatch' };
+    const solved = claims.stp ?? [claims.typ];
+    if (opts.allowedTypes && !solved.some((t) => opts.allowedTypes.includes(t)))
+        return { ok: false, error: 'type-not-allowed' };
+    if (opts.minSteps !== undefined && solved.length < opts.minSteps)
+        return { ok: false, error: 'too-few-steps' };
+    if (claims.cbm !== 'none') {
+        const key = keys.key(kid, 'client-binding');
+        const expected = key && opts.client ? bindingHash(key, claims.cbm, opts.client) : undefined;
+        if (!expected || !claims.cb || !safeEqual(expected, claims.cb))
+            return { ok: false, error: 'client-mismatch' };
+    }
+    const store = opts.store ?? (defaultStore ??= new MemoryStore());
+    const ttlMs = Math.max(1000, (claims.exp - nowSec + skew) * 1000);
+    if (!(await store.setIfAbsent(`pass:${claims.jti}`, ttlMs)))
+        return { ok: false, error: 'replayed' };
+    return { ok: true, claims };
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,IAAI,eAAe,EAAkC,UAAU,EAAE,MAAM,cAAc,CAAC;AACrH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAkC,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,YAAY,GAIb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAyB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAA8C,MAAM,aAAa,CAAC;AACxJ,OAAO,EAAE,eAAe,EAAE,KAAK,EAA0F,MAAM,YAAY,CAAC;AA+K5I,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,MAAM,KAAK,GAA6B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC3E,MAAM,YAAY,GAAqB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACpF,MAAM,gBAAgB,GAAoB,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAC/F,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAgBzC,MAAM,OAAO,WAAW;IAWD;IAVZ,IAAI,CAAU;IACd,KAAK,CAAmB;IAChB,QAAQ,CAA0C;IAClD,SAAS,GAAG,IAAI,GAAG,EAA4F,CAAC;IAChH,IAAI,CAAiB;IACrB,aAAa,CAAU;IACvB,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,IAAI,CAAW;IACf,GAAG,CAAe;IAEnC,YAAqB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAC9C,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACvG,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAU,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC9G,IAAI,CAAC,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAE,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,eAAe,CAAC;YACpC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU;YAChC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;YAC9C,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;YAC9D,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;SAC/B,CAAC;QACF,4FAA4F;QAC5F,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAED,6FAA6F;IAC7F,MAAM,CAAC,MAAc;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrI,MAAM,CAAC,GAAiB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAA+B,EAAE,CAAC,CAAC,CAAC,CAAE,GAAgC,IAAI,EAAE,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,cAAc,MAAM,IAAI,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvI,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QACpD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,8CAA8C,CAAC,CAAC;QACvH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,MAAM,QAAQ,GAAmB;YAC/B,2FAA2F;YAC3F,KAAK,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;YAC5F,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE;YAC/C,IAAI;YACJ,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YAC3G,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;SACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,IAAI,CAAC,KAAiB;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,MAAkB;QACpC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAE,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAA4B,EAAE,EAAU,EAAE,MAAkB;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;QAClD,IAAI,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,OAAO,EAAE,KAAK,UAAU;YAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAClF,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,MAAkB,EAAE,MAAc;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAAC,IAAmB,EAAE,OAAe;QACrD,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1I,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAqB,EAAE,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAqB,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAqB,EAAE,CAAC;YACnK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,IAAmB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1F,CAAC;IAEO,UAAU,CAAC,IAAmB;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,MAAM,CAAC,MAAsB,EAAE,IAA8B,EAAE,KAAa,EAAE,EAAU,EAAE,MAAc,EAAE,UAAoC,EAAE;QAC5J,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7D,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;gBAC7E,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAE,CAAC;YAClD,CAAC;YACD;gBACE,OAAO,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,CAAQ;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QAC/D,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,MAAM,GAAoB;YAC9B,CAAC,EAAE,CAAC;YACJ,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,GAAG,EAAE,CAAC,CAAC,IAAI;YACX,EAAE,EAAE,CAAC,CAAC,OAAO;YACb,GAAG,EAAE,CAAC,CAAC,MAAM;YACb,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG;YACH,GAAG;YACH,GAAG,EAAE,CAAC,CAAC,KAAK;YACZ,0FAA0F;YAC1F,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC5B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,EAAE,SAAS,CAAC,QAAQ;YACvB,GAAG,KAAK;SACT,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1L,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,UAAU;YAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;YACrB,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,GAAG,GAAG,GAAG;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAqB;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC5G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACxG,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACpH,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACjH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC5H,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC9J,MAAM,IAAI,GAAU,KAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QAE9H,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrH,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,4HAA4H;QAC5H,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,GAAG,SAAS,CAAC;aAC/I,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,SAAS,CAAC;;YAC5F,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9I,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAqB,EAAE,OAAuE,EAAE,EAAyB,EAAE;YAC7I,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;gBAC3D,IAAI,QAAQ,KAAK,KAAK;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;QACxI,CAAC,CAAC;QAEF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACjI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAEpH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,aAAa;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAE,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,QAAQ,GAAG,GAAG,CAAC;QAE7B,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAEhK,mFAAmF;QACnF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,4EAA4E;YAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1I,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;gBACtB,IAAI;gBACJ,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAG,KAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAa,CAAC,CAAC,CAAC,IAAI;gBACvF,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,MAAM,EAAE,MAAM,CAAC,GAAG;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,EAAE;gBACF,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;gBAC5B,IAAI,EAAE,IAAI,GAAG,CAAC;gBACd,IAAI,EAAE,MAAM;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAE,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1I,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE;YACzC,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;YAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/K,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAChI,CAAC;IAED,4EAA4E;IAC5E,eAAe,CAAC,KAAc,EAAE,IAAqF;QACnH,OAAO,eAAe,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC;QACrB,KAAK,gBAAgB;YACnB,OAAO,eAAe,CAAC;QACzB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC;QACzB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;QACnB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,6FAA6F;AAE7F,IAAI,YAAqC,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAC;AAEhD,SAAS,WAAW,CAAC,MAAwC;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,MAAiB,CAAC;IAClF,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,aAAa,CAAC,MAAyC,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,IAAI,GAAG,EAAE;YAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAc,EAAE,IAA4B;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC7E,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEjH,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC3H,MAAM,MAAM,GAAsB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,QAAQ,CAAC,CAAkB,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC/I,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAE/G,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/express.d.ts

@@ -0,0 +1,47 @@
+import type { ClientInfo } from './binding.js';
+import type { NawaCaptcha, PassTokenClaims } from './index.js';
+import { type ProtectOptions } from './http.js';
+export interface RequestLike {
+    method?: string;
+    url?: string;
+    path?: string;
+    ip?: string;
+    body?: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+    on?(event: 'data' | 'end' | 'error', cb: (arg?: unknown) => void): unknown;
+    nawaCaptcha?: PassTokenClaims;
+    /** @deprecated Same claims as `nawaCaptcha` (pre-rename name). */
+    nawaGuard?: PassTokenClaims;
+}
+export interface ResponseLike {
+    statusCode: number;
+    setHeader(name: string, value: string): unknown;
+    end(body?: string): unknown;
+}
+export type Next = (err?: unknown) => void;
+export type Middleware = (req: RequestLike, res: ResponseLike, next: Next) => void;
+export interface ExpressAdapterOptions {
+    /** How to read the client IP/UA. Default: `req.ip` (honours Express "trust proxy") and the User-Agent header. */
+    readonly getClient?: (req: RequestLike) => ClientInfo;
+}
+/**
+ * Mount under any prefix: `app.use('/captcha', nawaCaptchaExpress(guard))` serves
+ * `POST /captcha/challenge` and `POST /captcha/verify`.
+ */
+export declare function nawaCaptchaExpress(guard: NawaCaptcha, options?: ExpressAdapterOptions): Middleware;
+export interface RequireCaptchaOptions extends ProtectOptions, ExpressAdapterOptions {
+    /** Custom failure response. Default: 403 JSON `{ error: 'captcha-required', code }`. */
+    readonly onFail?: (req: RequestLike, res: ResponseLike, code: string) => void;
+}
+/**
+ * Guards a route: `app.post('/login', express.urlencoded(), requireCaptcha(guard, { expectedAction: 'login' }), handler)`.
+ * The token is read from the `X-Nawa-Captcha-Token` header or the `nawa-captcha-token` body field,
+ * verified (signature, expiry, action, binding) and redeemed once. Claims land on `req.nawaCaptcha`.
+ */
+export declare function requireCaptcha(guard: NawaCaptcha, options: RequireCaptchaOptions): Middleware;
+/** @deprecated Renamed to {@link nawaCaptchaExpress} (Nawa Guard is now Nawa Captcha). */
+export declare const nawaGuardExpress: typeof nawaCaptchaExpress;
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAOvI,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC;IAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAC3C,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,iHAAiH;IACjH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC;CACvD;AAsDD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,qBAA0B,GAAG,UAAU,CAkBtG;AAED,MAAM,WAAW,qBAAsB,SAAQ,cAAc,EAAE,qBAAqB;IAClF,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAe7F;AAED,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,2BAAqB,CAAC"}

package/dist/express.js

@@ -0,0 +1,107 @@
+import { MAX_BODY_BYTES, checkPassToken, handleChallenge, handleVerify } from './http.js';
+function defaultClient(req) {
+    const ua = req.headers['user-agent'];
+    return { ip: req.ip ?? req.socket?.remoteAddress, userAgent: Array.isArray(ua) ? ua[0] : ua };
+}
+function send(res, r) {
+    res.statusCode = r.status;
+    for (const [k, v] of Object.entries(r.headers))
+        res.setHeader(k, v);
+    res.end(JSON.stringify(r.body));
+}
+/** Uses `req.body` if a body parser ran; otherwise reads the stream itself (JSON, size-limited). */
+function readJson(req) {
+    if (req.body !== undefined)
+        return Promise.resolve(req.body);
+    if (!req.on)
+        return Promise.resolve(undefined);
+    const type = String(req.headers['content-type'] ?? '');
+    if (!type.toLowerCase().startsWith('application/json'))
+        return Promise.resolve(undefined);
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        let done = false;
+        req.on('data', (chunk) => {
+            if (done)
+                return;
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+            size += buf.length;
+            if (size > MAX_BODY_BYTES) {
+                done = true;
+                reject(new PayloadTooLarge());
+                return;
+            }
+            chunks.push(buf);
+        });
+        req.on('end', () => {
+            if (done)
+                return;
+            done = true;
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+            }
+            catch {
+                resolve(undefined);
+            }
+        });
+        req.on('error', (e) => {
+            if (!done) {
+                done = true;
+                reject(e);
+            }
+        });
+    });
+}
+class PayloadTooLarge extends Error {
+}
+/**
+ * Mount under any prefix: `app.use('/captcha', nawaCaptchaExpress(guard))` serves
+ * `POST /captcha/challenge` and `POST /captcha/verify`.
+ */
+export function nawaCaptchaExpress(guard, options = {}) {
+    const getClient = options.getClient ?? defaultClient;
+    return (req, res, next) => {
+        const path = req.path ?? new URL(req.url ?? '/', 'http://localhost').pathname;
+        const route = path === '/challenge' ? handleChallenge : path === '/verify' ? handleVerify : undefined;
+        if (!route)
+            return next();
+        if (req.method !== 'POST') {
+            res.setHeader('Allow', 'POST');
+            return send(res, { status: 405, headers: { 'Content-Type': 'application/json; charset=utf-8' }, body: { success: false, error: 'method-not-allowed' } });
+        }
+        readJson(req)
+            .then((body) => route(guard, { body, client: getClient(req) }))
+            .then((r) => send(res, r))
+            .catch((err) => {
+            if (err instanceof PayloadTooLarge)
+                return send(res, { status: 413, headers: { 'Content-Type': 'application/json; charset=utf-8' }, body: { success: false, error: 'payload-too-large' } });
+            next(err);
+        });
+    };
+}
+/**
+ * Guards a route: `app.post('/login', express.urlencoded(), requireCaptcha(guard, { expectedAction: 'login' }), handler)`.
+ * The token is read from the `X-Nawa-Captcha-Token` header or the `nawa-captcha-token` body field,
+ * verified (signature, expiry, action, binding) and redeemed once. Claims land on `req.nawaCaptcha`.
+ */
+export function requireCaptcha(guard, options) {
+    const getClient = options.getClient ?? defaultClient;
+    return (req, res, next) => {
+        checkPassToken(guard, { headers: req.headers, body: req.body, client: getClient(req) }, options)
+            .then((result) => {
+            if (result.ok) {
+                req.nawaCaptcha = result.claims;
+                req.nawaGuard = result.claims;
+                return next();
+            }
+            if (options.onFail)
+                return options.onFail(req, res, result.error);
+            send(res, { status: 403, headers: { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' }, body: { error: 'captcha-required', code: result.error } });
+        })
+            .catch(next);
+    };
+}
+/** @deprecated Renamed to {@link nawaCaptchaExpress} (Nawa Guard is now Nawa Captcha). */
+export const nawaGuardExpress = nawaCaptchaExpress;
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAA+C,MAAM,WAAW,CAAC;AAmCvI,SAAS,aAAa,CAAC,GAAgB;IACrC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,IAAI,CAAC,GAAiB,EAAE,CAAoB;IACnD,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,oGAAoG;AACpG,SAAS,QAAQ,CAAC,GAAgB;IAChC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,GAAG,CAAC,EAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,IAAI,IAAI;gBAAE,OAAO;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;YACnB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAG,CAAC,KAAK,EAAE,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;CAAG;AAEtC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB,EAAE,UAAiC,EAAE;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC3J,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC9D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACzB,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,GAAG,YAAY,eAAe;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;YAC5L,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,OAA8B;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,cAAc,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;aAC7F,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;gBAChC,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnL,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC"}