@opensyber/tokenforge 0.1.0 → 0.1.2

package/dist/adapters/hono.d.ts

@@ -1,8 +1,12 @@
 /**
- * Hono adapter — re-export from server/ for the new import path.
+ * Hono adapter — re-export of the cloud-managed verification middleware.
  * Usage: import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono'
+ *
+ * Self-hosted routes (createTokenForgeRoutes, createStepUpRoutes) are kept
+ * internal — they require the full crypto stack which is excluded from the
+ * published tarball. Self-hosting customers should use the source repo
+ * directly instead of the npm package.
  */
 export { tokenForgeMiddleware } from '../server/middleware.js';
-export { createTokenForgeRoutes } from '../server/binding.js';
-export { createStepUpRoutes } from '../server/step-up.js';
+export type { TokenForgeOptions } from '../server/middleware.js';
 //# sourceMappingURL=hono.d.ts.map

package/dist/adapters/hono.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/adapters/hono.js

@@ -1,8 +1,11 @@
 /**
- * Hono adapter — re-export from server/ for the new import path.
+ * Hono adapter — re-export of the cloud-managed verification middleware.
  * Usage: import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono'
+ *
+ * Self-hosted routes (createTokenForgeRoutes, createStepUpRoutes) are kept
+ * internal — they require the full crypto stack which is excluded from the
+ * published tarball. Self-hosting customers should use the source repo
+ * directly instead of the npm package.
  */
 export { tokenForgeMiddleware } from '../server/middleware.js';
-export { createTokenForgeRoutes } from '../server/binding.js';
-export { createStepUpRoutes } from '../server/step-up.js';
 //# sourceMappingURL=hono.js.map

package/dist/adapters/hono.js.map

@@ -1 +1 @@
-{"version":3,"file":"hono.js","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/adapters/index.d.ts

@@ -1,4 +1,4 @@
-export { tokenForgeMiddleware as honoMiddleware, createTokenForgeRoutes, createStepUpRoutes } from './hono.js';
+export { tokenForgeMiddleware as honoMiddleware } from './hono.js';
 export { tokenForgeMiddleware as expressMiddleware } from './express.js';
 export { withTokenForge, tokenForgeCheck } from './nextjs.js';
 export { tokenForgePlugin } from './fastify.js';

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/index.js

@@ -1,4 +1,4 @@
-export { tokenForgeMiddleware as honoMiddleware, createTokenForgeRoutes, createStepUpRoutes } from './hono.js';
+export { tokenForgeMiddleware as honoMiddleware } from './hono.js';
 export { tokenForgeMiddleware as expressMiddleware } from './express.js';
 export { withTokenForge, tokenForgeCheck } from './nextjs.js';
 export { tokenForgePlugin } from './fastify.js';

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/server/index.d.ts

@@ -1,7 +1,3 @@
 export { tokenForgeMiddleware } from './middleware.js';
 export type { TokenForgeOptions } from './middleware.js';
-export { createTokenForgeRoutes, tokenForgeRoutes } from './binding.js';
-export { createStepUpRoutes, stepUpRoutes } from './step-up.js';
-export { verifyTotp, generateTotp } from './totp.js';
-export type { TokenForgeStorage, StepUpChallengeRecord } from './storage/interface.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGrD,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -1,6 +1,6 @@
-// Public API — shipped in the npm package
+// Public API — shipped in the npm package.
+// The cloud-managed verification middleware is the only published entry point.
+// Self-hosted routes (binding, step-up) and internal crypto utilities (trust-score,
+// verify, crypto) are kept internal and excluded via package.json `files`.
 export { tokenForgeMiddleware } from './middleware.js';
-export { createTokenForgeRoutes, tokenForgeRoutes } from './binding.js';
-export { createStepUpRoutes, stepUpRoutes } from './step-up.js';
-export { verifyTotp, generateTotp } from './totp.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,+EAA+E;AAC/E,oFAAoF;AACpF,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensyber/tokenforge",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Device-bound session security — ECDSA P-256 signatures for every request after login",
   "private": false,
   "type": "module",
@@ -60,18 +60,6 @@
     "./fastify": {
       "import": "./dist/adapters/fastify.js",
       "types": "./dist/adapters/fastify.d.ts"
-    },
-    "./storage": {
-      "import": "./dist/server/storage/index.js",
-      "types": "./dist/server/storage/index.d.ts"
-    },
-    "./storage/internal": {
-      "import": "./src/server/storage/internal.ts",
-      "types": "./src/server/storage/internal.ts"
-    },
-    "./server/internal": {
-      "import": "./src/server/internal.ts",
-      "types": "./src/server/internal.ts"
     }
   },
   "files": [
@@ -84,8 +72,12 @@
     "!dist/server/crypto.*",
     "!dist/server/trust-score.*",
     "!dist/server/verify.*",
+    "!dist/server/binding.*",
+    "!dist/server/step-up.*",
+    "!dist/server/totp.*",
     "!dist/server/middleware-internal.*",
     "!dist/server/internal.*",
+    "!dist/server/storage/**",
     "README.md",
     "LICENSE.md"
   ],
@@ -98,7 +90,7 @@
     "prepublishOnly": "pnpm run clean && pnpm run build"
   },
   "dependencies": {
-    "hono": "^4.7.0"
+    "hono": "^4.12.14"
   },
   "peerDependencies": {
     "react": ">=18.0.0"

package/dist/server/binding.d.ts

@@ -1,19 +0,0 @@
-import { Hono } from 'hono';
-import type { TokenForgeServerOptions } from '../shared/types.js';
-interface Variables {
-    userId: string;
-    sessionId: string;
-}
-/**
- * TokenForge binding and session management routes.
- * Mount at /api/tf on the main Hono app.
- * @param options - Server options (storage, thresholds, callbacks).
- * @returns A Hono sub-app with /bind, /sessions, /events, /trust-score routes.
- */
-export declare function createTokenForgeRoutes(options: TokenForgeServerOptions): Hono<{
-    Variables: Variables;
-}>;
-/** @deprecated Use createTokenForgeRoutes(options) instead */
-export declare const tokenForgeRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
-export {};
-//# sourceMappingURL=binding.d.ts.map

package/dist/server/binding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/server/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,uBAAuB,EAAiB,MAAM,oBAAoB,CAAC;AAEjF,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAsFvG;AAED,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,4EAAa,CAAC"}

package/dist/server/binding.js

@@ -1,87 +0,0 @@
-import { Hono } from 'hono';
-import { hashFingerprint } from './trust-score.js';
-/**
- * TokenForge binding and session management routes.
- * Mount at /api/tf on the main Hono app.
- * @param options - Server options (storage, thresholds, callbacks).
- * @returns A Hono sub-app with /bind, /sessions, /events, /trust-score routes.
- */
-export function createTokenForgeRoutes(options) {
-    const tf = new Hono();
-    tf.post('/bind', async (c) => {
-        const userId = c.get('userId');
-        const sessionId = c.get('sessionId');
-        if (!userId || !sessionId)
-            return c.json({ error: 'unauthorized' }, 401);
-        const body = await c.req.json();
-        if (body.sessionId !== sessionId)
-            return c.json({ error: 'session_mismatch' }, 400);
-        if (!body.publicKey?.kty || body.publicKey.kty !== 'EC' || body.publicKey.crv !== 'P-256') {
-            return c.json({ error: 'invalid_key_format' }, 400);
-        }
-        const deviceId = crypto.randomUUID().replace(/-/g, '');
-        const fingerprint = hashFingerprint(body.metadata?.userAgent || '');
-        const expiresAt = new Date(Date.now() + options.sessionMaxAge * 1000).toISOString();
-        const ipAddress = options.getIpAddress?.(c.req.raw) ?? c.req.header('cf-connecting-ip') ?? '';
-        const countryCode = options.getCountryCode?.(c.req.raw) ?? c.req.header('cf-ipcountry') ?? '';
-        await options.storage.revokeUserSessions(userId);
-        const session = {
-            id: deviceId, session_id: sessionId, user_id: userId,
-            public_key: JSON.stringify(body.publicKey),
-            device_fingerprint: fingerprint, ip_address: ipAddress,
-            country_code: countryCode, trust_score: 100,
-            bound_at: new Date().toISOString(), last_verified_at: new Date().toISOString(),
-            expires_at: expiresAt, revoked: 0, revoked_reason: null,
-            created_at: new Date().toISOString(),
-        };
-        await options.storage.createSession(session);
-        await options.storage.logEvent({
-            id: crypto.randomUUID(), sessionId, userId,
-            eventType: 'DEVICE_BOUND', trustScoreBefore: 0, trustScoreAfter: 100,
-            ipAddress, countryCode,
-            userAgent: options.getUserAgent?.(c.req.raw) ?? c.req.header('user-agent') ?? '',
-            metadata: { deviceId, fingerprint, metadata: body.metadata },
-        });
-        return c.json({ deviceId, expiresAt });
-    });
-    tf.get('/sessions', async (c) => {
-        const userId = c.get('userId');
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401);
-        const sessions = await options.storage.listUserSessions(userId, 20);
-        return c.json({ sessions });
-    });
-    tf.delete('/sessions/:id', async (c) => {
-        const userId = c.get('userId');
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401);
-        await options.storage.revokeSession(c.req.param('id'), 'user_revoked');
-        return c.json({ revoked: true });
-    });
-    tf.get('/events', async (c) => {
-        const userId = c.get('userId');
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401);
-        const limit = parseInt(c.req.query('limit') || '50', 10);
-        const offset = parseInt(c.req.query('offset') || '0', 10);
-        const events = await options.storage.listEvents(userId, limit, offset);
-        return c.json({ events });
-    });
-    tf.get('/trust-score', async (c) => {
-        const userId = c.get('userId');
-        const sessionId = c.get('sessionId');
-        const deviceId = c.req.header('X-TF-Device-ID');
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401);
-        if (!deviceId || !sessionId)
-            return c.json({ trustScore: 0, isBound: false, deviceId: null });
-        const session = await options.storage.getSession(sessionId, deviceId);
-        if (!session)
-            return c.json({ trustScore: 0, isBound: false, deviceId: null });
-        return c.json({ trustScore: session.trust_score, isBound: true, deviceId });
-    });
-    return tf;
-}
-/** @deprecated Use createTokenForgeRoutes(options) instead */
-export const tokenForgeRoutes = new Hono();
-//# sourceMappingURL=binding.js.map

package/dist/server/binding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/server/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,EAAE,GAAG,IAAI,IAAI,EAA4B,CAAC;IAEhD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAIzB,CAAC;QAEL,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAE9F,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;YACpD,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1C,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS;YACtD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG;YAC3C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9E,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI;YACvD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7C,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM;YAC1C,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG;YACpE,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;YAChF,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC7D,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC"}

package/dist/server/step-up.d.ts

@@ -1,19 +0,0 @@
-import { Hono } from 'hono';
-import type { TokenForgeServerOptions } from '../shared/types.js';
-interface Variables {
-    userId: string;
-    sessionId: string;
-}
-/**
- * Step-up authentication routes for TokenForge.
- * Mount at /api/tf/step-up on the main Hono app.
- * @param options - Server options (storage, email sender, passkey verifier).
- * @returns A Hono sub-app with /initiate and /complete routes.
- */
-export declare function createStepUpRoutes(options: TokenForgeServerOptions): Hono<{
-    Variables: Variables;
-}>;
-/** @deprecated Use createStepUpRoutes(options) instead */
-export declare const stepUpRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
-export {};
-//# sourceMappingURL=step-up.d.ts.map

package/dist/server/step-up.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-up.d.ts","sourceRoot":"","sources":["../../src/server/step-up.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAIlE,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,uBAAuB,GAC/B,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAiGhC;AA8DD,0DAA0D;AAC1D,eAAO,MAAM,YAAY,4EAAa,CAAC"}

package/dist/server/step-up.js

@@ -1,139 +0,0 @@
-import { Hono } from 'hono';
-import { verifyTotp } from './totp.js';
-const MAX_CHALLENGES_PER_WINDOW = 5;
-const CHALLENGE_WINDOW_MINUTES = 15;
-const CHALLENGE_TTL_SECONDS = 300; // 5 minutes
-/**
- * Step-up authentication routes for TokenForge.
- * Mount at /api/tf/step-up on the main Hono app.
- * @param options - Server options (storage, email sender, passkey verifier).
- * @returns A Hono sub-app with /initiate and /complete routes.
- */
-export function createStepUpRoutes(options) {
-    const stepUp = new Hono();
-    stepUp.post('/initiate', async (c) => {
-        const userId = c.get('userId');
-        const sessionId = c.get('sessionId');
-        if (!userId || !sessionId)
-            return c.json({ error: 'unauthorized' }, 401);
-        const count = await options.storage.countRecentChallenges(userId, CHALLENGE_WINDOW_MINUTES);
-        if (count >= MAX_CHALLENGES_PER_WINDOW) {
-            return c.json({ error: 'rate_limited', message: 'Too many step-up attempts. Try again later.' }, 429);
-        }
-        const { method } = await c.req.json();
-        const challengeMethod = (method || 'totp');
-        const challengeId = crypto.randomUUID();
-        const now = new Date();
-        const expiresAt = new Date(now.getTime() + CHALLENGE_TTL_SECONDS * 1000).toISOString();
-        const challenge = {
-            id: challengeId, sessionId, userId,
-            reason: 'trust_score_drop', method: challengeMethod,
-            status: 'pending', expiresAt,
-            createdAt: now.toISOString(), completedAt: null,
-        };
-        await options.storage.createChallenge(challenge);
-        if (challengeMethod === 'email_otp') {
-            const otp = generateOtp();
-            await options.storage.storeOtp(challengeId, otp, CHALLENGE_TTL_SECONDS);
-            if (options.sendEmail) {
-                await options.sendEmail(userId, otp);
-            }
-            else {
-                throw new Error('sendEmail handler not configured — cannot deliver OTP');
-            }
-        }
-        if (challengeMethod === 'passkey') {
-            // Generate WebAuthn challenge and return it
-            const webauthnChallenge = generateWebAuthnChallenge();
-            return c.json({ challengeId, method: challengeMethod, expiresAt, webauthnChallenge });
-        }
-        return c.json({ challengeId, method: challengeMethod, expiresAt });
-    });
-    stepUp.post('/complete', async (c) => {
-        const userId = c.get('userId');
-        if (!userId)
-            return c.json({ error: 'unauthorized' }, 401);
-        const { challengeId, code, credential } = await c.req.json();
-        const challenge = await options.storage.getChallenge(challengeId, userId);
-        if (!challenge)
-            return c.json({ error: 'invalid_challenge' }, 400);
-        if (new Date(challenge.expiresAt) < new Date()) {
-            await options.storage.updateChallengeStatus(challengeId, 'expired');
-            return c.json({ error: 'challenge_expired' }, 400);
-        }
-        let verified = false;
-        if (challenge.method === 'email_otp') {
-            const storedOtp = await options.storage.getOtp(challengeId);
-            verified = storedOtp !== null && storedOtp === code;
-            if (verified)
-                await options.storage.deleteOtp(challengeId);
-        }
-        else if (challenge.method === 'totp' && code) {
-            verified = await verifyTotp(code, userId, options);
-        }
-        else if (challenge.method === 'passkey' && credential) {
-            const storedKey = options.getPasskeyPublicKey
-                ? await options.getPasskeyPublicKey(userId, credential.id)
-                : null;
-            if (storedKey) {
-                verified = await verifyPasskeyCredential(credential, storedKey, challengeId);
-            }
-        }
-        if (!verified) {
-            await options.storage.updateChallengeStatus(challengeId, 'failed');
-            return c.json({ error: 'verification_failed' }, 401);
-        }
-        await options.storage.updateChallengeStatus(challengeId, 'completed', new Date().toISOString());
-        const deviceId = c.req.header('X-TF-Device-ID');
-        if (deviceId) {
-            await options.storage.restoreTrust(deviceId, userId);
-        }
-        return c.json({ verified: true, trustScore: 100 });
-    });
-    return stepUp;
-}
-/** Generate a 6-digit OTP using CSPRNG */
-function generateOtp() {
-    const randomBytes = new Uint32Array(1);
-    crypto.getRandomValues(randomBytes);
-    return ((randomBytes[0] % 900000) + 100000).toString();
-}
-/** Generate a WebAuthn challenge (32 random bytes, base64url encoded) */
-function generateWebAuthnChallenge() {
-    const bytes = new Uint8Array(32);
-    crypto.getRandomValues(bytes);
-    return btoa(String.fromCharCode(...bytes))
-        .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-/**
- * Verify a WebAuthn passkey credential against the stored public key.
- * Uses ECDSA P-256 signature verification via Web Crypto API.
- */
-async function verifyPasskeyCredential(credential, publicKeySpki, expectedChallenge) {
-    try {
-        if (!credential.id || !credential.response?.signature || !credential.response?.authenticatorData) {
-            return false;
-        }
-        const clientDataJSON = atob(credential.response.clientDataJSON);
-        const clientData = JSON.parse(clientDataJSON);
-        if (clientData.type !== 'webauthn.get')
-            return false;
-        const decodedChallenge = atob(clientData.challenge?.replace(/-/g, '+').replace(/_/g, '/') ?? '');
-        if (decodedChallenge !== expectedChallenge)
-            return false;
-        const key = await crypto.subtle.importKey('spki', publicKeySpki, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
-        const authData = Uint8Array.from(atob(credential.response.authenticatorData), (ch) => ch.charCodeAt(0));
-        const clientDataHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(clientDataJSON));
-        const signedData = new Uint8Array(authData.length + clientDataHash.byteLength);
-        signedData.set(authData, 0);
-        signedData.set(new Uint8Array(clientDataHash), authData.length);
-        const sigBytes = Uint8Array.from(atob(credential.response.signature), (ch) => ch.charCodeAt(0));
-        return await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, sigBytes, signedData);
-    }
-    catch {
-        return false;
-    }
-}
-/** @deprecated Use createStepUpRoutes(options) instead */
-export const stepUpRoutes = new Hono();
-//# sourceMappingURL=step-up.js.map

package/dist/server/step-up.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../src/server/step-up.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,IAAI,EAA4B,CAAC;IAEpD,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC5F,IAAI,KAAK,IAAI,yBAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAuB,CAAC;QAC3D,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,MAAM,CAAqC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvF,MAAM,SAAS,GAA0B;YACvC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;YAClC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;YACnD,MAAM,EAAE,SAAS,EAAE,SAAS;YAC5B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI;SAChD,CAAC;QACF,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,yBAAyB,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAItD,CAAC;QAEL,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAiC,CAAC;QAC1G,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAEnE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,QAAQ,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;YACpD,IAAI,QAAQ;gBAAE,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;YAC/C,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB;gBAC3C,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAEhG,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0CAA0C;AAC1C,SAAS,WAAW;IAClB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,yEAAyE;AACzE,SAAS,yBAAyB;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAQD;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAA8B,EAC9B,aAA0B,EAC1B,iBAAyB;IAEzB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAA0C,CAAC;QACvF,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QAErD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,IAAI,gBAAgB,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAEzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EAAE,aAAa,EACrB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC/E,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC"}

package/dist/server/storage/index.d.ts

@@ -1,3 +0,0 @@
-export type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
-export { MemoryStorage } from './memory.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/storage/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/index.js

@@ -1,2 +0,0 @@
-export { MemoryStorage } from './memory.js';
-//# sourceMappingURL=index.js.map

package/dist/server/storage/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/interface.d.ts

@@ -1,61 +0,0 @@
-import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
-/**
- * Storage interface for TokenForge server.
- * Implement this to use any database/cache backend.
- */
-export interface TokenForgeStorage {
-    /** Find an active (non-revoked) session by sessionId + deviceId */
-    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
-    /** Create a new device session */
-    createSession(session: DeviceSession): Promise<void>;
-    /** Update trust score and last_verified_at for a session */
-    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
-    /** Mark a session as revoked */
-    revokeSession(deviceId: string, reason: string): Promise<void>;
-    /** Revoke all sessions for a user (called before re-binding) */
-    revokeUserSessions(userId: string): Promise<void>;
-    /** List a user's sessions (most recent first) */
-    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
-    /** Restore trust score to 100 after step-up */
-    restoreTrust(deviceId: string, userId: string): Promise<void>;
-    /** Check if nonce has been used */
-    hasNonce(nonce: string): Promise<boolean>;
-    /** Store a used nonce with TTL in seconds */
-    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
-    /** Insert a security event record */
-    logEvent(event: SecurityEvent & {
-        id: string;
-    }): Promise<void>;
-    /** List security events for a user (for dashboard) */
-    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
-        id: string;
-        created_at: string;
-    })[]>;
-    /** Create a step-up challenge */
-    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
-    /** Get a pending challenge by ID + userId */
-    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
-    /** Update challenge status */
-    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
-    /** Count recent challenges for rate limiting */
-    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
-    /** Store OTP code for a challenge with TTL */
-    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
-    /** Retrieve and consume OTP code */
-    getOtp(challengeId: string): Promise<string | null>;
-    /** Delete OTP after verification */
-    deleteOtp(challengeId: string): Promise<void>;
-}
-/** Step-up challenge stored in database */
-export interface StepUpChallengeRecord {
-    id: string;
-    sessionId: string;
-    userId: string;
-    reason: string;
-    method: 'totp' | 'email_otp' | 'passkey';
-    status: 'pending' | 'completed' | 'expired' | 'failed';
-    expiresAt: string;
-    createdAt: string;
-    completedAt: string | null;
-}
-//# sourceMappingURL=interface.d.ts.map

package/dist/server/storage/interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../../src/server/storage/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAEhC,mEAAmE;IACnE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,kCAAkC;IAClC,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,gCAAgC;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,gEAAgE;IAChE,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iDAAiD;IACjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,+CAA+C;IAC/C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9D,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,6CAA6C;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7D,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,sDAAsD;IACtD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAG3H,iCAAiC;IACjC,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,6CAA6C;IAC7C,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF,8BAA8B;IAC9B,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,gDAAgD;IAChD,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG9E,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,oCAAoC;IACpC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,oCAAoC;IACpC,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/server/storage/interface.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=interface.js.map

package/dist/server/storage/interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../../src/server/storage/interface.ts"],"names":[],"mappings":""}

package/dist/server/storage/memory.d.ts

@@ -1,40 +0,0 @@
-import type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
-import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
-/**
- * In-memory storage for testing and development.
- * Not suitable for production — data is lost on restart.
- */
-export declare class MemoryStorage implements TokenForgeStorage {
-    sessions: DeviceSession[];
-    events: (SecurityEvent & {
-        id: string;
-        created_at: string;
-    })[];
-    challenges: StepUpChallengeRecord[];
-    private nonces;
-    private otps;
-    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
-    createSession(session: DeviceSession): Promise<void>;
-    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
-    revokeSession(deviceId: string, reason: string): Promise<void>;
-    revokeUserSessions(userId: string): Promise<void>;
-    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
-    restoreTrust(deviceId: string, userId: string): Promise<void>;
-    hasNonce(nonce: string): Promise<boolean>;
-    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
-    logEvent(event: SecurityEvent & {
-        id: string;
-    }): Promise<void>;
-    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
-        id: string;
-        created_at: string;
-    })[]>;
-    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
-    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
-    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
-    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
-    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
-    getOtp(challengeId: string): Promise<string | null>;
-    deleteOtp(challengeId: string): Promise<void>;
-}
-//# sourceMappingURL=memory.d.ts.map

package/dist/server/storage/memory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/server/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,aAAc,YAAW,iBAAiB;IACrD,QAAQ,EAAE,aAAa,EAAE,CAAM;IAC/B,MAAM,EAAE,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAM;IACpE,UAAU,EAAE,qBAAqB,EAAE,CAAM;IACzC,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,IAAI,CAA0D;IAEhE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAM9E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOzE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAO1H,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAMxF,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO7E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}

package/dist/server/storage/memory.js

@@ -1,107 +0,0 @@
-/**
- * In-memory storage for testing and development.
- * Not suitable for production — data is lost on restart.
- */
-export class MemoryStorage {
-    sessions = [];
-    events = [];
-    challenges = [];
-    nonces = new Map(); // nonce → expiry timestamp
-    otps = new Map();
-    async getSession(sessionId, deviceId) {
-        return this.sessions.find((s) => s.session_id === sessionId && s.id === deviceId && s.revoked === 0) ?? null;
-    }
-    async createSession(session) {
-        this.sessions.push({ ...session });
-    }
-    async updateTrustScore(deviceId, trustScore) {
-        const s = this.sessions.find((s) => s.id === deviceId);
-        if (s) {
-            s.trust_score = trustScore;
-            s.last_verified_at = new Date().toISOString();
-        }
-    }
-    async revokeSession(deviceId, reason) {
-        const s = this.sessions.find((s) => s.id === deviceId);
-        if (s) {
-            s.revoked = 1;
-            s.revoked_reason = reason;
-        }
-    }
-    async revokeUserSessions(userId) {
-        for (const s of this.sessions) {
-            if (s.user_id === userId && s.revoked === 0) {
-                s.revoked = 1;
-                s.revoked_reason = 'rebind';
-            }
-        }
-    }
-    async listUserSessions(userId, limit) {
-        return this.sessions
-            .filter((s) => s.user_id === userId)
-            .sort((a, b) => b.bound_at.localeCompare(a.bound_at))
-            .slice(0, limit);
-    }
-    async restoreTrust(deviceId, userId) {
-        const s = this.sessions.find((s) => s.id === deviceId && s.user_id === userId);
-        if (s)
-            s.trust_score = 100;
-    }
-    async hasNonce(nonce) {
-        const expiry = this.nonces.get(nonce);
-        if (!expiry)
-            return false;
-        if (Date.now() > expiry) {
-            this.nonces.delete(nonce);
-            return false;
-        }
-        return true;
-    }
-    async storeNonce(nonce, ttlSeconds) {
-        this.nonces.set(nonce, Date.now() + ttlSeconds * 1000);
-    }
-    async logEvent(event) {
-        this.events.push({ ...event, created_at: new Date().toISOString() });
-    }
-    async listEvents(userId, limit, offset) {
-        return this.events
-            .filter((e) => e.userId === userId)
-            .sort((a, b) => b.created_at.localeCompare(a.created_at))
-            .slice(offset, offset + limit);
-    }
-    async createChallenge(challenge) {
-        this.challenges.push({ ...challenge });
-    }
-    async getChallenge(challengeId, userId) {
-        return this.challenges.find((c) => c.id === challengeId && c.userId === userId && c.status === 'pending') ?? null;
-    }
-    async updateChallengeStatus(challengeId, status, completedAt) {
-        const c = this.challenges.find((c) => c.id === challengeId);
-        if (c) {
-            c.status = status;
-            if (completedAt)
-                c.completedAt = completedAt;
-        }
-    }
-    async countRecentChallenges(userId, windowMinutes) {
-        const cutoff = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
-        return this.challenges.filter((c) => c.userId === userId && c.createdAt > cutoff).length;
-    }
-    async storeOtp(challengeId, code, ttlSeconds) {
-        this.otps.set(challengeId, { code, expiresAt: Date.now() + ttlSeconds * 1000 });
-    }
-    async getOtp(challengeId) {
-        const entry = this.otps.get(challengeId);
-        if (!entry)
-            return null;
-        if (Date.now() > entry.expiresAt) {
-            this.otps.delete(challengeId);
-            return null;
-        }
-        return entry.code;
-    }
-    async deleteOtp(challengeId) {
-        this.otps.delete(challengeId);
-    }
-}
-//# sourceMappingURL=memory.js.map

package/dist/server/storage/memory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/server/storage/memory.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,aAAa;IACxB,QAAQ,GAAoB,EAAE,CAAC;IAC/B,MAAM,GAA2D,EAAE,CAAC;IACpE,UAAU,GAA4B,EAAE,CAAC;IACjC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,2BAA2B;IAC/D,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;IAEtE,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAC1E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,cAAc,GAAG,QAAQ,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAa;QAClD,OAAO,IAAI,CAAC,QAAQ;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACpD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,CAAC;YAAE,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,UAAkB;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAqC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;QAC5D,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACxD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAgC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAc;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAC7E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,MAAc,EAAE,WAAoB;QACnF,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,MAAM,GAAG,MAAyC,CAAC;YACrD,IAAI,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,CACnD,CAAC,MAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,IAAY,EAAE,UAAkB;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/server/totp.d.ts

@@ -1,53 +0,0 @@
-import type { TokenForgeServerOptions } from '../shared/types.js';
-/**
- * Callback surface for TOTP attempt rate-limiting. Callers plug in a
- * storage-backed counter (KV, Redis, D1); when absent, lockout is
- * disabled and the caller MUST enforce rate-limiting elsewhere.
- *
- *  - `getFailedAttempts(userId)` returns the number of failed TOTP
- *    verifications for the user within the current lockout window.
- *  - `recordFailedAttempt(userId)` atomically increments the counter
- *    and sets a TTL of `windowSeconds`.
- *  - `resetFailedAttempts(userId)` clears the counter on a successful
- *    verification.
- */
-export interface TotpRateLimiter {
-    getFailedAttempts(userId: string): Promise<number>;
-    recordFailedAttempt(userId: string, windowSeconds: number): Promise<void>;
-    resetFailedAttempts(userId: string): Promise<void>;
-}
-export declare const TOTP_MAX_ATTEMPTS = 5;
-export declare const TOTP_LOCKOUT_WINDOW_SECONDS = 300;
-export declare class TotpLockedOutError extends Error {
-    readonly retryAfterSeconds: number;
-    constructor(retryAfterSeconds: number);
-}
-/**
- * TOTP verification (RFC 6238) using HMAC-SHA1.
- * Time step: 30 seconds, window: +/-1 step tolerance.
- *
- * Rate-limiting: when `options.rateLimiter` is provided, the user is
- * locked out for TOTP_LOCKOUT_WINDOW_SECONDS after TOTP_MAX_ATTEMPTS
- * failures. A TotpLockedOutError is thrown while locked so callers can
- * return a distinct 429 to the client instead of a generic "invalid
- * code". A successful verification resets the counter immediately.
- *
- * @param code - The 6-digit TOTP code from the user.
- * @param userId - User whose TOTP secret to look up.
- * @param options - Server options; must include `getTotpSecret` callback.
- * @returns True if the code is valid for the current or adjacent time window.
- * @throws TotpLockedOutError if the user is currently locked out.
- */
-export declare function verifyTotp(code: string, userId: string, options: TokenForgeServerOptions & {
-    getTotpSecret?: (userId: string) => Promise<string | null>;
-    rateLimiter?: TotpRateLimiter;
-}): Promise<boolean>;
-/**
- * Generate a TOTP code for a given counter value.
- * Uses HMAC-SHA1 per RFC 4226, with 6-digit output.
- * @param secretBase32 - Base32-encoded shared secret.
- * @param counter - HMAC counter value (typically `floor(time / 30)`).
- * @returns A 6-digit zero-padded TOTP code.
- */
-export declare function generateTotp(secretBase32: string, counter: number): Promise<string>;
-//# sourceMappingURL=totp.d.ts.map

package/dist/server/totp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/server/totp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM;gBAAzB,iBAAiB,EAAE,MAAM;CAI/C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,uBAAuB,GAAG;IACjC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,GACA,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBzF"}

package/dist/server/totp.js

@@ -1,114 +0,0 @@
-export const TOTP_MAX_ATTEMPTS = 5;
-export const TOTP_LOCKOUT_WINDOW_SECONDS = 300; // 5 min — matches the OWASP ASVS V6.2.6 guidance
-export class TotpLockedOutError extends Error {
-    retryAfterSeconds;
-    constructor(retryAfterSeconds) {
-        super(`Too many failed TOTP attempts; locked out for ${retryAfterSeconds}s`);
-        this.retryAfterSeconds = retryAfterSeconds;
-        this.name = 'TotpLockedOutError';
-    }
-}
-/**
- * TOTP verification (RFC 6238) using HMAC-SHA1.
- * Time step: 30 seconds, window: +/-1 step tolerance.
- *
- * Rate-limiting: when `options.rateLimiter` is provided, the user is
- * locked out for TOTP_LOCKOUT_WINDOW_SECONDS after TOTP_MAX_ATTEMPTS
- * failures. A TotpLockedOutError is thrown while locked so callers can
- * return a distinct 429 to the client instead of a generic "invalid
- * code". A successful verification resets the counter immediately.
- *
- * @param code - The 6-digit TOTP code from the user.
- * @param userId - User whose TOTP secret to look up.
- * @param options - Server options; must include `getTotpSecret` callback.
- * @returns True if the code is valid for the current or adjacent time window.
- * @throws TotpLockedOutError if the user is currently locked out.
- */
-export async function verifyTotp(code, userId, options) {
-    if (!options.getTotpSecret)
-        return false;
-    const limiter = options.rateLimiter;
-    if (limiter) {
-        const attempts = await limiter.getFailedAttempts(userId);
-        if (attempts >= TOTP_MAX_ATTEMPTS) {
-            throw new TotpLockedOutError(TOTP_LOCKOUT_WINDOW_SECONDS);
-        }
-    }
-    const secret = await options.getTotpSecret(userId);
-    if (!secret) {
-        if (limiter)
-            await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
-        return false;
-    }
-    const now = Math.floor(Date.now() / 1000);
-    const timeStep = 30;
-    // Check current window and ±1 step for clock skew tolerance
-    for (const offset of [-1, 0, 1]) {
-        const counter = Math.floor((now + offset * timeStep) / timeStep);
-        const expected = await generateTotp(secret, counter);
-        if (timingSafeEqual(code, expected)) {
-            if (limiter)
-                await limiter.resetFailedAttempts(userId);
-            return true;
-        }
-    }
-    if (limiter)
-        await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
-    return false;
-}
-/**
- * Generate a TOTP code for a given counter value.
- * Uses HMAC-SHA1 per RFC 4226, with 6-digit output.
- * @param secretBase32 - Base32-encoded shared secret.
- * @param counter - HMAC counter value (typically `floor(time / 30)`).
- * @returns A 6-digit zero-padded TOTP code.
- */
-export async function generateTotp(secretBase32, counter) {
-    const keyBytes = base32Decode(secretBase32);
-    const counterBytes = new ArrayBuffer(8);
-    const view = new DataView(counterBytes);
-    view.setBigUint64(0, BigInt(counter));
-    const key = await crypto.subtle.importKey('raw', keyBytes.buffer, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
-    const hmac = await crypto.subtle.sign('HMAC', key, counterBytes);
-    const hmacArray = new Uint8Array(hmac);
-    // Dynamic truncation (RFC 4226 section 5.3)
-    const offset = hmacArray[hmacArray.length - 1] & 0x0f;
-    const binary = ((hmacArray[offset] & 0x7f) << 24) |
-        ((hmacArray[offset + 1] & 0xff) << 16) |
-        ((hmacArray[offset + 2] & 0xff) << 8) |
-        (hmacArray[offset + 3] & 0xff);
-    return (binary % 1000000).toString().padStart(6, '0');
-}
-/** Decode a base32-encoded string (RFC 4648, no padding required) */
-function base32Decode(input) {
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-    const clean = input.replace(/[= ]/g, '').toUpperCase();
-    const bits = [];
-    for (const char of clean) {
-        const val = alphabet.indexOf(char);
-        if (val === -1)
-            continue;
-        for (let i = 4; i >= 0; i--) {
-            bits.push((val >> i) & 1);
-        }
-    }
-    const bytes = new Uint8Array(Math.floor(bits.length / 8));
-    for (let i = 0; i < bytes.length; i++) {
-        let byte = 0;
-        for (let j = 0; j < 8; j++) {
-            byte = (byte << 1) | (bits[i * 8 + j] ?? 0);
-        }
-        bytes[i] = byte;
-    }
-    return bytes;
-}
-/** Constant-time string comparison to prevent timing attacks */
-function timingSafeEqual(a, b) {
-    const maxLen = Math.max(a.length, b.length);
-    let result = a.length ^ b.length; // length mismatch contributes to failure
-    for (let i = 0; i < maxLen; i++) {
-        result |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
-    }
-    return result === 0;
-}
-//# sourceMappingURL=totp.js.map

package/dist/server/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/server/totp.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC,CAAC,iDAAiD;AAEjG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,iBAAyB;QAC5C,KAAK,CAAC,iDAAiD,iBAAiB,GAAG,CAAC,CAAC;QAD1D,sBAAiB,GAAjB,iBAAiB,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAc,EACd,OAGC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC;IAEpB,4DAA4D;IAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAoB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,QAAQ,CAAC,MAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CACxF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC,4CAA4C;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;IACvD,MAAM,MAAM,GACV,CAAC,CAAC,SAAS,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;IAElC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,yCAAyC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}