@opensyber/tokenforge 0.1.0

package/dist/server/binding.d.ts

@@ -0,0 +1,19 @@
+import { Hono } from 'hono';
+import type { TokenForgeServerOptions } from '../shared/types.js';
+interface Variables {
+    userId: string;
+    sessionId: string;
+}
+/**
+ * TokenForge binding and session management routes.
+ * Mount at /api/tf on the main Hono app.
+ * @param options - Server options (storage, thresholds, callbacks).
+ * @returns A Hono sub-app with /bind, /sessions, /events, /trust-score routes.
+ */
+export declare function createTokenForgeRoutes(options: TokenForgeServerOptions): Hono<{
+    Variables: Variables;
+}>;
+/** @deprecated Use createTokenForgeRoutes(options) instead */
+export declare const tokenForgeRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=binding.d.ts.map

package/dist/server/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/server/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,uBAAuB,EAAiB,MAAM,oBAAoB,CAAC;AAEjF,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAsFvG;AAED,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,4EAAa,CAAC"}

package/dist/server/binding.js

@@ -0,0 +1,87 @@
+import { Hono } from 'hono';
+import { hashFingerprint } from './trust-score.js';
+/**
+ * TokenForge binding and session management routes.
+ * Mount at /api/tf on the main Hono app.
+ * @param options - Server options (storage, thresholds, callbacks).
+ * @returns A Hono sub-app with /bind, /sessions, /events, /trust-score routes.
+ */
+export function createTokenForgeRoutes(options) {
+    const tf = new Hono();
+    tf.post('/bind', async (c) => {
+        const userId = c.get('userId');
+        const sessionId = c.get('sessionId');
+        if (!userId || !sessionId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const body = await c.req.json();
+        if (body.sessionId !== sessionId)
+            return c.json({ error: 'session_mismatch' }, 400);
+        if (!body.publicKey?.kty || body.publicKey.kty !== 'EC' || body.publicKey.crv !== 'P-256') {
+            return c.json({ error: 'invalid_key_format' }, 400);
+        }
+        const deviceId = crypto.randomUUID().replace(/-/g, '');
+        const fingerprint = hashFingerprint(body.metadata?.userAgent || '');
+        const expiresAt = new Date(Date.now() + options.sessionMaxAge * 1000).toISOString();
+        const ipAddress = options.getIpAddress?.(c.req.raw) ?? c.req.header('cf-connecting-ip') ?? '';
+        const countryCode = options.getCountryCode?.(c.req.raw) ?? c.req.header('cf-ipcountry') ?? '';
+        await options.storage.revokeUserSessions(userId);
+        const session = {
+            id: deviceId, session_id: sessionId, user_id: userId,
+            public_key: JSON.stringify(body.publicKey),
+            device_fingerprint: fingerprint, ip_address: ipAddress,
+            country_code: countryCode, trust_score: 100,
+            bound_at: new Date().toISOString(), last_verified_at: new Date().toISOString(),
+            expires_at: expiresAt, revoked: 0, revoked_reason: null,
+            created_at: new Date().toISOString(),
+        };
+        await options.storage.createSession(session);
+        await options.storage.logEvent({
+            id: crypto.randomUUID(), sessionId, userId,
+            eventType: 'DEVICE_BOUND', trustScoreBefore: 0, trustScoreAfter: 100,
+            ipAddress, countryCode,
+            userAgent: options.getUserAgent?.(c.req.raw) ?? c.req.header('user-agent') ?? '',
+            metadata: { deviceId, fingerprint, metadata: body.metadata },
+        });
+        return c.json({ deviceId, expiresAt });
+    });
+    tf.get('/sessions', async (c) => {
+        const userId = c.get('userId');
+        if (!userId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const sessions = await options.storage.listUserSessions(userId, 20);
+        return c.json({ sessions });
+    });
+    tf.delete('/sessions/:id', async (c) => {
+        const userId = c.get('userId');
+        if (!userId)
+            return c.json({ error: 'unauthorized' }, 401);
+        await options.storage.revokeSession(c.req.param('id'), 'user_revoked');
+        return c.json({ revoked: true });
+    });
+    tf.get('/events', async (c) => {
+        const userId = c.get('userId');
+        if (!userId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const limit = parseInt(c.req.query('limit') || '50', 10);
+        const offset = parseInt(c.req.query('offset') || '0', 10);
+        const events = await options.storage.listEvents(userId, limit, offset);
+        return c.json({ events });
+    });
+    tf.get('/trust-score', async (c) => {
+        const userId = c.get('userId');
+        const sessionId = c.get('sessionId');
+        const deviceId = c.req.header('X-TF-Device-ID');
+        if (!userId)
+            return c.json({ error: 'unauthorized' }, 401);
+        if (!deviceId || !sessionId)
+            return c.json({ trustScore: 0, isBound: false, deviceId: null });
+        const session = await options.storage.getSession(sessionId, deviceId);
+        if (!session)
+            return c.json({ trustScore: 0, isBound: false, deviceId: null });
+        return c.json({ trustScore: session.trust_score, isBound: true, deviceId });
+    });
+    return tf;
+}
+/** @deprecated Use createTokenForgeRoutes(options) instead */
+export const tokenForgeRoutes = new Hono();
+//# sourceMappingURL=binding.js.map

package/dist/server/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/server/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,EAAE,GAAG,IAAI,IAAI,EAA4B,CAAC;IAEhD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAIzB,CAAC;QAEL,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAE9F,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;YACpD,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1C,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS;YACtD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG;YAC3C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9E,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI;YACvD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7C,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM;YAC1C,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG;YACpE,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;YAChF,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC7D,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,7 @@
+export { tokenForgeMiddleware } from './middleware.js';
+export type { TokenForgeOptions } from './middleware.js';
+export { createTokenForgeRoutes, tokenForgeRoutes } from './binding.js';
+export { createStepUpRoutes, stepUpRoutes } from './step-up.js';
+export { verifyTotp, generateTotp } from './totp.js';
+export type { TokenForgeStorage, StepUpChallengeRecord } from './storage/interface.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGrD,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,6 @@
+// Public API — shipped in the npm package
+export { tokenForgeMiddleware } from './middleware.js';
+export { createTokenForgeRoutes, tokenForgeRoutes } from './binding.js';
+export { createStepUpRoutes, stepUpRoutes } from './step-up.js';
+export { verifyTotp, generateTotp } from './totp.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/server/middleware.d.ts

@@ -0,0 +1,30 @@
+import type { MiddlewareHandler } from 'hono';
+/** Options for the TokenForge API-backed middleware. */
+export interface TokenForgeOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification (e.g. ['/health', '/public/*']). */
+    skipPaths?: string[];
+    /** Paths that require elevated trust (>90). */
+    sensitiveOps?: string[];
+    /** Trust score threshold to allow (default: 80). */
+    allowThreshold?: number;
+    /** Trust score threshold for step-up (default: 40). */
+    stepUpThreshold?: number;
+}
+/**
+ * TokenForge Hono middleware — verifies device-bound sessions via the
+ * TokenForge cloud API. All verification runs server-side on TokenForge
+ * infrastructure.
+ *
+ * @param options - API key and optional configuration.
+ * @returns Hono middleware handler.
+ */
+export declare function tokenForgeMiddleware(options: TokenForgeOptions): MiddlewareHandler;
+/** @internal */
+export declare function shouldSkip(path: string, skipPaths?: string[]): boolean;
+/** @internal */
+export declare function isSensitiveOp(path: string, method: string, sensitiveOps?: string[]): boolean;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/server/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAgFnB;AAED,gBAAgB;AAChB,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAMtE;AAED,gBAAgB;AAChB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAaT"}

package/dist/server/middleware.js

@@ -0,0 +1,107 @@
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * TokenForge Hono middleware — verifies device-bound sessions via the
+ * TokenForge cloud API. All verification runs server-side on TokenForge
+ * infrastructure.
+ *
+ * @param options - API key and optional configuration.
+ * @returns Hono middleware handler.
+ */
+export function tokenForgeMiddleware(options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    const allowThreshold = options.allowThreshold ?? 80;
+    const stepUpThreshold = options.stepUpThreshold ?? 40;
+    return async (c, next) => {
+        if (shouldSkip(c.req.path, options.skipPaths))
+            return next();
+        const headers = {
+            signature: c.req.header('X-TF-Signature') ?? null,
+            nonce: c.req.header('X-TF-Nonce') ?? null,
+            timestamp: c.req.header('X-TF-Timestamp') ?? null,
+            deviceId: c.req.header('X-TF-Device-ID') ?? null,
+        };
+        // Call TokenForge API for verification
+        const res = await fetch(`${apiBase}/v1/edge/verify`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${options.apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                path: c.req.path,
+                method: c.req.method,
+                headers,
+                ipAddress: c.req.header('cf-connecting-ip')
+                    ?? c.req.header('x-forwarded-for') ?? '',
+                countryCode: c.req.header('cf-ipcountry') ?? '',
+                userAgent: c.req.header('user-agent') ?? '',
+            }),
+        });
+        if (!res.ok) {
+            // API unreachable — degrade gracefully
+            console.error('[TokenForge] API error:', res.status);
+            c.set('tf', { bound: false, trustScore: 0, deviceId: null });
+            return next();
+        }
+        const { data } = (await res.json());
+        if (data.status === 'block') {
+            return c.json({
+                error: 'session_blocked',
+                reason: data.reason,
+                trustScore: data.trustScore,
+            }, 401);
+        }
+        if (data.status === 'step_up') {
+            if (isSensitiveOp(c.req.path, c.req.method, options.sensitiveOps)) {
+                return c.json({
+                    error: 'elevated_trust_required',
+                    action: 'step_up_required',
+                    trustScore: data.trustScore,
+                }, 403);
+            }
+            // Allow step-up range through for non-sensitive ops
+        }
+        if (isSensitiveOp(c.req.path, c.req.method, options.sensitiveOps)
+            && data.trustScore < 90) {
+            return c.json({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: data.trustScore,
+            }, 403);
+        }
+        c.set('tf', {
+            bound: data.bound,
+            trustScore: data.trustScore,
+            deviceId: data.deviceId,
+        });
+        await next();
+    };
+}
+/** @internal */
+export function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((pattern) => {
+        if (pattern.endsWith('*'))
+            return path.startsWith(pattern.slice(0, -1));
+        return path === pattern;
+    });
+}
+/** @internal */
+export function isSensitiveOp(path, method, sensitiveOps) {
+    if (!sensitiveOps)
+        return false;
+    const key = `${method} ${path}`;
+    return sensitiveOps.some((op) => {
+        if (op.includes('*')) {
+            const parts = op.split(' ');
+            const opMethod = parts[0];
+            const opPath = parts[1];
+            if (opMethod !== method || !opPath)
+                return false;
+            return new RegExp('^' + opPath.replace(/\*/g, '[^/]+') + '$').test(path);
+        }
+        return key === op;
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/server/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AA8BlE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAEtD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;SACjD,CAAC;QAEF,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;uBACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;gBAC1C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;gBAC/C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;aAC5C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,uCAAuC;YACvC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YACD,oDAAoD;QACtD,CAAC;QAED,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;eAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,EACvB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAoB;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,YAAuB;IAEvB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/step-up.d.ts

@@ -0,0 +1,19 @@
+import { Hono } from 'hono';
+import type { TokenForgeServerOptions } from '../shared/types.js';
+interface Variables {
+    userId: string;
+    sessionId: string;
+}
+/**
+ * Step-up authentication routes for TokenForge.
+ * Mount at /api/tf/step-up on the main Hono app.
+ * @param options - Server options (storage, email sender, passkey verifier).
+ * @returns A Hono sub-app with /initiate and /complete routes.
+ */
+export declare function createStepUpRoutes(options: TokenForgeServerOptions): Hono<{
+    Variables: Variables;
+}>;
+/** @deprecated Use createStepUpRoutes(options) instead */
+export declare const stepUpRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=step-up.d.ts.map

package/dist/server/step-up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.d.ts","sourceRoot":"","sources":["../../src/server/step-up.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAIlE,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,uBAAuB,GAC/B,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAiGhC;AA8DD,0DAA0D;AAC1D,eAAO,MAAM,YAAY,4EAAa,CAAC"}

package/dist/server/step-up.js

@@ -0,0 +1,139 @@
+import { Hono } from 'hono';
+import { verifyTotp } from './totp.js';
+const MAX_CHALLENGES_PER_WINDOW = 5;
+const CHALLENGE_WINDOW_MINUTES = 15;
+const CHALLENGE_TTL_SECONDS = 300; // 5 minutes
+/**
+ * Step-up authentication routes for TokenForge.
+ * Mount at /api/tf/step-up on the main Hono app.
+ * @param options - Server options (storage, email sender, passkey verifier).
+ * @returns A Hono sub-app with /initiate and /complete routes.
+ */
+export function createStepUpRoutes(options) {
+    const stepUp = new Hono();
+    stepUp.post('/initiate', async (c) => {
+        const userId = c.get('userId');
+        const sessionId = c.get('sessionId');
+        if (!userId || !sessionId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const count = await options.storage.countRecentChallenges(userId, CHALLENGE_WINDOW_MINUTES);
+        if (count >= MAX_CHALLENGES_PER_WINDOW) {
+            return c.json({ error: 'rate_limited', message: 'Too many step-up attempts. Try again later.' }, 429);
+        }
+        const { method } = await c.req.json();
+        const challengeMethod = (method || 'totp');
+        const challengeId = crypto.randomUUID();
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + CHALLENGE_TTL_SECONDS * 1000).toISOString();
+        const challenge = {
+            id: challengeId, sessionId, userId,
+            reason: 'trust_score_drop', method: challengeMethod,
+            status: 'pending', expiresAt,
+            createdAt: now.toISOString(), completedAt: null,
+        };
+        await options.storage.createChallenge(challenge);
+        if (challengeMethod === 'email_otp') {
+            const otp = generateOtp();
+            await options.storage.storeOtp(challengeId, otp, CHALLENGE_TTL_SECONDS);
+            if (options.sendEmail) {
+                await options.sendEmail(userId, otp);
+            }
+            else {
+                throw new Error('sendEmail handler not configured — cannot deliver OTP');
+            }
+        }
+        if (challengeMethod === 'passkey') {
+            // Generate WebAuthn challenge and return it
+            const webauthnChallenge = generateWebAuthnChallenge();
+            return c.json({ challengeId, method: challengeMethod, expiresAt, webauthnChallenge });
+        }
+        return c.json({ challengeId, method: challengeMethod, expiresAt });
+    });
+    stepUp.post('/complete', async (c) => {
+        const userId = c.get('userId');
+        if (!userId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const { challengeId, code, credential } = await c.req.json();
+        const challenge = await options.storage.getChallenge(challengeId, userId);
+        if (!challenge)
+            return c.json({ error: 'invalid_challenge' }, 400);
+        if (new Date(challenge.expiresAt) < new Date()) {
+            await options.storage.updateChallengeStatus(challengeId, 'expired');
+            return c.json({ error: 'challenge_expired' }, 400);
+        }
+        let verified = false;
+        if (challenge.method === 'email_otp') {
+            const storedOtp = await options.storage.getOtp(challengeId);
+            verified = storedOtp !== null && storedOtp === code;
+            if (verified)
+                await options.storage.deleteOtp(challengeId);
+        }
+        else if (challenge.method === 'totp' && code) {
+            verified = await verifyTotp(code, userId, options);
+        }
+        else if (challenge.method === 'passkey' && credential) {
+            const storedKey = options.getPasskeyPublicKey
+                ? await options.getPasskeyPublicKey(userId, credential.id)
+                : null;
+            if (storedKey) {
+                verified = await verifyPasskeyCredential(credential, storedKey, challengeId);
+            }
+        }
+        if (!verified) {
+            await options.storage.updateChallengeStatus(challengeId, 'failed');
+            return c.json({ error: 'verification_failed' }, 401);
+        }
+        await options.storage.updateChallengeStatus(challengeId, 'completed', new Date().toISOString());
+        const deviceId = c.req.header('X-TF-Device-ID');
+        if (deviceId) {
+            await options.storage.restoreTrust(deviceId, userId);
+        }
+        return c.json({ verified: true, trustScore: 100 });
+    });
+    return stepUp;
+}
+/** Generate a 6-digit OTP using CSPRNG */
+function generateOtp() {
+    const randomBytes = new Uint32Array(1);
+    crypto.getRandomValues(randomBytes);
+    return ((randomBytes[0] % 900000) + 100000).toString();
+}
+/** Generate a WebAuthn challenge (32 random bytes, base64url encoded) */
+function generateWebAuthnChallenge() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Verify a WebAuthn passkey credential against the stored public key.
+ * Uses ECDSA P-256 signature verification via Web Crypto API.
+ */
+async function verifyPasskeyCredential(credential, publicKeySpki, expectedChallenge) {
+    try {
+        if (!credential.id || !credential.response?.signature || !credential.response?.authenticatorData) {
+            return false;
+        }
+        const clientDataJSON = atob(credential.response.clientDataJSON);
+        const clientData = JSON.parse(clientDataJSON);
+        if (clientData.type !== 'webauthn.get')
+            return false;
+        const decodedChallenge = atob(clientData.challenge?.replace(/-/g, '+').replace(/_/g, '/') ?? '');
+        if (decodedChallenge !== expectedChallenge)
+            return false;
+        const key = await crypto.subtle.importKey('spki', publicKeySpki, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+        const authData = Uint8Array.from(atob(credential.response.authenticatorData), (ch) => ch.charCodeAt(0));
+        const clientDataHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(clientDataJSON));
+        const signedData = new Uint8Array(authData.length + clientDataHash.byteLength);
+        signedData.set(authData, 0);
+        signedData.set(new Uint8Array(clientDataHash), authData.length);
+        const sigBytes = Uint8Array.from(atob(credential.response.signature), (ch) => ch.charCodeAt(0));
+        return await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, sigBytes, signedData);
+    }
+    catch {
+        return false;
+    }
+}
+/** @deprecated Use createStepUpRoutes(options) instead */
+export const stepUpRoutes = new Hono();
+//# sourceMappingURL=step-up.js.map

package/dist/server/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../src/server/step-up.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,IAAI,EAA4B,CAAC;IAEpD,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC5F,IAAI,KAAK,IAAI,yBAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAuB,CAAC;QAC3D,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,MAAM,CAAqC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvF,MAAM,SAAS,GAA0B;YACvC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;YAClC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;YACnD,MAAM,EAAE,SAAS,EAAE,SAAS;YAC5B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI;SAChD,CAAC;QACF,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,yBAAyB,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAItD,CAAC;QAEL,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAiC,CAAC;QAC1G,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAEnE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,QAAQ,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;YACpD,IAAI,QAAQ;gBAAE,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;YAC/C,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB;gBAC3C,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAEhG,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0CAA0C;AAC1C,SAAS,WAAW;IAClB,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,yEAAyE;AACzE,SAAS,yBAAyB;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAQD;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAA8B,EAC9B,aAA0B,EAC1B,iBAAyB;IAEzB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAA0C,CAAC;QACvF,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QAErD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,IAAI,gBAAgB,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAEzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EAAE,aAAa,EACrB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC/E,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC"}

package/dist/server/storage/index.d.ts

@@ -0,0 +1,3 @@
+export type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
+export { MemoryStorage } from './memory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/index.js

@@ -0,0 +1,2 @@
+export { MemoryStorage } from './memory.js';
+//# sourceMappingURL=index.js.map

package/dist/server/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/interface.d.ts

@@ -0,0 +1,61 @@
+import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
+/**
+ * Storage interface for TokenForge server.
+ * Implement this to use any database/cache backend.
+ */
+export interface TokenForgeStorage {
+    /** Find an active (non-revoked) session by sessionId + deviceId */
+    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
+    /** Create a new device session */
+    createSession(session: DeviceSession): Promise<void>;
+    /** Update trust score and last_verified_at for a session */
+    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    /** Mark a session as revoked */
+    revokeSession(deviceId: string, reason: string): Promise<void>;
+    /** Revoke all sessions for a user (called before re-binding) */
+    revokeUserSessions(userId: string): Promise<void>;
+    /** List a user's sessions (most recent first) */
+    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
+    /** Restore trust score to 100 after step-up */
+    restoreTrust(deviceId: string, userId: string): Promise<void>;
+    /** Check if nonce has been used */
+    hasNonce(nonce: string): Promise<boolean>;
+    /** Store a used nonce with TTL in seconds */
+    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
+    /** Insert a security event record */
+    logEvent(event: SecurityEvent & {
+        id: string;
+    }): Promise<void>;
+    /** List security events for a user (for dashboard) */
+    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[]>;
+    /** Create a step-up challenge */
+    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
+    /** Get a pending challenge by ID + userId */
+    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
+    /** Update challenge status */
+    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
+    /** Count recent challenges for rate limiting */
+    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    /** Store OTP code for a challenge with TTL */
+    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
+    /** Retrieve and consume OTP code */
+    getOtp(challengeId: string): Promise<string | null>;
+    /** Delete OTP after verification */
+    deleteOtp(challengeId: string): Promise<void>;
+}
+/** Step-up challenge stored in database */
+export interface StepUpChallengeRecord {
+    id: string;
+    sessionId: string;
+    userId: string;
+    reason: string;
+    method: 'totp' | 'email_otp' | 'passkey';
+    status: 'pending' | 'completed' | 'expired' | 'failed';
+    expiresAt: string;
+    createdAt: string;
+    completedAt: string | null;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/server/storage/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../../src/server/storage/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAEhC,mEAAmE;IACnE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,kCAAkC;IAClC,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,gCAAgC;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,gEAAgE;IAChE,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iDAAiD;IACjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,+CAA+C;IAC/C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9D,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,6CAA6C;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7D,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,sDAAsD;IACtD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAG3H,iCAAiC;IACjC,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,6CAA6C;IAC7C,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF,8BAA8B;IAC9B,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,gDAAgD;IAChD,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG9E,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,oCAAoC;IACpC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,oCAAoC;IACpC,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/server/storage/interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=interface.js.map

package/dist/server/storage/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../../src/server/storage/interface.ts"],"names":[],"mappings":""}

package/dist/server/storage/memory.d.ts

@@ -0,0 +1,40 @@
+import type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
+import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
+/**
+ * In-memory storage for testing and development.
+ * Not suitable for production — data is lost on restart.
+ */
+export declare class MemoryStorage implements TokenForgeStorage {
+    sessions: DeviceSession[];
+    events: (SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[];
+    challenges: StepUpChallengeRecord[];
+    private nonces;
+    private otps;
+    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
+    createSession(session: DeviceSession): Promise<void>;
+    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    revokeSession(deviceId: string, reason: string): Promise<void>;
+    revokeUserSessions(userId: string): Promise<void>;
+    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
+    restoreTrust(deviceId: string, userId: string): Promise<void>;
+    hasNonce(nonce: string): Promise<boolean>;
+    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
+    logEvent(event: SecurityEvent & {
+        id: string;
+    }): Promise<void>;
+    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[]>;
+    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
+    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
+    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
+    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
+    getOtp(challengeId: string): Promise<string | null>;
+    deleteOtp(challengeId: string): Promise<void>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/server/storage/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/server/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,aAAc,YAAW,iBAAiB;IACrD,QAAQ,EAAE,aAAa,EAAE,CAAM;IAC/B,MAAM,EAAE,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAM;IACpE,UAAU,EAAE,qBAAqB,EAAE,CAAM;IACzC,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,IAAI,CAA0D;IAEhE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAM9E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOzE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAO1H,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAMxF,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO7E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}