@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/server/step-up-policy.js

@@ -0,0 +1,101 @@
+/**
+ * Per-action step-up policy (Sprint 39).
+ *
+ * Tenant-scoped JSON config describing which routes require fresh PoP
+ * (a recent action-signing JWS) vs WebAuthn re-prompt vs nothing
+ * special. Will eventually live on `tf_tenants.stepUpActions` (per
+ * CISCO-dua spec) — schema migration pending. The pure logic here
+ * is independent of where the actions blob is stored.
+ *
+ * Shape (validated by `parseStepUpActions`):
+ *   [
+ *     { path: '/checkout',  requireFreshSig: true,  freshSigMaxAgeSec: 60 },
+ *     { path: '/admin/*',   requireFreshSig: true,  freshSigMaxAgeSec: 30, requireWebAuthn: true },
+ *     { path: '/health',    requireFreshSig: false, requireWebAuthn: false }
+ *   ]
+ *
+ * Matching rules:
+ *   - exact path match wins over glob-prefix
+ *   - longest glob-prefix wins among prefix-matches
+ *   - no match → default verdict (no step-up, no WebAuthn, default 60s)
+ */
+const DEFAULT_FRESH_SIG_MAX_AGE_SEC = 60;
+const MAX_ACTIONS = 50;
+const MIN_FRESH_SIG_SEC = 5;
+const MAX_FRESH_SIG_SEC = 600;
+const DEFAULT_VERDICT = {
+    matched: false,
+    requireFreshSig: false,
+    freshSigMaxAgeSec: DEFAULT_FRESH_SIG_MAX_AGE_SEC,
+    requireWebAuthn: false,
+};
+export function parseStepUpActions(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(parsed))
+        return null;
+    if (parsed.length > MAX_ACTIONS)
+        return null;
+    const actions = [];
+    for (const candidate of parsed) {
+        if (!candidate || typeof candidate !== 'object')
+            return null;
+        const c = candidate;
+        if (typeof c.path !== 'string' || c.path.length === 0 || c.path.length > 256)
+            return null;
+        const action = { path: c.path };
+        if (c.requireFreshSig !== undefined) {
+            if (typeof c.requireFreshSig !== 'boolean')
+                return null;
+            action.requireFreshSig = c.requireFreshSig;
+        }
+        if (c.freshSigMaxAgeSec !== undefined) {
+            if (typeof c.freshSigMaxAgeSec !== 'number' || !Number.isInteger(c.freshSigMaxAgeSec))
+                return null;
+            if (c.freshSigMaxAgeSec < MIN_FRESH_SIG_SEC || c.freshSigMaxAgeSec > MAX_FRESH_SIG_SEC)
+                return null;
+            action.freshSigMaxAgeSec = c.freshSigMaxAgeSec;
+        }
+        if (c.requireWebAuthn !== undefined) {
+            if (typeof c.requireWebAuthn !== 'boolean')
+                return null;
+            action.requireWebAuthn = c.requireWebAuthn;
+        }
+        actions.push(action);
+    }
+    return actions;
+}
+export function evaluateStepUpPolicy(actions, requestPath) {
+    // Exact match wins outright.
+    for (const a of actions) {
+        if (!a.path.endsWith('*') && a.path === requestPath)
+            return verdictFrom(a, true);
+    }
+    // Otherwise, longest matching glob-prefix wins.
+    let best = null;
+    let bestLen = -1;
+    for (const a of actions) {
+        if (!a.path.endsWith('*'))
+            continue;
+        const prefix = a.path.slice(0, -1);
+        if (requestPath.startsWith(prefix) && prefix.length > bestLen) {
+            best = a;
+            bestLen = prefix.length;
+        }
+    }
+    return best ? verdictFrom(best, true) : DEFAULT_VERDICT;
+}
+function verdictFrom(a, matched) {
+    return {
+        matched,
+        requireFreshSig: a.requireFreshSig ?? false,
+        freshSigMaxAgeSec: a.freshSigMaxAgeSec ?? DEFAULT_FRESH_SIG_MAX_AGE_SEC,
+        requireWebAuthn: a.requireWebAuthn ?? false,
+    };
+}
+//# sourceMappingURL=step-up-policy.js.map

package/dist/server/step-up-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-policy.js","sourceRoot":"../src/","sources":["server/step-up-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,eAAe,GAAkB;IACrC,OAAO,EAAE,KAAK;IACd,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,6BAA6B;IAChD,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,CAAC,GAAG,SAAoC,CAAC;QAC/C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,CAAC,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,GAAG,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACpG,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAChC,WAAmB;IAEnB,6BAA6B;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,gDAAgD;IAChD,IAAI,IAAI,GAAwB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,CAAC;YACT,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,CAAe,EAAE,OAAgB;IACpD,OAAO;QACL,OAAO;QACP,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,KAAK;QAC3C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,6BAA6B;QACvE,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,KAAK;KAC5C,CAAC;AACJ,CAAC"}

package/dist/server/storage/index.d.ts

@@ -0,0 +1,3 @@
+export type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
+export { MemoryStorage } from './memory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"../src/","sources":["server/storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/index.js

@@ -0,0 +1,2 @@
+export { MemoryStorage } from './memory.js';
+//# sourceMappingURL=index.js.map

package/dist/server/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"../src/","sources":["server/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/storage/interface.d.ts

@@ -0,0 +1,73 @@
+import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
+/**
+ * Storage interface for TokenForge server.
+ * Implement this to use any database/cache backend.
+ */
+export interface TokenForgeStorage {
+    /** Find an active (non-revoked) session by sessionId + deviceId */
+    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
+    /** Create a new device session */
+    createSession(session: DeviceSession): Promise<void>;
+    /** Update trust score and last_verified_at for a session */
+    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    /** Store the DBSC bound cookie hash + expiry for a device session */
+    updateBoundCookieHash(deviceId: string, hash: string, expiresAt: string): Promise<void>;
+    /** Mark a session as revoked */
+    revokeSession(deviceId: string, reason: string): Promise<void>;
+    /** Revoke all sessions for a user (called before re-binding) */
+    revokeUserSessions(userId: string): Promise<void>;
+    /** List a user's sessions (most recent first) */
+    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
+    /** Restore trust score to 100 after step-up */
+    restoreTrust(deviceId: string, userId: string): Promise<void>;
+    /** Check if nonce has been used */
+    hasNonce(nonce: string): Promise<boolean>;
+    /** Store a used nonce with TTL in seconds */
+    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
+    /** Insert a security event record */
+    logEvent(event: SecurityEvent & {
+        id: string;
+    }): Promise<void>;
+    /** List security events for a user (for dashboard) */
+    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[]>;
+    /** Create a step-up challenge */
+    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
+    /** Get a pending challenge by ID + userId */
+    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
+    /** Update challenge status */
+    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
+    /** Count recent challenges for rate limiting */
+    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    /** Retrieve the activity histogram for a user (null if none stored). */
+    getActivityHistogram(userId: string): Promise<{
+        buckets: number[];
+        totalRequests: number;
+    } | null>;
+    /** Store the updated activity histogram for a user. */
+    setActivityHistogram(userId: string, histogram: {
+        buckets: number[];
+        totalRequests: number;
+    }): Promise<void>;
+    /** Store OTP code for a challenge with TTL */
+    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
+    /** Retrieve and consume OTP code */
+    getOtp(challengeId: string): Promise<string | null>;
+    /** Delete OTP after verification */
+    deleteOtp(challengeId: string): Promise<void>;
+}
+/** Step-up challenge stored in database */
+export interface StepUpChallengeRecord {
+    id: string;
+    sessionId: string;
+    userId: string;
+    reason: string;
+    method: 'totp' | 'email_otp' | 'passkey';
+    status: 'pending' | 'completed' | 'expired' | 'failed';
+    expiresAt: string;
+    createdAt: string;
+    completedAt: string | null;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/server/storage/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"../src/","sources":["server/storage/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAEhC,mEAAmE;IACnE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,kCAAkC;IAClC,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,qEAAqE;IACrE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,gCAAgC;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,gEAAgE;IAChE,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iDAAiD;IACjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,+CAA+C;IAC/C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9D,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,6CAA6C;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7D,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,sDAAsD;IACtD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAG3H,iCAAiC;IACjC,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,6CAA6C;IAC7C,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF,8BAA8B;IAC9B,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,gDAAgD;IAChD,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG9E,wEAAwE;IACxE,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnG,uDAAuD;IACvD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7G,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,oCAAoC;IACpC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,oCAAoC;IACpC,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/server/storage/interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=interface.js.map

package/dist/server/storage/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"../src/","sources":["server/storage/interface.ts"],"names":[],"mappings":""}

package/dist/server/storage/memory.d.ts

@@ -0,0 +1,50 @@
+import type { TokenForgeStorage, StepUpChallengeRecord } from './interface.js';
+import type { DeviceSession, SecurityEvent } from '../../shared/types.js';
+/**
+ * In-memory storage for testing and development.
+ * Not suitable for production — data is lost on restart.
+ */
+export declare class MemoryStorage implements TokenForgeStorage {
+    sessions: DeviceSession[];
+    events: (SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[];
+    challenges: StepUpChallengeRecord[];
+    private nonces;
+    private otps;
+    private histograms;
+    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
+    createSession(session: DeviceSession): Promise<void>;
+    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    updateBoundCookieHash(deviceId: string, hash: string, expiresAt: string): Promise<void>;
+    revokeSession(deviceId: string, reason: string): Promise<void>;
+    revokeUserSessions(userId: string): Promise<void>;
+    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
+    restoreTrust(deviceId: string, userId: string): Promise<void>;
+    hasNonce(nonce: string): Promise<boolean>;
+    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
+    logEvent(event: SecurityEvent & {
+        id: string;
+    }): Promise<void>;
+    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[]>;
+    createChallenge(challenge: StepUpChallengeRecord): Promise<void>;
+    getChallenge(challengeId: string, userId: string): Promise<StepUpChallengeRecord | null>;
+    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
+    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    getActivityHistogram(userId: string): Promise<{
+        buckets: number[];
+        totalRequests: number;
+    } | null>;
+    setActivityHistogram(userId: string, histogram: {
+        buckets: number[];
+        totalRequests: number;
+    }): Promise<void>;
+    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
+    getOtp(challengeId: string): Promise<string | null>;
+    deleteOtp(challengeId: string): Promise<void>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/server/storage/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"../src/","sources":["server/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,aAAc,YAAW,iBAAiB;IACrD,QAAQ,EAAE,aAAa,EAAE,CAAM;IAC/B,MAAM,EAAE,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAM;IACpE,UAAU,EAAE,qBAAqB,EAAE,CAAM;IACzC,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,IAAI,CAA0D;IACtE,OAAO,CAAC,UAAU,CAAmE;IAE/E,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAM9E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOzE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAO1H,eAAe,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAMxF,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO7E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAIlG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5G,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}

package/dist/server/storage/memory.js

@@ -0,0 +1,121 @@
+/**
+ * In-memory storage for testing and development.
+ * Not suitable for production — data is lost on restart.
+ */
+export class MemoryStorage {
+    sessions = [];
+    events = [];
+    challenges = [];
+    nonces = new Map(); // nonce → expiry timestamp
+    otps = new Map();
+    histograms = new Map();
+    async getSession(sessionId, deviceId) {
+        return this.sessions.find((s) => s.session_id === sessionId && s.id === deviceId && s.revoked === 0) ?? null;
+    }
+    async createSession(session) {
+        this.sessions.push({ ...session });
+    }
+    async updateTrustScore(deviceId, trustScore) {
+        const s = this.sessions.find((s) => s.id === deviceId);
+        if (s) {
+            s.trust_score = trustScore;
+            s.last_verified_at = new Date().toISOString();
+        }
+    }
+    async updateBoundCookieHash(deviceId, hash, expiresAt) {
+        const s = this.sessions.find((s) => s.id === deviceId);
+        if (s) {
+            s.bound_cookie_hash = hash;
+            s.bound_cookie_expires_at = expiresAt;
+        }
+    }
+    async revokeSession(deviceId, reason) {
+        const s = this.sessions.find((s) => s.id === deviceId);
+        if (s) {
+            s.revoked = 1;
+            s.revoked_reason = reason;
+        }
+    }
+    async revokeUserSessions(userId) {
+        for (const s of this.sessions) {
+            if (s.user_id === userId && s.revoked === 0) {
+                s.revoked = 1;
+                s.revoked_reason = 'rebind';
+            }
+        }
+    }
+    async listUserSessions(userId, limit) {
+        return this.sessions
+            .filter((s) => s.user_id === userId)
+            .sort((a, b) => b.bound_at.localeCompare(a.bound_at))
+            .slice(0, limit);
+    }
+    async restoreTrust(deviceId, userId) {
+        const s = this.sessions.find((s) => s.id === deviceId && s.user_id === userId);
+        if (s)
+            s.trust_score = 100;
+    }
+    async hasNonce(nonce) {
+        const expiry = this.nonces.get(nonce);
+        if (!expiry)
+            return false;
+        if (Date.now() > expiry) {
+            this.nonces.delete(nonce);
+            return false;
+        }
+        return true;
+    }
+    async storeNonce(nonce, ttlSeconds) {
+        this.nonces.set(nonce, Date.now() + ttlSeconds * 1000);
+    }
+    async logEvent(event) {
+        this.events.push({ ...event, created_at: new Date().toISOString() });
+    }
+    async listEvents(userId, limit, offset) {
+        return this.events
+            .filter((e) => e.userId === userId)
+            .sort((a, b) => b.created_at.localeCompare(a.created_at))
+            .slice(offset, offset + limit);
+    }
+    async createChallenge(challenge) {
+        this.challenges.push({ ...challenge });
+    }
+    async getChallenge(challengeId, userId) {
+        return this.challenges.find((c) => c.id === challengeId && c.userId === userId && c.status === 'pending') ?? null;
+    }
+    async updateChallengeStatus(challengeId, status, completedAt) {
+        const c = this.challenges.find((c) => c.id === challengeId);
+        if (c) {
+            c.status = status;
+            if (completedAt)
+                c.completedAt = completedAt;
+        }
+    }
+    async countRecentChallenges(userId, windowMinutes) {
+        const cutoff = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
+        return this.challenges.filter((c) => c.userId === userId && c.createdAt > cutoff).length;
+    }
+    async getActivityHistogram(userId) {
+        return this.histograms.get(`tf:activity:${userId}`) ?? null;
+    }
+    async setActivityHistogram(userId, histogram) {
+        this.histograms.set(`tf:activity:${userId}`, { ...histogram, buckets: [...histogram.buckets] });
+    }
+    async storeOtp(challengeId, code, ttlSeconds) {
+        this.otps.set(challengeId, { code, expiresAt: Date.now() + ttlSeconds * 1000 });
+    }
+    async getOtp(challengeId) {
+        const entry = this.otps.get(challengeId);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.otps.delete(challengeId);
+            return null;
+        }
+        return entry.code;
+    }
+    async deleteOtp(challengeId) {
+        this.otps.delete(challengeId);
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/server/storage/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"../src/","sources":["server/storage/memory.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,aAAa;IACxB,QAAQ,GAAoB,EAAE,CAAC;IAC/B,MAAM,GAA2D,EAAE,CAAC;IACpE,UAAU,GAA4B,EAAE,CAAC;IACjC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,2BAA2B;IAC/D,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC9D,UAAU,GAAG,IAAI,GAAG,EAAwD,CAAC;IAErF,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAC1E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,IAAY,EAAE,SAAiB;QAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,cAAc,GAAG,QAAQ,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAa;QAClD,OAAO,IAAI,CAAC,QAAQ;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACpD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,CAAC;YAAE,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,UAAkB;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAqC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;QAC5D,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACxD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAgC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAc;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAC7E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,MAAc,EAAE,WAAoB;QACnF,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,MAAM,GAAG,MAAyC,CAAC;YACrD,IAAI,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,CACnD,CAAC,MAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,SAAuD;QAChG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,IAAY,EAAE,UAAkB;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/server/webauthn-verify.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Server-side WebAuthn verifier — runs in Cloudflare Workers (Web Crypto only).
+ *
+ * Limitations (intentional, documented):
+ *  - We use attestation: 'none' on the client, so attestation statement
+ *    verification is skipped (only the authData → COSE_Key extraction matters).
+ *  - Only ES256 (alg -7, ECDSA P-256) keys are accepted on the server. EdDSA
+ *    is offered to the client for forward-compat but Web Crypto support is
+ *    spotty in Workers; reject EdDSA at verify time with a clear error.
+ *  - Counter check is not enforced here. Callers can read the 4-byte counter
+ *    out of authenticatorData[33..37] if they want to persist + compare.
+ */
+export interface AttestationVerifyResult {
+    publicKeyJwk: JsonWebKey;
+    credentialId: Uint8Array;
+    rpIdHash: Uint8Array;
+}
+/** base64url → ArrayBuffer */
+export declare function b64uToBuf(b64url: string): ArrayBuffer;
+/** Uint8Array → base64url (no padding). */
+export declare function bufToB64u(buf: ArrayBuffer | Uint8Array): string;
+/** Parse clientDataJSON and verify challenge + origin. */
+export declare function verifyClientDataJSON(clientDataJSON: string, expectedChallenge: string, expectedOrigin: string, expectedType: 'webauthn.create' | 'webauthn.get'): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify a WebAuthn attestation (registration). Returns the extracted
+ * public key as JWK plus the credentialId for persistence.
+ */
+export declare function verifyWebAuthnAttestation(attestationObjectB64u: string, clientDataJSONB64u: string, expectedChallenge: string, expectedOrigin: string): Promise<AttestationVerifyResult>;
+/**
+ * Verify a WebAuthn assertion. The signature is over
+ * (authenticatorData || sha256(clientDataJSON)).
+ */
+export declare function verifyWebAuthnAssertion(signatureB64u: string, authenticatorDataB64u: string, clientDataJSONB64u: string, publicKeyJwk: JsonWebKey, expectedChallenge: string, expectedOrigin: string): Promise<boolean>;
+/** WebAuthn ECDSA sigs are DER-encoded; Web Crypto wants raw r||s. */
+export declare function derToRawEcdsa(der: Uint8Array): Uint8Array;
+//# sourceMappingURL=webauthn-verify.d.ts.map

package/dist/server/webauthn-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.d.ts","sourceRoot":"../src/","sources":["server/webauthn-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,8BAA8B;AAC9B,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAOrD;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK/D;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,iBAAiB,GAAG,cAAc,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAWlC;AAiCD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,UAAU,EACxB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CA4BlB;AASD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAuBzD"}

package/dist/server/webauthn-verify.js

@@ -0,0 +1,175 @@
+/**
+ * Server-side WebAuthn verifier — runs in Cloudflare Workers (Web Crypto only).
+ *
+ * Limitations (intentional, documented):
+ *  - We use attestation: 'none' on the client, so attestation statement
+ *    verification is skipped (only the authData → COSE_Key extraction matters).
+ *  - Only ES256 (alg -7, ECDSA P-256) keys are accepted on the server. EdDSA
+ *    is offered to the client for forward-compat but Web Crypto support is
+ *    spotty in Workers; reject EdDSA at verify time with a clear error.
+ *  - Counter check is not enforced here. Callers can read the 4-byte counter
+ *    out of authenticatorData[33..37] if they want to persist + compare.
+ */
+import { decodeCbor } from './cbor.js';
+/** base64url → ArrayBuffer */
+export function b64uToBuf(b64url) {
+    const base64 = b64url.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes.buffer;
+}
+/** Uint8Array → base64url (no padding). */
+export function bufToB64u(buf) {
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+/** Parse clientDataJSON and verify challenge + origin. */
+export function verifyClientDataJSON(clientDataJSON, expectedChallenge, expectedOrigin, expectedType) {
+    let json;
+    try {
+        const text = new TextDecoder().decode(b64uToBuf(clientDataJSON));
+        json = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: 'clientDataJSON malformed' };
+    }
+    if (json.type !== expectedType)
+        return { ok: false, reason: `type mismatch: ${json.type}` };
+    if (json.challenge !== expectedChallenge)
+        return { ok: false, reason: 'challenge mismatch' };
+    if (json.origin !== expectedOrigin)
+        return { ok: false, reason: `origin mismatch: ${json.origin}` };
+    return { ok: true };
+}
+/**
+ * Verify a WebAuthn attestation (registration). Returns the extracted
+ * public key as JWK plus the credentialId for persistence.
+ */
+export async function verifyWebAuthnAttestation(attestationObjectB64u, clientDataJSONB64u, expectedChallenge, expectedOrigin) {
+    const cd = verifyClientDataJSON(clientDataJSONB64u, expectedChallenge, expectedOrigin, 'webauthn.create');
+    if (!cd.ok)
+        throw new Error(`webauthn.create: ${cd.reason}`);
+    const attBuf = new Uint8Array(b64uToBuf(attestationObjectB64u));
+    const decoded = decodeCbor(attBuf);
+    if (!(decoded instanceof Map))
+        throw new Error('attestationObject: not a CBOR map');
+    const authData = decoded.get('authData');
+    if (!(authData instanceof Uint8Array))
+        throw new Error('attestationObject: authData missing');
+    return parseAuthDataAttestedCredential(authData);
+}
+/** Pull rpIdHash + credentialId + COSE_Key out of attested authData. */
+function parseAuthDataAttestedCredential(authData) {
+    if (authData.length < 37 + 18)
+        throw new Error('authData too short for attested credential');
+    const rpIdHash = authData.slice(0, 32);
+    const flags = authData[32] ?? 0;
+    if ((flags & 0x40) === 0)
+        throw new Error('authData: AT (attested credential) flag not set');
+    // skip signCount (4 bytes), aaguid (16 bytes)
+    let p = 37 + 16;
+    const credIdLen = ((authData[p] ?? 0) << 8) | (authData[p + 1] ?? 0);
+    p += 2;
+    const credentialId = authData.slice(p, p + credIdLen);
+    p += credIdLen;
+    const cosePublicKey = decodeCbor(authData.slice(p));
+    return { publicKeyJwk: coseToJwk(cosePublicKey), credentialId, rpIdHash };
+}
+/** Convert a COSE_Key (CBOR map) → JWK. ES256 only. */
+function coseToJwk(cose) {
+    if (!(cose instanceof Map))
+        throw new Error('COSE_Key: not a map');
+    const kty = cose.get(1);
+    const alg = cose.get(3);
+    if (kty !== 2)
+        throw new Error(`COSE_Key kty=${String(kty)} unsupported (need EC2)`);
+    if (alg !== -7)
+        throw new Error(`COSE_Key alg=${String(alg)} unsupported (need ES256/-7)`);
+    const x = cose.get(-2);
+    const y = cose.get(-3);
+    if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array)) {
+        throw new Error('COSE_Key: x/y missing');
+    }
+    return { kty: 'EC', crv: 'P-256', x: bufToB64u(x), y: bufToB64u(y) };
+}
+/**
+ * Verify a WebAuthn assertion. The signature is over
+ * (authenticatorData || sha256(clientDataJSON)).
+ */
+export async function verifyWebAuthnAssertion(signatureB64u, authenticatorDataB64u, clientDataJSONB64u, publicKeyJwk, expectedChallenge, expectedOrigin) {
+    const cd = verifyClientDataJSON(clientDataJSONB64u, expectedChallenge, expectedOrigin, 'webauthn.get');
+    if (!cd.ok)
+        return false;
+    const authData = new Uint8Array(b64uToBuf(authenticatorDataB64u));
+    const clientDataBuf = new Uint8Array(b64uToBuf(clientDataJSONB64u));
+    const clientDataHash = new Uint8Array(await crypto.subtle.digest('SHA-256', clientDataBuf));
+    const signed = new Uint8Array(authData.length + clientDataHash.length);
+    signed.set(authData, 0);
+    signed.set(clientDataHash, authData.length);
+    const key = await crypto.subtle.importKey('jwk', publicKeyJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    const sigDer = new Uint8Array(b64uToBuf(signatureB64u));
+    let sigRaw;
+    try {
+        sigRaw = derToRawEcdsa(sigDer);
+    }
+    catch {
+        return false;
+    }
+    try {
+        return await crypto.subtle.verify({ name: 'ECDSA', hash: { name: 'SHA-256' } }, key, copyToArrayBuffer(sigRaw), copyToArrayBuffer(signed));
+    }
+    catch {
+        return false;
+    }
+}
+/** Copy a Uint8Array into a freshly allocated ArrayBuffer (escapes SharedArrayBuffer typing). */
+function copyToArrayBuffer(src) {
+    const out = new ArrayBuffer(src.byteLength);
+    new Uint8Array(out).set(src);
+    return out;
+}
+/** WebAuthn ECDSA sigs are DER-encoded; Web Crypto wants raw r||s. */
+export function derToRawEcdsa(der) {
+    // SEQUENCE 0x30, total len, INTEGER 0x02, rLen, r, INTEGER 0x02, sLen, s
+    const at = (i) => {
+        const v = der[i];
+        if (v === undefined)
+            throw new Error('DER: truncated');
+        return v;
+    };
+    if (at(0) !== 0x30)
+        throw new Error('DER: not a SEQUENCE');
+    let p = 2;
+    if (at(1) & 0x80)
+        p = 2 + (at(1) & 0x7f);
+    if (at(p) !== 0x02)
+        throw new Error('DER: r not INTEGER');
+    let rLen = at(p + 1);
+    let rStart = p + 2;
+    if (rLen > 32) {
+        rStart += rLen - 32;
+        rLen = 32;
+    }
+    const r = der.slice(rStart, rStart + rLen);
+    p = rStart + rLen;
+    if (at(p) !== 0x02)
+        throw new Error('DER: s not INTEGER');
+    let sLen = at(p + 1);
+    let sStart = p + 2;
+    if (sLen > 32) {
+        sStart += sLen - 32;
+        sLen = 32;
+    }
+    const s = der.slice(sStart, sStart + sLen);
+    const raw = new Uint8Array(64);
+    raw.set(r, 32 - r.length);
+    raw.set(s, 64 - s.length);
+    return raw;
+}
+//# sourceMappingURL=webauthn-verify.js.map

package/dist/server/webauthn-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.js","sourceRoot":"../src/","sources":["server/webauthn-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,8BAA8B;AAC9B,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,GAA6B;IACrD,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,iBAAyB,EACzB,cAAsB,EACtB,YAAgD;IAEhD,IAAI,IAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5F,IAAI,IAAI,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,qBAA6B,EAC7B,kBAA0B,EAC1B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,EAAE,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC1G,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAE9F,OAAO,+BAA+B,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,+BAA+B,CAAC,QAAoB;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC7F,8CAA8C;IAC9C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC,IAAI,CAAC,CAAC;IACP,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IACtD,CAAC,IAAI,SAAS,CAAC;IACf,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACrF,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,qBAA6B,EAC7B,kBAA0B,EAC1B,YAAwB,EACxB,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,EAAE,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IACvG,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC/E,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAE/D,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,GAAG,EACH,iBAAiB,CAAC,MAAM,CAAC,EACzB,iBAAiB,CAAC,MAAM,CAAC,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,GAAe;IACxC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,yEAAyE;IACzE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC"}