@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/server/cloud-middleware.js

@@ -0,0 +1,344 @@
+import { PROTOCOL_V2 } from '../protocol/v2.js';
+import { readTokenForgeProof, verifyTokenForgeCloudRequest, } from './cloud-verify.js';
+const DEFAULT_API_URL = 'https://tokenforge-api.opensyber.cloud';
+const DEFAULT_TIMEOUT_MS = 1_500;
+const DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;
+const DEFAULT_FAILURE_THRESHOLD = 3;
+const DEFAULT_OPEN_INTERVAL_MS = 10_000;
+const DEFAULT_MAX_OPEN_INTERVAL_MS = 5 * 60_000;
+const DEVICE_PATTERN = /^[A-Za-z0-9_.:-]{8,256}$/;
+class CloudVerifyFailure extends Error {
+    kind;
+    code;
+    constructor(kind, code) {
+        super(`TokenForge Cloud verification ${kind}`);
+        this.kind = kind;
+        this.code = code;
+    }
+}
+/**
+ * Compose local verification with TokenForge Cloud verification.
+ * Local denial always wins. Monitor observes cloud decisions; enforce requires
+ * both local and cloud acceptance.
+ */
+export function createTokenForgeCloudMiddleware(options) {
+    const mode = normalizeMode(options.mode);
+    const apiUrl = normalizeApiUrl(options.apiUrl ?? DEFAULT_API_URL);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const timeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_TIMEOUT_MS);
+    const maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
+    const skipPaths = exactSkipPaths(options.skipPaths);
+    const breaker = new CircuitBreaker(positiveInteger(options.failureThreshold, DEFAULT_FAILURE_THRESHOLD), positiveInteger(options.openIntervalMs, DEFAULT_OPEN_INTERVAL_MS), positiveInteger(options.maxOpenIntervalMs, DEFAULT_MAX_OPEN_INTERVAL_MS));
+    if (typeof fetcher !== 'function')
+        throw new Error('TokenForge Cloud middleware requires fetch');
+    return (next) => async (request) => {
+        if (mode === 'off')
+            return next(request);
+        if (skipPaths.has(new URL(request.url).pathname))
+            return next(request);
+        const local = await verifyTokenForgeCloudRequest(request, options.local);
+        const proof = readTokenForgeProof(request);
+        const correlationId = local.binding?.correlationId;
+        let cloud = null;
+        let cloudFailure = null;
+        if (!local.allowed)
+            return localRejection(local);
+        if (!proof) {
+            cloudFailure = new CloudVerifyFailure('rejected', 'proof_invalid');
+        }
+        else if (!options.apiKey?.trim()) {
+            cloudFailure = new CloudVerifyFailure('unavailable', 'not_configured');
+        }
+        else if (!breaker.allow(now(options))) {
+            cloudFailure = new CloudVerifyFailure('unavailable', 'circuit_open');
+            emit(options, {
+                type: 'circuit_open',
+                mode,
+                outcome: 'circuit_open',
+                latencyMs: 0,
+                circuit: breaker.state(now(options)),
+                correlationId,
+            });
+        }
+        else {
+            const started = now(options);
+            emit(options, {
+                type: 'attempt',
+                mode,
+                outcome: 'attempt',
+                latencyMs: 0,
+                circuit: breaker.state(started),
+                correlationId,
+            });
+            try {
+                cloud = await verifyRemote(fetcher, apiUrl, options.apiKey, proof, timeoutMs, maxResponseBytes);
+                breaker.success();
+                emit(options, {
+                    type: 'success',
+                    mode,
+                    outcome: cloud.status,
+                    latencyMs: Math.max(0, now(options) - started),
+                    circuit: breaker.state(now(options)),
+                    correlationId,
+                });
+            }
+            catch (error) {
+                cloudFailure = error instanceof CloudVerifyFailure
+                    ? error
+                    : new CloudVerifyFailure('unavailable', 'invalid_response');
+                if (cloudFailure.kind === 'rejected')
+                    breaker.success();
+                else
+                    breaker.failure(now(options));
+                emit(options, {
+                    type: cloudFailure.kind === 'timeout' ? 'timeout' : 'error',
+                    mode,
+                    outcome: cloudFailure.code,
+                    latencyMs: Math.max(0, now(options) - started),
+                    circuit: breaker.state(now(options)),
+                    correlationId,
+                });
+            }
+        }
+        const cloudAllows = cloud?.status === 'allow' && cloud.bound;
+        if (!cloudAllows) {
+            emit(options, {
+                type: 'would_block',
+                mode,
+                outcome: cloud?.status ?? cloudFailure?.code ?? 'unavailable',
+                latencyMs: 0,
+                circuit: breaker.state(now(options)),
+                correlationId,
+            });
+        }
+        if (cloud && local.allowed !== cloudAllows) {
+            emit(options, {
+                type: 'local_cloud_mismatch',
+                mode,
+                outcome: 'local_cloud_mismatch',
+                latencyMs: 0,
+                circuit: breaker.state(now(options)),
+                correlationId,
+            });
+        }
+        if (mode === 'monitor')
+            return next(request);
+        if (cloudFailure) {
+            if (cloudFailure.kind === 'rejected') {
+                return safeJson(401, { error: 'tokenforge_rejected', reason: cloudFailure.code });
+            }
+            return safeJson(503, { error: 'tokenforge_unavailable' });
+        }
+        if (!cloud || !cloud.bound || cloud.status === 'block') {
+            return safeJson(401, {
+                error: 'tokenforge_rejected',
+                reason: cloud?.reason || 'not_bound',
+            });
+        }
+        if (cloud.status === 'step_up') {
+            return safeJson(403, { error: 'tokenforge_step_up_required' });
+        }
+        return next(request);
+    };
+}
+async function verifyRemote(fetcher, apiUrl, apiKey, proof, timeoutMs, maxResponseBytes) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    let raw;
+    try {
+        response = await fetcher(`${apiUrl}/v2/edge/verify`, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(proof),
+        });
+        raw = await readBoundedResponse(response, maxResponseBytes);
+    }
+    catch {
+        if (controller.signal.aborted)
+            throw new CloudVerifyFailure('timeout', 'timeout');
+        throw new CloudVerifyFailure('unavailable', 'transport_error');
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!response.ok) {
+        const code = safeRemoteCode(raw);
+        const authenticationFailure = response.status === 401 && code === 'unauthorized';
+        if (response.status >= 400 && response.status < 500 && !authenticationFailure) {
+            throw new CloudVerifyFailure('rejected', code);
+        }
+        throw new CloudVerifyFailure('unavailable', code);
+    }
+    let data;
+    try {
+        const envelope = requireRecord(JSON.parse(raw));
+        data = requireRecord(envelope.data);
+    }
+    catch {
+        throw new CloudVerifyFailure('unavailable', 'invalid_response');
+    }
+    if ((data.status !== 'allow' && data.status !== 'step_up' && data.status !== 'block') ||
+        typeof data.bound !== 'boolean' ||
+        typeof data.trustScore !== 'number' ||
+        !Number.isInteger(data.trustScore) ||
+        data.trustScore < 0 || data.trustScore > 100 ||
+        typeof data.deviceId !== 'string' || !DEVICE_PATTERN.test(data.deviceId) ||
+        data.protocol !== PROTOCOL_V2) {
+        throw new CloudVerifyFailure('unavailable', 'invalid_response');
+    }
+    return {
+        status: data.status,
+        bound: data.bound,
+        trustScore: data.trustScore,
+        deviceId: data.deviceId,
+        reason: safeReason(data.reason),
+        protocol: PROTOCOL_V2,
+    };
+}
+class CircuitBreaker {
+    threshold;
+    openInterval;
+    maxOpenInterval;
+    #failures = 0;
+    #openUntil = 0;
+    #currentInterval;
+    #halfOpenProbe = false;
+    constructor(threshold, openInterval, maxOpenInterval) {
+        this.threshold = threshold;
+        this.openInterval = openInterval;
+        this.maxOpenInterval = maxOpenInterval;
+        this.#currentInterval = openInterval;
+    }
+    allow(at) {
+        if (this.#openUntil > at)
+            return false;
+        if (this.#failures < this.threshold)
+            return true;
+        if (this.#halfOpenProbe)
+            return false;
+        this.#halfOpenProbe = true;
+        return true;
+    }
+    state(at) {
+        if (this.#openUntil > at)
+            return 'open';
+        if (this.#failures >= this.threshold)
+            return 'half_open';
+        return 'closed';
+    }
+    success() {
+        this.#failures = 0;
+        this.#openUntil = 0;
+        this.#currentInterval = this.openInterval;
+        this.#halfOpenProbe = false;
+    }
+    failure(at) {
+        this.#halfOpenProbe = false;
+        this.#failures += 1;
+        if (this.#failures < this.threshold)
+            return;
+        this.#openUntil = at + this.#currentInterval;
+        this.#currentInterval = Math.min(this.#currentInterval * 2, this.maxOpenInterval);
+    }
+}
+async function readBoundedResponse(response, maxBytes) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new CloudVerifyFailure('unavailable', 'response_too_large');
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(output);
+}
+function localRejection(local) {
+    const status = local.statusCode >= 400 && local.statusCode <= 599
+        ? local.statusCode
+        : 401;
+    return safeJson(status, { error: safeReason(local.code) || 'local_verification_failed' });
+}
+function emit(options, event) {
+    try {
+        options.telemetry?.({ ...event, operation: '/v2/edge/verify' });
+    }
+    catch {
+        // Telemetry must never affect the authorization result.
+    }
+}
+function safeRemoteCode(raw) {
+    try {
+        return safeReason(requireRecord(JSON.parse(raw)).error) || 'verify_rejected';
+    }
+    catch {
+        return 'verify_rejected';
+    }
+}
+function safeReason(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9._:-]{1,96}$/.test(value)
+        ? value
+        : '';
+}
+function safeJson(status, value) {
+    return new Response(JSON.stringify(value), {
+        status,
+        headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+    });
+}
+function normalizeMode(mode) {
+    return mode === 'monitor' || mode === 'enforce' ? mode : 'off';
+}
+function normalizeApiUrl(input) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:' || !url.hostname || url.username || url.password ||
+        url.search || url.hash) {
+        throw new Error('TokenForge Cloud API URL is invalid');
+    }
+    return url.toString().replace(/\/$/, '');
+}
+function positiveInteger(value, fallback) {
+    return Number.isSafeInteger(value) && (value ?? 0) > 0 ? value : fallback;
+}
+function exactSkipPaths(paths) {
+    const result = new Set();
+    for (const path of paths ?? []) {
+        if (!path.startsWith('/') || path.includes('?') || path.includes('#')) {
+            throw new Error('TokenForge Cloud skip paths must be exact absolute URL paths');
+        }
+        result.add(path);
+    }
+    return result;
+}
+function requireRecord(input) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error('expected object');
+    }
+    return input;
+}
+function now(options) {
+    return options.now?.() ?? Date.now();
+}
+//# sourceMappingURL=cloud-middleware.js.map

package/dist/server/cloud-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-middleware.js","sourceRoot":"../src/","sources":["server/cloud-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAI7B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,4BAA4B,GAAG,CAAC,GAAG,MAAM,CAAC;AAChD,MAAM,cAAc,GAAG,0BAA0B,CAAC;AA6ClD,MAAM,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IAFX,YACW,IAAsB,EACtB,IAAY;QAErB,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAHtC,SAAI,GAAJ,IAAI,CAAkB;QACtB,SAAI,GAAJ,IAAI,CAAQ;IAGvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAyC;IAEzC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAChF,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,cAAc,CAChC,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,EACpE,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,wBAAwB,CAAC,EACjE,eAAe,CAAC,OAAO,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CACzE,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAEjG,OAAO,CAAC,IAA8B,EAA4B,EAAE,CAClE,KAAK,EAAE,OAAgB,EAAqB,EAAE;QAC5C,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvE,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;QACnD,IAAI,KAAK,GAA+B,IAAI,CAAC;QAC7C,IAAI,YAAY,GAA8B,IAAI,CAAC;QAEnD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,YAAY,GAAG,IAAI,kBAAkB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxC,YAAY,GAAG,IAAI,kBAAkB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,cAAc;gBACpB,IAAI;gBACJ,OAAO,EAAE,cAAc;gBACvB,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,SAAS;gBACf,IAAI;gBACJ,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/B,aAAa;aACd,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,YAAY,CACxB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,MAAM,EACd,KAAK,EACL,SAAS,EACT,gBAAgB,CACjB,CAAC;gBACF,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,SAAS;oBACf,IAAI;oBACJ,OAAO,EAAE,KAAK,CAAC,MAAM;oBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;oBAC9C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpC,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,GAAG,KAAK,YAAY,kBAAkB;oBAChD,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,kBAAkB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;;oBACnD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,YAAY,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;oBAC3D,IAAI;oBACJ,OAAO,EAAE,YAAY,CAAC,IAAI;oBAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;oBAC9C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpC,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,EAAE,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC;QAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,aAAa;gBACnB,IAAI;gBACJ,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,IAAI,IAAI,aAAa;gBAC7D,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,IAAI;gBACJ,OAAO,EAAE,sBAAsB;gBAC/B,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,GAAG,EAAE;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,WAAW;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAqB,EACrB,MAAc,EACd,MAAc,EACd,KAAmC,EACnC,SAAiB,EACjB,gBAAwB;IAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,QAAkB,CAAC;IACvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,iBAAiB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClF,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9E,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,IACE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;QAC/B,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,GAAG;QAC5C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACxE,IAAI,CAAC,QAAQ,KAAK,WAAW,EAC7B,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,QAAQ,EAAE,WAAW;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,cAAc;IAOP;IACA;IACA;IARX,SAAS,GAAG,CAAC,CAAC;IACd,UAAU,GAAG,CAAC,CAAC;IACf,gBAAgB,CAAS;IACzB,cAAc,GAAG,KAAK,CAAC;IAEvB,YACW,SAAiB,EACjB,YAAoB,EACpB,eAAuB;QAFvB,cAAS,GAAT,SAAS,CAAQ;QACjB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,oBAAe,GAAf,eAAe,CAAQ;QAEhC,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,IAAI,CAAC,UAAU,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,IAAI,CAAC,UAAU,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,EAAU;QACnB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5C,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACpF,CAAC;CACF;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,QAAgB;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;YACxF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAkC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG;QAC/D,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,GAAG,CAAC;IACR,OAAO,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,IAAI,CACX,OAAyC,EACzC,KAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QACvE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAc;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAyB;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAC1E,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAoC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,GAAG,CAAC,OAAyC;IACpD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,CAAC"}

package/dist/server/cloud-verify.d.ts

@@ -0,0 +1,30 @@
+import { type RequestProofV2 } from '../protocol/v2.js';
+import type { CloudBinding, CloudBindingStore, CloudSessionResolver } from './cloud-bind.js';
+/** Atomic replay store. Multi-instance services must share one implementation. */
+export interface CloudReplayStore {
+    consume(scope: string, nonce: string, ttlMilliseconds: number): Promise<boolean>;
+}
+export interface CloudVerificationBindingStore extends CloudBindingStore {
+    getByCloudDeviceId(cloudDeviceId: string): Promise<CloudBinding | null>;
+}
+export interface CloudVerifyOptions {
+    bindingStore: CloudVerificationBindingStore;
+    replayStore: CloudReplayStore;
+    resolveSession: CloudSessionResolver;
+    timestampWindowMs?: number;
+    maxBodyBytes?: number;
+    now?: () => number;
+}
+export interface TokenForgeLocalVerification {
+    allowed: boolean;
+    statusCode: number;
+    code: string;
+    binding?: CloudBinding;
+}
+/** Verify one Cloud v2 request-bound proof and atomically consume its nonce. */
+export declare function verifyTokenForgeCloudRequest(request: Request, options: CloudVerifyOptions): Promise<TokenForgeLocalVerification>;
+export type TokenForgeProofWithSignature = RequestProofV2 & {
+    signature: string;
+};
+export declare function readTokenForgeProof(request: Request): TokenForgeProofWithSignature | null;
+//# sourceMappingURL=cloud-verify.d.ts.map

package/dist/server/cloud-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-verify.d.ts","sourceRoot":"../src/","sources":["server/cloud-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAOzB,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,gBAAgB,CAAC;IAC9B,cAAc,EAAE,oBAAoB,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,gFAAgF;AAChF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,2BAA2B,CAAC,CAmHtC;AAED,MAAM,MAAM,4BAA4B,GAAG,cAAc,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,4BAA4B,GAAG,IAAI,CA8BzF"}

package/dist/server/cloud-verify.js

@@ -0,0 +1,206 @@
+import { PROTOCOL_V2, canonicalizeOrigin, encodeRequestProof, sha256Base64Url, } from '../protocol/v2.js';
+const DEFAULT_TIMESTAMP_WINDOW_MS = 60_000;
+const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_FUTURE_SKEW_MS = 5_000;
+const PUBLIC_JWK_KEYS = new Set(['kty', 'crv', 'x', 'y', 'ext', 'key_ops']);
+/** Verify one Cloud v2 request-bound proof and atomically consume its nonce. */
+export async function verifyTokenForgeCloudRequest(request, options) {
+    if (!options.bindingStore || !options.replayStore || typeof options.resolveSession !== 'function') {
+        return reject(503, 'tokenforge_local_unavailable');
+    }
+    const timestampWindowMs = positiveInteger(options.timestampWindowMs, DEFAULT_TIMESTAMP_WINDOW_MS);
+    const maxBodyBytes = positiveInteger(options.maxBodyBytes, DEFAULT_MAX_BODY_BYTES);
+    const now = options.now?.() ?? Date.now();
+    const proof = readTokenForgeProof(request);
+    if (!proof)
+        return reject(401, 'tokenforge_proof_invalid');
+    let session;
+    try {
+        session = await options.resolveSession(request);
+    }
+    catch {
+        return reject(401, 'tokenforge_proof_invalid');
+    }
+    if (!session?.sessionId)
+        return reject(401, 'tokenforge_proof_invalid');
+    const publicSessionId = await hashOpaque('session', session.sessionId);
+    if (publicSessionId !== proof.sessionId) {
+        return reject(401, 'tokenforge_proof_invalid');
+    }
+    let binding;
+    try {
+        binding = await options.bindingStore.getByCloudDeviceId(proof.deviceId);
+    }
+    catch {
+        return reject(503, 'tokenforge_binding_unavailable');
+    }
+    if (!binding ||
+        binding.projectId !== proof.projectId ||
+        binding.sessionId !== proof.sessionId ||
+        (session.localDeviceId && binding.localDeviceId !== session.localDeviceId) ||
+        Date.parse(binding.expiresAt) <= now) {
+        return reject(401, 'tokenforge_binding_invalid', binding ?? undefined);
+    }
+    const actualOrigin = request.headers.get('Origin');
+    if (actualOrigin) {
+        try {
+            if (canonicalizeOrigin(actualOrigin) !== canonicalizeOrigin(proof.origin)) {
+                return reject(401, 'tokenforge_origin_mismatch', binding);
+            }
+        }
+        catch {
+            return reject(401, 'tokenforge_origin_mismatch', binding);
+        }
+    }
+    let body;
+    try {
+        const boundedRequest = request.clone();
+        body = Uint8Array.from(await readBoundedBody(boundedRequest, maxBodyBytes));
+    }
+    catch {
+        return reject(413, 'tokenforge_body_too_large', binding);
+    }
+    if (await sha256Base64Url(body) !== proof.bodySha256) {
+        return reject(401, 'tokenforge_body_mismatch', binding);
+    }
+    const signedAt = Number(proof.timestamp);
+    if (!Number.isSafeInteger(signedAt) ||
+        signedAt < now - timestampWindowMs ||
+        signedAt > now + MAX_FUTURE_SKEW_MS) {
+        return reject(401, 'tokenforge_timestamp_stale', binding);
+    }
+    let canonical;
+    let signature;
+    let publicKey;
+    try {
+        canonical = encodeRequestProof(proof);
+        signature = decodeBase64Url(proof.signature, 64);
+        publicKey = await importPublicVerificationKey(binding.publicKeyJwk);
+    }
+    catch {
+        return reject(401, 'tokenforge_proof_invalid', binding);
+    }
+    let signatureValid = false;
+    try {
+        signatureValid = await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signature, canonical);
+    }
+    catch {
+        return reject(401, 'tokenforge_signature_invalid', binding);
+    }
+    if (!signatureValid)
+        return reject(401, 'tokenforge_signature_invalid', binding);
+    let fresh;
+    try {
+        fresh = await options.replayStore.consume(`${binding.projectId}:${binding.cloudDeviceId}`, proof.nonce, timestampWindowMs + MAX_FUTURE_SKEW_MS);
+    }
+    catch {
+        return reject(503, 'tokenforge_replay_unavailable', binding);
+    }
+    if (!fresh)
+        return reject(401, 'tokenforge_nonce_replay', binding);
+    return { allowed: true, statusCode: 200, code: 'allow', binding };
+}
+export function readTokenForgeProof(request) {
+    const protocol = boundedHeader(request, 'X-TF-Protocol', 32);
+    const projectId = boundedHeader(request, 'X-TF-Project-ID', 256);
+    const deviceId = boundedHeader(request, 'X-TF-Device-ID', 256);
+    const sessionId = boundedHeader(request, 'X-TF-Session-ID', 256);
+    const bodySha256 = boundedHeader(request, 'X-TF-Body-SHA256', 64);
+    const origin = boundedHeader(request, 'X-TF-Origin', 512);
+    const nonce = boundedHeader(request, 'X-TF-Nonce', 64);
+    const timestamp = boundedHeader(request, 'X-TF-Timestamp', 16);
+    const signature = boundedHeader(request, 'X-TF-Signature', 128);
+    if (protocol !== PROTOCOL_V2 || !projectId || !deviceId || !sessionId ||
+        !bodySha256 || !nonce || !timestamp || !signature) {
+        return null;
+    }
+    return {
+        protocol: PROTOCOL_V2,
+        projectId,
+        deviceId,
+        sessionId,
+        method: request.method,
+        path: new URL(request.url).pathname || '/',
+        query: new URL(request.url).search.slice(1),
+        bodySha256,
+        origin,
+        nonce,
+        timestamp,
+        signature,
+    };
+}
+async function importPublicVerificationKey(raw) {
+    const parsed = requireRecord(JSON.parse(raw));
+    rejectUnknownKeys(parsed, PUBLIC_JWK_KEYS);
+    if (parsed.kty !== 'EC' || parsed.crv !== 'P-256' ||
+        typeof parsed.x !== 'string' || typeof parsed.y !== 'string') {
+        throw new Error('invalid public key');
+    }
+    decodeBase64Url(parsed.x, 32);
+    decodeBase64Url(parsed.y, 32);
+    return crypto.subtle.importKey('jwk', parsed, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+}
+async function readBoundedBody(request, maxBytes) {
+    if (!request.body)
+        return new Uint8Array();
+    const reader = request.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new Error('body too large');
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return body;
+}
+async function hashOpaque(purpose, value) {
+    return sha256Base64Url(new TextEncoder().encode(`tokenforge-v2:${purpose}\0${value}`));
+}
+function boundedHeader(request, name, maxLength) {
+    const value = request.headers.get(name) ?? '';
+    return value.length <= maxLength ? value : '';
+}
+function decodeBase64Url(value, expectedBytes) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error('invalid base64url');
+    const padding = '='.repeat((4 - (value.length % 4)) % 4);
+    const binary = atob(value.replace(/-/g, '+').replace(/_/g, '/') + padding);
+    const decoded = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    if (decoded.byteLength !== expectedBytes)
+        throw new Error('invalid base64url length');
+    return decoded;
+}
+function requireRecord(input) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error('expected object');
+    }
+    return input;
+}
+function rejectUnknownKeys(input, allowed) {
+    for (const key of Object.keys(input)) {
+        if (!allowed.has(key))
+            throw new Error(`unsupported key field: ${key}`);
+    }
+}
+function positiveInteger(value, fallback) {
+    return Number.isSafeInteger(value) && (value ?? 0) > 0 ? value : fallback;
+}
+function reject(statusCode, code, binding) {
+    return { allowed: false, statusCode, code, binding };
+}
+//# sourceMappingURL=cloud-verify.js.map

package/dist/server/cloud-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-verify.js","sourceRoot":"../src/","sources":["server/cloud-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAO3B,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AA2B5E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAA2B;IAE3B,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAClG,OAAO,MAAM,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,CACvC,OAAO,CAAC,iBAAiB,EACzB,2BAA2B,CAC5B,CAAC;IACF,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAE3D,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAExE,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,eAAe,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,IACE,CAAC,OAAO;QACR,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACrC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACrC,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,EACpC,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,kBAAkB,CAAC,YAAY,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,OAAO,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,EAEhC,CAAC;QACL,IAAI,GAAG,UAAU,CAAC,IAAI,CACpB,MAAM,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,CACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,2BAA2B,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,GAAG,GAAG,iBAAiB;QAClC,QAAQ,GAAG,GAAG,GAAG,kBAAkB,EACnC,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,SAAqB,CAAC;IAC1B,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjD,SAAS,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,SAAS,EACT,SAAyB,EACzB,SAAyB,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAEjF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CACvC,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,EAC/C,KAAK,CAAC,KAAK,EACX,iBAAiB,GAAG,kBAAkB,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,EAAE,+BAA+B,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAEnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAID,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAChE,IACE,QAAQ,KAAK,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QACjE,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,SAAS;QACT,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG;QAC1C,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,UAAU;QACV,MAAM;QACN,KAAK;QACL,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,GAAW;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,IACE,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAC7C,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,MAAoB,EACpB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,QAAgB;IAC/D,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,IAAY,EAAE,SAAiB;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,aAAqB;IAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B,EAAE,OAA4B;IACrF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,MAAM,CACb,UAAkB,EAClB,IAAY,EACZ,OAAsB;IAEtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/dist/server/dbsc-challenge.d.ts

@@ -0,0 +1,51 @@
+/**
+ * DBSC challenge issuer — emits the random bytes the client must sign,
+ * stores their SHA-256 hash + a 60-second expiry, and consumes them
+ * exactly once.
+ *
+ * The challenge bytes never live at rest — we store only the hash so a
+ * DB read does not let an attacker pre-compute valid signatures.
+ *
+ * Pure logic; persistence is injected so this works on any storage.
+ */
+export interface ChallengeStore {
+    put(record: ChallengeRecord): Promise<void>;
+    takeIfFresh(hash: string, now: Date): Promise<ChallengeRecord | null>;
+}
+export interface ChallengeRecord {
+    id: string;
+    tenantId: string;
+    challengeHash: string;
+    purpose: 'register' | 'refresh' | 'step_up';
+    sessionId?: string | null;
+    actionHash?: string | null;
+    issuedAt: string;
+    expiresAt: string;
+    consumed: boolean;
+}
+export interface IssueChallengeInput {
+    tenantId: string;
+    purpose: ChallengeRecord['purpose'];
+    sessionId?: string;
+    actionHash?: string;
+    ttlSeconds?: number;
+}
+export interface IssueChallengeOutput {
+    /** base64url-encoded random bytes — send to the client. */
+    challenge: string;
+    /** Stored record, returned for callers who need the id/expiry. */
+    record: ChallengeRecord;
+}
+export declare function issueChallenge(store: ChallengeStore, input: IssueChallengeInput): Promise<IssueChallengeOutput>;
+export declare function consumeChallenge(store: ChallengeStore, challenge: string, expected: {
+    tenantId: string;
+    purpose: ChallengeRecord['purpose'];
+    sessionId?: string;
+}): Promise<{
+    ok: true;
+    record: ChallengeRecord;
+} | {
+    ok: false;
+    reason: string;
+}>;
+//# sourceMappingURL=dbsc-challenge.d.ts.map