@opensyber/tokenforge 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +130 -11
- package/dist/adapters/astro.d.ts +9 -0
- package/dist/adapters/astro.d.ts.map +1 -1
- package/dist/adapters/astro.js +13 -0
- package/dist/adapters/astro.js.map +1 -1
- package/dist/adapters/cloud-v2-bridge.d.ts +8 -0
- package/dist/adapters/cloud-v2-bridge.d.ts.map +1 -0
- package/dist/adapters/cloud-v2-bridge.js +24 -0
- package/dist/adapters/cloud-v2-bridge.js.map +1 -0
- package/dist/adapters/express.d.ts +15 -2
- package/dist/adapters/express.d.ts.map +1 -1
- package/dist/adapters/express.js +38 -0
- package/dist/adapters/express.js.map +1 -1
- package/dist/adapters/fastify.d.ts +15 -6
- package/dist/adapters/fastify.d.ts.map +1 -1
- package/dist/adapters/fastify.js +38 -0
- package/dist/adapters/fastify.js.map +1 -1
- package/dist/adapters/hono.d.ts +12 -0
- package/dist/adapters/hono.d.ts.map +1 -1
- package/dist/adapters/hono.js +13 -0
- package/dist/adapters/hono.js.map +1 -1
- package/dist/adapters/index.d.ts.map +1 -1
- package/dist/adapters/index.js.map +1 -1
- package/dist/adapters/nextjs.d.ts +15 -0
- package/dist/adapters/nextjs.d.ts.map +1 -1
- package/dist/adapters/nextjs.js +57 -30
- package/dist/adapters/nextjs.js.map +1 -1
- package/dist/adapters/sveltekit.d.ts +9 -0
- package/dist/adapters/sveltekit.d.ts.map +1 -1
- package/dist/adapters/sveltekit.js +13 -0
- package/dist/adapters/sveltekit.js.map +1 -1
- package/dist/client/action-signer.d.ts.map +1 -1
- package/dist/client/action-signer.js.map +1 -1
- package/dist/client/binding.d.ts.map +1 -1
- package/dist/client/binding.js.map +1 -1
- package/dist/client/cloud-device.d.ts +54 -0
- package/dist/client/cloud-device.d.ts.map +1 -0
- package/dist/client/cloud-device.js +301 -0
- package/dist/client/cloud-device.js.map +1 -0
- package/dist/client/crypto.d.ts.map +1 -1
- package/dist/client/crypto.js.map +1 -1
- package/dist/client/index.d.ts +1 -0
- package/dist/client/index.d.ts.map +1 -1
- package/dist/client/index.js +3 -1
- package/dist/client/index.js.map +1 -1
- package/dist/client/interceptor.d.ts.map +1 -1
- package/dist/client/interceptor.js +27 -3
- package/dist/client/interceptor.js.map +1 -1
- package/dist/client/signer.d.ts +23 -3
- package/dist/client/signer.d.ts.map +1 -1
- package/dist/client/signer.js +33 -5
- package/dist/client/signer.js.map +1 -1
- package/dist/client/storage.d.ts.map +1 -1
- package/dist/client/storage.js.map +1 -1
- package/dist/client/webauthn.d.ts.map +1 -1
- package/dist/client/webauthn.js.map +1 -1
- package/dist/protocol/v2.d.ts +23 -0
- package/dist/protocol/v2.d.ts.map +1 -0
- package/dist/protocol/v2.js +157 -0
- package/dist/protocol/v2.js.map +1 -0
- package/dist/react/index.d.ts.map +1 -1
- package/dist/react/index.js.map +1 -1
- package/dist/react/provider.d.ts.map +1 -1
- package/dist/react/provider.js.map +1 -1
- package/dist/server/action-verify.d.ts.map +1 -1
- package/dist/server/action-verify.js +1 -1
- package/dist/server/action-verify.js.map +1 -1
- package/dist/server/activity-histogram.d.ts +47 -0
- package/dist/server/activity-histogram.d.ts.map +1 -0
- package/dist/server/activity-histogram.js +76 -0
- package/dist/server/activity-histogram.js.map +1 -0
- package/dist/server/aitm-heuristics.d.ts.map +1 -1
- package/dist/server/aitm-heuristics.js.map +1 -1
- package/dist/server/bind-with-id-token.d.ts +55 -0
- package/dist/server/bind-with-id-token.d.ts.map +1 -0
- package/dist/server/bind-with-id-token.js +70 -0
- package/dist/server/bind-with-id-token.js.map +1 -0
- package/dist/server/bound-cookie.d.ts.map +1 -1
- package/dist/server/bound-cookie.js.map +1 -1
- package/dist/server/cbor.d.ts.map +1 -1
- package/dist/server/cbor.js.map +1 -1
- package/dist/server/cloud-bind.d.ts +42 -0
- package/dist/server/cloud-bind.d.ts.map +1 -0
- package/dist/server/cloud-bind.js +387 -0
- package/dist/server/cloud-bind.js.map +1 -0
- package/dist/server/cloud-middleware.d.ts +46 -0
- package/dist/server/cloud-middleware.d.ts.map +1 -0
- package/dist/server/cloud-middleware.js +344 -0
- package/dist/server/cloud-middleware.js.map +1 -0
- package/dist/server/cloud-verify.d.ts +30 -0
- package/dist/server/cloud-verify.d.ts.map +1 -0
- package/dist/server/cloud-verify.js +206 -0
- package/dist/server/cloud-verify.js.map +1 -0
- package/dist/server/dbsc-challenge.d.ts.map +1 -1
- package/dist/server/dbsc-challenge.js.map +1 -1
- package/dist/server/dbsc-endpoint.d.ts +20 -0
- package/dist/server/dbsc-endpoint.d.ts.map +1 -0
- package/dist/server/dbsc-endpoint.js +85 -0
- package/dist/server/dbsc-endpoint.js.map +1 -0
- package/dist/server/dbsc-verify.d.ts +32 -0
- package/dist/server/dbsc-verify.d.ts.map +1 -0
- package/dist/server/dbsc-verify.js +65 -0
- package/dist/server/dbsc-verify.js.map +1 -0
- package/dist/server/identity-profile.d.ts +18 -0
- package/dist/server/identity-profile.d.ts.map +1 -0
- package/dist/server/identity-profile.js +113 -0
- package/dist/server/identity-profile.js.map +1 -0
- package/dist/server/index.d.ts +10 -0
- package/dist/server/index.d.ts.map +1 -1
- package/dist/server/index.js +5 -0
- package/dist/server/index.js.map +1 -1
- package/dist/server/jws-verify.d.ts.map +1 -1
- package/dist/server/jws-verify.js.map +1 -1
- package/dist/server/middleware.d.ts +9 -0
- package/dist/server/middleware.d.ts.map +1 -1
- package/dist/server/middleware.js +60 -20
- package/dist/server/middleware.js.map +1 -1
- package/dist/server/oidc-verify.d.ts +16 -1
- package/dist/server/oidc-verify.d.ts.map +1 -1
- package/dist/server/oidc-verify.js +9 -1
- package/dist/server/oidc-verify.js.map +1 -1
- package/dist/server/policy.d.ts.map +1 -1
- package/dist/server/policy.js.map +1 -1
- package/dist/server/step-up-policy.d.ts.map +1 -1
- package/dist/server/step-up-policy.js.map +1 -1
- package/dist/server/storage/index.d.ts +3 -0
- package/dist/server/storage/index.d.ts.map +1 -0
- package/dist/server/storage/index.js +2 -0
- package/dist/server/storage/index.js.map +1 -0
- package/dist/server/storage/interface.d.ts +73 -0
- package/dist/server/storage/interface.d.ts.map +1 -0
- package/dist/server/storage/interface.js +2 -0
- package/dist/server/storage/interface.js.map +1 -0
- package/dist/server/storage/memory.d.ts +50 -0
- package/dist/server/storage/memory.d.ts.map +1 -0
- package/dist/server/storage/memory.js +121 -0
- package/dist/server/storage/memory.js.map +1 -0
- package/dist/server/webauthn-verify.d.ts.map +1 -1
- package/dist/server/webauthn-verify.js.map +1 -1
- package/dist/server/webhooks.d.ts.map +1 -1
- package/dist/server/webhooks.js.map +1 -1
- package/dist/shared/action-hash.d.ts.map +1 -1
- package/dist/shared/action-hash.js.map +1 -1
- package/dist/shared/identity.d.ts +45 -0
- package/dist/shared/identity.d.ts.map +1 -0
- package/dist/shared/identity.js +176 -0
- package/dist/shared/identity.js.map +1 -0
- package/dist/shared/types-internal.d.ts.map +1 -1
- package/dist/shared/types-internal.js.map +1 -1
- package/dist/shared/types.d.ts +47 -2
- package/dist/shared/types.d.ts.map +1 -1
- package/dist/shared/types.js +1 -0
- package/dist/shared/types.js.map +1 -1
- package/package.json +9 -47
- package/dist/server/trust-score-fixtures.d.ts +0 -9
- package/dist/server/trust-score-fixtures.d.ts.map +0 -1
- package/dist/server/trust-score-fixtures.js +0 -23
- package/dist/server/trust-score-fixtures.js.map +0 -1
- package/dist/server/webauthn-verify.test-helpers.d.ts +0 -8
- package/dist/server/webauthn-verify.test-helpers.d.ts.map +0 -1
- package/dist/server/webauthn-verify.test-helpers.js +0 -39
- package/dist/server/webauthn-verify.test-helpers.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"nextjs.d.ts","sourceRoot":"../src/","sources":["adapters/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,KAAK,WAAW,GAAG,OAAO,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhE,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,OAAO,EAAE,qBAAqB,IAIhB,KAAK,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqCnD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAmDpF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAexD;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,qBAAe,CAAC;AAM5C,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE3E,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,QAAQ,SAAS,OAAO,GAAG,WAAW,EAC1E,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC5D,OAAO,EAAE,4BAA4B,GACpC,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAO1C;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,4BAA4B,GACpC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAEhD;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,GACvC,+BAA+B,CAEjC"}
|
package/dist/adapters/nextjs.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
|
|
1
2
|
const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
|
|
2
3
|
/**
|
|
3
4
|
* Next.js App Router — wrap an API route handler with TokenForge verification.
|
|
@@ -18,39 +19,36 @@ export function withTokenForge(handler, options) {
|
|
|
18
19
|
const apiBase = options.apiBase ?? DEFAULT_API_BASE;
|
|
19
20
|
return async (req) => {
|
|
20
21
|
const url = new URL(req.url);
|
|
21
|
-
|
|
22
|
-
const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
|
|
23
|
-
method: 'POST',
|
|
24
|
-
headers: {
|
|
25
|
-
Authorization: `Bearer ${options.apiKey}`,
|
|
26
|
-
'Content-Type': 'application/json',
|
|
27
|
-
},
|
|
28
|
-
body: JSON.stringify({
|
|
29
|
-
path: url.pathname,
|
|
30
|
-
method: req.method,
|
|
31
|
-
headers: {
|
|
32
|
-
signature: header('x-tf-signature'),
|
|
33
|
-
nonce: header('x-tf-nonce'),
|
|
34
|
-
timestamp: header('x-tf-timestamp'),
|
|
35
|
-
deviceId: header('x-tf-device-id'),
|
|
36
|
-
},
|
|
37
|
-
ipAddress: header('x-forwarded-for') ?? '',
|
|
38
|
-
countryCode: header('cf-ipcountry') ?? '',
|
|
39
|
-
userAgent: header('user-agent') ?? '',
|
|
40
|
-
}),
|
|
41
|
-
});
|
|
42
|
-
if (!apiRes.ok) {
|
|
22
|
+
if (shouldSkip(url.pathname, options.skipPaths)) {
|
|
43
23
|
return handler(req, { bound: false, trustScore: 0, deviceId: null });
|
|
44
24
|
}
|
|
45
|
-
const
|
|
46
|
-
|
|
47
|
-
|
|
25
|
+
const header = (name) => req.headers.get(name);
|
|
26
|
+
try {
|
|
27
|
+
const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
|
|
28
|
+
method: 'POST',
|
|
29
|
+
headers: { Authorization: `Bearer ${options.apiKey}`, 'Content-Type': 'application/json' },
|
|
30
|
+
body: JSON.stringify({
|
|
31
|
+
path: url.pathname, method: req.method,
|
|
32
|
+
headers: {
|
|
33
|
+
signature: header('x-tf-signature'), nonce: header('x-tf-nonce'),
|
|
34
|
+
timestamp: header('x-tf-timestamp'), deviceId: header('x-tf-device-id'),
|
|
35
|
+
},
|
|
36
|
+
ipAddress: header('x-forwarded-for') ?? '',
|
|
37
|
+
countryCode: header('cf-ipcountry') ?? '',
|
|
38
|
+
userAgent: header('user-agent') ?? '',
|
|
39
|
+
}),
|
|
40
|
+
});
|
|
41
|
+
if (!apiRes.ok)
|
|
42
|
+
return handler(req, { bound: false, trustScore: 0, deviceId: null });
|
|
43
|
+
const { data } = (await apiRes.json());
|
|
44
|
+
if (data.status === 'block') {
|
|
45
|
+
return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
|
|
46
|
+
}
|
|
47
|
+
return handler(req, { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId });
|
|
48
|
+
}
|
|
49
|
+
catch {
|
|
50
|
+
return handler(req, { bound: false, trustScore: 0, deviceId: null });
|
|
48
51
|
}
|
|
49
|
-
return handler(req, {
|
|
50
|
-
bound: data.bound,
|
|
51
|
-
trustScore: data.trustScore,
|
|
52
|
-
deviceId: data.deviceId,
|
|
53
|
-
});
|
|
54
52
|
};
|
|
55
53
|
}
|
|
56
54
|
/**
|
|
@@ -62,6 +60,9 @@ export function withTokenForge(handler, options) {
|
|
|
62
60
|
export async function tokenForgeCheck(req, options) {
|
|
63
61
|
const apiBase = options.apiBase ?? DEFAULT_API_BASE;
|
|
64
62
|
const url = new URL(req.url);
|
|
63
|
+
if (shouldSkip(url.pathname, options.skipPaths)) {
|
|
64
|
+
return { proceed: true, tf: { bound: false, trustScore: 0, deviceId: null } };
|
|
65
|
+
}
|
|
65
66
|
const header = (name) => req.headers.get(name);
|
|
66
67
|
const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
|
|
67
68
|
method: 'POST',
|
|
@@ -124,4 +125,30 @@ export function withFreshSig(handler, opts = {}) {
|
|
|
124
125
|
return handler(req, tf);
|
|
125
126
|
};
|
|
126
127
|
}
|
|
128
|
+
/**
|
|
129
|
+
* Cross-adapter alias for {@link withFreshSig}. The 5 non-Next.js adapters
|
|
130
|
+
* (astro / express / fastify / hono / sveltekit) all export `requireFreshSig`;
|
|
131
|
+
* exposing the same name here keeps the per-adapter docs uniform so the
|
|
132
|
+
* Sprint 39 step-up snippet doesn't fork by framework.
|
|
133
|
+
*/
|
|
134
|
+
export const requireFreshSig = withFreshSig;
|
|
135
|
+
function shouldSkip(path, skipPaths) {
|
|
136
|
+
return skipPaths?.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p) ?? false;
|
|
137
|
+
}
|
|
138
|
+
/** Wrap a Next.js route handler with the Cloud v2 local and remote gates. */
|
|
139
|
+
export function withTokenForgeCloudV2(handler, options) {
|
|
140
|
+
const gate = createTokenForgeCloudV2Gate(options);
|
|
141
|
+
return async (request) => {
|
|
142
|
+
const rejection = await gate(request);
|
|
143
|
+
return rejection ?? handler(request);
|
|
144
|
+
};
|
|
145
|
+
}
|
|
146
|
+
/** Run only the Cloud v2 authorization decision for middleware composition. */
|
|
147
|
+
export function tokenForgeCloudV2Check(options) {
|
|
148
|
+
return createTokenForgeCloudV2Gate(options);
|
|
149
|
+
}
|
|
150
|
+
/** Expose the generic Cloud v2 bind handler as a Next.js route handler. */
|
|
151
|
+
export function tokenForgeCloudV2BindRoute(handler) {
|
|
152
|
+
return handler;
|
|
153
|
+
}
|
|
127
154
|
//# sourceMappingURL=nextjs.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"nextjs.js","sourceRoot":"../src/","sources":["adapters/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAqBlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+D,EAC/D,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAgB,EAAqB,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;oBACtC,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAChE,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACxE;oBACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;YACzC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;aACnC;YACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA+D,EAC/D,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE;QACvB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,EAAE,EAAE,UAAU,IAAI,CAAC;aAChC,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;AACzG,CAAC;AAID,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CACnC,OAA4D,EAC5D,OAAqC;IAErC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,OAAiB,EAAqB,EAAE;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CACpC,OAAqC;IAErC,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
|
|
1
2
|
/** TokenForge context attached to event.locals.tf */
|
|
2
3
|
export interface TfContext {
|
|
3
4
|
bound: boolean;
|
|
@@ -53,5 +54,13 @@ export declare function requireFreshSig(event: {
|
|
|
53
54
|
}, opts?: {
|
|
54
55
|
minTrustScore?: number;
|
|
55
56
|
}): void;
|
|
57
|
+
export type TokenForgeSvelteKitCloudV2Options = TokenForgeCloudV2AdapterOptions;
|
|
58
|
+
/** SvelteKit handle hook backed by the shared fail-closed Cloud v2 contract. */
|
|
59
|
+
export declare function tokenForgeCloudV2Handle(options: TokenForgeSvelteKitCloudV2Options): Handle;
|
|
60
|
+
export interface TokenForgeSvelteKitCloudV2RouteEvent {
|
|
61
|
+
request: Request;
|
|
62
|
+
}
|
|
63
|
+
/** Adapt the generic Cloud v2 bind handler to a SvelteKit server route. */
|
|
64
|
+
export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (event: TokenForgeSvelteKitCloudV2RouteEvent) => Promise<Response>;
|
|
56
65
|
export {};
|
|
57
66
|
//# sourceMappingURL=sveltekit.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"sveltekit.d.ts","sourceRoot":"../src/","sources":["adapters/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IACzC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yEAAyE;AACzE,UAAU,YAAY;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrD,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAqE5E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;CAAE,EACrC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,IAAI,CAaN;AASD,MAAM,MAAM,iCAAiC,GAAG,+BAA+B,CAAC;AAEhF,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAOR;AAED,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAGtC,OAAO,oCAAoC,KAC1C,OAAO,CAAC,QAAQ,CAAC,CACrB"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
|
|
1
2
|
const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
|
|
2
3
|
/**
|
|
3
4
|
* SvelteKit `handle` hook for TokenForge verification via the cloud API.
|
|
@@ -85,4 +86,16 @@ function shouldSkip(path, skipPaths) {
|
|
|
85
86
|
return false;
|
|
86
87
|
return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
|
|
87
88
|
}
|
|
89
|
+
/** SvelteKit handle hook backed by the shared fail-closed Cloud v2 contract. */
|
|
90
|
+
export function tokenForgeCloudV2Handle(options) {
|
|
91
|
+
const gate = createTokenForgeCloudV2Gate(options);
|
|
92
|
+
return async ({ event, resolve }) => {
|
|
93
|
+
const rejection = await gate(event.request);
|
|
94
|
+
return rejection ?? resolve(event);
|
|
95
|
+
};
|
|
96
|
+
}
|
|
97
|
+
/** Adapt the generic Cloud v2 bind handler to a SvelteKit server route. */
|
|
98
|
+
export function tokenForgeCloudV2BindRoute(handler) {
|
|
99
|
+
return async (event) => handler(event.request);
|
|
100
|
+
}
|
|
88
101
|
//# sourceMappingURL=sveltekit.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sveltekit.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"sveltekit.js","sourceRoot":"../src/","sources":["adapters/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAgClE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;oBAC5B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EACP,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC/D,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqC,EACrC,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC;AAID,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,OAA0C;IAE1C,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAMD,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,KAAK,EACV,KAA2C,EACxB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"action-signer.d.ts","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"action-signer.d.ts","sourceRoot":"../src/","sources":["client/action-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,UAAU,EAAE,SAAS,CAAC;IACtB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAqC3B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"action-signer.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"action-signer.js","sourceRoot":"../src/","sources":["client/action-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAyClC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,IAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnE,MAAM,MAAM,GAA4B,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACrE,IAAI,IAAI,CAAC,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAEpC,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,SAAS;QACnB,GAAG;QACH,GAAG;QACH,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,IAAI,CAAC,UAAU,EACf,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CACzB,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,iBAAiB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"binding.d.ts","sourceRoot":"../src/","sources":["client/binding.ts"],"names":[],"mappings":"AAKA,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAwD3B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binding.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"binding.js","sourceRoot":"../src/","sources":["client/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAkBnD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB,EACjB,OAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC;IAE1C,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CACzD,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CACxD,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QACpD,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;QAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,YAAY;YACvB,SAAS;YACT,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;IAErE,MAAM,cAAc,CAAC;QACnB,QAAQ;QACR,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC"}
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
import { PROTOCOL_V2 } from '../protocol/v2.js';
|
|
2
|
+
export interface BrowserDeviceRecord {
|
|
3
|
+
keyPair: CryptoKeyPair;
|
|
4
|
+
localDeviceId: string;
|
|
5
|
+
projectId?: string;
|
|
6
|
+
deviceId?: string;
|
|
7
|
+
sessionId?: string;
|
|
8
|
+
expiresAt?: string;
|
|
9
|
+
}
|
|
10
|
+
export interface BrowserDeviceStore {
|
|
11
|
+
load(): Promise<BrowserDeviceRecord | null>;
|
|
12
|
+
save(record: BrowserDeviceRecord): Promise<void>;
|
|
13
|
+
clear(): Promise<void>;
|
|
14
|
+
}
|
|
15
|
+
export interface TokenForgeDeviceOptions {
|
|
16
|
+
/** Authenticated application endpoint. This endpoint, not the browser, owns the bearer key. */
|
|
17
|
+
bindEndpoint: string;
|
|
18
|
+
/** Existing application fetch wrapper carrying its normal cookie/session authentication. */
|
|
19
|
+
fetch: typeof fetch;
|
|
20
|
+
/** Expected browser origin. Defaults to location.origin or the bind endpoint origin. */
|
|
21
|
+
origin?: string;
|
|
22
|
+
/** API origins allowed to receive TokenForge proof headers. Defaults to the bind origin. */
|
|
23
|
+
allowedOrigins?: readonly string[];
|
|
24
|
+
/** Exact URL paths that must pass through without TokenForge proof headers. */
|
|
25
|
+
skipPaths?: readonly string[];
|
|
26
|
+
/** Test/custom storage adapter. Production defaults to IndexedDB. */
|
|
27
|
+
store?: BrowserDeviceStore;
|
|
28
|
+
}
|
|
29
|
+
export interface BoundResult {
|
|
30
|
+
protocol: typeof PROTOCOL_V2;
|
|
31
|
+
mode: 'monitor' | 'enforce';
|
|
32
|
+
bound: true;
|
|
33
|
+
projectId: string;
|
|
34
|
+
deviceId: string;
|
|
35
|
+
sessionId: string;
|
|
36
|
+
expiresAt: string;
|
|
37
|
+
}
|
|
38
|
+
export interface UnboundResult {
|
|
39
|
+
protocol: typeof PROTOCOL_V2;
|
|
40
|
+
mode: 'off' | 'monitor';
|
|
41
|
+
bound: false;
|
|
42
|
+
status?: 'unavailable';
|
|
43
|
+
}
|
|
44
|
+
export type BindResult = BoundResult | UnboundResult;
|
|
45
|
+
export declare class TokenForgeDevice {
|
|
46
|
+
#private;
|
|
47
|
+
private constructor();
|
|
48
|
+
static open(options: TokenForgeDeviceOptions): Promise<TokenForgeDevice>;
|
|
49
|
+
get privateKeyExtractable(): boolean;
|
|
50
|
+
get deviceId(): string | null;
|
|
51
|
+
bindAuthenticatedSession(): Promise<BindResult>;
|
|
52
|
+
wrapFetch(authenticatedFetch?: typeof fetch): typeof fetch;
|
|
53
|
+
}
|
|
54
|
+
//# sourceMappingURL=cloud-device.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-device.d.ts","sourceRoot":"../src/","sources":["client/cloud-device.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAMZ,MAAM,mBAAmB,CAAC;AAkB3B,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,+FAA+F;IAC/F,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,IAAI,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,qBAAa,gBAAgB;;IAO3B,OAAO;WAcM,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8C9E,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAE5B;IAEK,wBAAwB,IAAI,OAAO,CAAC,UAAU,CAAC;IAwCrD,SAAS,CAAC,kBAAkB,GAAE,OAAO,KAA2B,GAAG,OAAO,KAAK;CAuDhF"}
|
|
@@ -0,0 +1,301 @@
|
|
|
1
|
+
import { PROTOCOL_V2, base64Url, canonicalizeOrigin, encodeRequestProof, sha256Base64Url, } from '../protocol/v2.js';
|
|
2
|
+
const DB_NAME = 'tokenforge-cloud';
|
|
3
|
+
const STORE_NAME = 'device';
|
|
4
|
+
const RECORD_KEY = 'current';
|
|
5
|
+
const MAX_BIND_RESPONSE_BYTES = 64 * 1024;
|
|
6
|
+
const PROOF_HEADERS = [
|
|
7
|
+
'X-TF-Protocol',
|
|
8
|
+
'X-TF-Project-ID',
|
|
9
|
+
'X-TF-Device-ID',
|
|
10
|
+
'X-TF-Session-ID',
|
|
11
|
+
'X-TF-Body-SHA256',
|
|
12
|
+
'X-TF-Origin',
|
|
13
|
+
'X-TF-Nonce',
|
|
14
|
+
'X-TF-Timestamp',
|
|
15
|
+
'X-TF-Signature',
|
|
16
|
+
];
|
|
17
|
+
export class TokenForgeDevice {
|
|
18
|
+
#options;
|
|
19
|
+
#store;
|
|
20
|
+
#allowedOrigins;
|
|
21
|
+
#skipPaths;
|
|
22
|
+
#record;
|
|
23
|
+
constructor(options, store, record, allowedOrigins, skipPaths) {
|
|
24
|
+
this.#options = options;
|
|
25
|
+
this.#store = store;
|
|
26
|
+
this.#record = record;
|
|
27
|
+
this.#allowedOrigins = allowedOrigins;
|
|
28
|
+
this.#skipPaths = skipPaths;
|
|
29
|
+
}
|
|
30
|
+
static async open(options) {
|
|
31
|
+
const unsafe = options;
|
|
32
|
+
if ('apiKey' in unsafe || 'APIKey' in unsafe || 'tokenForgeApiKey' in unsafe) {
|
|
33
|
+
throw new Error('TokenForgeDevice never accepts an API key; bind through the authenticated server endpoint');
|
|
34
|
+
}
|
|
35
|
+
if (!options?.bindEndpoint || typeof options.fetch !== 'function') {
|
|
36
|
+
throw new Error('TokenForgeDevice requires bindEndpoint and authenticated fetch');
|
|
37
|
+
}
|
|
38
|
+
const expectedOrigin = resolveExpectedOrigin(options);
|
|
39
|
+
const bindOrigin = canonicalizeOrigin(new URL(options.bindEndpoint, expectedOrigin).origin);
|
|
40
|
+
const configuredOrigins = options.allowedOrigins ?? [bindOrigin];
|
|
41
|
+
if (configuredOrigins.length === 0) {
|
|
42
|
+
throw new Error('TokenForgeDevice requires at least one allowed API origin');
|
|
43
|
+
}
|
|
44
|
+
const allowedOrigins = new Set(configuredOrigins.map((origin) => canonicalizeOrigin(origin)));
|
|
45
|
+
const skipPaths = new Set(options.skipPaths ?? []);
|
|
46
|
+
for (const path of skipPaths) {
|
|
47
|
+
if (!path.startsWith('/') || path.includes('?') || path.includes('#')) {
|
|
48
|
+
throw new Error('TokenForgeDevice skip paths must be exact absolute URL paths');
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
const store = options.store ?? new IndexedDBDeviceStore();
|
|
52
|
+
let record = null;
|
|
53
|
+
try {
|
|
54
|
+
record = await store.load();
|
|
55
|
+
}
|
|
56
|
+
catch {
|
|
57
|
+
// Corrupt/unavailable browser storage degrades to a fresh in-memory key.
|
|
58
|
+
}
|
|
59
|
+
if (record && !validRecord(record)) {
|
|
60
|
+
try {
|
|
61
|
+
await store.clear();
|
|
62
|
+
}
|
|
63
|
+
catch { /* storage may be unavailable */ }
|
|
64
|
+
record = null;
|
|
65
|
+
}
|
|
66
|
+
if (!record) {
|
|
67
|
+
const keyPair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
|
|
68
|
+
record = { keyPair, localDeviceId: `tf_local_${crypto.randomUUID()}` };
|
|
69
|
+
try {
|
|
70
|
+
await store.save(record);
|
|
71
|
+
}
|
|
72
|
+
catch { /* memory record remains usable */ }
|
|
73
|
+
}
|
|
74
|
+
return new TokenForgeDevice(options, store, record, allowedOrigins, skipPaths);
|
|
75
|
+
}
|
|
76
|
+
get privateKeyExtractable() {
|
|
77
|
+
return this.#record.keyPair.privateKey.extractable;
|
|
78
|
+
}
|
|
79
|
+
get deviceId() {
|
|
80
|
+
return this.#record.deviceId ?? null;
|
|
81
|
+
}
|
|
82
|
+
async bindAuthenticatedSession() {
|
|
83
|
+
const publicKey = await crypto.subtle.exportKey('jwk', this.#record.keyPair.publicKey);
|
|
84
|
+
const idempotencyKey = await sha256Base64Url(new TextEncoder().encode(`${this.#record.localDeviceId}\0${publicKey.x ?? ''}\0${publicKey.y ?? ''}`));
|
|
85
|
+
const response = await this.#options.fetch(this.#options.bindEndpoint, {
|
|
86
|
+
method: 'POST',
|
|
87
|
+
credentials: 'include',
|
|
88
|
+
headers: {
|
|
89
|
+
Accept: 'application/json',
|
|
90
|
+
'Content-Type': 'application/json',
|
|
91
|
+
'Idempotency-Key': idempotencyKey,
|
|
92
|
+
},
|
|
93
|
+
body: JSON.stringify({
|
|
94
|
+
protocol: PROTOCOL_V2,
|
|
95
|
+
localDeviceId: this.#record.localDeviceId,
|
|
96
|
+
publicKey,
|
|
97
|
+
}),
|
|
98
|
+
});
|
|
99
|
+
if (!response.ok)
|
|
100
|
+
throw new Error(`TokenForge bind failed with status ${response.status}`);
|
|
101
|
+
const raw = await response.text();
|
|
102
|
+
if (new TextEncoder().encode(raw).length > MAX_BIND_RESPONSE_BYTES) {
|
|
103
|
+
throw new Error('TokenForge bind returned an oversized response');
|
|
104
|
+
}
|
|
105
|
+
let decoded;
|
|
106
|
+
try {
|
|
107
|
+
decoded = JSON.parse(raw);
|
|
108
|
+
}
|
|
109
|
+
catch {
|
|
110
|
+
throw new Error('TokenForge bind returned invalid JSON');
|
|
111
|
+
}
|
|
112
|
+
const result = parseBindResult(decoded);
|
|
113
|
+
if (result.bound) {
|
|
114
|
+
this.#record = {
|
|
115
|
+
...this.#record,
|
|
116
|
+
projectId: result.projectId,
|
|
117
|
+
deviceId: result.deviceId,
|
|
118
|
+
sessionId: result.sessionId,
|
|
119
|
+
expiresAt: result.expiresAt,
|
|
120
|
+
};
|
|
121
|
+
try {
|
|
122
|
+
await this.#store.save(this.#record);
|
|
123
|
+
}
|
|
124
|
+
catch { /* current page remains bound */ }
|
|
125
|
+
}
|
|
126
|
+
return result;
|
|
127
|
+
}
|
|
128
|
+
wrapFetch(authenticatedFetch = this.#options.fetch) {
|
|
129
|
+
return async (input, init) => {
|
|
130
|
+
const request = new Request(input, init);
|
|
131
|
+
const url = new URL(request.url);
|
|
132
|
+
if (!this.#allowedOrigins.has(url.origin.toLowerCase()) ||
|
|
133
|
+
this.#skipPaths.has(url.pathname)) {
|
|
134
|
+
return authenticatedFetch(withoutProofHeaders(request));
|
|
135
|
+
}
|
|
136
|
+
const binding = currentBinding(this.#record);
|
|
137
|
+
if (!binding)
|
|
138
|
+
return authenticatedFetch(withoutProofHeaders(request));
|
|
139
|
+
const method = request.method.toUpperCase();
|
|
140
|
+
const body = method === 'GET' || method === 'HEAD'
|
|
141
|
+
? new Uint8Array()
|
|
142
|
+
: new Uint8Array(await request.clone().arrayBuffer());
|
|
143
|
+
const nonceBytes = new Uint8Array(32);
|
|
144
|
+
crypto.getRandomValues(nonceBytes);
|
|
145
|
+
const proof = {
|
|
146
|
+
protocol: PROTOCOL_V2,
|
|
147
|
+
projectId: binding.projectId,
|
|
148
|
+
deviceId: binding.deviceId,
|
|
149
|
+
sessionId: binding.sessionId,
|
|
150
|
+
method,
|
|
151
|
+
path: url.pathname,
|
|
152
|
+
query: url.search.slice(1),
|
|
153
|
+
bodySha256: await sha256Base64Url(body),
|
|
154
|
+
origin: this.#origin(),
|
|
155
|
+
nonce: base64Url(nonceBytes),
|
|
156
|
+
timestamp: Date.now().toString(),
|
|
157
|
+
};
|
|
158
|
+
const canonical = encodeRequestProof(proof);
|
|
159
|
+
const signature = new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, this.#record.keyPair.privateKey, canonical));
|
|
160
|
+
if (signature.length !== 64)
|
|
161
|
+
throw new Error('TokenForge browser produced an unsupported signature encoding');
|
|
162
|
+
const headers = new Headers(request.headers);
|
|
163
|
+
headers.set('X-TF-Protocol', proof.protocol);
|
|
164
|
+
headers.set('X-TF-Project-ID', proof.projectId);
|
|
165
|
+
headers.set('X-TF-Device-ID', proof.deviceId);
|
|
166
|
+
headers.set('X-TF-Session-ID', proof.sessionId);
|
|
167
|
+
headers.set('X-TF-Body-SHA256', proof.bodySha256);
|
|
168
|
+
headers.set('X-TF-Origin', proof.origin);
|
|
169
|
+
headers.set('X-TF-Nonce', proof.nonce);
|
|
170
|
+
headers.set('X-TF-Timestamp', proof.timestamp);
|
|
171
|
+
headers.set('X-TF-Signature', base64Url(signature));
|
|
172
|
+
return authenticatedFetch(new Request(request, { headers }));
|
|
173
|
+
};
|
|
174
|
+
}
|
|
175
|
+
#origin() {
|
|
176
|
+
return resolveExpectedOrigin(this.#options);
|
|
177
|
+
}
|
|
178
|
+
}
|
|
179
|
+
function resolveExpectedOrigin(options) {
|
|
180
|
+
if (options.origin)
|
|
181
|
+
return canonicalizeOrigin(options.origin);
|
|
182
|
+
if (typeof location !== 'undefined' && location.origin)
|
|
183
|
+
return canonicalizeOrigin(location.origin);
|
|
184
|
+
return canonicalizeOrigin(new URL(options.bindEndpoint, 'https://localhost').origin);
|
|
185
|
+
}
|
|
186
|
+
function withoutProofHeaders(request) {
|
|
187
|
+
const headers = new Headers(request.headers);
|
|
188
|
+
for (const header of PROOF_HEADERS)
|
|
189
|
+
headers.delete(header);
|
|
190
|
+
return new Request(request, { headers });
|
|
191
|
+
}
|
|
192
|
+
class IndexedDBDeviceStore {
|
|
193
|
+
async load() {
|
|
194
|
+
const store = await openStore('readonly');
|
|
195
|
+
return requestResult(store.get(RECORD_KEY)).then((value) => value ?? null);
|
|
196
|
+
}
|
|
197
|
+
async save(record) {
|
|
198
|
+
const store = await openStore('readwrite');
|
|
199
|
+
await requestResult(store.put(record, RECORD_KEY));
|
|
200
|
+
}
|
|
201
|
+
async clear() {
|
|
202
|
+
const store = await openStore('readwrite');
|
|
203
|
+
await requestResult(store.delete(RECORD_KEY));
|
|
204
|
+
}
|
|
205
|
+
}
|
|
206
|
+
function openStore(mode) {
|
|
207
|
+
return new Promise((resolve, reject) => {
|
|
208
|
+
if (typeof indexedDB === 'undefined')
|
|
209
|
+
return reject(new Error('IndexedDB unavailable'));
|
|
210
|
+
const request = indexedDB.open(DB_NAME, 1);
|
|
211
|
+
request.onupgradeneeded = () => request.result.createObjectStore(STORE_NAME);
|
|
212
|
+
request.onerror = () => reject(new Error('IndexedDB unavailable'));
|
|
213
|
+
request.onsuccess = () => {
|
|
214
|
+
try {
|
|
215
|
+
resolve(request.result.transaction(STORE_NAME, mode).objectStore(STORE_NAME));
|
|
216
|
+
}
|
|
217
|
+
catch {
|
|
218
|
+
reject(new Error('IndexedDB unavailable'));
|
|
219
|
+
}
|
|
220
|
+
};
|
|
221
|
+
});
|
|
222
|
+
}
|
|
223
|
+
function requestResult(request) {
|
|
224
|
+
return new Promise((resolve, reject) => {
|
|
225
|
+
request.onsuccess = () => resolve(request.result);
|
|
226
|
+
request.onerror = () => reject(new Error('IndexedDB operation failed'));
|
|
227
|
+
});
|
|
228
|
+
}
|
|
229
|
+
function validRecord(record) {
|
|
230
|
+
const privateKey = record.keyPair?.privateKey;
|
|
231
|
+
const publicKey = record.keyPair?.publicKey;
|
|
232
|
+
return Boolean(privateKey && publicKey && privateKey.type === 'private' && publicKey.type === 'public' &&
|
|
233
|
+
!privateKey.extractable && privateKey.algorithm.name === 'ECDSA' &&
|
|
234
|
+
publicKey.algorithm.name === 'ECDSA' && /^tf_local_[A-Za-z0-9-]{8,}$/.test(record.localDeviceId));
|
|
235
|
+
}
|
|
236
|
+
function parseBindResult(input) {
|
|
237
|
+
const root = input && typeof input === 'object' ? input : {};
|
|
238
|
+
const value = root.data && typeof root.data === 'object' ? root.data : root;
|
|
239
|
+
if (value.protocol === PROTOCOL_V2 && value.bound === false &&
|
|
240
|
+
(value.mode === 'off' || value.mode === 'monitor') &&
|
|
241
|
+
(value.status === undefined || value.status === 'unavailable')) {
|
|
242
|
+
return {
|
|
243
|
+
protocol: PROTOCOL_V2,
|
|
244
|
+
mode: value.mode,
|
|
245
|
+
bound: false,
|
|
246
|
+
...(value.status === 'unavailable' ? { status: value.status } : {}),
|
|
247
|
+
};
|
|
248
|
+
}
|
|
249
|
+
const result = {
|
|
250
|
+
protocol: value.protocol,
|
|
251
|
+
mode: value.mode,
|
|
252
|
+
bound: value.bound,
|
|
253
|
+
projectId: value.projectId,
|
|
254
|
+
deviceId: value.deviceId,
|
|
255
|
+
sessionId: value.sessionId,
|
|
256
|
+
expiresAt: value.expiresAt,
|
|
257
|
+
};
|
|
258
|
+
if (result.protocol !== PROTOCOL_V2 || result.bound !== true ||
|
|
259
|
+
(result.mode !== 'monitor' && result.mode !== 'enforce') || typeof result.projectId !== 'string' ||
|
|
260
|
+
typeof result.deviceId !== 'string' || typeof result.sessionId !== 'string' ||
|
|
261
|
+
typeof result.expiresAt !== 'string') {
|
|
262
|
+
throw new Error('TokenForge bind returned an invalid response');
|
|
263
|
+
}
|
|
264
|
+
// Reuse the canonical encoder's strict identifiers with harmless request fields.
|
|
265
|
+
encodeRequestProof({
|
|
266
|
+
protocol: PROTOCOL_V2,
|
|
267
|
+
projectId: result.projectId,
|
|
268
|
+
deviceId: result.deviceId,
|
|
269
|
+
sessionId: result.sessionId,
|
|
270
|
+
method: 'GET', path: '/', query: '',
|
|
271
|
+
bodySha256: '47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU',
|
|
272
|
+
origin: '', nonce: 'AAAAAAAAAAAAAAAAAAAAAA', timestamp: '0000000000000',
|
|
273
|
+
});
|
|
274
|
+
if (Number.isNaN(Date.parse(result.expiresAt)))
|
|
275
|
+
throw new Error('TokenForge bind returned an invalid expiry');
|
|
276
|
+
return result;
|
|
277
|
+
}
|
|
278
|
+
function currentBinding(record) {
|
|
279
|
+
if (!record.projectId || !record.deviceId || !record.sessionId) {
|
|
280
|
+
return null;
|
|
281
|
+
}
|
|
282
|
+
if (!record.expiresAt || Number.isNaN(Date.parse(record.expiresAt)) || Date.parse(record.expiresAt) <= Date.now()) {
|
|
283
|
+
return null;
|
|
284
|
+
}
|
|
285
|
+
try {
|
|
286
|
+
encodeRequestProof({
|
|
287
|
+
protocol: PROTOCOL_V2,
|
|
288
|
+
projectId: record.projectId,
|
|
289
|
+
deviceId: record.deviceId,
|
|
290
|
+
sessionId: record.sessionId,
|
|
291
|
+
method: 'GET', path: '/', query: '',
|
|
292
|
+
bodySha256: '47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU',
|
|
293
|
+
origin: '', nonce: 'AAAAAAAAAAAAAAAAAAAAAA', timestamp: '0000000000000',
|
|
294
|
+
});
|
|
295
|
+
}
|
|
296
|
+
catch {
|
|
297
|
+
return null;
|
|
298
|
+
}
|
|
299
|
+
return { projectId: record.projectId, deviceId: record.deviceId, sessionId: record.sessionId };
|
|
300
|
+
}
|
|
301
|
+
//# sourceMappingURL=cloud-device.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-device.js","sourceRoot":"../src/","sources":["client/cloud-device.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,aAAa,GAAG;IACpB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAmDX,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAA0B;IAClC,MAAM,CAAqB;IAC3B,eAAe,CAAsB;IACrC,UAAU,CAAsB;IACzC,OAAO,CAAsB;IAE7B,YACE,OAAgC,EAChC,KAAyB,EACzB,MAA2B,EAC3B,cAAmC,EACnC,SAA8B;QAE9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAgC;QAChD,MAAM,MAAM,GAAG,OAA4D,CAAC;QAC5E,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,IAAI,kBAAkB,IAAI,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5F,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,oBAAoB,EAAE,CAAC;QAC1D,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACvE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;YACF,MAAM,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YACvE,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,wBAAwB;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CACnE,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5E,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,cAAc;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,WAAW;gBACrB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;gBACzC,SAAS;aACV,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG;gBACb,GAAG,IAAI,CAAC,OAAO;gBACf,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YACF,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,qBAAmC,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC9D,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;YAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IACE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EACjC,CAAC;gBACD,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAChD,CAAC,CAAC,IAAI,UAAU,EAAE;gBAClB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,KAAK,GAAmB;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM;gBACN,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1B,UAAU,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;gBACtB,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;aACjC,CAAC;YACF,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACvD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAC/B,SAAyB,CAC1B,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YAC9G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,OAAO,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,OAAgC;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,aAAa;QAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,oBAAoB;IACxB,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO,aAAa,CAAkC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAA2B;QACpC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,SAAS,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7E,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;YAAC,CAAC;YACtF,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAAC,CAAC;QACvD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAI,OAAsB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA2B;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5C,OAAO,OAAO,CACZ,UAAU,IAAI,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QACvF,CAAC,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAChE,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QACvD,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClD,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QACxD,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAChG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAC3E,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,iFAAiF;IACjF,kBAAkB,CAAC;QACjB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnC,UAAU,EAAE,6CAA6C;QACzD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,eAAe;KACxE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC9G,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,MAA2B;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,kBAAkB,CAAC;YACjB,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,UAAU,EAAE,6CAA6C;YACzD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,eAAe;SACxE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACjG,CAAC"}
|