@spfn/auth 0.2.0-beta.9 → 0.2.0-beta.90

package/dist/client-proof.js

@@ -0,0 +1,1814 @@
+// src/server/client-proof/canonical-json.ts
+var CanonicalJsonError = class extends Error {
+  constructor(code) {
+    super(`canonical JSON: ${code}`);
+    this.code = code;
+    this.name = "CanonicalJsonError";
+  }
+};
+var INT64_MIN = -(2n ** 63n);
+var INT64_MAX = 2n ** 63n - 1n;
+function parseCanonicalJson(bytes) {
+  let text2;
+  try {
+    text2 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CanonicalJsonError("INVALID_UTF8");
+  }
+  const parser = new Parser(text2);
+  const value = parser.parseValue();
+  parser.skipWhitespace();
+  if (!parser.atEnd()) {
+    throw new CanonicalJsonError("TRAILING_CONTENT");
+  }
+  return value;
+}
+function isCanonicalBytes(bytes, value) {
+  const encoded = encodeCanonicalJson(value);
+  if (encoded.length !== bytes.length) {
+    return false;
+  }
+  for (let i = 0; i < encoded.length; i++) {
+    if (encoded[i] !== bytes[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+var Parser = class {
+  constructor(text2) {
+    this.text = text2;
+  }
+  pos = 0;
+  atEnd() {
+    return this.pos >= this.text.length;
+  }
+  skipWhitespace() {
+    while (!this.atEnd()) {
+      const c = this.text[this.pos];
+      if (c === " " || c === "	" || c === "\n" || c === "\r") {
+        this.pos++;
+        continue;
+      }
+      break;
+    }
+  }
+  parseValue() {
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const c = this.text[this.pos];
+    if (c === "{") {
+      return this.parseObject();
+    }
+    if (c === "[") {
+      return this.parseArray();
+    }
+    if (c === '"') {
+      return this.parseString();
+    }
+    if (c === "-" || c >= "0" && c <= "9") {
+      return this.parseNumber();
+    }
+    if (this.text.startsWith("null", this.pos)) {
+      this.pos += 4;
+      return null;
+    }
+    if (this.text.startsWith("true", this.pos)) {
+      this.pos += 4;
+      return true;
+    }
+    if (this.text.startsWith("false", this.pos)) {
+      this.pos += 5;
+      return false;
+    }
+    throw new CanonicalJsonError("INVALID_TOKEN");
+  }
+  parseObject() {
+    this.pos++;
+    const members2 = /* @__PURE__ */ new Map();
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    if (this.text[this.pos] === "}") {
+      this.pos++;
+      return members2;
+    }
+    for (; ; ) {
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      if (this.text[this.pos] !== '"') {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      const key = this.parseString();
+      if (members2.has(key)) {
+        throw new CanonicalJsonError("DUPLICATE_KEY");
+      }
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      if (this.text[this.pos] !== ":") {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      this.pos++;
+      members2.set(key, this.parseValue());
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const next = this.text[this.pos];
+      if (next === ",") {
+        this.pos++;
+        continue;
+      }
+      if (next === "}") {
+        this.pos++;
+        return members2;
+      }
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+  }
+  parseArray() {
+    this.pos++;
+    const items = [];
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    if (this.text[this.pos] === "]") {
+      this.pos++;
+      return items;
+    }
+    for (; ; ) {
+      items.push(this.parseValue());
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const next = this.text[this.pos];
+      if (next === ",") {
+        this.pos++;
+        continue;
+      }
+      if (next === "]") {
+        this.pos++;
+        return items;
+      }
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+  }
+  parseString() {
+    this.pos++;
+    let out = "";
+    for (; ; ) {
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const c = this.text[this.pos];
+      const code = this.text.charCodeAt(this.pos);
+      if (c === '"') {
+        this.pos++;
+        return out;
+      }
+      if (c === "\\") {
+        out += this.parseEscape();
+        continue;
+      }
+      if (code < 32) {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      out += c;
+      this.pos++;
+    }
+  }
+  parseEscape() {
+    this.pos++;
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const c = this.text[this.pos];
+    this.pos++;
+    switch (c) {
+      case '"':
+        return '"';
+      case "\\":
+        return "\\";
+      case "/":
+        return "/";
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "n":
+        return "\n";
+      case "r":
+        return "\r";
+      case "t":
+        return "	";
+      case "u":
+        return this.parseUnicodeEscape();
+      default:
+        throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+  }
+  parseUnicodeEscape() {
+    const high = this.readHex4();
+    if (high >= 56320 && high <= 57343) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    if (high < 55296 || high > 56319) {
+      return String.fromCharCode(high);
+    }
+    if (this.text[this.pos] !== "\\" || this.text[this.pos + 1] !== "u") {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    this.pos += 2;
+    const low = this.readHex4();
+    if (low < 56320 || low > 57343) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    return String.fromCharCode(high, low);
+  }
+  readHex4() {
+    if (this.pos + 4 > this.text.length) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const hex = this.text.slice(this.pos, this.pos + 4);
+    if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    this.pos += 4;
+    return parseInt(hex, 16);
+  }
+  parseNumber() {
+    const start = this.pos;
+    if (this.text[this.pos] === "-") {
+      this.pos++;
+    }
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const first = this.text[this.pos];
+    if (first < "0" || first > "9") {
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+    if (first === "0") {
+      this.pos++;
+    } else {
+      while (!this.atEnd() && this.text[this.pos] >= "0" && this.text[this.pos] <= "9") {
+        this.pos++;
+      }
+    }
+    if (!this.atEnd()) {
+      const next = this.text[this.pos];
+      if (next >= "0" && next <= "9") {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      if (next === "." || next === "e" || next === "E") {
+        throw new CanonicalJsonError("NON_INTEGER_NUMBER");
+      }
+    }
+    const value = BigInt(this.text.slice(start, this.pos));
+    if (value < INT64_MIN || value > INT64_MAX) {
+      throw new CanonicalJsonError("INTEGER_OUT_OF_RANGE");
+    }
+    return value;
+  }
+};
+function encodeCanonicalJson(value) {
+  return new TextEncoder().encode(encodeToString(value));
+}
+function encodeToString(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (typeof value === "string") {
+    return encodeString(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(encodeToString).join(",")}]`;
+  }
+  const keys = [...value.keys()].sort(compareByCodePoints);
+  const members2 = keys.map((key) => `${encodeString(key)}:${encodeToString(value.get(key))}`);
+  return `{${members2.join(",")}}`;
+}
+function compareByCodePoints(a, b) {
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    const ca = a.codePointAt(i);
+    const cb = b.codePointAt(j);
+    if (ca !== cb) {
+      return ca - cb;
+    }
+    i += ca > 65535 ? 2 : 1;
+    j += cb > 65535 ? 2 : 1;
+  }
+  return a.length - i - (b.length - j);
+}
+function encodeString(value) {
+  let out = '"';
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (ch === '"') {
+      out += '\\"';
+    } else if (ch === "\\") {
+      out += "\\\\";
+    } else if (code === 8) {
+      out += "\\b";
+    } else if (code === 12) {
+      out += "\\f";
+    } else if (code === 10) {
+      out += "\\n";
+    } else if (code === 13) {
+      out += "\\r";
+    } else if (code === 9) {
+      out += "\\t";
+    } else if (code < 32) {
+      out += `\\u00${code.toString(16).padStart(2, "0")}`;
+    } else {
+      out += ch;
+    }
+  }
+  return out + '"';
+}
+
+// src/server/client-proof/proof.ts
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from "crypto";
+var CLIENT_PROOF_PROFILE = "clientProofV1";
+var ABSENT_BODY_SHA256 = "0".repeat(64);
+var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
+var PROOF_INPUT_FIELDS = [
+  "profile",
+  "method",
+  "path",
+  "clientId",
+  "keyId",
+  "nonce",
+  "issuedAtMillis",
+  "bodySha256"
+];
+var PROOF_INPUT_SEPARATOR = "\n";
+var PROOF_SIGNATURE_BYTES = 64;
+var PROOF_SIGNATURE_HEX_LENGTH = PROOF_SIGNATURE_BYTES * 2;
+var PROOF_SIGNATURE_PATTERN = /^[0-9a-f]{128}$/;
+var RAW_SIGNATURE_ENCODING = "ieee-p1363";
+var ProofInputError = class extends Error {
+  constructor() {
+    super("proof input field contains a C0 control character");
+    this.name = "ProofInputError";
+  }
+};
+function canonicalProofInput(input) {
+  const values = {
+    profile: CLIENT_PROOF_PROFILE,
+    method: input.method,
+    path: input.path,
+    clientId: input.clientId,
+    keyId: input.keyId,
+    nonce: input.nonce,
+    issuedAtMillis: input.issuedAtMillis.toString(),
+    bodySha256: input.bodySha256
+  };
+  const fields = PROOF_INPUT_FIELDS.map((name) => values[name]);
+  for (const field of fields) {
+    for (const ch of field) {
+      if (ch.codePointAt(0) < 32) {
+        throw new ProofInputError();
+      }
+    }
+  }
+  return fields.join(PROOF_INPUT_SEPARATOR);
+}
+function parseClientProofPublicKey(spkiDerBase64) {
+  const key = createPublicKey({
+    key: Buffer.from(spkiDerBase64, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+    throw new Error("a clientProofV1 public key must be an ECDSA P-256 key");
+  }
+  return key;
+}
+function verifyClientProof(input, presentedProof, publicKey) {
+  const data = Buffer.from(canonicalProofInput(input), "utf8");
+  if (!PROOF_SIGNATURE_PATTERN.test(presentedProof)) {
+    return false;
+  }
+  return verify(
+    "sha256",
+    data,
+    { key: publicKey, dsaEncoding: RAW_SIGNATURE_ENCODING },
+    Buffer.from(presentedProof, "hex")
+  );
+}
+function signClientProof(input, privateKeyPkcs8DerBase64) {
+  const key = createPrivateKey({
+    key: Buffer.from(privateKeyPkcs8DerBase64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+  return sign(
+    "sha256",
+    Buffer.from(canonicalProofInput(input), "utf8"),
+    { key, dsaEncoding: RAW_SIGNATURE_ENCODING }
+  ).toString("hex");
+}
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+// src/server/client-proof/refusal.ts
+import { randomBytes } from "crypto";
+var HTTP_STATUS = {
+  PROOF_INVALID: 401,
+  PROOF_REPLAYED: 401,
+  PROOF_EXPIRED: 401,
+  SESSION_REVOKED: 401,
+  PROFILE_REJECTED: 400,
+  CONTRACT_UNSUPPORTED: 409
+};
+function newHexId() {
+  return randomBytes(16).toString("hex");
+}
+var ClientProofRefusal = class _ClientProofRefusal {
+  constructor(code, message) {
+    this.code = code;
+    this.message = message;
+  }
+  get httpStatus() {
+    return HTTP_STATUS[this.code];
+  }
+  /** The canonical bytes of `{"error":{"code":…,"message":…,"requestId":…}}`. */
+  envelopeBytes(requestId) {
+    const error = /* @__PURE__ */ new Map([
+      ["code", this.code],
+      ["message", this.message],
+      ["requestId", requestId]
+    ]);
+    return encodeCanonicalJson(/* @__PURE__ */ new Map([["error", error]]));
+  }
+  /** Nothing request-derived reaches a log through this. */
+  toString() {
+    return `ClientProofRefusal(${this.code})`;
+  }
+  // ---- shape: what arrived is not the contract (rule 2) -------------------
+  static unroutable() {
+    return contractViolation("no operation in this contract answers that method and path");
+  }
+  static malformedHeaders() {
+    return contractViolation("the request does not carry the contract header fields exactly once each");
+  }
+  static missingContentType() {
+    return contractViolation("a request that carries a body must declare the contract content type");
+  }
+  static bodyTooLarge() {
+    return contractViolation("the request body exceeds the size this server accepts");
+  }
+  /**
+   * The body parsed but its bytes are not the canonical form of what it
+   * parsed to. Not PROOF_INVALID even though it is discovered next to the
+   * proof: the proof over these bytes verifies perfectly well, and an
+   * auth-family answer would tell the client to re-handshake and send the
+   * same non-canonical bytes again.
+   */
+  static bodyNotCanonical() {
+    return contractViolation("the request body is not the canonical JSON form of the value it encodes");
+  }
+  static bodyNotTheDeclaredType() {
+    return contractViolation("the request body is not the request type this operation declares");
+  }
+  static sessionHeaderMisplaced() {
+    return contractViolation("the session header is present exactly on the operations that require one");
+  }
+  static unprocessable() {
+    return contractViolation("the request could not be processed");
+  }
+  /**
+   * A client that ships separately from the server said nothing about which
+   * contract it was built against. Without it the server cannot tell whether
+   * the two ends agree, and answering as though they do is what produces the
+   * undecodable body this check exists to replace.
+   */
+  static contractVersionMissing() {
+    return contractViolation("a client of this kind must state the contract version it was generated from");
+  }
+  static contractVersionUnsupported() {
+    return contractViolation("the stated contract version is outside the range this server serves");
+  }
+  // ---- the profile allowlist ----------------------------------------------
+  static profileRejected() {
+    return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
+  }
+  // ---- auth: a new session might clear it (rule 1) -------------------------
+  static sessionRevoked() {
+    return new _ClientProofRefusal("SESSION_REVOKED", "the key or session was revoked");
+  }
+  static proofExpired() {
+    return new _ClientProofRefusal("PROOF_EXPIRED", "issuedAtMillis falls outside the replay window");
+  }
+  static proofReplayed() {
+    return new _ClientProofRefusal("PROOF_REPLAYED", "the nonce was already used inside the replay window");
+  }
+  static proofInvalid() {
+    return new _ClientProofRefusal("PROOF_INVALID", "the client proof did not verify");
+  }
+};
+function contractViolation(message) {
+  return new ClientProofRefusal("CONTRACT_UNSUPPORTED", message);
+}
+
+// src/server/client-proof/replay-store.ts
+import { getCache } from "@spfn/core/cache";
+function replayLedgerKey(clientId, nonce) {
+  return JSON.stringify([clientId, nonce]);
+}
+var MemoryReplayLedger = class {
+  /** replayLedgerKey(...) → the millis it was spent at. */
+  spent = /* @__PURE__ */ new Map();
+  isSpent(clientId, nonce) {
+    return this.spent.has(replayLedgerKey(clientId, nonce));
+  }
+  /** Records the pair at `atMillis`; false when it was already spent. */
+  spend(clientId, nonce, atMillis) {
+    const key = replayLedgerKey(clientId, nonce);
+    if (this.spent.has(key)) {
+      return false;
+    }
+    this.spent.set(key, atMillis);
+    return true;
+  }
+  /** Drops entries older than the window, judged against `nowMillis`. */
+  prune(nowMillis, windowMillis) {
+    for (const [key, spentAtMillis] of this.spent) {
+      if (nowMillis - spentAtMillis > windowMillis) {
+        this.spent.delete(key);
+      }
+    }
+  }
+  get size() {
+    return this.spent.size;
+  }
+  clear() {
+    this.spent.clear();
+  }
+};
+var MemoryReplayStore = class {
+  constructor(windowMillis = DEFAULT_REPLAY_WINDOW_MILLIS) {
+    this.windowMillis = windowMillis;
+  }
+  ledger = new MemoryReplayLedger();
+  async isSpent(clientId, nonce) {
+    this.ledger.prune(Date.now(), this.windowMillis);
+    return this.ledger.isSpent(clientId, nonce);
+  }
+  async spend(clientId, nonce) {
+    const now = Date.now();
+    this.ledger.prune(now, this.windowMillis);
+    return this.ledger.spend(clientId, nonce, now);
+  }
+};
+var RedisReplayStore = class {
+  constructor(windowMillis = DEFAULT_REPLAY_WINDOW_MILLIS) {
+    this.windowMillis = windowMillis;
+  }
+  async isSpent(clientId, nonce) {
+    return await this.cache().exists(this.key(clientId, nonce)) === 1;
+  }
+  async spend(clientId, nonce) {
+    return await this.cache().set(this.key(clientId, nonce), "1", "PX", this.windowMillis, "NX") === "OK";
+  }
+  cache() {
+    const cache = getCache();
+    if (!cache) {
+      throw new Error("client-proof replay ledger: cache is not available");
+    }
+    return cache;
+  }
+  key(clientId, nonce) {
+    return `spfn:auth:client-proof:replay:${sha256Hex(Buffer.from(replayLedgerKey(clientId, nonce), "utf8"))}`;
+  }
+};
+var configured = null;
+function configureClientProofReplayStore(store) {
+  configured = store;
+}
+function getClientProofReplayStore() {
+  configured ??= new MemoryReplayStore();
+  return configured;
+}
+
+// src/server/client-proof/state.ts
+function systemClock() {
+  return { nowMillis: () => Date.now() };
+}
+var TestClock = class {
+  constructor(millis) {
+    this.millis = millis;
+  }
+  nowMillis() {
+    return this.millis;
+  }
+  advance(byMillis) {
+    this.millis += byMillis;
+  }
+};
+var DEFAULT_SESSION_TTL_MILLIS = 6e5;
+var ClientProofState = class {
+  replayWindowMillis;
+  clock;
+  initialPublicKeys;
+  publicKeys = /* @__PURE__ */ new Map();
+  sessions = /* @__PURE__ */ new Map();
+  /** The replay ledger — the shared memory implementation, used dev-only here. */
+  spentNonces = new MemoryReplayLedger();
+  revokedKeyIds = /* @__PURE__ */ new Set();
+  holds = /* @__PURE__ */ new Map();
+  initialSessionTtlMillis;
+  sessionTtlMillis;
+  requestCount = 0;
+  handshakeCount = 0;
+  echoCount = 0;
+  itemsListCount = 0;
+  refusalCount = 0;
+  constructor(options) {
+    this.clock = options.clock ?? systemClock();
+    this.initialSessionTtlMillis = options.sessionTtlMillis ?? DEFAULT_SESSION_TTL_MILLIS;
+    this.sessionTtlMillis = this.initialSessionTtlMillis;
+    this.replayWindowMillis = options.replayWindowMillis ?? DEFAULT_REPLAY_WINDOW_MILLIS;
+    this.initialPublicKeys = new Map(
+      Object.entries(options.publicKeys).map(([keyId, spki]) => [keyId, parseClientProofPublicKey(spki)])
+    );
+    for (const [keyId, key] of this.initialPublicKeys) {
+      this.publicKeys.set(keyId, key);
+    }
+  }
+  // ---- key registration --------------------------------------------------
+  /**
+   * Registers (or replaces) the public key `keyId` presents proofs under.
+   *
+   * @throws when the key is not base64 SPKI DER naming a P-256 key.
+   */
+  registerPublicKey(keyId, publicKeySpkiDerBase64) {
+    this.publicKeys.set(keyId, parseClientProofPublicKey(publicKeySpkiDerBase64));
+  }
+  // ---- admission ---------------------------------------------------------
+  /**
+   * Runs the contract's checks in the contract's order and returns the
+   * refusal, or null when the request is admitted (spending its nonce).
+   */
+  admit(args) {
+    const now = this.clock.nowMillis();
+    this.prune(now);
+    if (this.revokedKeyIds.has(args.keyId)) {
+      return ClientProofRefusal.sessionRevoked();
+    }
+    if (args.requiresSession) {
+      const session = args.presentedSessionId === null ? void 0 : this.sessions.get(args.presentedSessionId);
+      if (session === void 0 || session.expiresAtMillis <= now || session.keyId !== args.keyId || session.clientId !== args.clientId) {
+        return ClientProofRefusal.sessionRevoked();
+      }
+    }
+    const age = now - Number(args.proofInput.issuedAtMillis);
+    if (age < 0 || age > this.replayWindowMillis) {
+      return ClientProofRefusal.proofExpired();
+    }
+    if (this.spentNonces.isSpent(args.clientId, args.proofInput.nonce)) {
+      return ClientProofRefusal.proofReplayed();
+    }
+    const publicKey = this.publicKeys.get(args.keyId);
+    if (publicKey === void 0) {
+      return ClientProofRefusal.proofInvalid();
+    }
+    if (!verifyClientProof(args.proofInput, args.presentedProof, publicKey)) {
+      return ClientProofRefusal.proofInvalid();
+    }
+    this.spentNonces.spend(args.clientId, args.proofInput.nonce, Number(args.proofInput.issuedAtMillis));
+    return null;
+  }
+  // ---- sessions ----------------------------------------------------------
+  /** Opens a session and returns its id and the expiry the server advertises. */
+  openSession(clientId, keyId) {
+    const now = this.clock.nowMillis();
+    this.prune(now);
+    const sessionId = newHexId();
+    const expiresAtMillis = now + this.sessionTtlMillis;
+    this.sessions.set(sessionId, { clientId, keyId, expiresAtMillis });
+    return { sessionId, expiresAtMillis };
+  }
+  /** Test hook: installs a session with a chosen id (wire-fixture replays). */
+  seedSession(sessionId, clientId, keyId, expiresAtMillis) {
+    this.sessions.set(sessionId, { clientId, keyId, expiresAtMillis });
+  }
+  /** Drops every session, as a restart would. Advertised expiries stay told. */
+  expireSessions() {
+    this.sessions.clear();
+  }
+  /** Revokes a key and drops the sessions it opened. */
+  revokeKey(keyId) {
+    this.revokedKeyIds.add(keyId);
+    for (const [sessionId, session] of this.sessions) {
+      if (session.keyId === keyId) {
+        this.sessions.delete(sessionId);
+      }
+    }
+  }
+  setSessionTtlMillis(millis) {
+    this.sessionTtlMillis = millis;
+  }
+  /** Returns the state to how it started, counters and registered keys included. */
+  reset() {
+    this.publicKeys.clear();
+    for (const [keyId, key] of this.initialPublicKeys) {
+      this.publicKeys.set(keyId, key);
+    }
+    this.sessions.clear();
+    this.spentNonces.clear();
+    this.revokedKeyIds.clear();
+    this.holds.clear();
+    this.sessionTtlMillis = this.initialSessionTtlMillis;
+    this.requestCount = 0;
+    this.handshakeCount = 0;
+    this.echoCount = 0;
+    this.itemsListCount = 0;
+    this.refusalCount = 0;
+  }
+  // ---- delays (dev/test only) --------------------------------------------
+  /** Makes the next `count` requests to `path` wait `millis` before processing. */
+  holdPath(path, millis, count) {
+    this.holds.set(path, { millis, remaining: count });
+  }
+  /** Consumes one configured delay for `path`; returns how long to wait, or 0. */
+  takeHoldMillis(path) {
+    const hold2 = this.holds.get(path);
+    if (hold2 === void 0) {
+      return 0;
+    }
+    hold2.remaining -= 1;
+    if (hold2.remaining <= 0) {
+      this.holds.delete(path);
+    }
+    return hold2.millis;
+  }
+  // ---- counters ----------------------------------------------------------
+  recordRequest() {
+    this.requestCount += 1;
+  }
+  recordOperation(operationId) {
+    if (operationId === "auth.clientProof.handshake") {
+      this.handshakeCount += 1;
+    } else if (operationId === "echo.send") {
+      this.echoCount += 1;
+    } else if (operationId === "items.list") {
+      this.itemsListCount += 1;
+    }
+  }
+  recordRefusal() {
+    this.refusalCount += 1;
+  }
+  stats() {
+    this.prune(this.clock.nowMillis());
+    return {
+      requestCount: this.requestCount,
+      handshakeCount: this.handshakeCount,
+      echoCount: this.echoCount,
+      itemsListCount: this.itemsListCount,
+      refusalCount: this.refusalCount,
+      liveSessionCount: this.sessions.size,
+      spentNonceCount: this.spentNonces.size
+    };
+  }
+  nowMillis() {
+    return this.clock.nowMillis();
+  }
+  /** The clock, exposed for the dev control surface's advance-clock route. */
+  get clockRef() {
+    return this.clock;
+  }
+  // ---- housekeeping ------------------------------------------------------
+  /**
+   * Drops what can no longer affect an answer. The nonce predicate is the
+   * exact negation of the window check in `admit`: an entry is dropped only
+   * once a proof carrying that issuedAtMillis would be refused as expired
+   * anyway. Dropping one moment earlier would let a nonce inside the window
+   * be spent twice.
+   */
+  prune(nowMillis) {
+    for (const [sessionId, session] of this.sessions) {
+      if (session.expiresAtMillis <= nowMillis) {
+        this.sessions.delete(sessionId);
+      }
+    }
+    this.spentNonces.prune(nowMillis, this.replayWindowMillis);
+  }
+};
+
+// src/server/client-proof/admission.ts
+var CLIENT_PROOF_HEADERS = {
+  profile: "x-spfn-auth-profile",
+  clientId: "x-spfn-client-id",
+  keyId: "x-spfn-key-id",
+  nonce: "x-spfn-nonce",
+  issuedAtMillis: "x-spfn-issued-at",
+  proof: "x-spfn-proof",
+  session: "x-spfn-session"
+};
+var CLIENT_PROOF_CONTENT_TYPE = "application/json";
+var INT64_MIN2 = -(2n ** 63n);
+var INT64_MAX2 = 2n ** 63n - 1n;
+function admitClientProofRequest(args) {
+  const credentials = readCredentials(args.headers);
+  if (credentials === null) {
+    return refused(ClientProofRefusal.malformedHeaders());
+  }
+  if (credentials.profile !== CLIENT_PROOF_PROFILE) {
+    return refused(ClientProofRefusal.profileRejected());
+  }
+  if (!isRequestContentType(args.headers.get("content-type"))) {
+    return refused(ClientProofRefusal.missingContentType());
+  }
+  if (args.requiresSession !== (credentials.sessionId !== null)) {
+    return refused(ClientProofRefusal.sessionHeaderMisplaced());
+  }
+  let value;
+  try {
+    value = parseCanonicalJson(args.body);
+  } catch {
+    return refused(ClientProofRefusal.bodyNotCanonical());
+  }
+  if (!isCanonicalBytes(args.body, value)) {
+    return refused(ClientProofRefusal.bodyNotCanonical());
+  }
+  const proofInput = {
+    method: args.method,
+    path: args.path,
+    clientId: credentials.clientId,
+    keyId: credentials.keyId,
+    nonce: credentials.nonce,
+    issuedAtMillis: credentials.issuedAtMillis,
+    bodySha256: sha256Hex(args.body)
+  };
+  let refusal;
+  try {
+    refusal = args.state.admit({
+      clientId: credentials.clientId,
+      keyId: credentials.keyId,
+      presentedSessionId: credentials.sessionId,
+      requiresSession: args.requiresSession,
+      proofInput,
+      presentedProof: credentials.proof
+    });
+  } catch {
+    return refused(ClientProofRefusal.unprocessable());
+  }
+  if (refusal !== null) {
+    return refused(refusal);
+  }
+  return { admitted: true, value, credentials };
+}
+function refused(refusal) {
+  return { admitted: false, refusal };
+}
+function readCredentials(headers) {
+  const profile = headers.get(CLIENT_PROOF_HEADERS.profile);
+  const clientId = headers.get(CLIENT_PROOF_HEADERS.clientId);
+  const keyId = headers.get(CLIENT_PROOF_HEADERS.keyId);
+  const nonce = headers.get(CLIENT_PROOF_HEADERS.nonce);
+  const issuedAtRaw = headers.get(CLIENT_PROOF_HEADERS.issuedAtMillis);
+  const proof = headers.get(CLIENT_PROOF_HEADERS.proof);
+  if (profile === null || clientId === null || keyId === null || nonce === null || issuedAtRaw === null || proof === null) {
+    return null;
+  }
+  const issuedAtMillis = parseInt64(issuedAtRaw);
+  if (issuedAtMillis === null) {
+    return null;
+  }
+  return {
+    profile,
+    clientId,
+    keyId,
+    nonce,
+    issuedAtMillis,
+    proof,
+    sessionId: headers.get(CLIENT_PROOF_HEADERS.session)
+  };
+}
+function parseInt64(raw) {
+  if (!/^[+-]?\d{1,19}$/.test(raw)) {
+    return null;
+  }
+  const value = BigInt(raw);
+  if (value < INT64_MIN2 || value > INT64_MAX2) {
+    return null;
+  }
+  return value;
+}
+function isRequestContentType(value) {
+  if (value === null) {
+    return false;
+  }
+  return value.split(";")[0].trim().toLowerCase() === CLIENT_PROOF_CONTENT_TYPE;
+}
+
+// src/server/client-proof/contract-types.ts
+var CONTRACT_OPERATIONS = [
+  {
+    id: "auth.clientProof.handshake",
+    method: "POST",
+    path: "/v1/auth/client-proof/handshake",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "HandshakeRequest",
+    responseType: "HandshakeResponse",
+    summary: "Presents a client proof and opens a session."
+  },
+  {
+    id: "echo.send",
+    method: "POST",
+    path: "/v1/echo",
+    authProfile: "clientProofV1",
+    requiresSession: true,
+    requestType: "EchoRequest",
+    responseType: "EchoResponse",
+    summary: "Authenticated round trip used as the smallest real vertical slice."
+  },
+  {
+    id: "items.list",
+    method: "POST",
+    path: "/v1/items/list",
+    authProfile: "clientProofV1",
+    requiresSession: true,
+    requestType: "ListItemsRequest",
+    responseType: "ListItemsResponse",
+    summary: "Authenticated paged read covering optional fields and arrays."
+  }
+];
+var AUTH_SURFACE_OPERATIONS = [
+  {
+    id: "auth.enroll.register",
+    method: "POST",
+    path: "/_auth/register",
+    authProfile: "none",
+    requiresSession: false,
+    requestType: "RegisterRequest",
+    responseType: "RegisterResponse",
+    summary: "Registers an account with a verification token and enrolls the client-generated public key."
+  },
+  {
+    id: "auth.enroll.login",
+    method: "POST",
+    path: "/_auth/login",
+    authProfile: "none",
+    requiresSession: false,
+    requestType: "LoginRequest",
+    responseType: "LoginResponse",
+    summary: "Authenticates with password credentials and enrolls a fresh client-generated public key."
+  },
+  {
+    id: "auth.enroll.oauthNative",
+    method: "POST",
+    path: "/_auth/oauth/{provider}/native",
+    authProfile: "none",
+    requiresSession: false,
+    requestType: "OauthNativeRequest",
+    responseType: "OauthNativeResponse",
+    summary: "Verifies a native/web social id_token server-side and enrolls the client-generated public key."
+  },
+  {
+    id: "auth.keys.rotate",
+    method: "POST",
+    path: "/_auth/keys/rotate",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RotateKeyRequest",
+    responseType: "RotateKeyResponse",
+    summary: "Replaces the authenticated key with a new client-generated public key before its TTL runs out."
+  },
+  {
+    id: "auth.keys.list",
+    method: "POST",
+    path: "/_auth/keys/list",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "ListKeysRequest",
+    responseType: "ListKeysResponse",
+    summary: "Lists the keys registered to the caller, one per device that can sign for them."
+  },
+  {
+    id: "auth.keys.revoke",
+    method: "POST",
+    path: "/_auth/keys/revoke",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeKeyRequest",
+    responseType: "RevokeKeyResponse",
+    summary: "Revokes one of the caller's keys, signing that device out."
+  },
+  {
+    id: "auth.keys.revokeAll",
+    method: "POST",
+    path: "/_auth/keys/revoke-all",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeAllKeysRequest",
+    responseType: "RevokeAllKeysResponse",
+    summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise."
+  }
+];
+var ContractTypeError = class extends Error {
+  constructor() {
+    super("not the declared contract type");
+    this.name = "ContractTypeError";
+  }
+};
+function decodeHandshakeRequest(value) {
+  const members2 = objectWithKeys(value, ["clientId", "keyId", "nonce", "issuedAtMillis"], []);
+  return {
+    clientId: text(members2.get("clientId")),
+    keyId: text(members2.get("keyId")),
+    nonce: text(members2.get("nonce")),
+    issuedAtMillis: integer(members2.get("issuedAtMillis"))
+  };
+}
+function decodeEchoRequest(value) {
+  const members2 = objectWithKeys(value, ["message", "sequence"], []);
+  return {
+    message: text(members2.get("message")),
+    sequence: integer(members2.get("sequence"))
+  };
+}
+function decodeListItemsRequest(value) {
+  const members2 = objectWithKeys(value, ["limit"], ["cursor"]);
+  const request = { limit: integer(members2.get("limit")) };
+  if (members2.has("cursor")) {
+    request.cursor = text(members2.get("cursor"));
+  }
+  return request;
+}
+function objectWithKeys(value, required2, optional2) {
+  if (!(value instanceof Map)) {
+    throw new ContractTypeError();
+  }
+  for (const key of required2) {
+    if (!value.has(key)) {
+      throw new ContractTypeError();
+    }
+  }
+  for (const key of value.keys()) {
+    if (!required2.includes(key) && !optional2.includes(key)) {
+      throw new ContractTypeError();
+    }
+  }
+  return value;
+}
+function text(value) {
+  if (typeof value !== "string") {
+    throw new ContractTypeError();
+  }
+  return value;
+}
+function integer(value) {
+  if (typeof value !== "bigint") {
+    throw new ContractTypeError();
+  }
+  return value;
+}
+function encodeHandshakeResponse(sessionId, expiresAtMillis) {
+  return /* @__PURE__ */ new Map([
+    ["sessionId", sessionId],
+    ["expiresAtMillis", expiresAtMillis]
+  ]);
+}
+function encodeEchoResponse(message, sequence, serverTimeMillis) {
+  return /* @__PURE__ */ new Map([
+    ["message", message],
+    ["sequence", sequence],
+    ["serverTimeMillis", serverTimeMillis]
+  ]);
+}
+function encodeListItemsResponse(items, nextCursor) {
+  const encodedItems = items.map((item) => /* @__PURE__ */ new Map([
+    ["id", item.id],
+    ["name", item.name],
+    ["updatedAtMillis", item.updatedAtMillis]
+  ]));
+  const members2 = /* @__PURE__ */ new Map([["items", encodedItems]]);
+  if (nextCursor !== null) {
+    members2.set("nextCursor", nextCursor);
+  }
+  return members2;
+}
+
+// src/server/client-proof/dev-control.ts
+var CONTROL_PREFIX = "/control/";
+var CONTROL_TOKEN_HEADER = "x-spfn-reference-control";
+var HTTP_OK = 200;
+var HTTP_BAD_REQUEST = 400;
+var HTTP_FORBIDDEN = 403;
+var HTTP_NOT_FOUND = 404;
+var HTTP_CONFLICT = 409;
+var MAX_CONTROL_BODY_BYTES = 4096;
+async function handleControlRequest(state, controlToken, path, request) {
+  if (path === "/control/health") {
+    return answer(HTTP_OK, /* @__PURE__ */ new Map([["status", "ok"]]));
+  }
+  if (request.headers.get(CONTROL_TOKEN_HEADER) !== controlToken) {
+    return answer(HTTP_FORBIDDEN, failure("control token"));
+  }
+  const raw = new Uint8Array(await request.arrayBuffer());
+  const body = raw.length > MAX_CONTROL_BODY_BYTES ? raw.slice(0, MAX_CONTROL_BODY_BYTES) : raw;
+  switch (path) {
+    case "/control/stats":
+      return stats(state);
+    case "/control/reset":
+      state.reset();
+      return ok();
+    case "/control/expire-sessions":
+      state.expireSessions();
+      return ok();
+    case "/control/register-key":
+      return registerKey(state, body);
+    case "/control/revoke-key":
+      return revokeKey(state, body);
+    case "/control/session-ttl":
+      return sessionTtl(state, body);
+    case "/control/hold":
+      return hold(state, body);
+    case "/control/advance-clock":
+      return advanceClock(state, body);
+    default:
+      return answer(HTTP_NOT_FOUND, failure("unknown control route"));
+  }
+}
+function stats(state) {
+  const counters = state.stats();
+  return answer(HTTP_OK, withOk(/* @__PURE__ */ new Map([
+    ["echoCount", BigInt(counters.echoCount)],
+    ["handshakeCount", BigInt(counters.handshakeCount)],
+    ["itemsListCount", BigInt(counters.itemsListCount)],
+    ["liveSessionCount", BigInt(counters.liveSessionCount)],
+    ["refusalCount", BigInt(counters.refusalCount)],
+    ["requestCount", BigInt(counters.requestCount)],
+    ["spentNonceCount", BigInt(counters.spentNonceCount)]
+  ])));
+}
+function registerKey(state, body) {
+  const keyId = stringField(body, "keyId");
+  const publicKey = stringField(body, "publicKey");
+  if (keyId === null) {
+    return badRequest("keyId");
+  }
+  if (publicKey === null) {
+    return badRequest("publicKey");
+  }
+  try {
+    state.registerPublicKey(keyId, publicKey);
+  } catch {
+    return badRequest("publicKey");
+  }
+  return ok();
+}
+function revokeKey(state, body) {
+  const keyId = stringField(body, "keyId");
+  if (keyId === null) {
+    return badRequest("keyId");
+  }
+  state.revokeKey(keyId);
+  return ok();
+}
+function sessionTtl(state, body) {
+  const ttlMillis = integerField(body, "ttlMillis");
+  if (ttlMillis === null) {
+    return badRequest("ttlMillis");
+  }
+  state.setSessionTtlMillis(Number(ttlMillis));
+  return ok();
+}
+function hold(state, body) {
+  const path = stringField(body, "path");
+  const millis = integerField(body, "millis");
+  const count = integerField(body, "count");
+  if (path === null) {
+    return badRequest("path");
+  }
+  if (millis === null) {
+    return badRequest("millis");
+  }
+  if (count === null) {
+    return badRequest("count");
+  }
+  state.holdPath(path, Number(millis), Number(count));
+  return ok();
+}
+function advanceClock(state, body) {
+  const clock = state.clockRef;
+  if (!(clock instanceof TestClock)) {
+    return answer(HTTP_CONFLICT, failure("server is running on the system clock"));
+  }
+  const millis = integerField(body, "millis");
+  if (millis === null) {
+    return badRequest("millis");
+  }
+  clock.advance(Number(millis));
+  return ok();
+}
+function members(body) {
+  if (body.length === 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  let parsed;
+  try {
+    parsed = parseCanonicalJson(body);
+  } catch {
+    return null;
+  }
+  return parsed instanceof Map ? parsed : null;
+}
+function stringField(body, field) {
+  const value = members(body)?.get(field);
+  return typeof value === "string" ? value : null;
+}
+function integerField(body, field) {
+  const value = members(body)?.get(field);
+  return typeof value === "bigint" ? value : null;
+}
+function badRequest(field) {
+  return answer(HTTP_BAD_REQUEST, failure(`missing or malformed field: ${field}`));
+}
+function ok() {
+  return answer(HTTP_OK, withOk(/* @__PURE__ */ new Map()));
+}
+function failure(reason) {
+  return /* @__PURE__ */ new Map([["ok", false], ["reason", reason]]);
+}
+function withOk(extra) {
+  extra.set("ok", true);
+  return extra;
+}
+function answer(status, value) {
+  const bytes = encodeCanonicalJson(value);
+  const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  return new Response(buffer, { status, headers: { "content-type": "application/json" } });
+}
+
+// src/server/client-proof/contract-bundle.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/server/types.ts
+var KEY_ALGORITHM = ["ES256", "RS256"];
+
+// src/server/client-proof/wire-headers.ts
+var CLIENT_IDENTITY_HEADERS = {
+  kind: "x-spfn-client-kind",
+  version: "x-spfn-client-version",
+  contractVersion: "x-spfn-client-contract-version"
+};
+var SERVER_CONTRACT_HEADERS = {
+  version: "x-spfn-server-contract-version",
+  supportedRange: "x-spfn-supported-contract-range"
+};
+var CLIENT_KINDS = ["web", "ios", "android"];
+function isAppKind(kind) {
+  return kind !== "web";
+}
+
+// src/server/client-proof/contract-bundle.ts
+var CONTRACT_VERSION = "0.6.0";
+var CONTRACT_MAJOR = 0;
+var CONTRACT_SUPPORTED_RANGE = ">=0.6.0 <0.7.0";
+function required(name, type) {
+  return { name, type, optional: false };
+}
+function optional(name, type) {
+  return { name, type, optional: true };
+}
+var CONTRACT_TYPES = [
+  {
+    name: "HandshakeRequest",
+    fields: [
+      required("clientId", "string"),
+      required("keyId", "string"),
+      required("nonce", "string"),
+      required("issuedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "HandshakeResponse",
+    fields: [
+      required("sessionId", "string"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  {
+    name: "EchoRequest",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer")
+    ]
+  },
+  {
+    name: "EchoResponse",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer"),
+      required("serverTimeMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsRequest",
+    fields: [
+      required("limit", "integer"),
+      optional("cursor", "string")
+    ]
+  },
+  {
+    name: "Item",
+    fields: [
+      required("id", "string"),
+      required("name", "string"),
+      required("updatedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsResponse",
+    fields: [
+      required("items", "array<Item>"),
+      optional("nextCursor", "string")
+    ]
+  },
+  {
+    name: "RegisterRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("verificationToken", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RegisterResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string")
+    ]
+  },
+  {
+    name: "LoginRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      optional("oldKeyId", "string")
+    ]
+  },
+  {
+    name: "LoginResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("passwordChangeRequired", "boolean")
+    ]
+  },
+  {
+    name: "OauthNativeRequest",
+    fields: [
+      required("idToken", "string"),
+      required("nonce", "string"),
+      optional("accessToken", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "OauthNativeResponse",
+    fields: [
+      required("userId", "string"),
+      required("keyId", "string"),
+      required("isNewUser", "boolean")
+    ]
+  },
+  {
+    name: "RotateKeyRequest",
+    fields: [
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RotateKeyResponse",
+    fields: [
+      required("success", "boolean"),
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "ListKeysRequest",
+    fields: [
+      optional("includeRevoked", "boolean")
+    ]
+  },
+  {
+    name: "KeySummary",
+    fields: [
+      required("keyId", "string"),
+      optional("deviceName", "string"),
+      optional("platform", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      required("fingerprintPrefix", "string"),
+      required("createdAtMillis", "integer"),
+      optional("lastUsedAtMillis", "integer"),
+      optional("expiresAtMillis", "integer"),
+      required("isExpired", "boolean"),
+      required("isActive", "boolean"),
+      optional("revokedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListKeysResponse",
+    fields: [
+      required("keys", "array<KeySummary>")
+    ]
+  },
+  {
+    name: "RevokeKeyRequest",
+    fields: [
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "RevokeKeyResponse",
+    fields: [
+      required("keyId", "string"),
+      required("selfRevoked", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysRequest",
+    fields: [
+      optional("includeCurrent", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysResponse",
+    fields: [
+      required("revokedCount", "integer"),
+      required("currentKeyRevoked", "boolean")
+    ]
+  }
+];
+var CONTRACT_ENUMS = [
+  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] }
+];
+var BUNDLE_FILENAME = "spfn-mobile-contract.json";
+var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;
+
+// src/server/client-proof/wire-version.ts
+function readClientIdentity(headers) {
+  const kind = headers.get(CLIENT_IDENTITY_HEADERS.kind);
+  if (kind === null || !isClientKind(kind)) {
+    return null;
+  }
+  return {
+    kind,
+    version: headers.get(CLIENT_IDENTITY_HEADERS.version),
+    contractVersion: headers.get(CLIENT_IDENTITY_HEADERS.contractVersion)
+  };
+}
+function isClientKind(value) {
+  return CLIENT_KINDS.includes(value);
+}
+function isContractVersionSupported(clientVersion) {
+  const client = parseVersion(clientVersion);
+  if (client === null) {
+    return false;
+  }
+  const server = parseVersion(CONTRACT_VERSION);
+  if (server === null || client.major !== server.major) {
+    return false;
+  }
+  return CONTRACT_MAJOR > 0 || client.minor === server.minor;
+}
+function parseVersion(raw) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(raw);
+  if (match === null) {
+    return null;
+  }
+  return { major: Number(match[1]), minor: Number(match[2]) };
+}
+function judgeClientIdentity(identity) {
+  if (identity === null || !isAppKind(identity.kind)) {
+    return null;
+  }
+  if (identity.contractVersion === null) {
+    return ClientProofRefusal.contractVersionMissing();
+  }
+  if (!isContractVersionSupported(identity.contractVersion)) {
+    return ClientProofRefusal.contractVersionUnsupported();
+  }
+  return null;
+}
+function applyServerContractHeaders(headers) {
+  headers.set(SERVER_CONTRACT_HEADERS.version, CONTRACT_VERSION);
+  headers.set(SERVER_CONTRACT_HEADERS.supportedRange, CONTRACT_SUPPORTED_RANGE);
+}
+function serverContractHeaders() {
+  return {
+    [SERVER_CONTRACT_HEADERS.version]: CONTRACT_VERSION,
+    [SERVER_CONTRACT_HEADERS.supportedRange]: CONTRACT_SUPPORTED_RANGE
+  };
+}
+
+// src/server/client-proof/dev-handler.ts
+var MAX_BODY_BYTES = 1 << 20;
+var HTTP_OK2 = 200;
+var DEV_CATALOGUE = [
+  { id: "item-0001", name: "alpha", updatedAtMillis: 1750000000001n },
+  { id: "item-0002", name: "bravo", updatedAtMillis: 1750000000002n },
+  { id: "item-0003", name: "charlie", updatedAtMillis: 1750000000003n },
+  { id: "item-0004", name: "delta", updatedAtMillis: 1750000000004n },
+  { id: "item-0005", name: "echo", updatedAtMillis: 1750000000005n }
+];
+var DEV_MAX_LIMIT = 100n;
+function createClientProofDevHandler(options) {
+  const state = new ClientProofState(options);
+  const controlToken = options.controlToken ?? newHexId();
+  const enableControl = options.enableControl ?? true;
+  const log = options.log ?? (() => void 0);
+  async function dispatch(request) {
+    state.recordRequest();
+    const url = new URL(request.url);
+    if (enableControl && url.pathname.startsWith(CONTROL_PREFIX)) {
+      return handleControlRequest(state, controlToken, url.pathname, request);
+    }
+    const operation = url.search === "" ? CONTRACT_OPERATIONS.find((op) => op.path === url.pathname && op.method === request.method) : void 0;
+    if (operation === void 0) {
+      return refuse(ClientProofRefusal.unroutable());
+    }
+    const body = await readBodyCapped(request);
+    if (body === null) {
+      return refuse(ClientProofRefusal.bodyTooLarge());
+    }
+    await waitOutHold(url.pathname);
+    const admission = admitClientProofRequest({
+      state,
+      headers: request.headers,
+      method: operation.method,
+      path: operation.path,
+      requiresSession: operation.requiresSession,
+      body
+    });
+    if (!admission.admitted) {
+      return refuse(admission.refusal);
+    }
+    return apply(operation, admission);
+  }
+  function apply(operation, admission) {
+    let value;
+    try {
+      if (operation.id === "auth.clientProof.handshake") {
+        const request = decodeHandshakeRequest(admission.value);
+        if (request.clientId !== admission.credentials.clientId || request.keyId !== admission.credentials.keyId) {
+          return refuse(ClientProofRefusal.bodyNotTheDeclaredType());
+        }
+        const opened = state.openSession(request.clientId, request.keyId);
+        value = encodeHandshakeResponse(opened.sessionId, BigInt(opened.expiresAtMillis));
+      } else if (operation.id === "echo.send") {
+        const request = decodeEchoRequest(admission.value);
+        value = encodeEchoResponse(request.message, request.sequence, BigInt(state.nowMillis()));
+      } else {
+        const listed = listItems(decodeListItemsRequest(admission.value));
+        if (listed === null) {
+          return refuse(ClientProofRefusal.bodyNotTheDeclaredType());
+        }
+        value = listed;
+      }
+    } catch (error) {
+      if (error instanceof ContractTypeError) {
+        return refuse(ClientProofRefusal.bodyNotTheDeclaredType());
+      }
+      return refuse(ClientProofRefusal.unprocessable());
+    }
+    state.recordOperation(operation.id);
+    return contractResponse(HTTP_OK2, encodeCanonicalJson(value));
+  }
+  function refuse(refusal) {
+    state.recordRefusal();
+    return contractResponse(refusal.httpStatus, refusal.envelopeBytes(newHexId()));
+  }
+  async function waitOutHold(path) {
+    const millis = state.takeHoldMillis(path);
+    if (millis > 0) {
+      await new Promise((resolve) => setTimeout(resolve, millis));
+    }
+  }
+  return {
+    state,
+    controlToken,
+    fetch: async (request) => {
+      try {
+        const response = await dispatch(request);
+        log(`${request.method} ${new URL(request.url).pathname} -> ${response.status}`);
+        return response;
+      } catch {
+        return refuse(ClientProofRefusal.unprocessable());
+      }
+    }
+  };
+}
+function listItems(request) {
+  if (request.limit < 1n || request.limit > DEV_MAX_LIMIT) {
+    return null;
+  }
+  let start = 0;
+  if (request.cursor !== void 0) {
+    const index = DEV_CATALOGUE.findIndex((item) => item.id === request.cursor);
+    if (index < 0) {
+      return null;
+    }
+    start = index + 1;
+  }
+  const end = Math.min(DEV_CATALOGUE.length, start + Number(request.limit));
+  const page = DEV_CATALOGUE.slice(start, end);
+  const nextCursor = end < DEV_CATALOGUE.length && page.length > 0 ? page[page.length - 1].id : null;
+  return encodeListItemsResponse([...page], nextCursor);
+}
+function contractResponse(status, body) {
+  return new Response(toArrayBuffer(body), {
+    status,
+    headers: { "content-type": "application/json", ...serverContractHeaders() }
+  });
+}
+async function readBodyCapped(request) {
+  if (request.body === null) {
+    return new Uint8Array(0);
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    total += value.length;
+    if (total > MAX_BODY_BYTES) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return body;
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+
+// src/server/client-proof/guard.ts
+function createClientProofGuard(state, options = {}) {
+  return async (c, next) => {
+    const body = new Uint8Array(await c.req.arrayBuffer());
+    const admission = admitClientProofRequest({
+      state,
+      headers: c.req.raw.headers,
+      method: c.req.method,
+      path: options.contractPath ?? c.req.path,
+      requiresSession: true,
+      body
+    });
+    if (!admission.admitted) {
+      state.recordRefusal();
+      const bytes = admission.refusal.envelopeBytes(newHexId());
+      const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+      return c.newResponse(buffer, admission.refusal.httpStatus, {
+        "content-type": "application/json",
+        ...serverContractHeaders()
+      });
+    }
+    c.set("clientType", "mobile");
+    c.set("clientProof", {
+      credentials: admission.credentials,
+      value: admission.value
+    });
+    await next();
+    return void 0;
+  };
+}
+
+// src/server/client-proof/version-middleware.ts
+var CLIENT_IDENTITY_CONTEXT_KEY = "clientIdentity";
+function createClientVersionMiddleware() {
+  return async (c, next) => {
+    const identity = readClientIdentity(c.req.raw.headers);
+    const refusal = judgeClientIdentity(identity);
+    if (refusal !== null) {
+      const bytes = refusal.envelopeBytes(newHexId());
+      const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+      const response = c.newResponse(buffer, refusal.httpStatus, {
+        "content-type": "application/json"
+      });
+      applyServerContractHeaders(response.headers);
+      return response;
+    }
+    if (identity !== null) {
+      c.set(CLIENT_IDENTITY_CONTEXT_KEY, identity);
+    }
+    await next();
+    applyServerContractHeaders(c.res.headers);
+    return void 0;
+  };
+}
+export {
+  ABSENT_BODY_SHA256,
+  AUTH_SURFACE_OPERATIONS,
+  CLIENT_IDENTITY_CONTEXT_KEY,
+  CLIENT_IDENTITY_HEADERS,
+  CLIENT_KINDS,
+  CLIENT_PROOF_CONTENT_TYPE,
+  CLIENT_PROOF_HEADERS,
+  CLIENT_PROOF_PROFILE,
+  CONTRACT_OPERATIONS,
+  CONTROL_PREFIX,
+  CONTROL_TOKEN_HEADER,
+  CanonicalJsonError,
+  ClientProofRefusal,
+  ClientProofState,
+  ContractTypeError,
+  DEFAULT_REPLAY_WINDOW_MILLIS,
+  DEFAULT_SESSION_TTL_MILLIS,
+  DEV_CATALOGUE,
+  DEV_MAX_LIMIT,
+  MemoryReplayLedger,
+  MemoryReplayStore,
+  PROOF_SIGNATURE_BYTES,
+  PROOF_SIGNATURE_HEX_LENGTH,
+  ProofInputError,
+  RedisReplayStore,
+  SERVER_CONTRACT_HEADERS,
+  TestClock,
+  admitClientProofRequest,
+  applyServerContractHeaders,
+  canonicalProofInput,
+  configureClientProofReplayStore,
+  createClientProofDevHandler,
+  createClientProofGuard,
+  createClientVersionMiddleware,
+  decodeEchoRequest,
+  decodeHandshakeRequest,
+  decodeListItemsRequest,
+  encodeCanonicalJson,
+  encodeEchoResponse,
+  encodeHandshakeResponse,
+  encodeListItemsResponse,
+  getClientProofReplayStore,
+  isAppKind,
+  isCanonicalBytes,
+  isContractVersionSupported,
+  isRequestContentType,
+  judgeClientIdentity,
+  newHexId,
+  parseCanonicalJson,
+  parseClientProofPublicKey,
+  readClientIdentity,
+  readCredentials,
+  replayLedgerKey,
+  serverContractHeaders,
+  sha256Hex,
+  signClientProof,
+  systemClock,
+  verifyClientProof
+};
+//# sourceMappingURL=client-proof.js.map