covara 0.11.2 → 0.13.0

package/dist/index.js

@@ -6,12 +6,12 @@ export { useResource } from "./resource/hook.js";
 export { createResourceFilter } from "./resource/filter.js";
 export { changelog, recordCreate, recordUpdate, recordDelete } from "./resource/changelog.js";
 export { encodeCursor, decodeCursor, parseOrderBy, createPagination, setGlobalCursorSigningSecret, getGlobalCursorSigningSecret, } from "./resource/pagination.js";
-export { ResourceError, NotFoundError, ValidationError, UnauthorizedError, ForbiddenError, RateLimitError, BatchLimitError, ConflictError, SearchError, SearchNotConfiguredError, formatErrorResponse, formatZodError, } from "./resource/error.js";
+export { ResourceError, NotFoundError, ValidationError, UnauthorizedError, ForbiddenError, RateLimitError, PowRequiredError, CaptchaRequiredError, BatchLimitError, ConflictError, SearchError, SearchNotConfiguredError, formatErrorResponse, formatZodError, } from "./resource/error.js";
 export { columnName, columnNames, } from "./resource/column-ref.js";
 // Subscriptions
 export { createSubscription as createServerSubscription, pushUpdatesToSubscriptions, pushDeletesToSubscriptions, clearAllSubscriptions, } from "./resource/subscription.js";
 // Procedures
-export { defineProcedure, executeProcedure, createTimestampHooks, composeHooks, } from "./resource/procedures.js";
+export { defineProcedure, procedureBuilder, executeProcedure, createTimestampHooks, composeHooks, } from "./resource/procedures.js";
 // Query utilities
 export { parseSelect, applyProjection } from "./resource/query.js";
 // Auth
@@ -30,6 +30,13 @@ export { hashPassword, verifyPassword, needsRehash } from "./auth/password.js";
 export { createCsrfMiddleware, issueCsrfToken, generateCsrfToken, LoginThrottle, InMemoryVerificationTokenStore, KVVerificationTokenStore, createKVVerificationTokenStore, issueToken, verifyToken, issuePasswordResetToken, verifyPasswordResetToken, hashNewPassword, } from "./auth/index.js";
 export { useAuth, createAuthRoutes } from "./auth/routes.js";
 export { InMemorySessionStore } from "./auth/types.js";
+// Abuse protection (token-bucket budget + proof-of-work)
+export { abuseProtection, setGlobalAbuseProtection, getGlobalAbuseProtection, hasGlobalAbuseProtection, clearGlobalAbuseProtection, isBudgetEnabled, isPowEnabled, DEFAULT_POW_DIFFICULTY, DEFAULT_POW_TTL_MS, } from "./abuse/config.js";
+export { turnstile, hcaptcha, recaptcha, customCaptcha, } from "./abuse/captcha.js";
+export { createAbuseMiddleware } from "./abuse/middleware.js";
+export { enforceAbuse } from "./abuse/enforce.js";
+export { issueChallenge, verifySolution, computeFingerprint, consumeNonce, resolvePowSecret, } from "./pow/server.js";
+export { solveChallenge, sha256Hex, leadingZeroBits, } from "./pow/core.js";
 // Middleware
 export { createRateLimiter } from "./middleware/rateLimit.js";
 export { errorHandler, notFoundHandler } from "./middleware/error.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,cAAc;AACd,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGvD,kBAAkB;AAClB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAe,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,4BAA4B,EAC5B,4BAA4B,GAI7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,UAAU,EACV,WAAW,GAUZ,MAAM,uBAAuB,CAAC;AAE/B,gBAAgB;AAChB,OAAO,EACL,kBAAkB,IAAI,wBAAwB,EAC9C,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC,aAAa;AACb,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,kBAAkB;AAClB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO;AACP,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,EAAE,EACF,EAAE,EACF,EAAE,EACF,GAAG,EACH,EAAE,EACF,GAAG,EACH,MAAM,EACN,KAAK,EACL,IAAI,EACJ,OAAO,EACP,MAAM,EACN,SAAS,EACT,GAAG,EACH,EAAE,EACF,UAAU,EACV,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQ5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAShB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAYpD,aAAa;AACb,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOrF,yBAAyB;AACzB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,eAAe,IAAI,sBAAsB,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC3H,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AASlF,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAUpC,WAAW;AACX,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,MAAM,CAAC;AASd,qFAAqF;AACrF,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,mBAAmB;AACnB,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AASjD,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAUnB,WAAW;AACX,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,MAAM,CAAC;AAgBd,8DAA8D;AAC9D,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAG3N,gBAAgB;AAChB,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAyBhB,mBAAmB;AACnB,OAAO,EACL,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,IAAI,gBAAgB,EAChC,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAoBjB,YAAY;AACZ,OAAO,EACL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAS9B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAG7D,SAAS;AACT,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAelB,yBAAyB;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAkBnB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,oBAAoB;AACpB,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,WAAW,EACX,aAAa,EACb,IAAI,EACJ,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,MAAM,CAAC;AAoBd,QAAQ;AACR,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAWjB,UAAU;AACV,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,GACb,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,cAAc;AACd,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGvD,kBAAkB;AAClB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAe,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,4BAA4B,EAC5B,4BAA4B,GAI7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,UAAU,EACV,WAAW,GAUZ,MAAM,uBAAuB,CAAC;AAE/B,gBAAgB;AAChB,OAAO,EACL,kBAAkB,IAAI,wBAAwB,EAC9C,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC,aAAa;AACb,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,kBAAkB;AAClB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO;AACP,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,EAAE,EACF,EAAE,EACF,EAAE,EACF,GAAG,EACH,EAAE,EACF,GAAG,EACH,MAAM,EACN,KAAK,EACL,IAAI,EACJ,OAAO,EACP,MAAM,EACN,SAAS,EACT,GAAG,EACH,EAAE,EACF,UAAU,EACV,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQ5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAShB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAYpD,yDAAyD;AACzD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,aAAa;AACb,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOrF,yBAAyB;AACzB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,eAAe,IAAI,sBAAsB,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC3H,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AASlF,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAUpC,WAAW;AACX,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,MAAM,CAAC;AASd,qFAAqF;AACrF,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,mBAAmB;AACnB,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AASjD,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAUnB,WAAW;AACX,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,MAAM,CAAC;AAgBd,8DAA8D;AAC9D,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAG3N,gBAAgB;AAChB,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAyBhB,mBAAmB;AACnB,OAAO,EACL,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,IAAI,gBAAgB,EAChC,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAoBjB,YAAY;AACZ,OAAO,EACL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAS9B,wBAAwB;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAG7D,SAAS;AACT,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAelB,yBAAyB;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAkBnB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,oBAAoB;AACpB,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAGlC,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,WAAW,EACX,aAAa,EACb,IAAI,EACJ,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,MAAM,CAAC;AAoBd,QAAQ;AACR,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAWjB,UAAU;AACV,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,GACb,MAAM,WAAW,CAAC"}

package/dist/pow/core.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Isomorphic proof-of-work primitives.
+ *
+ * This module has ZERO Node.js dependencies so it can be bundled into the
+ * browser client. It provides a synchronous SHA-256, base64url codecs, the
+ * leading-zero-bit difficulty metric, the challenge payload encode/decode, and
+ * the hashcash-style solver shared by client and server.
+ */
+export type PowAlgorithm = "sha256";
+export interface ChallengePayload {
+    v: number;
+    d: number;
+    fp: string;
+    iat: number;
+    exp: number;
+    n: string;
+    alg: PowAlgorithm;
+}
+/**
+ * Synchronous SHA-256 over raw bytes, returning the 32-byte digest.
+ */
+export declare const sha256Bytes: (message: Uint8Array) => Uint8Array;
+export declare const utf8Bytes: (input: string) => Uint8Array;
+export declare const bytesToHex: (bytes: Uint8Array) => string;
+export declare const sha256Hex: (input: string | Uint8Array) => string;
+export declare const base64UrlEncodeBytes: (bytes: Uint8Array) => string;
+export declare const base64UrlDecodeBytes: (input: string) => Uint8Array;
+export declare const base64UrlEncode: (input: string) => string;
+export declare const base64UrlDecode: (input: string) => string;
+/**
+ * Count the number of leading zero bits in a byte array (most significant bit
+ * of byte 0 first).
+ */
+export declare const leadingZeroBits: (bytes: Uint8Array) => number;
+export declare const encodeChallengePayload: (payload: ChallengePayload) => string;
+export declare const decodeChallengePayload: (encoded: string) => ChallengePayload;
+/**
+ * Hash that the solver must drive below the difficulty target. The full
+ * challenge token (payload.signature) is concatenated with the candidate nonce
+ * so a solution is bound to the exact issued challenge.
+ */
+export declare const solutionDigest: (token: string, nonce: string, algorithm?: PowAlgorithm) => Uint8Array;
+export declare const meetsDifficulty: (token: string, nonce: string, difficulty: number, algorithm?: PowAlgorithm) => boolean;
+export interface SolveOptions {
+    algorithm?: PowAlgorithm;
+    maxIterations?: number;
+}
+/**
+ * Find a nonce whose `solutionDigest` has at least `difficulty` leading zero
+ * bits. Returns the nonce as a decimal string. Difficulty 0 resolves
+ * immediately. Throws if `maxIterations` is exhausted (a safety valve against
+ * an unreasonable difficulty).
+ */
+export declare const solveChallenge: (token: string, difficulty: number, options?: SolveOptions) => string;
+//# sourceMappingURL=core.d.ts.map

package/dist/pow/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/pow/core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,YAAY,CAAC;CACnB;AAkBD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,UAAU,KAAG,UAwEjD,CAAC;AAKF,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,UAAmC,CAAC;AAI9E,eAAO,MAAM,UAAU,GAAI,OAAO,UAAU,KAAG,MAM9C,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,GAAG,UAAU,KAAG,MACwB,CAAC;AAWhF,eAAO,MAAM,oBAAoB,GAAI,OAAO,UAAU,KAAG,MAgBxD,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,KAAG,UAmBpD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MACR,CAAC;AAEzC,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MACH,CAAC;AAY9C;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,UAAU,KAAG,MAQnD,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,SAAS,gBAAgB,KAAG,MACzB,CAAC;AAE3C,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,gBAaxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,OAAO,MAAM,EACb,YAAW,YAAuB,KACjC,UAKF,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,OAAO,MAAM,EACb,OAAO,MAAM,EACb,YAAY,MAAM,EAClB,YAAW,YAAuB,KACjC,OAAiF,CAAC;AAErF,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,YAAY,MAAM,EAClB,UAAS,YAAiB,KACzB,MAeF,CAAC"}

package/dist/pow/core.js

@@ -0,0 +1,220 @@
+/**
+ * Isomorphic proof-of-work primitives.
+ *
+ * This module has ZERO Node.js dependencies so it can be bundled into the
+ * browser client. It provides a synchronous SHA-256, base64url codecs, the
+ * leading-zero-bit difficulty metric, the challenge payload encode/decode, and
+ * the hashcash-style solver shared by client and server.
+ */
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+/**
+ * Synchronous SHA-256 over raw bytes, returning the 32-byte digest.
+ */
+export const sha256Bytes = (message) => {
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+        0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const bitLen = message.length * 8;
+    const withOne = message.length + 1;
+    const totalLen = withOne + ((56 - (withOne % 64) + 64) % 64) + 8;
+    const padded = new Uint8Array(totalLen);
+    padded.set(message);
+    padded[message.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(totalLen - 4, bitLen >>> 0, false);
+    view.setUint32(totalLen - 8, Math.floor(bitLen / 0x100000000), false);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < totalLen; offset += 64) {
+        for (let i = 0; i < 16; i++) {
+            w[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let a = h[0];
+        let b = h[1];
+        let c = h[2];
+        let d = h[3];
+        let e = h[4];
+        let f = h[5];
+        let g = h[6];
+        let hh = h[7];
+        for (let i = 0; i < 64; i++) {
+            const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+            const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    const out = new Uint8Array(32);
+    const outView = new DataView(out.buffer);
+    for (let i = 0; i < 8; i++) {
+        outView.setUint32(i * 4, h[i], false);
+    }
+    return out;
+};
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export const utf8Bytes = (input) => encoder.encode(input);
+const HEX = "0123456789abcdef";
+export const bytesToHex = (bytes) => {
+    let out = "";
+    for (let i = 0; i < bytes.length; i++) {
+        out += HEX[bytes[i] >>> 4] + HEX[bytes[i] & 0xf];
+    }
+    return out;
+};
+export const sha256Hex = (input) => bytesToHex(sha256Bytes(typeof input === "string" ? utf8Bytes(input) : input));
+const B64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const B64URL_LOOKUP = (() => {
+    const table = new Int16Array(128).fill(-1);
+    for (let i = 0; i < B64URL.length; i++) {
+        table[B64URL.charCodeAt(i)] = i;
+    }
+    return table;
+})();
+export const base64UrlEncodeBytes = (bytes) => {
+    let out = "";
+    let i = 0;
+    for (; i + 2 < bytes.length; i += 3) {
+        const n = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
+        out += B64URL[(n >>> 18) & 63] + B64URL[(n >>> 12) & 63] + B64URL[(n >>> 6) & 63] + B64URL[n & 63];
+    }
+    const rem = bytes.length - i;
+    if (rem === 1) {
+        const n = bytes[i] << 16;
+        out += B64URL[(n >>> 18) & 63] + B64URL[(n >>> 12) & 63];
+    }
+    else if (rem === 2) {
+        const n = (bytes[i] << 16) | (bytes[i + 1] << 8);
+        out += B64URL[(n >>> 18) & 63] + B64URL[(n >>> 12) & 63] + B64URL[(n >>> 6) & 63];
+    }
+    return out;
+};
+export const base64UrlDecodeBytes = (input) => {
+    const len = input.length;
+    const bytes = [];
+    let buffer = 0;
+    let bits = 0;
+    for (let i = 0; i < len; i++) {
+        const code = input.charCodeAt(i);
+        const value = code < 128 ? B64URL_LOOKUP[code] : -1;
+        if (value === -1) {
+            throw new Error("Invalid base64url character");
+        }
+        buffer = (buffer << 6) | value;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((buffer >>> bits) & 0xff);
+        }
+    }
+    return new Uint8Array(bytes);
+};
+export const base64UrlEncode = (input) => base64UrlEncodeBytes(utf8Bytes(input));
+export const base64UrlDecode = (input) => decoder.decode(base64UrlDecodeBytes(input));
+const CLZ8 = (byte) => {
+    if (byte === 0)
+        return 8;
+    let n = 0;
+    for (let mask = 0x80; mask > 0; mask >>= 1) {
+        if (byte & mask)
+            break;
+        n++;
+    }
+    return n;
+};
+/**
+ * Count the number of leading zero bits in a byte array (most significant bit
+ * of byte 0 first).
+ */
+export const leadingZeroBits = (bytes) => {
+    let count = 0;
+    for (let i = 0; i < bytes.length; i++) {
+        const z = CLZ8(bytes[i]);
+        count += z;
+        if (z !== 8)
+            break;
+    }
+    return count;
+};
+export const encodeChallengePayload = (payload) => base64UrlEncode(JSON.stringify(payload));
+export const decodeChallengePayload = (encoded) => {
+    const parsed = JSON.parse(base64UrlDecode(encoded));
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        typeof parsed.d !== "number" ||
+        typeof parsed.fp !== "string" ||
+        typeof parsed.exp !== "number" ||
+        typeof parsed.n !== "string") {
+        throw new Error("Malformed challenge payload");
+    }
+    return parsed;
+};
+/**
+ * Hash that the solver must drive below the difficulty target. The full
+ * challenge token (payload.signature) is concatenated with the candidate nonce
+ * so a solution is bound to the exact issued challenge.
+ */
+export const solutionDigest = (token, nonce, algorithm = "sha256") => {
+    if (algorithm !== "sha256") {
+        throw new Error(`Unsupported proof-of-work algorithm: ${algorithm}`);
+    }
+    return sha256Bytes(utf8Bytes(`${token}:${nonce}`));
+};
+export const meetsDifficulty = (token, nonce, difficulty, algorithm = "sha256") => leadingZeroBits(solutionDigest(token, nonce, algorithm)) >= difficulty;
+/**
+ * Find a nonce whose `solutionDigest` has at least `difficulty` leading zero
+ * bits. Returns the nonce as a decimal string. Difficulty 0 resolves
+ * immediately. Throws if `maxIterations` is exhausted (a safety valve against
+ * an unreasonable difficulty).
+ */
+export const solveChallenge = (token, difficulty, options = {}) => {
+    const algorithm = options.algorithm ?? "sha256";
+    const maxIterations = options.maxIterations ?? 1e8;
+    if (difficulty <= 0) {
+        return "0";
+    }
+    for (let nonce = 0; nonce < maxIterations; nonce++) {
+        const candidate = String(nonce);
+        if (meetsDifficulty(token, candidate, difficulty, algorithm)) {
+            return candidate;
+        }
+    }
+    throw new Error(`Proof-of-work not solved within ${maxIterations} iterations (difficulty ${difficulty})`);
+};
+//# sourceMappingURL=core.js.map

package/dist/pow/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/pow/core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;IACxB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC/C,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE3E;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAmB,EAAc,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;QACxB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;QACtE,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IAEtE,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAE9B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAE5B,EAAE,GAAG,CAAC,CAAC;YACP,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9E,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAU,EAAE;IACtD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAA0B,EAAU,EAAE,CAC9D,UAAU,CAAC,WAAW,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEhF,MAAM,MAAM,GAAG,kEAAkE,CAAC;AAClF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAiB,EAAU,EAAE;IAChE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAAc,EAAE;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACvD,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACvD,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AAE9C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;IACpC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,GAAG,IAAI;YAAE,MAAM;QACvB,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC1E,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAoB,EAAE;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAqB,CAAC;IACxE,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ;QAC5B,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAa,EACb,KAAa,EACb,YAA0B,QAAQ,EACtB,EAAE;IACd,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAAa,EACb,KAAa,EACb,UAAkB,EAClB,YAA0B,QAAQ,EACzB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,UAAU,CAAC;AAOrF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAa,EACb,UAAkB,EAClB,UAAwB,EAAE,EAClB,EAAE;IACV,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC;IACnD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mCAAmC,aAAa,2BAA2B,UAAU,GAAG,CACzF,CAAC;AACJ,CAAC,CAAC"}

package/dist/pow/server.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Server-side proof-of-work: stateless signed challenge issuance + verification
+ * plus a short-TTL replay cache. Challenge verification is cryptographically
+ * stateless (HMAC); only one-time-use enforcement touches the (KV or memory)
+ * replay cache.
+ */
+import type { KVAdapter } from "../kv/index.js";
+import { type ChallengePayload, type PowAlgorithm } from "./core.js";
+export declare const POW_HEADER: {
+    readonly challenge: "Covara-PoW-Challenge";
+    readonly difficulty: "Covara-PoW-Difficulty";
+    readonly algorithm: "Covara-PoW-Algorithm";
+    readonly nonce: "Covara-PoW-Nonce";
+};
+/**
+ * Resolve the HMAC secret: explicit config -> COVARA_POW_SECRET env -> a random
+ * dev-only secret (warns; a random per-process secret breaks verification
+ * across processes, so production must set one explicitly).
+ */
+export declare const resolvePowSecret: (configured?: string) => string;
+export declare const resetPowSecretForTests: () => void;
+/**
+ * Bind a challenge to the exact request: method + path(+query) + a hash of the
+ * raw body. The client re-sends the identical request, so the fingerprint
+ * recomputes to the same value on the retry.
+ */
+export declare const computeFingerprint: (method: string, pathWithQuery: string, bodyText?: string) => string;
+export interface IssueChallengeOptions {
+    secret: string;
+    difficulty: number;
+    fingerprint: string;
+    ttlMs?: number;
+    algorithm?: PowAlgorithm;
+    now?: number;
+    nonce?: string;
+}
+export interface IssuedChallenge {
+    token: string;
+    difficulty: number;
+    algorithm: PowAlgorithm;
+    expiresAt: number;
+}
+export declare const issueChallenge: (options: IssueChallengeOptions) => IssuedChallenge;
+export type VerifyFailure = "missing" | "malformed" | "bad_signature" | "expired" | "fingerprint_mismatch" | "insufficient_difficulty" | "replayed";
+export interface VerifyResult {
+    ok: boolean;
+    reason?: VerifyFailure;
+    payload?: ChallengePayload;
+}
+export interface VerifySolutionOptions {
+    secret: string;
+    token: string | undefined | null;
+    nonce: string | undefined | null;
+    fingerprint: string;
+    now?: number;
+}
+/**
+ * Stateless verification of a submitted solution. Does NOT consult the replay
+ * cache — call `consumeNonce` separately once verification passes so a failed
+ * verification never burns a nonce.
+ */
+export declare const verifySolution: (options: VerifySolutionOptions) => VerifyResult;
+/**
+ * Atomically record a nonce as consumed. Returns true when the nonce is fresh
+ * (first use) and false when it has already been used within its TTL window.
+ * Uses an atomic INCR on the global KV (or an injected store); falls back to an
+ * in-process map when no KV is configured.
+ */
+export declare const consumeNonce: (nonce: string, expiresAt: number, store?: KVAdapter, now?: number) => Promise<boolean>;
+export declare const clearReplayCacheForTests: () => void;
+//# sourceMappingURL=server.d.ts.map

package/dist/pow/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/pow/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAItC,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,QAAQ,CAAC;AAEhB,eAAO,MAAM,UAAU;;;;;CAKb,CAAC;AAQX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,KAAG,MAYtD,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAO,IAEzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,eAAe,MAAM,EACrB,iBAAa,KACZ,MAC6E,CAAC;AAOjF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,cAAc,GAAI,SAAS,qBAAqB,KAAG,eAgB/D,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,WAAW,GACX,eAAe,GACf,SAAS,GACT,sBAAsB,GACtB,yBAAyB,GACzB,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,qBAAqB,KAAG,YAiC/D,CAAC;AAsBF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GACvB,OAAO,MAAM,EACb,WAAW,MAAM,EACjB,QAAQ,SAAS,EACjB,YAAgB,KACf,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAEF,eAAO,MAAM,wBAAwB,QAAO,IAM3C,CAAC"}

package/dist/pow/server.js

@@ -0,0 +1,152 @@
+/**
+ * Server-side proof-of-work: stateless signed challenge issuance + verification
+ * plus a short-TTL replay cache. Challenge verification is cryptographically
+ * stateless (HMAC); only one-time-use enforcement touches the (KV or memory)
+ * replay cache.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { getGlobalKV, hasGlobalKV } from "../kv/index.js";
+import { getLogger } from "../server/logger.js";
+import { readEnv } from "../server/env.js";
+import { base64UrlEncodeBytes, decodeChallengePayload, encodeChallengePayload, meetsDifficulty, sha256Hex, utf8Bytes, } from "./core.js";
+export const POW_HEADER = {
+    challenge: "Covara-PoW-Challenge",
+    difficulty: "Covara-PoW-Difficulty",
+    algorithm: "Covara-PoW-Algorithm",
+    nonce: "Covara-PoW-Nonce",
+};
+const CHALLENGE_VERSION = 1;
+const REPLAY_PREFIX = "covara:pow:used:";
+const DEFAULT_TTL_MS = 120000;
+let resolvedSecret = null;
+/**
+ * Resolve the HMAC secret: explicit config -> COVARA_POW_SECRET env -> a random
+ * dev-only secret (warns; a random per-process secret breaks verification
+ * across processes, so production must set one explicitly).
+ */
+export const resolvePowSecret = (configured) => {
+    if (configured)
+        return configured;
+    const fromEnv = readEnv("COVARA_POW_SECRET");
+    if (fromEnv)
+        return fromEnv;
+    if (!resolvedSecret) {
+        resolvedSecret = randomBytes(32).toString("hex");
+        getLogger().warn("Proof-of-work secret not configured; generated a random per-process secret. " +
+            "Set COVARA_POW_SECRET (or abuseProtection.pow.secret) so challenges verify across processes/restarts.");
+    }
+    return resolvedSecret;
+};
+export const resetPowSecretForTests = () => {
+    resolvedSecret = null;
+};
+/**
+ * Bind a challenge to the exact request: method + path(+query) + a hash of the
+ * raw body. The client re-sends the identical request, so the fingerprint
+ * recomputes to the same value on the retry.
+ */
+export const computeFingerprint = (method, pathWithQuery, bodyText = "") => sha256Hex(`${method.toUpperCase()}\n${pathWithQuery}\n${sha256Hex(bodyText)}`);
+const sign = (secret, payloadEncoded) => base64UrlEncodeBytes(new Uint8Array(createHmac("sha256", secret).update(payloadEncoded).digest()));
+export const issueChallenge = (options) => {
+    const now = options.now ?? Date.now();
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const algorithm = options.algorithm ?? "sha256";
+    const payload = {
+        v: CHALLENGE_VERSION,
+        d: options.difficulty,
+        fp: options.fingerprint,
+        iat: now,
+        exp: now + ttlMs,
+        n: options.nonce ?? randomBytes(16).toString("hex"),
+        alg: algorithm,
+    };
+    const encoded = encodeChallengePayload(payload);
+    const token = `${encoded}.${sign(options.secret, encoded)}`;
+    return { token, difficulty: options.difficulty, algorithm, expiresAt: payload.exp };
+};
+/**
+ * Stateless verification of a submitted solution. Does NOT consult the replay
+ * cache — call `consumeNonce` separately once verification passes so a failed
+ * verification never burns a nonce.
+ */
+export const verifySolution = (options) => {
+    const { secret, token, nonce, fingerprint } = options;
+    const now = options.now ?? Date.now();
+    if (!token || !nonce)
+        return { ok: false, reason: "missing" };
+    const dot = token.indexOf(".");
+    if (dot <= 0 || dot === token.length - 1)
+        return { ok: false, reason: "malformed" };
+    const encoded = token.slice(0, dot);
+    const providedSig = token.slice(dot + 1);
+    let payload;
+    try {
+        payload = decodeChallengePayload(encoded);
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    const expectedSig = sign(secret, encoded);
+    const a = utf8Bytes(providedSig);
+    const b = utf8Bytes(expectedSig);
+    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (payload.exp <= now)
+        return { ok: false, reason: "expired" };
+    if (payload.fp !== fingerprint)
+        return { ok: false, reason: "fingerprint_mismatch" };
+    if (!meetsDifficulty(token, nonce, payload.d, payload.alg)) {
+        return { ok: false, reason: "insufficient_difficulty" };
+    }
+    return { ok: true, payload };
+};
+const memoryReplay = new Map();
+let memoryCleanup = null;
+const ensureMemoryCleanup = () => {
+    if (memoryCleanup)
+        return;
+    memoryCleanup = setInterval(() => {
+        const now = Date.now();
+        for (const [key, entry] of memoryReplay) {
+            if (entry.expiresAt <= now)
+                memoryReplay.delete(key);
+        }
+    }, 60000);
+    if (typeof memoryCleanup === "object" && "unref" in memoryCleanup) {
+        memoryCleanup.unref();
+    }
+};
+/**
+ * Atomically record a nonce as consumed. Returns true when the nonce is fresh
+ * (first use) and false when it has already been used within its TTL window.
+ * Uses an atomic INCR on the global KV (or an injected store); falls back to an
+ * in-process map when no KV is configured.
+ */
+export const consumeNonce = async (nonce, expiresAt, store, now = Date.now()) => {
+    const ttlSeconds = Math.max(1, Math.ceil((expiresAt - now) / 1000));
+    const kv = store ?? (hasGlobalKV() ? getGlobalKV() : null);
+    if (!kv) {
+        ensureMemoryCleanup();
+        const existing = memoryReplay.get(nonce);
+        if (existing && existing.expiresAt > now)
+            return false;
+        memoryReplay.set(nonce, { expiresAt });
+        return true;
+    }
+    const key = `${REPLAY_PREFIX}${nonce}`;
+    const count = await kv.incr(key);
+    if (count === 1) {
+        await kv.expire(key, ttlSeconds);
+        return true;
+    }
+    return false;
+};
+export const clearReplayCacheForTests = () => {
+    memoryReplay.clear();
+    if (memoryCleanup) {
+        clearInterval(memoryCleanup);
+        memoryCleanup = null;
+    }
+};
+//# sourceMappingURL=server.js.map

package/dist/pow/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/pow/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,SAAS,GAGV,MAAM,QAAQ,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,sBAAsB;IACjC,UAAU,EAAE,uBAAuB;IACnC,SAAS,EAAE,sBAAsB;IACjC,KAAK,EAAE,kBAAkB;CACjB,CAAC;AAEX,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,cAAc,GAAG,MAAO,CAAC;AAE/B,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAmB,EAAU,EAAE;IAC9D,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,SAAS,EAAE,CAAC,IAAI,CACd,8EAA8E;YAC5E,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAS,EAAE;IAC/C,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,aAAqB,EACrB,QAAQ,GAAG,EAAE,EACL,EAAE,CACV,SAAS,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,aAAa,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEjF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,cAAsB,EAAU,EAAE,CAC9D,oBAAoB,CAClB,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAC7E,CAAC;AAmBJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA8B,EAAmB,EAAE;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,OAAO,GAAqB;QAChC,CAAC,EAAE,iBAAiB;QACpB,CAAC,EAAE,OAAO,CAAC,UAAU;QACrB,EAAE,EAAE,OAAO,CAAC,WAAW;QACvB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,KAAK;QAChB,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnD,GAAG,EAAE,SAAS;KACf,CAAC;IACF,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AACtF,CAAC,CAAC;AAyBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA8B,EAAgB,EAAE;IAC7E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEpF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEzC,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACrF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC,CAAC;AAMF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;AACpD,IAAI,aAAa,GAA0C,IAAI,CAAC;AAEhE,MAAM,mBAAmB,GAAG,GAAS,EAAE;IACrC,IAAI,aAAa;QAAE,OAAO;IAC1B,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,EAAE,KAAM,CAAC,CAAC;IACX,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;QAClE,aAAa,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,KAAa,EACb,SAAiB,EACjB,KAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EACE,EAAE;IACpB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE3D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,mBAAmB,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,KAAK,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAS,EAAE;IACjD,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,aAAa,CAAC,CAAC;QAC7B,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC,CAAC"}

package/dist/resource/error.d.ts

@@ -4,6 +4,8 @@ export declare const ERROR_TYPES: {
     readonly NOT_FOUND: "/__covara/problems/not-found";
     readonly VALIDATION_ERROR: "/__covara/problems/validation-error";
     readonly RATE_LIMIT_EXCEEDED: "/__covara/problems/rate-limit-exceeded";
+    readonly PROOF_OF_WORK_REQUIRED: "/__covara/problems/proof-of-work-required";
+    readonly CAPTCHA_REQUIRED: "/__covara/problems/captcha-required";
     readonly FILTER_PARSE_ERROR: "/__covara/problems/filter-parse-error";
     readonly UNAUTHORIZED: "/__covara/problems/unauthorized";
     readonly FORBIDDEN: "/__covara/problems/forbidden";
@@ -59,6 +61,18 @@ export declare class RateLimitError extends ResourceError {
     retryAfter: number;
     constructor(retryAfter: number, message?: string);
 }
+export declare class PowRequiredError extends ResourceError {
+    challenge: string;
+    difficulty: number;
+    algorithm: string;
+    constructor(challenge: string, difficulty: number, algorithm?: string, message?: string);
+}
+export declare class CaptchaRequiredError extends ResourceError {
+    provider: string;
+    siteKey?: string | undefined;
+    action?: string | undefined;
+    constructor(provider: string, siteKey?: string | undefined, action?: string | undefined, message?: string);
+}
 export declare class UnauthorizedError extends ResourceError {
     constructor(message?: string);
 }
@@ -98,6 +112,9 @@ export declare class SearchNotConfiguredError extends ResourceError {
 export declare class SearchError extends ResourceError {
     constructor(message: string, details?: unknown);
 }
+export declare class RelationPathNotInMemoryError extends Error {
+    constructor(field: string);
+}
 export declare const formatZodError: (error: ZodError) => FieldError[];
 export declare const formatRFC7807Error: (error: unknown, requestId?: string) => ProblemDetail;
 export declare const formatErrorResponse: (error: unknown) => {