dbsc-toolkit 1.4.0 → 2.0.0

package/dist/nextjs/index.js

@@ -1,12 +1,12 @@
 import { NextResponse } from "next/server.js";
-import { handleRegistration, handleRefresh, issueChallenge, buildRegistrationHeader, buildChallengeHeader, parseSessionSkippedHeader, REGISTRATION_HEADER, CHALLENGE_HEADER, LEGACY_REGISTRATION_HEADER, LEGACY_CHALLENGE_HEADER, NoopRateLimiter, emit, DbscProtocolError, DbscVerificationError, } from "../core/index.js";
+import { handleRegistration, handleRefresh, handleBoundRegistration, handleBoundRefresh, issueChallenge, buildRegistrationHeader, buildChallengeHeader, parseSessionSkippedHeader, REGISTRATION_HEADER, CHALLENGE_HEADER, LEGACY_REGISTRATION_HEADER, LEGACY_CHALLENGE_HEADER, NoopRateLimiter, emit, DbscProtocolError, DbscVerificationError, ErrorCodes, } from "../core/index.js";
 const cookieNames = (secure) => ({
     bound: secure ? "__Host-dbsc-session" : "dbsc-session",
     reg: secure ? "__Host-dbsc-reg" : "dbsc-reg",
     challenge: secure ? "__Host-dbsc-challenge" : "dbsc-challenge",
 });
-const DEFAULT_BOUND_TTL = 10 * 60;
-const DEFAULT_REG_TTL = 24 * 60 * 60;
+const DEFAULT_BOUND_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_REG_TTL_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 function cookieBase(secure) {
     return {
@@ -19,7 +19,7 @@ function cookieBase(secure) {
 export async function bindSession(res, sessionId, storage, opts) {
     const secure = opts.secure ?? true;
     const registrationPath = opts.registrationPath ?? "/dbsc/registration";
-    const regCookieTtl = opts.registrationCookieTtl ?? DEFAULT_REG_TTL * 1000;
+    const regCookieTtl = opts.registrationCookieTtl ?? DEFAULT_REG_TTL_MS;
     const sessionTtl = opts.sessionTtl ?? DEFAULT_SESSION_TTL_MS;
     const existing = await storage.getSession(sessionId);
     const now = Date.now();
@@ -52,7 +52,7 @@ export async function bindSession(res, sessionId, storage, opts) {
     });
 }
 export function createDbscMiddleware(opts) {
-    const { storage, registrationPath = "/dbsc/registration", refreshPath = "/dbsc/refresh", boundCookieTtl = DEFAULT_BOUND_TTL * 1000, registrationCookieTtl = DEFAULT_REG_TTL * 1000, rateLimiter = new NoopRateLimiter(), onEvent, autoBind, secure = true, } = opts;
+    const { storage, registrationPath = "/dbsc/registration", refreshPath = "/dbsc/refresh", boundStatePath = "/dbsc-bound/state", boundChallengePath = "/dbsc-bound/challenge", boundRegistrationPath = "/dbsc-bound/registration", boundRefreshPath = "/dbsc-bound/refresh", boundCookieTtl = DEFAULT_BOUND_TTL_MS, registrationCookieTtl = DEFAULT_REG_TTL_MS, rateLimiter = new NoopRateLimiter(), onEvent, autoBind, secure = true, } = opts;
     const COOKIES = cookieNames(secure);
     return async function middleware(req) {
         const url = req.nextUrl.pathname;
@@ -191,6 +191,135 @@ export function createDbscMiddleware(opts) {
                 throw err;
             }
         }
+        const readBoundSessionId = () => req.cookies.get(COOKIES.bound)?.value ?? req.cookies.get(COOKIES.reg)?.value;
+        if (req.method === "GET" && url === boundStatePath) {
+            const sid = readBoundSessionId();
+            if (!sid)
+                return NextResponse.json({ phase: "unbound", sessionId: null });
+            const session = await storage.getSession(sid);
+            if (!session)
+                return NextResponse.json({ phase: "unbound", sessionId: null });
+            const key = await storage.getBoundKey(sid);
+            if (!key) {
+                const challenge = await issueChallenge(sid, storage);
+                return NextResponse.json({ phase: "needs-registration", sessionId: sid, challenge: challenge.jti });
+            }
+            return NextResponse.json({
+                phase: "bound",
+                sessionId: sid,
+                tier: session.tier,
+                refreshIntervalMs: boundCookieTtl,
+            });
+        }
+        if (req.method === "GET" && url === boundChallengePath) {
+            const sid = readBoundSessionId();
+            if (!sid)
+                return NextResponse.json({ error: "no session" }, { status: 403 });
+            const session = await storage.getSession(sid);
+            if (!session)
+                return NextResponse.json({ error: "no session" }, { status: 403 });
+            const challenge = await issueChallenge(sid, storage);
+            return NextResponse.json({ challenge: challenge.jti });
+        }
+        if (req.method === "POST" && url === boundRegistrationPath) {
+            const allowed = await rateLimiter.checkRegistration(ip);
+            if (!allowed)
+                return NextResponse.json({ error: "rate limited" }, { status: 429 });
+            const sid = readBoundSessionId();
+            if (!sid)
+                return NextResponse.json({ error: "missing session cookie" }, { status: 400 });
+            let body;
+            try {
+                body = (await req.json()) ?? {};
+            }
+            catch {
+                return NextResponse.json({ error: "body must be JSON" }, { status: 400 });
+            }
+            if (!body.publicKey || !body.signature || !body.challenge) {
+                return NextResponse.json({ error: "publicKey, signature, and challenge are required" }, { status: 400 });
+            }
+            try {
+                await handleBoundRegistration({ sessionId: sid, publicKey: body.publicKey, signature: body.signature, expectedJti: body.challenge }, storage);
+                emit(onEvent, {
+                    type: "registration",
+                    sessionId: sid,
+                    tier: "bound",
+                    timestamp: Date.now(),
+                    algorithm: "ES256",
+                    ip,
+                });
+                const res = NextResponse.json({
+                    session_identifier: sid,
+                    refresh_url: boundRefreshPath,
+                    tier: "bound",
+                });
+                res.cookies.set(COOKIES.bound, sid, { ...cookieBase(secure), maxAge: boundCookieTtl / 1000 });
+                return res;
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sid);
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, {
+                        type: "verification_failure",
+                        sessionId: sid,
+                        tier: "bound",
+                        timestamp: Date.now(),
+                        reason: err.code,
+                        ip,
+                    });
+                    return NextResponse.json({ error: err.message }, { status: 400 });
+                }
+                throw err;
+            }
+        }
+        if (req.method === "POST" && url === boundRefreshPath) {
+            const sid = readBoundSessionId();
+            if (!sid)
+                return NextResponse.json({ error: "no session" }, { status: 403 });
+            const allowed = await rateLimiter.checkRefresh(ip, sid);
+            if (!allowed)
+                return NextResponse.json({ error: "rate limited" }, { status: 429 });
+            let body;
+            try {
+                body = (await req.json()) ?? {};
+            }
+            catch {
+                return NextResponse.json({ error: "body must be JSON" }, { status: 400 });
+            }
+            if (!body.challenge || !body.signature || typeof body.timestamp !== "number") {
+                return NextResponse.json({ error: "challenge, signature, and timestamp are required" }, { status: 400 });
+            }
+            try {
+                await handleBoundRefresh({ sessionId: sid, signature: body.signature, expectedJti: body.challenge, timestamp: body.timestamp }, storage);
+                emit(onEvent, { type: "refresh", sessionId: sid, tier: "bound", timestamp: Date.now(), ip });
+                const res = NextResponse.json({
+                    session_identifier: sid,
+                    refresh_url: boundRefreshPath,
+                    tier: "bound",
+                });
+                res.cookies.set(COOKIES.bound, sid, { ...cookieBase(secure), maxAge: boundCookieTtl / 1000 });
+                return res;
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sid);
+                const keyStillThere = await storage.getBoundKey(sid);
+                if (keyStillThere && err instanceof DbscVerificationError && err.code === ErrorCodes.SIGNATURE_INVALID) {
+                    emit(onEvent, { type: "session_stolen", sessionId: sid, tier: "bound", timestamp: Date.now(), ip });
+                }
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, {
+                        type: "verification_failure",
+                        sessionId: sid,
+                        tier: "bound",
+                        timestamp: Date.now(),
+                        reason: err.code,
+                        ip,
+                    });
+                    return NextResponse.json({ error: err.message }, { status: 401 });
+                }
+                throw err;
+            }
+        }
         if (autoBind && !req.cookies.get(COOKIES.bound)?.value && !req.cookies.get(COOKIES.reg)?.value) {
             const result = await autoBind(req);
             if (result) {
@@ -228,9 +357,10 @@ export async function getDbscSession(req, storage, opts = {}) {
     const session = await storage.getSession(sessionId);
     if (!session)
         return { sessionId: null, tier: "none", skipped, revoke };
-    const boundCookieTtl = opts.boundCookieTtl ?? DEFAULT_BOUND_TTL * 1000;
+    const boundCookieTtl = opts.boundCookieTtl ?? DEFAULT_BOUND_TTL_MS;
     const staleAfter = session.lastRefreshAt + boundCookieTtl;
-    if (session.tier === "dbsc" && Date.now() > staleAfter) {
+    const refreshable = session.tier === "dbsc" || session.tier === "bound";
+    if (refreshable && Date.now() > staleAfter) {
         return { sessionId, tier: "none", skipped, revoke };
     }
     return { sessionId, tier: session.tier, skipped, revoke };

package/dist/nextjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,iBAAiB,EACjB,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc;IACtD,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;IAC5C,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB;CAC/D,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAClC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAMnD,SAAS,UAAU,CAAC,MAAe;IACjC,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,SAAiB,EACjB,OAAuB,EACvB,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,eAAe,GAAG,IAAI,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,UAAU;YAC3B,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC;QACxC,WAAW,EAAE,gBAAgB;QAC7B,SAAS,EAAE,SAAS,CAAC,GAAG;QACxB,UAAU,EAAE,OAAO,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAChD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAEvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;QACtC,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,YAAY,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;QAChD,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,GAAG,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,EACJ,OAAO,EACP,gBAAgB,GAAG,oBAAoB,EACvC,WAAW,GAAG,eAAe,EAC7B,cAAc,GAAG,iBAAiB,GAAG,IAAI,EACzC,qBAAqB,GAAG,eAAe,GAAG,IAAI,EAC9C,WAAW,GAAG,IAAI,eAAe,EAAE,EACnC,OAAO,EACP,QAAQ,EACR,MAAM,GAAG,IAAI,GACd,GAAG,IAAI,CAAC;IAET,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,KAAK,UAAU,UAAU,CAAC,GAAgB;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QAE3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;YAE9D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,kBAAkB,CACtB;oBACE,SAAS;oBACT,wBAAwB,EACtB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;wBAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;wBACvC,SAAS;oBACX,WAAW;iBACZ,EACD,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,cAAc;oBACpB,SAAS;oBACT,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,SAAS,EAAE,OAAO;oBAClB,EAAE;iBACH,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG;oBACX,kBAAkB,EAAE,SAAS;oBAC7B,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE;wBACL,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;wBAC1B,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,EAAE;qBACxB;oBACD,WAAW,EAAE;wBACX;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO,CAAC,KAAK;4BACnB,UAAU,EAAE,wCAAwC;yBACrD;qBACF;iBACF,CAAC;gBACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;oBACxC,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,cAAc,GAAG,IAAI;iBAC9B,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,cAAc,GAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAE1C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACzF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;oBAChD,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;YAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACzF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;oBAChD,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;gBAEnG,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,SAAS;oBACf,SAAS;oBACT,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,EAAE;iBACH,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG;oBACX,kBAAkB,EAAE,SAAS;oBAC7B,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE;wBACL,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;wBAC1B,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,EAAE;qBACxB;oBACD,WAAW,EAAE;wBACX;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO,CAAC,KAAK;4BACnB,UAAU,EAAE,wCAAwC;yBACrD;qBACF;iBACF,CAAC;gBACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;oBACxC,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,cAAc,GAAG,IAAI;iBAC9B,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE;oBAChD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM;oBACN,gBAAgB;oBAChB,qBAAqB;iBACtB,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgB,EAChB,OAA+B,EAC/B,OAA0E,EAAE;IAE5E,MAAM,UAAU,GAAuC;QACrD,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS;QAChF,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS;KAC3E,CAAC;IACF,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAEhE,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,SAAS;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAExE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,GAKX,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc;IACtD,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;IAC5C,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB;CAC/D,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAUnD,SAAS,UAAU,CAAC,MAAe;IACjC,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,SAAiB,EACjB,OAAuB,EACvB,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,kBAAkB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,UAAU;YAC3B,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC;QACxC,WAAW,EAAE,gBAAgB;QAC7B,SAAS,EAAE,SAAS,CAAC,GAAG;QACxB,UAAU,EAAE,OAAO,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAChD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAEvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;QACtC,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,YAAY,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;QAChD,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,GAAG,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,EACJ,OAAO,EACP,gBAAgB,GAAG,oBAAoB,EACvC,WAAW,GAAG,eAAe,EAC7B,cAAc,GAAG,mBAAmB,EACpC,kBAAkB,GAAG,uBAAuB,EAC5C,qBAAqB,GAAG,0BAA0B,EAClD,gBAAgB,GAAG,qBAAqB,EACxC,cAAc,GAAG,oBAAoB,EACrC,qBAAqB,GAAG,kBAAkB,EAC1C,WAAW,GAAG,IAAI,eAAe,EAAE,EACnC,OAAO,EACP,QAAQ,EACR,MAAM,GAAG,IAAI,GACd,GAAG,IAAI,CAAC;IAET,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,KAAK,UAAU,UAAU,CAAC,GAAgB;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QAE3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;YAE9D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,kBAAkB,CACtB;oBACE,SAAS;oBACT,wBAAwB,EACtB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;wBAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;wBACvC,SAAS;oBACX,WAAW;iBACZ,EACD,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,cAAc;oBACpB,SAAS;oBACT,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,SAAS,EAAE,OAAO;oBAClB,EAAE;iBACH,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG;oBACX,kBAAkB,EAAE,SAAS;oBAC7B,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE;wBACL,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;wBAC1B,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,EAAE;qBACxB;oBACD,WAAW,EAAE;wBACX;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO,CAAC,KAAK;4BACnB,UAAU,EAAE,wCAAwC;yBACrD;qBACF;iBACF,CAAC;gBACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;oBACxC,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,cAAc,GAAG,IAAI;iBAC9B,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,cAAc,GAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAE1C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACzF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;oBAChD,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;YAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACzF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;oBAChD,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;gBAEnG,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,SAAS;oBACf,SAAS;oBACT,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,EAAE;iBACH,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG;oBACX,kBAAkB,EAAE,SAAS;oBAC7B,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE;wBACL,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;wBAC1B,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,EAAE;qBACxB;oBACD,WAAW,EAAE;wBACX;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO,CAAC,KAAK;4BACnB,UAAU,EAAE,wCAAwC;yBACrD;qBACF;iBACF,CAAC;gBACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;oBACxC,GAAG,UAAU,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,cAAc,GAAG,IAAI;iBAC9B,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,GAAuB,EAAE,CAClD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAE/E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC;gBACvB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,GAAG;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,iBAAiB,EAAE,cAAc;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnF,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEzF,IAAI,IAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1D,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,uBAAuB,CAC3B,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EACrG,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE;oBACZ,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,GAAG;oBACd,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,SAAS,EAAE,OAAO;oBAClB,EAAE;iBACH,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC;oBAC5B,kBAAkB,EAAE,GAAG;oBACvB,WAAW,EAAE,gBAAgB;oBAC7B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,SAAS,EAAE,GAAG;wBACd,IAAI,EAAE,OAAO;wBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;wBACrB,MAAM,EAAE,GAAG,CAAC,IAAI;wBAChB,EAAE;qBACH,CAAC,CAAC;oBACH,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAE7E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnF,IAAI,IAAoE,CAAC;YACzE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC7E,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,kBAAkB,CACtB,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EACrG,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7F,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC;oBAC5B,kBAAkB,EAAE,GAAG;oBACvB,WAAW,EAAE,gBAAgB;oBAC7B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrD,IAAI,aAAa,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBACvG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,SAAS,EAAE,GAAG;wBACd,IAAI,EAAE,OAAO;wBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;wBACrB,MAAM,EAAE,GAAG,CAAC,IAAI;wBAChB,EAAE;qBACH,CAAC,CAAC;oBACH,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE;oBAChD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM;oBACN,gBAAgB;oBAChB,qBAAqB;iBACtB,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgB,EAChB,OAA+B,EAC/B,OAA0E,EAAE;IAE5E,MAAM,UAAU,GAAuC;QACrD,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS;QAChF,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS;KAC3E,CAAC;IACF,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAEhE,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,SAAS;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAExE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;IACxE,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dbsc-toolkit",
-  "version": "1.4.0",
-  "description": "Server-side Device Bound Session Credentials (DBSC) for Node.js. Verified against Chrome 147.",
+  "version": "2.0.0",
+  "description": "Server-side Device Bound Session Credentials (DBSC) for Node.js plus a Web Crypto polyfill for Firefox, Safari, and older Chromium. Cookie-theft protection on every modern browser.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.js",
@@ -56,7 +56,6 @@
     "clean": "rimraf dist"
   },
   "dependencies": {
-    "@simplewebauthn/server": "^13.3.0",
     "jose": "^6.2.3"
   },
   "peerDependencies": {
@@ -93,7 +92,6 @@
   },
   "devDependencies": {
     "@fastify/cookie": "^11.0.2",
-    "@simplewebauthn/browser": "^13.3.0",
     "@types/express": "^5.0.6",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.0.0",

package/dist/client/detect.d.ts

@@ -1,3 +0,0 @@
-export type ClientTier = "dbsc" | "webauthn" | "hmac" | "none";
-export declare function detectClientTier(): Promise<ClientTier>;
-//# sourceMappingURL=detect.d.ts.map

package/dist/client/detect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/client/detect.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/D,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,CAoB5D"}

package/dist/client/detect.js

@@ -1,20 +0,0 @@
-export async function detectClientTier() {
-    // DBSC is browser-native; Chrome 146+ handles it automatically via HTTP headers.
-    // No JS detection is needed for the DBSC path — the browser drives it.
-    // This SDK only handles the fallback paths.
-    if (typeof window === "undefined")
-        return "none";
-    if (window.PublicKeyCredential &&
-        typeof PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable === "function") {
-        try {
-            const available = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
-            if (available)
-                return "webauthn";
-        }
-        catch {
-            // platform check failed, fall through to hmac
-        }
-    }
-    return "hmac";
-}
-//# sourceMappingURL=detect.js.map

package/dist/client/detect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/client/detect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,iFAAiF;IACjF,uEAAuE;IACvE,4CAA4C;IAE5C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAEjD,IACE,MAAM,CAAC,mBAAmB;QAC1B,OAAO,mBAAmB,CAAC,6CAA6C,KAAK,UAAU,EACvF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAC;YAC5F,IAAI,SAAS;gBAAE,OAAO,UAAU,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/client/signals.d.ts

@@ -1,9 +0,0 @@
-export interface ClientSignals {
-    userAgent: string;
-    acceptLanguage: string;
-    secureContext: boolean;
-    screenDepth: number;
-    timezone: string;
-}
-export declare function collectClientSignals(): ClientSignals;
-//# sourceMappingURL=signals.d.ts.map

package/dist/client/signals.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signals.d.ts","sourceRoot":"","sources":["../../src/client/signals.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAQpD"}

package/dist/client/signals.js

@@ -1,13 +0,0 @@
-// Signal collection for the HMAC fallback tier.
-// This is NOT hardware binding. It is best-effort context binding.
-// Operators using this tier must review GDPR obligations for signal collection.
-export function collectClientSignals() {
-    return {
-        userAgent: navigator.userAgent,
-        acceptLanguage: navigator.language,
-        secureContext: window.isSecureContext,
-        screenDepth: screen.colorDepth,
-        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
-    };
-}
-//# sourceMappingURL=signals.js.map

package/dist/client/signals.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signals.js","sourceRoot":"","sources":["../../src/client/signals.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,mEAAmE;AACnE,gFAAgF;AAUhF,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,aAAa,EAAE,MAAM,CAAC,eAAe;QACrC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;KAC3D,CAAC;AACJ,CAAC"}

package/dist/client/webauthn.d.ts

@@ -1,3 +0,0 @@
-export declare function registerWebAuthn(options: unknown): Promise<unknown>;
-export declare function authenticateWebAuthn(options: unknown): Promise<unknown>;
-//# sourceMappingURL=webauthn.d.ts.map

package/dist/client/webauthn.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/client/webauthn.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzE;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7E"}

package/dist/client/webauthn.js

@@ -1,8 +0,0 @@
-import { startRegistration, startAuthentication } from "@simplewebauthn/browser";
-export async function registerWebAuthn(options) {
-    return startRegistration(options);
-}
-export async function authenticateWebAuthn(options) {
-    return startAuthentication(options);
-}
-//# sourceMappingURL=webauthn.js.map

package/dist/client/webauthn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/client/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IACrD,OAAO,iBAAiB,CAAC,OAAkD,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,OAAO,mBAAmB,CAAC,OAAoD,CAAC,CAAC;AACnF,CAAC"}

package/dist/core/fallback/hmac.d.ts

@@ -1,9 +0,0 @@
-export interface HmacSignalBundle {
-    userAgent: string;
-    acceptLanguage: string;
-    secureContext: boolean;
-}
-export declare function collectSignals(headers: Record<string, string | string[] | undefined>): HmacSignalBundle;
-export declare function generateHmacToken(signals: HmacSignalBundle, secret: Buffer): string;
-export declare function verifyHmacToken(token: string, signals: HmacSignalBundle, secret: Buffer): boolean;
-//# sourceMappingURL=hmac.d.ts.map

package/dist/core/fallback/hmac.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../../src/core/fallback/hmac.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,gBAAgB,CAMvG;AAQD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKnF;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAeT"}

package/dist/core/fallback/hmac.js

@@ -1,37 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-// This tier binds a cookie to a set of browser signals via HMAC.
-// It does NOT provide hardware-level binding. Use only when DBSC and WebAuthn
-// are both unavailable. Document this limitation to end users.
-const SIGNAL_SEPARATOR = "|";
-export function collectSignals(headers) {
-    return {
-        userAgent: headers["user-agent"] ?? "",
-        acceptLanguage: headers["accept-language"] ?? "",
-        secureContext: headers["x-forwarded-proto"] === "https",
-    };
-}
-function serializeSignals(bundle) {
-    return [bundle.userAgent, bundle.acceptLanguage, String(bundle.secureContext)].join(SIGNAL_SEPARATOR);
-}
-export function generateHmacToken(signals, secret) {
-    const nonce = randomBytes(16).toString("base64url");
-    const data = `${nonce}${SIGNAL_SEPARATOR}${serializeSignals(signals)}`;
-    const mac = createHmac("sha256", secret).update(data).digest("base64url");
-    return `${nonce}.${mac}`;
-}
-export function verifyHmacToken(token, signals, secret) {
-    const dot = token.indexOf(".");
-    if (dot === -1)
-        return false;
-    const nonce = token.slice(0, dot);
-    const providedMac = token.slice(dot + 1);
-    const data = `${nonce}${SIGNAL_SEPARATOR}${serializeSignals(signals)}`;
-    const expectedMac = createHmac("sha256", secret).update(data).digest("base64url");
-    try {
-        return timingSafeEqual(Buffer.from(providedMac), Buffer.from(expectedMac));
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=hmac.js.map

package/dist/core/fallback/hmac.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../../../src/core/fallback/hmac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,iEAAiE;AACjE,8EAA8E;AAC9E,+DAA+D;AAE/D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAQ7B,MAAM,UAAU,cAAc,CAAC,OAAsD;IACnF,OAAO;QACL,SAAS,EAAG,OAAO,CAAC,YAAY,CAAY,IAAI,EAAE;QAClD,cAAc,EAAG,OAAO,CAAC,iBAAiB,CAAY,IAAI,EAAE;QAC5D,aAAa,EAAG,OAAO,CAAC,mBAAmB,CAAY,KAAK,OAAO;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwB;IAChD,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CACjF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAyB,EAAE,MAAc;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,OAAyB,EACzB,MAAc;IAEd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElF,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/fallback/negotiate.d.ts

@@ -1,9 +0,0 @@
-import type { ProtectionTier } from "../types.js";
-export interface NegotiationContext {
-    acceptsDbsc: boolean;
-    supportsWebAuthn: boolean;
-    hmacAllowed: boolean;
-}
-export declare function negotiateTier(ctx: NegotiationContext): ProtectionTier;
-export declare function detectDbscSupport(headers: Record<string, string | string[] | undefined>): boolean;
-//# sourceMappingURL=negotiate.d.ts.map

package/dist/core/fallback/negotiate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"negotiate.d.ts","sourceRoot":"","sources":["../../../src/core/fallback/negotiate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,GAAG,cAAc,CAKrE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAWjG"}

package/dist/core/fallback/negotiate.js

@@ -1,22 +0,0 @@
-export function negotiateTier(ctx) {
-    if (ctx.acceptsDbsc)
-        return "dbsc";
-    if (ctx.supportsWebAuthn)
-        return "webauthn";
-    if (ctx.hmacAllowed)
-        return "hmac";
-    return "none";
-}
-export function detectDbscSupport(headers) {
-    const secFetch = headers["sec-fetch-site"];
-    const ua = (headers["user-agent"] ?? "");
-    // Chrome 146+ on Windows carries DBSC support
-    // The definitive signal is whether the browser responds to Secure-Session-Registration
-    // This header is set by the server; we detect support by checking Chrome version
-    const chromeMatch = /Chrome\/(\d+)/.exec(ua);
-    if (!chromeMatch)
-        return false;
-    const version = parseInt(chromeMatch[1] ?? "0", 10);
-    return version >= 146 && !!secFetch;
-}
-//# sourceMappingURL=negotiate.js.map

package/dist/core/fallback/negotiate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"negotiate.js","sourceRoot":"","sources":["../../../src/core/fallback/negotiate.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAsD;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;IAEnD,8CAA8C;IAC9C,uFAAuF;IACvF,iFAAiF;IACjF,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC;AACtC,CAAC"}

package/dist/core/fallback/webauthn.d.ts

@@ -1,10 +0,0 @@
-import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, type VerifiedRegistrationResponse, type VerifyAuthenticationResponseOpts } from "@simplewebauthn/server";
-export interface WebAuthnRegistrationChallenge {
-    options: Awaited<ReturnType<typeof generateRegistrationOptions>>;
-    challenge: string;
-}
-export declare function generateWebAuthnRegistration(rpName: string, rpId: string, userId: string, userName: string): Promise<WebAuthnRegistrationChallenge>;
-export declare function verifyWebAuthnRegistration(response: Parameters<typeof verifyRegistrationResponse>[0]["response"], expectedChallenge: string, expectedOrigin: string, rpId: string): Promise<VerifiedRegistrationResponse>;
-export declare function generateWebAuthnAuthentication(rpId: string, allowedCredentialIds: string[]): Promise<Awaited<ReturnType<typeof generateAuthenticationOptions>>>;
-export declare function verifyWebAuthnAuthentication(opts: VerifyAuthenticationResponseOpts): Promise<Awaited<ReturnType<typeof verifyAuthenticationResponse>>>;
-//# sourceMappingURL=webauthn.d.ts.map

package/dist/core/fallback/webauthn.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../src/core/fallback/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAE5B,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACtC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,6BAA6B,CAAC,CAkBxC;AAED,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EACtE,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,4BAA4B,CAAC,CAOvC;AAED,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,oBAAoB,EAAE,MAAM,EAAE,GAC7B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CASpE;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAEnE"}

package/dist/core/fallback/webauthn.js

@@ -1,41 +0,0 @@
-import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from "@simplewebauthn/server";
-export async function generateWebAuthnRegistration(rpName, rpId, userId, userName) {
-    const opts = {
-        rpName,
-        rpID: rpId,
-        userID: new TextEncoder().encode(userId),
-        userName,
-        authenticatorSelection: {
-            residentKey: "required",
-            userVerification: "preferred",
-        },
-        attestationType: "none",
-    };
-    const options = await generateRegistrationOptions(opts);
-    return {
-        options,
-        challenge: options.challenge,
-    };
-}
-export async function verifyWebAuthnRegistration(response, expectedChallenge, expectedOrigin, rpId) {
-    return verifyRegistrationResponse({
-        response,
-        expectedChallenge,
-        expectedOrigin,
-        expectedRPID: rpId,
-    });
-}
-export async function generateWebAuthnAuthentication(rpId, allowedCredentialIds) {
-    return generateAuthenticationOptions({
-        rpID: rpId,
-        allowCredentials: allowedCredentialIds.map((id) => ({
-            id,
-            transports: ["internal"],
-        })),
-        userVerification: "preferred",
-    });
-}
-export async function verifyWebAuthnAuthentication(opts) {
-    return verifyAuthenticationResponse(opts);
-}
-//# sourceMappingURL=webauthn.js.map

package/dist/core/fallback/webauthn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../../src/core/fallback/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAI7B,MAAM,wBAAwB,CAAC;AAOhC,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAc,EACd,IAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,IAAI,GAAoC;QAC5C,MAAM;QACN,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,QAAQ;QACR,sBAAsB,EAAE;YACtB,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,WAAW;SAC9B;QACD,eAAe,EAAE,MAAM;KACxB,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO;QACL,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAsE,EACtE,iBAAyB,EACzB,cAAsB,EACtB,IAAY;IAEZ,OAAO,0BAA0B,CAAC;QAChC,QAAQ;QACR,iBAAiB;QACjB,cAAc;QACd,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,oBAA8B;IAE9B,OAAO,6BAA6B,CAAC;QACnC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,EAAE;YACF,UAAU,EAAE,CAAC,UAAU,CAAC;SACzB,CAAC,CAAC;QACH,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAsC;IAEtC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}