dbsc-toolkit 2.10.0 → 2.11.0

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Stop stolen session cookies from being replayed on another device.</strong><br>
-  A language-neutral DBSC protocol spec plus a reference implementation for Node.js — with a Web Crypto polyfill so every browser is covered, not just Chrome.
+  Device Bound Session Credentials for Node.js — one framework-agnostic core with adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit and raw <code>node:http</code>, plus a Web Crypto polyfill so every browser is covered, not just Chrome. A language-neutral protocol spec with a Node reference implementation.
 </p>
 
 <p align="center">
@@ -122,9 +122,23 @@ Load the polyfill in your HTML so non-Chromium browsers reach `tier: "bound"`:
 
 Full walk-through, failure modes, and migration timeline: **[docs/getting-started.md](./docs/getting-started.md)** and **[docs/integrating-existing-auth.md](./docs/integrating-existing-auth.md)**.
 
-### Not on Express?
+### Any framework
 
-The protocol lives in a framework-agnostic core — plain functions plus a `StorageAdapter`, no HTTP-layer assumptions. The Express/Fastify/Hono/Next.js adapters are thin wrappers. Build on the core directly for any runtime:
+The protocol lives in a framework-agnostic core — plain functions plus a `StorageAdapter`, no HTTP-layer assumptions. The adapters are thin wrappers; pick yours:
+
+| Framework | Import |
+|---|---|
+| Express | `dbsc-toolkit/express` |
+| Fastify | `dbsc-toolkit/fastify` |
+| Hono (Node, Bun, Deno, Workers) | `dbsc-toolkit/hono` |
+| Next.js (App Router) | `dbsc-toolkit/nextjs` |
+| NestJS | `dbsc-toolkit/nestjs` |
+| Koa | `dbsc-toolkit/koa` |
+| SvelteKit | `dbsc-toolkit/sveltekit` |
+| Any other server (raw `node:http`) | `dbsc-toolkit/node` |
+| [Better Auth](https://better-auth.com) | `@dbsc-toolkit/better-auth` |
+
+**No adapter for your framework? You can still use it.** Every adapter is a thin shell over the same core, so any HTTP framework on Node works — wire the core in directly:
 
 ```ts
 import {
@@ -136,7 +150,7 @@ import {
 } from "dbsc-toolkit";
 ```
 
-Complete raw-`http` example: [docs/adapters.md](./docs/adapters.md#writing-your-own-adapter).
+The generic `dbsc-toolkit/node` adapter is exactly this over raw `node:http`. Complete example: [docs/adapters.md](./docs/adapters.md#writing-your-own-adapter).
 
 ## How it compares
 
@@ -186,7 +200,7 @@ The polyfill is on by default. To run native DBSC only (Chromium 145+, no `bound
 
 | Package | What it is |
 |---|---|
-| `dbsc-toolkit` | Core + Express/Fastify/Hono/Next.js adapters, memory/Redis/Postgres storage |
+| `dbsc-toolkit` | Core + adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit & raw `node:http`; memory/Redis/Postgres storage |
 | `dbsc-toolkit/client` | Browser SDK + Web Crypto polyfill |
 | [`@dbsc-toolkit/better-auth`](./packages/better-auth/) | First-class [Better Auth](https://better-auth.com) plugin — binds every sign-in method automatically |
 
@@ -211,7 +225,7 @@ The wire protocol is documented as a language-neutral spec in [`spec/`](./spec/)
 - [x] Per-request proof + body signing + replay cache
 - [x] Multi-subdomain binding (`cookieScope: "site"`)
 - [x] Better Auth plugin
-- [ ] Koa / NestJS adapters
+- [x] NestJS, Koa, SvelteKit & generic `node:http` adapters
 - [ ] Bun / Deno native paths
 - [ ] Third-party security audit
 
@@ -220,7 +234,7 @@ The wire protocol is documented as a language-neutral spec in [`spec/`](./spec/)
 | Import | What it is |
 |---|---|
 | `dbsc-toolkit` | Core: types, crypto, protocol handlers, framework-agnostic |
-| `dbsc-toolkit/express` · `/fastify` · `/hono` · `/nextjs` | Framework adapters |
+| `dbsc-toolkit/express` · `/fastify` · `/hono` · `/nextjs` · `/nestjs` · `/koa` · `/sveltekit` · `/node` | Framework adapters |
 | `dbsc-toolkit/client` | Browser SDK + polyfill |
 | `dbsc-toolkit/storage/{memory,redis,postgres}` | Storage adapters |
 

package/dist/koa/create-dbsc.d.ts

@@ -0,0 +1,25 @@
+import type { Context, Middleware } from "koa";
+import type Application from "koa";
+import { type RequireProofOptions } from "../core/index.js";
+import { type DbscKoaOptions } from "./index.js";
+export interface CreateDbscOptions extends DbscKoaOptions {
+    /** Default session TTL (ms) for `bind()`. */
+    sessionTtl?: number;
+}
+export interface BindOptions {
+    userId: string;
+    namespace?: string;
+}
+export interface DbscKit {
+    /** Mount the dbsc middleware on the Koa app. */
+    install(app: Application): Application;
+    /** The raw dbsc middleware, for manual mounting. */
+    middleware(): Middleware;
+    /** Start a binding for an explicit session id. */
+    bind(ctx: Context, sessionId: string, opts: BindOptions): Promise<string>;
+    /** The route guard — requires a bound device + a per-request proof. */
+    requireProof(opts?: RequireProofOptions): Middleware;
+}
+/** Builds a configured DBSC kit for Koa. */
+export declare function createDbsc(opts: CreateDbscOptions): DbscKit;
+//# sourceMappingURL=create-dbsc.d.ts.map

package/dist/koa/create-dbsc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.d.ts","sourceRoot":"","sources":["../../src/koa/create-dbsc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAC/C,OAAO,KAAK,WAAW,MAAM,KAAK,CAAC;AACnC,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGpE,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,CAAC;IACvC,oDAAoD;IACpD,UAAU,IAAI,UAAU,CAAC;IACzB,kDAAkD;IAClD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,uEAAuE;IACvE,YAAY,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAAC;CACtD;AAED,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CA6B3D"}

package/dist/koa/create-dbsc.js

@@ -0,0 +1,32 @@
+import { dbsc, bindSession } from "./index.js";
+import { requireProof } from "./require-proof.js";
+/** Builds a configured DBSC kit for Koa. */
+export function createDbsc(opts) {
+    const secure = opts.secure ?? true;
+    const cookieScope = opts.cookieScope;
+    const cookieDomain = opts.cookieDomain;
+    const registrationPath = opts.registrationPath ?? "/dbsc/registration";
+    const middleware = dbsc(opts);
+    async function bind(ctx, sessionId, bindOpts) {
+        await bindSession(ctx, sessionId, opts.storage, {
+            userId: bindOpts.userId,
+            secure,
+            ...(cookieScope !== undefined && { cookieScope }),
+            ...(cookieDomain !== undefined && { cookieDomain }),
+            registrationPath,
+            ...(opts.registrationCookieTtl !== undefined && { registrationCookieTtl: opts.registrationCookieTtl }),
+            ...(opts.sessionTtl !== undefined && { sessionTtl: opts.sessionTtl }),
+        });
+        return sessionId;
+    }
+    return {
+        middleware: () => middleware,
+        install(app) {
+            app.use(middleware);
+            return app;
+        },
+        bind,
+        requireProof,
+    };
+}
+//# sourceMappingURL=create-dbsc.js.map

package/dist/koa/create-dbsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.js","sourceRoot":"","sources":["../../src/koa/create-dbsc.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,WAAW,EAAuB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAuBlD,4CAA4C;AAC5C,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,KAAK,UAAU,IAAI,CAAC,GAAY,EAAE,SAAiB,EAAE,QAAqB;QACxE,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM;YACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,gBAAgB;YAChB,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;QAC5B,OAAO,CAAC,GAAgB;YACtB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI;QACJ,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/koa/index.d.ts

@@ -0,0 +1,19 @@
+import type { Context, Middleware } from "koa";
+import type { StorageAdapter } from "../core/index.js";
+import { type DbscNodeOptions, type BindSessionOptions } from "../node/index.js";
+export { requireProof } from "./require-proof.js";
+export { createDbsc } from "./create-dbsc.js";
+export type { CreateDbscOptions, DbscKit, BindOptions } from "./create-dbsc.js";
+export type { DbscNodeSession as DbscKoaSession, BindSessionOptions } from "../node/index.js";
+export interface DbscKoaOptions extends DbscNodeOptions {
+}
+/**
+ * Koa middleware. Koa's `ctx.req` / `ctx.res` are the raw `node:http` objects,
+ * so this delegates to the generic node handler: when it answers a DBSC
+ * protocol route it sets `ctx.respond = false` (the node handler already wrote
+ * the response). Otherwise the resolved session lands on `ctx.state.dbsc`.
+ */
+export declare function dbsc(opts: DbscKoaOptions): Middleware;
+/** Start a binding from a Koa login handler, then set your own `ctx.body`. */
+export declare function bindSession(ctx: Context, sessionId: string, storage: StorageAdapter, opts: BindSessionOptions): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/koa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/koa/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAIL,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChF,YAAY,EAAE,eAAe,IAAI,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE9F,MAAM,WAAW,cAAe,SAAQ,eAAe;CAAG;AAE1D;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAWrD;AAED,8EAA8E;AAC9E,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/koa/index.js

@@ -0,0 +1,26 @@
+import { dbsc as nodeDbsc, bindSession as nodeBindSession, getDbscSession, } from "../node/index.js";
+export { requireProof } from "./require-proof.js";
+export { createDbsc } from "./create-dbsc.js";
+/**
+ * Koa middleware. Koa's `ctx.req` / `ctx.res` are the raw `node:http` objects,
+ * so this delegates to the generic node handler: when it answers a DBSC
+ * protocol route it sets `ctx.respond = false` (the node handler already wrote
+ * the response). Otherwise the resolved session lands on `ctx.state.dbsc`.
+ */
+export function dbsc(opts) {
+    const handler = nodeDbsc(opts);
+    return async (ctx, next) => {
+        const handled = await handler(ctx.req, ctx.res);
+        if (handled) {
+            ctx.respond = false;
+            return;
+        }
+        ctx.state.dbsc = getDbscSession(ctx.req);
+        await next();
+    };
+}
+/** Start a binding from a Koa login handler, then set your own `ctx.body`. */
+export async function bindSession(ctx, sessionId, storage, opts) {
+    await nodeBindSession(ctx.res, sessionId, storage, opts);
+}
+//# sourceMappingURL=index.js.map

package/dist/koa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/koa/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,IAAI,IAAI,QAAQ,EAChB,WAAW,IAAI,eAAe,EAC9B,cAAc,GAIf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAM9C;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAAC,IAAoB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;YACpB,OAAO;QACT,CAAC;QACA,GAAG,CAAC,KAAgD,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrF,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,IAAwB;IAExB,MAAM,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/dist/koa/require-proof.d.ts

@@ -0,0 +1,9 @@
+import type { Middleware } from "koa";
+import { type RequireProofOptions } from "../core/index.js";
+/**
+ * The route guard for Koa. Mount `dbsc()` first so the session is on
+ * `ctx.state.dbsc`. Reads the raw body from `ctx.request.rawBody` when a body
+ * parser populated it, else from the socket.
+ */
+export declare function requireProof(opts?: RequireProofOptions): Middleware;
+//# sourceMappingURL=require-proof.d.ts.map

package/dist/koa/require-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.d.ts","sourceRoot":"","sources":["../../src/koa/require-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,KAAK,CAAC;AAE/C,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAgB1B;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,UAAU,CAmDvE"}

package/dist/koa/require-proof.js

@@ -0,0 +1,69 @@
+import { verifyBoundProof, noBindingReason, DbscVerificationError, } from "../core/index.js";
+import { DBSC_INTERNAL } from "../node/index.js";
+async function readRawBody(ctx) {
+    const rawBody = ctx.request.rawBody;
+    if (typeof rawBody === "string")
+        return new TextEncoder().encode(rawBody);
+    const req = ctx.req;
+    const cached = req["__dbscRawBody"];
+    if (Buffer.isBuffer(cached))
+        return new Uint8Array(cached);
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    const raw = Buffer.concat(chunks);
+    req["__dbscRawBody"] = raw;
+    return new Uint8Array(raw);
+}
+/**
+ * The route guard for Koa. Mount `dbsc()` first so the session is on
+ * `ctx.state.dbsc`. Reads the raw body from `ctx.request.rawBody` when a body
+ * parser populated it, else from the socket.
+ */
+export function requireProof(opts = {}) {
+    return async (ctx, next) => {
+        const session = ctx.state.dbsc;
+        const tier = session?.tier ?? "none";
+        const skipped = session?.skipped ?? [];
+        if (!session?.sessionId || tier === "none") {
+            ctx.status = 403;
+            ctx.body = { error: "device-bound session required", currentTier: "none", reason: noBindingReason(skipped), skipped };
+            return;
+        }
+        const internal = session[DBSC_INTERNAL];
+        const storage = opts.storage ?? internal?.storage;
+        if (!storage) {
+            ctx.status = 500;
+            ctx.body = { error: "requireProof: storage unavailable — mount dbsc() before this route, or pass { storage }" };
+            return;
+        }
+        const allowDbscWithoutProof = opts.allowDbscWithoutProof ?? (internal?.boundEnabled === false ? true : undefined);
+        if (tier === "dbsc" && allowDbscWithoutProof) {
+            await next();
+            return;
+        }
+        const proofHeader = ctx.get("x-dbsc-bound-proof") || undefined;
+        try {
+            await verifyBoundProof({
+                sessionId: session.sessionId,
+                proofHeader,
+                method: ctx.method,
+                path: ctx.path,
+                signBody: true,
+                bodyBytes: await readRawBody(ctx),
+                ...(opts.timestampWindowMs !== undefined && { timestampWindowMs: opts.timestampWindowMs }),
+                ...(internal?.replayCache !== undefined && { replayCache: internal.replayCache }),
+            }, storage);
+            await next();
+        }
+        catch (err) {
+            if (err instanceof DbscVerificationError) {
+                ctx.status = 403;
+                ctx.body = { error: err.message, code: err.code };
+                return;
+            }
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=require-proof.js.map

package/dist/koa/require-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.js","sourceRoot":"","sources":["../../src/koa/require-proof.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAA2C,MAAM,kBAAkB,CAAC;AAE1F,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,OAAO,GAAI,GAAG,CAAC,OAA2C,CAAC,OAAO,CAAC;IACzE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,GAAsB,CAAC;IACvC,MAAM,MAAM,GAAI,GAA+C,CAAC,eAAe,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,GAA+C,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IACxE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAI,GAAG,CAAC,KAAoC,CAAC,IAAI,CAAC;QAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;YACtH,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAI,OAAmD,CAAC,aAAa,CAA6B,CAAC;QACjH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yFAAyF,EAAE,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,gBAAgB,CACpB;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;gBACX,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC1F,GAAG,CAAC,QAAQ,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;aAClF,EACD,OAAO,CACR,CAAC;YACF,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/nestjs/index.d.ts

@@ -0,0 +1,45 @@
+import { type DynamicModule, type NestModule, type MiddlewareConsumer, type CanActivate, type ExecutionContext } from "@nestjs/common";
+import type { Response } from "express";
+import { type RequireProofOptions } from "../core/index.js";
+import { type DbscExpressOptions, type BindOptions } from "../express/index.js";
+export { bindSession } from "../express/index.js";
+export type { DbscExpressOptions as DbscNestOptions, BindOptions } from "../express/index.js";
+/** DI token for the DBSC options passed to `DbscModule.forRoot()`. */
+export declare const DBSC_OPTIONS: unique symbol;
+/** Injectable wrapper around the Express kit's `bind()` — call it in your login controller. */
+export declare class DbscService {
+    private readonly kit;
+    constructor(opts: DbscExpressOptions);
+    /** Start a binding for an explicit session id. */
+    bind(res: Response, sessionId: string, opts: BindOptions): Promise<string>;
+}
+/**
+ * Registers DBSC on a NestJS app (Express platform). It mounts the protocol
+ * middleware for every route and exposes `DbscService`:
+ *
+ *   @Module({ imports: [DbscModule.forRoot({ storage })] })
+ *   export class AppModule {}
+ */
+export declare class DbscModule implements NestModule {
+    private readonly opts;
+    constructor(opts: DbscExpressOptions);
+    static forRoot(opts: DbscExpressOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}
+/**
+ * Zero-config route guard. Requires a bound device + a per-request proof:
+ *
+ *   @UseGuards(DbscGuard)
+ *   @Post("payment")
+ *   pay() { ... }
+ *
+ * POST bodies are body-hashed, so a guarded POST must deliver raw bytes (set
+ * `rawBody: true` in `NestFactory.create` and disable the JSON parser on that
+ * route, or use a raw-body middleware). GET routes need no parser.
+ */
+export declare class DbscGuard implements CanActivate {
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+/** Builds a guard with options baked in (e.g. a storage override or timestamp window). */
+export declare function createDbscGuard(opts: RequireProofOptions): new () => CanActivate;
+//# sourceMappingURL=index.d.ts.map

package/dist/nestjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,kBAAkB,EAGvB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EAAE,kBAAkB,IAAI,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9F,sEAAsE;AACtE,eAAO,MAAM,YAAY,eAAwC,CAAC;AAElE,+FAA+F;AAC/F,qBACa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;gBACI,IAAI,EAAE,kBAAkB;IAG1D,kDAAkD;IAClD,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAG3E;AAED;;;;;;GAMG;AACH,qBACa,UAAW,YAAW,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,kBAAkB;IAE3E,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,aAAa;IASvD,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAG9C;AAiDD;;;;;;;;;;GAUG;AACH,qBACa,SAAU,YAAW,WAAW;IACrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAK/D;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,UAAU,WAAW,CAUhF"}

package/dist/nestjs/index.js

@@ -0,0 +1,147 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DbscModule_1;
+import { Injectable, Module, Inject, ForbiddenException, InternalServerErrorException, } from "@nestjs/common";
+import { verifyBoundProof, noBindingReason, DbscVerificationError, } from "../core/index.js";
+import { dbsc, createDbsc, DBSC_INTERNAL, } from "../express/index.js";
+export { bindSession } from "../express/index.js";
+/** DI token for the DBSC options passed to `DbscModule.forRoot()`. */
+export const DBSC_OPTIONS = Symbol("dbsc-toolkit.nestjs.options");
+/** Injectable wrapper around the Express kit's `bind()` — call it in your login controller. */
+let DbscService = class DbscService {
+    kit;
+    constructor(opts) {
+        this.kit = createDbsc(opts);
+    }
+    /** Start a binding for an explicit session id. */
+    bind(res, sessionId, opts) {
+        return this.kit.bind(res, sessionId, opts);
+    }
+};
+DbscService = __decorate([
+    Injectable(),
+    __param(0, Inject(DBSC_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], DbscService);
+export { DbscService };
+/**
+ * Registers DBSC on a NestJS app (Express platform). It mounts the protocol
+ * middleware for every route and exposes `DbscService`:
+ *
+ *   @Module({ imports: [DbscModule.forRoot({ storage })] })
+ *   export class AppModule {}
+ */
+let DbscModule = DbscModule_1 = class DbscModule {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    static forRoot(opts) {
+        return {
+            module: DbscModule_1,
+            global: true,
+            providers: [{ provide: DBSC_OPTIONS, useValue: opts }, DbscService],
+            exports: [DBSC_OPTIONS, DbscService],
+        };
+    }
+    configure(consumer) {
+        consumer.apply(dbsc(this.opts)).forRoutes("*");
+    }
+};
+DbscModule = DbscModule_1 = __decorate([
+    Module({}),
+    __param(0, Inject(DBSC_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], DbscModule);
+export { DbscModule };
+async function runProof(req, res, opts) {
+    const dbscLocals = res.locals.dbsc;
+    const tier = dbscLocals?.tier ?? "none";
+    const skipped = dbscLocals?.skipped ?? [];
+    if (!dbscLocals?.sessionId || tier === "none") {
+        throw new ForbiddenException({ error: "device-bound session required", currentTier: "none", reason: noBindingReason(skipped), skipped });
+    }
+    const internal = res.locals[DBSC_INTERNAL];
+    const storage = opts.storage ?? internal?.storage;
+    if (!storage) {
+        throw new InternalServerErrorException("requireProof: storage unavailable — import DbscModule.forRoot(...)");
+    }
+    const allowDbscWithoutProof = opts.allowDbscWithoutProof ?? (internal?.boundEnabled === false ? true : undefined);
+    if (tier === "dbsc" && allowDbscWithoutProof)
+        return;
+    let bodyBytes;
+    const raw = req.body;
+    if (raw instanceof Buffer)
+        bodyBytes = new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength);
+    else if (raw instanceof Uint8Array)
+        bodyBytes = raw;
+    else if (typeof raw === "string")
+        bodyBytes = new TextEncoder().encode(raw);
+    else
+        bodyBytes = new Uint8Array(0);
+    try {
+        await verifyBoundProof({
+            sessionId: dbscLocals.sessionId,
+            proofHeader: req.headers["x-dbsc-bound-proof"],
+            method: req.method,
+            path: req.path,
+            signBody: true,
+            bodyBytes,
+            ...(opts.timestampWindowMs !== undefined && { timestampWindowMs: opts.timestampWindowMs }),
+            ...(internal?.replayCache !== undefined && { replayCache: internal.replayCache }),
+        }, storage);
+    }
+    catch (err) {
+        if (err instanceof DbscVerificationError) {
+            throw new ForbiddenException({ error: err.message, code: err.code });
+        }
+        throw err;
+    }
+}
+/**
+ * Zero-config route guard. Requires a bound device + a per-request proof:
+ *
+ *   @UseGuards(DbscGuard)
+ *   @Post("payment")
+ *   pay() { ... }
+ *
+ * POST bodies are body-hashed, so a guarded POST must deliver raw bytes (set
+ * `rawBody: true` in `NestFactory.create` and disable the JSON parser on that
+ * route, or use a raw-body middleware). GET routes need no parser.
+ */
+let DbscGuard = class DbscGuard {
+    async canActivate(context) {
+        const http = context.switchToHttp();
+        await runProof(http.getRequest(), http.getResponse(), {});
+        return true;
+    }
+};
+DbscGuard = __decorate([
+    Injectable()
+], DbscGuard);
+export { DbscGuard };
+/** Builds a guard with options baked in (e.g. a storage override or timestamp window). */
+export function createDbscGuard(opts) {
+    let ConfiguredDbscGuard = class ConfiguredDbscGuard {
+        async canActivate(context) {
+            const http = context.switchToHttp();
+            await runProof(http.getRequest(), http.getResponse(), opts);
+            return true;
+        }
+    };
+    ConfiguredDbscGuard = __decorate([
+        Injectable()
+    ], ConfiguredDbscGuard);
+    return ConfiguredDbscGuard;
+}
+//# sourceMappingURL=index.js.map

package/dist/nestjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,UAAU,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EAClB,4BAA4B,GAM7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,IAAI,EACJ,UAAU,EACV,aAAa,GAKd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAElE,+FAA+F;AAExF,IAAM,WAAW,GAAjB,MAAM,WAAW;IACL,GAAG,CAAU;IAC9B,YAAkC,IAAwB;QACxD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,kDAAkD;IAClD,IAAI,CAAC,GAAa,EAAE,SAAiB,EAAE,IAAiB;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AATY,WAAW;IADvB,UAAU,EAAE;IAGE,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;;GAFtB,WAAW,CASvB;;AAED;;;;;;GAMG;AAEI,IAAM,UAAU,kBAAhB,MAAM,UAAU;IAC8B;IAAnD,YAAmD,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAE/E,MAAM,CAAC,OAAO,CAAC,IAAwB;QACrC,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC;YACnE,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,UAAU;IADtB,MAAM,CAAC,EAAE,CAAC;IAEI,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;;GADtB,UAAU,CAetB;;AAED,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,GAAa,EAAE,IAAyB;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3I,CAAC;IAED,MAAM,QAAQ,GAAI,GAAG,CAAC,MAAuC,CAAC,aAAa,CAA6B,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,oEAAoE,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,MAAM,IAAI,qBAAqB;QAAE,OAAO;IAErD,IAAI,SAAqB,CAAC;IAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAe,CAAC;IAChC,IAAI,GAAG,YAAY,MAAM;QAAE,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;SAC7F,IAAI,GAAG,YAAY,UAAU;QAAE,SAAS,GAAG,GAAG,CAAC;SAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;QACvE,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,gBAAgB,CACpB;YACE,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAuB;YACpE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1F,GAAG,CAAC,QAAQ,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;SAClF,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAW,EAAE,IAAI,CAAC,WAAW,EAAY,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AANY,SAAS;IADrB,UAAU,EAAE;GACA,SAAS,CAMrB;;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,IAAyB;IAEvD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;QACvB,KAAK,CAAC,WAAW,CAAC,OAAyB;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAW,EAAE,IAAI,CAAC,WAAW,EAAY,EAAE,IAAI,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAA;IANK,mBAAmB;QADxB,UAAU,EAAE;OACP,mBAAmB,CAMxB;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}

package/dist/node/create-dbsc.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RequireProofOptions } from "../core/index.js";
+import { type DbscNodeOptions, type DbscNodeHandler, type DbscNodeSession } from "./index.js";
+import { type NodeProofGuard } from "./require-proof.js";
+export interface CreateDbscOptions extends DbscNodeOptions {
+    /** Default session TTL (ms) for `bind()`. */
+    sessionTtl?: number;
+}
+export interface BindOptions {
+    userId: string;
+    namespace?: string;
+}
+export interface DbscKit {
+    /** The dbsc handler — run it first in your request pipeline. Returns true when it answered a protocol route. */
+    handler(): DbscNodeHandler;
+    /** Read the resolved session off a request the handler has processed. */
+    getSession(req: IncomingMessage): DbscNodeSession | undefined;
+    /** Start a binding for an explicit session id (e.g. your server-session id). */
+    bind(res: ServerResponse, sessionId: string, opts: BindOptions): Promise<string>;
+    /** The route guard — requires a bound device + a per-request proof. */
+    requireProof(opts?: RequireProofOptions): NodeProofGuard;
+}
+/**
+ * Builds a configured DBSC kit for raw `node:http`. There is no `install()`
+ * because raw http has no router — wire `handler()` at the top of your request
+ * listener and branch on its boolean return.
+ */
+export declare function createDbsc(opts: CreateDbscOptions): DbscKit;
+//# sourceMappingURL=create-dbsc.d.ts.map

package/dist/node/create-dbsc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.d.ts","sourceRoot":"","sources":["../../src/node/create-dbsc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,gHAAgH;IAChH,OAAO,IAAI,eAAe,CAAC;IAC3B,yEAAyE;IACzE,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9D,gFAAgF;IAChF,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,uEAAuE;IACvE,YAAY,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,cAAc,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CA0B3D"}

package/dist/node/create-dbsc.js

@@ -0,0 +1,33 @@
+import { dbsc, bindSession, getDbscSession, } from "./index.js";
+import { requireProof } from "./require-proof.js";
+/**
+ * Builds a configured DBSC kit for raw `node:http`. There is no `install()`
+ * because raw http has no router — wire `handler()` at the top of your request
+ * listener and branch on its boolean return.
+ */
+export function createDbsc(opts) {
+    const secure = opts.secure ?? true;
+    const cookieScope = opts.cookieScope;
+    const cookieDomain = opts.cookieDomain;
+    const registrationPath = opts.registrationPath ?? "/dbsc/registration";
+    const handler = dbsc(opts);
+    async function bind(res, sessionId, bindOpts) {
+        await bindSession(res, sessionId, opts.storage, {
+            userId: bindOpts.userId,
+            secure,
+            ...(cookieScope !== undefined && { cookieScope }),
+            ...(cookieDomain !== undefined && { cookieDomain }),
+            registrationPath,
+            ...(opts.registrationCookieTtl !== undefined && { registrationCookieTtl: opts.registrationCookieTtl }),
+            ...(opts.sessionTtl !== undefined && { sessionTtl: opts.sessionTtl }),
+        });
+        return sessionId;
+    }
+    return {
+        handler: () => handler,
+        getSession: getDbscSession,
+        bind,
+        requireProof,
+    };
+}
+//# sourceMappingURL=create-dbsc.js.map

package/dist/node/create-dbsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.js","sourceRoot":"","sources":["../../src/node/create-dbsc.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,GAIf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAuBvE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3B,KAAK,UAAU,IAAI,CAAC,GAAmB,EAAE,SAAiB,EAAE,QAAqB;QAC/E,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM;YACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,gBAAgB;YAChB,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;QACtB,UAAU,EAAE,cAAc;QAC1B,IAAI;QACJ,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/node/index.d.ts

@@ -0,0 +1,53 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type DbscOptions, type StorageAdapter, type ProofReplayCache, type ProtectionTier, type SkippedEntry, type CookieScope } from "../core/index.js";
+export { requireProof } from "./require-proof.js";
+export { createDbsc } from "./create-dbsc.js";
+export type { CreateDbscOptions, DbscKit, BindOptions } from "./create-dbsc.js";
+/** Internal carrier so `requireProof()` can reach storage without re-passing it. */
+export interface DbscInternal {
+    storage: StorageAdapter;
+    secure: boolean;
+    /** When false, `requireProof()` auto-relaxes the native dbsc tier. */
+    boundEnabled: boolean;
+    replayCache?: ProofReplayCache;
+}
+export declare const DBSC_INTERNAL: unique symbol;
+export interface DbscNodeOptions extends DbscOptions {
+    secure?: boolean;
+    boundStatePath?: string;
+    boundChallengePath?: string;
+    boundRegistrationPath?: string;
+    boundRefreshPath?: string;
+}
+export interface DbscNodeSession {
+    sessionId: string | null;
+    tier: ProtectionTier;
+    skipped: SkippedEntry[];
+    revoke: () => Promise<void>;
+}
+/**
+ * The dbsc handler for raw `node:http`. Call it first in your request
+ * pipeline: it returns `true` when it has fully answered a DBSC protocol route
+ * (the response is ended — stop), and `false` otherwise, having attached the
+ * resolved session to the request. Read it back with `getDbscSession(req)`.
+ */
+export type DbscNodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+/** Reads the session the `dbsc()` handler attached to this request. */
+export declare function getDbscSession(req: IncomingMessage): DbscNodeSession | undefined;
+/** Reads and JSON-parses the raw request body. Returns `{}` on empty/invalid. */
+export declare function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>>;
+export interface BindSessionOptions {
+    userId: string;
+    /** Match the value passed to dbsc({ secure }). Defaults true. */
+    secure?: boolean;
+    /** Match the value passed to dbsc({ cookieScope }). Defaults "host". */
+    cookieScope?: CookieScope;
+    /** Match the value passed to dbsc({ cookieDomain }). Required for cookieScope: "site". */
+    cookieDomain?: string;
+    registrationPath?: string;
+    registrationCookieTtl?: number;
+    sessionTtl?: number;
+}
+export declare function bindSession(res: ServerResponse, sessionId: string, storage: StorageAdapter, opts: BindSessionOptions): Promise<void>;
+export declare function dbsc(opts: DbscNodeOptions): DbscNodeHandler;
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAwBL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEhF,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AACD,eAAO,MAAM,aAAa,EAAE,OAAO,MAA6C,CAAC;AAejF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9F,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAEhF;AAmED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiBzF;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAwT3D"}