dbsc-toolkit 2.10.0 → 2.12.0

package/dist/sveltekit/index.d.ts

@@ -0,0 +1,49 @@
+import type { Handle, RequestEvent } from "@sveltejs/kit";
+import { type DbscOptions, type StorageAdapter, type ProofReplayCache, type ProtectionTier, type SkippedEntry, type CookieScope } from "../core/index.js";
+export { requireProof } from "./require-proof.js";
+export { requireDpop } from "./require-dpop.js";
+/** Internal carrier so `requireProof()` can reach storage without re-passing it. */
+export interface DbscInternal {
+    storage: StorageAdapter;
+    secure: boolean;
+    boundEnabled: boolean;
+    replayCache?: ProofReplayCache;
+}
+export declare const DBSC_INTERNAL: unique symbol;
+export interface DbscSvelteKitOptions extends DbscOptions {
+    secure?: boolean;
+    boundStatePath?: string;
+    boundChallengePath?: string;
+    boundRegistrationPath?: string;
+    boundRefreshPath?: string;
+}
+export interface DbscSvelteKitSession {
+    sessionId: string | null;
+    tier: ProtectionTier;
+    skipped: SkippedEntry[];
+    revoke: () => Promise<void>;
+}
+export interface BindSessionOptions {
+    userId: string;
+    secure?: boolean;
+    cookieScope?: CookieScope;
+    cookieDomain?: string;
+    registrationPath?: string;
+    registrationCookieTtl?: number;
+    sessionTtl?: number;
+}
+/**
+ * Start a binding from a SvelteKit action or `+server` handler. Sets the
+ * registration header + cookies on the event; return your own response after.
+ */
+export declare function bindSession(event: RequestEvent, sessionId: string, storage: StorageAdapter, opts: BindSessionOptions): Promise<void>;
+/**
+ * SvelteKit `handle` hook. Add it to `src/hooks.server.ts`:
+ *
+ *   export const handle = dbscHandle({ storage });
+ *
+ * It answers the DBSC protocol routes itself and, for every other request,
+ * resolves the session onto `event.locals.dbsc`.
+ */
+export declare function dbscHandle(opts: DbscSvelteKitOptions): Handle;
+//# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAsBL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AACD,eAAO,MAAM,aAAa,EAAE,OAAO,MAAkD,CAAC;AActF,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAqCD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAoP7D"}

package/dist/sveltekit/index.js

@@ -0,0 +1,319 @@
+import { handleRegistration, handleRefresh, handleBoundRegistration, handleBoundRefresh, issueChallenge, buildRegistrationHeader, buildChallengeHeader, parseSessionSkippedHeader, REGISTRATION_HEADER, CHALLENGE_HEADER, LEGACY_REGISTRATION_HEADER, LEGACY_CHALLENGE_HEADER, NoopRateLimiter, emit, maybeEmitPolyfillMissing, resolveCookieNames, resolveCookieScope, cookieAttributesString, DbscProtocolError, DbscVerificationError, ErrorCodes, } from "../core/index.js";
+export { requireProof } from "./require-proof.js";
+export { requireDpop } from "./require-dpop.js";
+export const DBSC_INTERNAL = Symbol("dbsc-toolkit.sveltekit.internal");
+const cookieNames = (s) => resolveCookieNames(s);
+const DEFAULT_BOUND_TTL = 10 * 60 * 1000;
+const DEFAULT_REG_TTL = 24 * 60 * 60 * 1000;
+const DEFAULT_SESSION_TTL = 24 * 60 * 60 * 1000;
+function serializeCookie(name, value, scope, maxAgeSec) {
+    const { domain } = resolveCookieScope(scope);
+    const parts = [`${name}=${value}`, "HttpOnly"];
+    if (scope.secure)
+        parts.push("Secure");
+    parts.push("SameSite=Lax", `Max-Age=${maxAgeSec}`, "Path=/");
+    if (domain)
+        parts.push(`Domain=${domain}`);
+    return parts.join("; ");
+}
+function jsonResponse(status, body, extra) {
+    const headers = new Headers({ "content-type": "application/json" });
+    for (const [k, v] of Object.entries(extra?.headers ?? {}))
+        headers.set(k, v);
+    for (const c of extra?.cookies ?? [])
+        headers.append("set-cookie", c);
+    return new Response(JSON.stringify(body), { status, headers });
+}
+function emptyResponse(status, extra) {
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(extra?.headers ?? {}))
+        headers.set(k, v);
+    for (const c of extra?.cookies ?? [])
+        headers.append("set-cookie", c);
+    return new Response(null, { status, headers });
+}
+function clientIp(event) {
+    try {
+        return event.getClientAddress();
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Start a binding from a SvelteKit action or `+server` handler. Sets the
+ * registration header + cookies on the event; return your own response after.
+ */
+export async function bindSession(event, sessionId, storage, opts) {
+    const secure = opts.secure ?? true;
+    const registrationPath = opts.registrationPath ?? "/dbsc/registration";
+    const regCookieTtl = opts.registrationCookieTtl ?? DEFAULT_REG_TTL;
+    const sessionTtl = opts.sessionTtl ?? DEFAULT_SESSION_TTL;
+    const scope = {
+        secure,
+        ...(opts.cookieScope !== undefined && { cookieScope: opts.cookieScope }),
+        ...(opts.cookieDomain !== undefined && { cookieDomain: opts.cookieDomain }),
+    };
+    const { domain } = resolveCookieScope(scope);
+    const COOKIES = cookieNames(scope);
+    const existing = await storage.getSession(sessionId);
+    const now = Date.now();
+    if (!existing) {
+        await storage.setSession({
+            id: sessionId,
+            userId: opts.userId,
+            tier: "none",
+            createdAt: now,
+            expiresAt: now + sessionTtl,
+            lastRefreshAt: 0,
+        });
+    }
+    const challenge = await issueChallenge(sessionId, storage);
+    const regHeader = buildRegistrationHeader({ registrationPath, challenge: challenge.jti, cookieName: COOKIES.bound });
+    event.setHeaders({ [REGISTRATION_HEADER]: regHeader, [LEGACY_REGISTRATION_HEADER]: regHeader });
+    const base = { httpOnly: true, secure, sameSite: "lax", path: "/", ...(domain !== undefined && { domain }) };
+    event.cookies.set(COOKIES.reg, sessionId, { ...base, maxAge: regCookieTtl / 1000 });
+    event.cookies.set(COOKIES.challenge, challenge.jti, { ...base, maxAge: 5 * 60 });
+}
+/**
+ * SvelteKit `handle` hook. Add it to `src/hooks.server.ts`:
+ *
+ *   export const handle = dbscHandle({ storage });
+ *
+ * It answers the DBSC protocol routes itself and, for every other request,
+ * resolves the session onto `event.locals.dbsc`.
+ */
+export function dbscHandle(opts) {
+    const { storage, registrationPath = "/dbsc/registration", refreshPath = "/dbsc/refresh", boundStatePath = "/dbsc-bound/state", boundChallengePath = "/dbsc-bound/challenge", boundRegistrationPath = "/dbsc-bound/registration", boundRefreshPath = "/dbsc-bound/refresh", bound = true, boundCookieTtl = DEFAULT_BOUND_TTL, refreshGraceMs = 30_000, rateLimiter = new NoopRateLimiter(), replayCache, onEvent, secure = true, cookieScope, cookieDomain, } = opts;
+    const scope = {
+        secure,
+        ...(cookieScope !== undefined && { cookieScope }),
+        ...(cookieDomain !== undefined && { cookieDomain }),
+    };
+    resolveCookieScope(scope);
+    const cookieAttrs = cookieAttributesString(scope);
+    const COOKIES = cookieNames(scope);
+    const polyfillMissingEmitted = new Set();
+    function configBody(sessionId, origin, refreshUrl) {
+        return {
+            session_identifier: sessionId,
+            refresh_url: refreshUrl,
+            scope: { origin, include_site: true, scope_specification: [] },
+            credentials: [{ type: "cookie", name: COOKIES.bound, attributes: cookieAttrs }],
+        };
+    }
+    function get(req, name) {
+        return req.headers.get(name) ?? undefined;
+    }
+    function readBoundSessionId(event) {
+        return event.cookies.get(COOKIES.bound) ?? event.cookies.get(COOKIES.reg);
+    }
+    function skippedFrom(req) {
+        return parseSessionSkippedHeader({
+            "secure-session-skipped": req.headers.get("secure-session-skipped") ?? undefined,
+            "sec-session-skipped": req.headers.get("sec-session-skipped") ?? undefined,
+        });
+    }
+    return async ({ event, resolve }) => {
+        const { request, url } = event;
+        const method = request.method;
+        const ip = clientIp(event);
+        if (method === "POST" && url.pathname === registrationPath) {
+            const sessionId = event.cookies.get(COOKIES.reg);
+            const expectedJti = event.cookies.get(COOKIES.challenge);
+            if (!sessionId || !expectedJti)
+                return jsonResponse(400, { error: "missing session or challenge cookie" });
+            if (!(await rateLimiter.checkRegistration(ip)))
+                return jsonResponse(429, { error: "rate limited" });
+            try {
+                await handleRegistration({ sessionId, secSessionResponseHeader: get(request, "secure-session-response") ?? get(request, "sec-session-response"), expectedJti }, storage);
+                emit(onEvent, { type: "registration", sessionId, tier: "dbsc", timestamp: Date.now(), algorithm: "ES256", ip });
+                return jsonResponse(200, configBody(sessionId, url.origin, refreshPath), {
+                    cookies: [
+                        serializeCookie(COOKIES.bound, sessionId, scope, boundCookieTtl / 1000),
+                        serializeCookie(COOKIES.challenge, "", scope, 0),
+                    ],
+                });
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sessionId);
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, { type: "verification_failure", sessionId, tier: "dbsc", timestamp: Date.now(), reason: err.code, ip });
+                    return jsonResponse(400, { error: err.message });
+                }
+                throw err;
+            }
+        }
+        if (method === "POST" && url.pathname === refreshPath) {
+            const sessionId = get(request, "sec-secure-session-id") ?? event.cookies.get(COOKIES.bound);
+            if (!sessionId)
+                return emptyResponse(403);
+            if (!(await rateLimiter.checkRefresh(ip, sessionId)))
+                return jsonResponse(429, { error: "rate limited" });
+            const responseHeader = get(request, "secure-session-response") ?? get(request, "sec-session-response");
+            const expectedJti = event.cookies.get(COOKIES.challenge);
+            if (!responseHeader || !expectedJti) {
+                const challenge = await issueChallenge(sessionId, storage);
+                return emptyResponse(403, {
+                    headers: { [CHALLENGE_HEADER]: buildChallengeHeader(challenge.jti, sessionId), [LEGACY_CHALLENGE_HEADER]: buildChallengeHeader(challenge.jti, sessionId) },
+                    cookies: [serializeCookie(COOKIES.challenge, challenge.jti, scope, 5 * 60)],
+                });
+            }
+            try {
+                await handleRefresh({ sessionId, secSessionResponseHeader: responseHeader, expectedJti }, storage);
+                emit(onEvent, { type: "refresh", sessionId, tier: "dbsc", timestamp: Date.now(), ip });
+                return jsonResponse(200, configBody(sessionId, url.origin, refreshPath), {
+                    cookies: [serializeCookie(COOKIES.bound, sessionId, scope, boundCookieTtl / 1000), serializeCookie(COOKIES.challenge, "", scope, 0)],
+                });
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sessionId);
+                const stolenCheck = await storage.getBoundKey(sessionId);
+                if (stolenCheck && err instanceof DbscVerificationError && err.code === ErrorCodes.SIGNATURE_INVALID) {
+                    emit(onEvent, { type: "session_stolen", sessionId, tier: "dbsc", timestamp: Date.now(), ip });
+                }
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, { type: "verification_failure", sessionId, tier: "dbsc", timestamp: Date.now(), reason: err.code, ip });
+                    const challenge = await issueChallenge(sessionId, storage);
+                    return jsonResponse(403, { error: err.message }, {
+                        headers: { [CHALLENGE_HEADER]: buildChallengeHeader(challenge.jti, sessionId), [LEGACY_CHALLENGE_HEADER]: buildChallengeHeader(challenge.jti, sessionId) },
+                        cookies: [serializeCookie(COOKIES.challenge, challenge.jti, scope, 5 * 60)],
+                    });
+                }
+                throw err;
+            }
+        }
+        if (method === "GET" && url.pathname === boundStatePath) {
+            const headers = { "X-Server-Time": String(Date.now()) };
+            if (!bound)
+                return jsonResponse(200, { phase: "unbound", sessionId: null }, { headers });
+            const skipped = skippedFrom(request);
+            const nativeSkipped = skipped.length ? skipped.map((s) => s.reason) : undefined;
+            const sid = readBoundSessionId(event);
+            if (!sid)
+                return jsonResponse(200, { phase: "unbound", sessionId: null, ...(nativeSkipped && { nativeSkipped }) }, { headers });
+            const session = await storage.getSession(sid);
+            if (!session)
+                return jsonResponse(200, { phase: "unbound", sessionId: null, ...(nativeSkipped && { nativeSkipped }) }, { headers });
+            const nativeKey = await storage.getBoundKey(sid, "native");
+            const boundKey = await storage.getBoundKey(sid, "bound");
+            if (!nativeKey && !boundKey) {
+                const challenge = await issueChallenge(sid, storage);
+                return jsonResponse(200, { phase: "needs-registration", sessionId: sid, challenge: challenge.jti, ...(nativeSkipped && { nativeSkipped }) }, { headers });
+            }
+            if (nativeKey && !boundKey) {
+                const challenge = await issueChallenge(sid, storage);
+                return jsonResponse(200, { phase: "needs-bound-registration", sessionId: sid, tier: session.tier, challenge: challenge.jti, refreshIntervalMs: boundCookieTtl, ...(nativeSkipped && { nativeSkipped }) }, { headers });
+            }
+            return jsonResponse(200, { phase: "bound", sessionId: sid, tier: session.tier, refreshIntervalMs: boundCookieTtl, ...(nativeSkipped && { nativeSkipped }) }, { headers });
+        }
+        if (bound && method === "GET" && url.pathname === boundChallengePath) {
+            const headers = { "X-Server-Time": String(Date.now()) };
+            const sid = readBoundSessionId(event);
+            if (!sid)
+                return jsonResponse(403, { error: "no session" }, { headers });
+            const session = await storage.getSession(sid);
+            if (!session)
+                return jsonResponse(403, { error: "no session" }, { headers });
+            const challenge = await issueChallenge(sid, storage);
+            return jsonResponse(200, { challenge: challenge.jti }, { headers });
+        }
+        if (bound && method === "POST" && url.pathname === boundRegistrationPath) {
+            const headers = { "X-Server-Time": String(Date.now()) };
+            if (!(await rateLimiter.checkRegistration(ip)))
+                return jsonResponse(429, { error: "rate limited" }, { headers });
+            const sid = readBoundSessionId(event);
+            if (!sid)
+                return jsonResponse(400, { error: "missing session cookie" }, { headers });
+            let body;
+            try {
+                body = (await request.json()) ?? {};
+            }
+            catch {
+                return jsonResponse(400, { error: "body must be JSON" }, { headers });
+            }
+            if (!body.publicKey || !body.signature || !body.challenge)
+                return jsonResponse(400, { error: "publicKey, signature, and challenge are required" }, { headers });
+            try {
+                await handleBoundRegistration({ sessionId: sid, publicKey: body.publicKey, signature: body.signature, expectedJti: body.challenge }, storage);
+                emit(onEvent, { type: "registration", sessionId: sid, tier: "bound", timestamp: Date.now(), algorithm: "ES256", ip });
+                return jsonResponse(200, { session_identifier: sid, refresh_url: boundRefreshPath, tier: "bound" }, { headers, cookies: [serializeCookie(COOKIES.bound, sid, scope, boundCookieTtl / 1000)] });
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sid);
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, { type: "verification_failure", sessionId: sid, tier: "bound", timestamp: Date.now(), reason: err.code, ip });
+                    return jsonResponse(400, { error: err.message }, { headers });
+                }
+                throw err;
+            }
+        }
+        if (bound && method === "POST" && url.pathname === boundRefreshPath) {
+            const headers = { "X-Server-Time": String(Date.now()) };
+            const sid = readBoundSessionId(event);
+            if (!sid)
+                return jsonResponse(403, { error: "no session" }, { headers });
+            if (!(await rateLimiter.checkRefresh(ip, sid)))
+                return jsonResponse(429, { error: "rate limited" }, { headers });
+            let body;
+            try {
+                body = (await request.json()) ?? {};
+            }
+            catch {
+                return jsonResponse(400, { error: "body must be JSON" }, { headers });
+            }
+            if (!body.challenge || !body.signature || typeof body.timestamp !== "number")
+                return jsonResponse(400, { error: "challenge, signature, and timestamp are required" }, { headers });
+            try {
+                await handleBoundRefresh({ sessionId: sid, signature: body.signature, expectedJti: body.challenge, timestamp: body.timestamp }, storage);
+                emit(onEvent, { type: "refresh", sessionId: sid, tier: "bound", timestamp: Date.now(), ip });
+                return jsonResponse(200, { session_identifier: sid, refresh_url: boundRefreshPath, tier: "bound" }, { headers, cookies: [serializeCookie(COOKIES.bound, sid, scope, boundCookieTtl / 1000)] });
+            }
+            catch (err) {
+                await rateLimiter.recordFailure(ip, sid);
+                const keyStillThere = await storage.getBoundKey(sid);
+                if (keyStillThere && err instanceof DbscVerificationError && err.code === ErrorCodes.SIGNATURE_INVALID) {
+                    emit(onEvent, { type: "session_stolen", sessionId: sid, tier: "bound", timestamp: Date.now(), ip });
+                }
+                if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                    emit(onEvent, { type: "verification_failure", sessionId: sid, tier: "bound", timestamp: Date.now(), reason: err.code, ip });
+                    return jsonResponse(401, { error: err.message }, { headers });
+                }
+                throw err;
+            }
+        }
+        const sessionId = event.cookies.get(COOKIES.bound) ?? null;
+        const skipped = skippedFrom(request);
+        let tier = "none";
+        if (sessionId) {
+            const session = await storage.getSession(sessionId);
+            if (session) {
+                const staleAfter = session.lastRefreshAt + boundCookieTtl + refreshGraceMs;
+                const refreshable = session.tier === "dbsc" || session.tier === "bound";
+                tier = refreshable && Date.now() > staleAfter ? "none" : session.tier;
+                if (onEvent) {
+                    await maybeEmitPolyfillMissing({ storage, session, ip, emitted: polyfillMissingEmitted, onEvent });
+                }
+            }
+        }
+        const dbscSession = {
+            sessionId,
+            tier,
+            skipped,
+            revoke: async () => {
+                if (sessionId)
+                    await storage.revokeSession(sessionId);
+                event.cookies.delete(COOKIES.bound, { path: "/" });
+            },
+        };
+        dbscSession[DBSC_INTERNAL] = {
+            storage,
+            secure,
+            boundEnabled: bound,
+            ...(replayCache !== undefined && { replayCache }),
+        };
+        event.locals.dbsc = dbscSession;
+        return resolve(event);
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/sveltekit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,GAOX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAShD,MAAM,CAAC,MAAM,aAAa,GAAkB,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAQtF,MAAM,WAAW,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAE5D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiBhD,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,KAAgB,EAAE,SAAiB;IACvF,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,IAAa,EACb,KAAgE;IAEhE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,KAAgE;IACrG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB;IACnC,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAmB,EACnB,SAAiB,EACjB,OAAuB,EACvB,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,eAAe,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,KAAK,GAAc;QACvB,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC5E,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,UAAU;YAC3B,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACrH,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtH,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IACpF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAA0B;IACnD,MAAM,EACJ,OAAO,EACP,gBAAgB,GAAG,oBAAoB,EACvC,WAAW,GAAG,eAAe,EAC7B,cAAc,GAAG,mBAAmB,EACpC,kBAAkB,GAAG,uBAAuB,EAC5C,qBAAqB,GAAG,0BAA0B,EAClD,gBAAgB,GAAG,qBAAqB,EACxC,KAAK,GAAG,IAAI,EACZ,cAAc,GAAG,iBAAiB,EAClC,cAAc,GAAG,MAAM,EACvB,WAAW,GAAG,IAAI,eAAe,EAAE,EACnC,WAAW,EACX,OAAO,EACP,MAAM,GAAG,IAAI,EACb,WAAW,EACX,YAAY,GACb,GAAG,IAAI,CAAC;IAET,MAAM,KAAK,GAAc;QACvB,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC;IACF,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,SAAS,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,UAAkB;QACvE,OAAO;YACL,kBAAkB,EAAE,SAAS;YAC7B,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE;YAC9D,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY;QACrC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC5C,CAAC;IACD,SAAS,kBAAkB,CAAC,KAAmB;QAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,SAAS,WAAW,CAAC,GAAY;QAC/B,OAAO,yBAAyB,CAAC;YAC/B,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS;YAChF,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3B,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC;gBACH,MAAM,kBAAkB,CACtB,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE,WAAW,EAAE,EACrI,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChH,OAAO,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;oBACvE,OAAO,EAAE;wBACP,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;wBACvE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;qBACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAG,GAA6B,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACjJ,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC,SAAS;gBAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAE1G,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACvG,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,OAAO,aAAa,CAAC,GAAG,EAAE;oBACxB,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE;oBAC1J,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;iBAC5E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvF,OAAO,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;oBACvE,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;iBACrI,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,WAAW,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBACrG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAG,GAA6B,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACjJ,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBAC3D,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;wBAC/C,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE;wBAC1J,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;qBAC5E,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAChI,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACpI,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5J,CAAC;YACD,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzN,CAAC;YACD,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5K,CAAC;QAED,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjH,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,IAAI,IAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAChK,IAAI,CAAC;gBACH,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9I,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtH,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACjM,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5H,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjH,IAAI,IAAoE,CAAC;YACzE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnL,IAAI,CAAC;gBACH,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBACzI,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7F,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACjM,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrD,IAAI,aAAa,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBACvG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5H,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,GAAmB,MAAM,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,GAAG,cAAc,GAAG,cAAc,CAAC;gBAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;gBACxE,IAAI,GAAG,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtE,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAyB;YACxC,SAAS;YACT,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,IAAI,SAAS;oBAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;gBACtD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,CAAC;SACF,CAAC;QACD,WAAuD,CAAC,aAAa,CAAC,GAAG;YACxE,OAAO;YACP,MAAM;YACN,YAAY,EAAE,KAAK;YACnB,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;SAC3B,CAAC;QACxB,KAAK,CAAC,MAAuC,CAAC,IAAI,GAAG,WAAW,CAAC;QAElE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/sveltekit/require-dpop.d.ts

@@ -0,0 +1,17 @@
+import { type RequestEvent } from "@sveltejs/kit";
+import { type RequireDpopOptions } from "../core/dpop/index.js";
+/**
+ * DPoP (RFC 9449) route guard for SvelteKit. Returns a 401 `Response` to return
+ * from the handler on failure, or `undefined` when the proof is valid:
+ *
+ *   export async function GET(event) {
+ *     const denied = await requireDpop({ getBoundJkt })(event);
+ *     if (denied) return denied;
+ *     // ... reached only with a valid DPoP proof
+ *   }
+ *
+ * Unlike `requireProof` (which throws a 403), DPoP returns a Response so the
+ * `WWW-Authenticate: DPoP` header is carried per RFC 9449 §7.1.
+ */
+export declare function requireDpop(opts?: RequireDpopOptions<RequestEvent>): (event: RequestEvent) => Promise<Response | undefined>;
+//# sourceMappingURL=require-dpop.d.ts.map

package/dist/sveltekit/require-dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dpop.d.ts","sourceRoot":"","sources":["../../src/sveltekit/require-dpop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,GAAE,kBAAkB,CAAC,YAAY,CAAM,IACvD,OAAO,YAAY,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqClE"}

package/dist/sveltekit/require-dpop.js

@@ -0,0 +1,48 @@
+import { runDpopGuard, DPOP_WWW_AUTHENTICATE, } from "../core/dpop/index.js";
+import { DBSC_INTERNAL } from "./index.js";
+/**
+ * DPoP (RFC 9449) route guard for SvelteKit. Returns a 401 `Response` to return
+ * from the handler on failure, or `undefined` when the proof is valid:
+ *
+ *   export async function GET(event) {
+ *     const denied = await requireDpop({ getBoundJkt })(event);
+ *     if (denied) return denied;
+ *     // ... reached only with a valid DPoP proof
+ *   }
+ *
+ * Unlike `requireProof` (which throws a 403), DPoP returns a Response so the
+ * `WWW-Authenticate: DPoP` header is carried per RFC 9449 §7.1.
+ */
+export function requireDpop(opts = {}) {
+    return async (event) => {
+        const session = event.locals.dbsc;
+        const internal = session
+            ? session[DBSC_INTERNAL]
+            : undefined;
+        const replayCache = opts.replayCache ?? internal?.replayCache;
+        const boundJkt = opts.getBoundJkt ? await opts.getBoundJkt(event) : undefined;
+        const outcome = await runDpopGuard({
+            proof: event.request.headers.get("DPoP") ?? undefined,
+            authorization: event.request.headers.get("Authorization") ?? undefined,
+            method: event.request.method,
+            url: event.url.href,
+            boundJkt,
+            replayCache,
+            opts: {
+                ...(opts.requireTokenBinding !== undefined && { requireTokenBinding: opts.requireTokenBinding }),
+                ...(opts.iatWindowMs !== undefined && { iatWindowMs: opts.iatWindowMs }),
+            },
+        });
+        if (!outcome.ok) {
+            return new Response(JSON.stringify({ error: "invalid_dpop_proof", code: outcome.error?.code }), {
+                status: 401,
+                headers: {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": DPOP_WWW_AUTHENTICATE,
+                },
+            });
+        }
+        return undefined;
+    };
+}
+//# sourceMappingURL=require-dpop.js.map

package/dist/sveltekit/require-dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dpop.js","sourceRoot":"","sources":["../../src/sveltekit/require-dpop.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAgD,MAAM,YAAY,CAAC;AAEzF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAAyC,EAAE;IACrE,OAAO,KAAK,EAAE,KAAmB,EAAiC,EAAE;QAClE,MAAM,OAAO,GAAI,KAAK,CAAC,MAAkC,CAAC,IAE7C,CAAC;QACd,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAG,OAAmD,CAAC,aAAa,CAA8B;YACnG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;YACrD,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;YACtE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YACnB,QAAQ;YACR,WAAW;YACX,IAAI,EAAE;gBACJ,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAChG,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aACzE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAC1E;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,qBAAqB;iBAC1C;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/sveltekit/require-proof.d.ts

@@ -0,0 +1,15 @@
+import { type RequestEvent } from "@sveltejs/kit";
+import { type RequireProofOptions } from "../core/index.js";
+/**
+ * The route guard for SvelteKit. `await` it at the top of a `+server` handler
+ * or a form action, after `dbscHandle` has populated `event.locals.dbsc`:
+ *
+ *   export async function POST(event) {
+ *     await requireProof()(event);
+ *     // ... reached only from the bound device
+ *   }
+ *
+ * Throws a SvelteKit `error(403)` when there is no binding or the proof fails.
+ */
+export declare function requireProof(opts?: RequireProofOptions): (event: RequestEvent) => Promise<void>;
+//# sourceMappingURL=require-proof.d.ts.map

package/dist/sveltekit/require-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.d.ts","sourceRoot":"","sources":["../../src/sveltekit/require-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,IAC3C,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwClD"}

package/dist/sveltekit/require-proof.js

@@ -0,0 +1,52 @@
+import { error } from "@sveltejs/kit";
+import { verifyBoundProof, DbscVerificationError, } from "../core/index.js";
+import { DBSC_INTERNAL } from "./index.js";
+/**
+ * The route guard for SvelteKit. `await` it at the top of a `+server` handler
+ * or a form action, after `dbscHandle` has populated `event.locals.dbsc`:
+ *
+ *   export async function POST(event) {
+ *     await requireProof()(event);
+ *     // ... reached only from the bound device
+ *   }
+ *
+ * Throws a SvelteKit `error(403)` when there is no binding or the proof fails.
+ */
+export function requireProof(opts = {}) {
+    return async (event) => {
+        const session = event.locals.dbsc;
+        const tier = session?.tier ?? "none";
+        if (!session?.sessionId || tier === "none") {
+            throw error(403, "device-bound session required");
+        }
+        const internal = session[DBSC_INTERNAL];
+        const storage = opts.storage ?? internal?.storage;
+        if (!storage) {
+            throw error(500, "requireProof: storage unavailable — add dbscHandle to hooks.server.ts, or pass { storage }");
+        }
+        const allowDbscWithoutProof = opts.allowDbscWithoutProof ?? (internal?.boundEnabled === false ? true : undefined);
+        if (tier === "dbsc" && allowDbscWithoutProof)
+            return;
+        const proofHeader = event.request.headers.get("x-dbsc-bound-proof") ?? undefined;
+        const bodyBytes = new Uint8Array(await event.request.clone().arrayBuffer());
+        try {
+            await verifyBoundProof({
+                sessionId: session.sessionId,
+                proofHeader,
+                method: event.request.method,
+                path: event.url.pathname,
+                signBody: true,
+                bodyBytes,
+                ...(opts.timestampWindowMs !== undefined && { timestampWindowMs: opts.timestampWindowMs }),
+                ...(internal?.replayCache !== undefined && { replayCache: internal.replayCache }),
+            }, storage);
+        }
+        catch (err) {
+            if (err instanceof DbscVerificationError) {
+                throw error(403, err.message);
+            }
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=require-proof.js.map

package/dist/sveltekit/require-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.js","sourceRoot":"","sources":["../../src/sveltekit/require-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAgD,MAAM,YAAY,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,OAAO,KAAK,EAAE,KAAmB,EAAiB,EAAE;QAClD,MAAM,OAAO,GAAI,KAAK,CAAC,MAAkC,CAAC,IAAwC,CAAC;QACnG,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAI,OAAmD,CAAC,aAAa,CAA6B,CAAC;QACjH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,CAAC,GAAG,EAAE,4FAA4F,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,IAAI,KAAK,MAAM,IAAI,qBAAqB;YAAE,OAAO;QAErD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC;QACjF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,gBAAgB,CACpB;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;gBACX,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;gBAC5B,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;gBACxB,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC1F,GAAG,CAAC,QAAQ,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;aAClF,EACD,OAAO,CACR,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}