dbsc-toolkit 2.12.0 → 2.13.0

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Stop stolen session cookies from being replayed on another device.</strong><br>
-  Device Bound Session Credentials for Node.js — one framework-agnostic core with adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit and raw <code>node:http</code>, plus a Web Crypto polyfill so every browser is covered, not just Chrome. A language-neutral protocol spec with a Node reference implementation.
+  Device Bound Session Credentials for Node.js — one framework-agnostic core with adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit, Electron and raw <code>node:http</code>, plus a Web Crypto polyfill so every browser is covered, not just Chrome. A language-neutral protocol spec with a Node reference implementation.
 </p>
 
 <p align="center">
@@ -120,7 +120,7 @@ Load the polyfill in your HTML so non-Chromium browsers reach `tier: "bound"`:
 </script>
 ```
 
-Full walk-through, failure modes, and migration timeline: **[docs/getting-started.md](./docs/getting-started.md)** and **[docs/integrating-existing-auth.md](./docs/integrating-existing-auth.md)**.
+Full walk-through, failure modes, and migration timeline: **[docs/quickstart.md](./docs/quickstart.md)** and **[docs/guide.md](./docs/guide.md)**.
 
 ### Any framework
 
@@ -135,6 +135,7 @@ The protocol lives in a framework-agnostic core — plain functions plus a `Stor
 | NestJS | `dbsc-toolkit/nestjs` |
 | Koa | `dbsc-toolkit/koa` |
 | SvelteKit | `dbsc-toolkit/sveltekit` |
+| Electron (main process) | `dbsc-toolkit/electron` |
 | Any other server (raw `node:http`) | `dbsc-toolkit/node` |
 | [Better Auth](https://better-auth.com) | `@dbsc-toolkit/better-auth` |
 
@@ -213,13 +214,13 @@ const token = signAccessToken({ sub, cnf: { jkt } });   // your JWT lib
 app.get("/api/resource", requireDpop({ getBoundJkt }), handler);
 ```
 
-`requireDpop` is exported from every adapter (Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit, `node:http`). A failed check answers `401` with `WWW-Authenticate: DPoP`. Always pass `getBoundJkt` so the presented token is bound to its key — see [docs/dpop.md](./docs/dpop.md) and [spec/10-dpop.md](./spec/10-dpop.md).
+`requireDpop` is exported from every adapter (Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit, Electron, `node:http`). A failed check answers `401` with `WWW-Authenticate: DPoP`. Always pass `getBoundJkt` so the presented token is bound to its key — see [docs/dpop.md](./docs/dpop.md) and [spec/10-dpop.md](./spec/10-dpop.md).
 
 ## Ecosystem
 
 | Package | What it is |
 |---|---|
-| `dbsc-toolkit` | Core + adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit & raw `node:http`; memory/Redis/Postgres storage |
+| `dbsc-toolkit` | Core + adapters for Express, Fastify, Hono, Next.js, NestJS, Koa, SvelteKit, Electron & raw `node:http`; memory/Redis/Postgres storage |
 | `dbsc-toolkit/dpop` | Optional DPoP (RFC 9449) — bind bearer/access tokens to a device key |
 | `dbsc-toolkit/client` | Browser SDK + Web Crypto polyfill |
 | [`@dbsc-toolkit/better-auth`](./packages/better-auth/) | First-class [Better Auth](https://better-auth.com) plugin — binds every sign-in method automatically |
@@ -245,7 +246,7 @@ The wire protocol is documented as a language-neutral spec in [`spec/`](./spec/)
 - [x] Per-request proof + body signing + replay cache
 - [x] Multi-subdomain binding (`cookieScope: "site"`)
 - [x] Better Auth plugin
-- [x] NestJS, Koa, SvelteKit & generic `node:http` adapters
+- [x] NestJS, Koa, SvelteKit, Electron & generic `node:http` adapters
 - [x] DPoP (RFC 9449) for bearer-token binding
 - [ ] Bun / Deno native paths
 - [ ] Third-party security audit
@@ -255,7 +256,7 @@ The wire protocol is documented as a language-neutral spec in [`spec/`](./spec/)
 | Import | What it is |
 |---|---|
 | `dbsc-toolkit` | Core: types, crypto, protocol handlers, framework-agnostic |
-| `dbsc-toolkit/express` · `/fastify` · `/hono` · `/nextjs` · `/nestjs` · `/koa` · `/sveltekit` · `/node` | Framework adapters |
+| `dbsc-toolkit/express` · `/fastify` · `/hono` · `/nextjs` · `/nestjs` · `/koa` · `/sveltekit` · `/electron` · `/node` | Framework adapters |
 | `dbsc-toolkit/dpop` | Optional DPoP (RFC 9449) verifier + `requireDpop` per adapter |
 | `dbsc-toolkit/client` | Browser SDK + polyfill |
 | `dbsc-toolkit/storage/{memory,redis,postgres}` | Storage adapters |
@@ -264,10 +265,10 @@ The wire protocol is documented as a language-neutral spec in [`spec/`](./spec/)
 
 - **Protocol spec (language-neutral):** [spec/](./spec/) · [conformance](./spec/09-conformance.md) · [test vectors](./spec/vectors)
 - **Concepts & protocol:** [HOW-IT-WORKS.md](./HOW-IT-WORKS.md)
-- **Getting started:** [docs/getting-started.md](./docs/getting-started.md)
-- **Add to an existing app:** [docs/integrating-existing-auth.md](./docs/integrating-existing-auth.md)
-- **Per-request signing & replay cache:** [docs/per-request-signing.md](./docs/per-request-signing.md)
-- **Bound polyfill wire protocol:** [docs/bound-polyfill.md](./docs/bound-polyfill.md)
+- **Getting started:** [docs/quickstart.md](./docs/quickstart.md)
+- **Add to an existing app:** [docs/guide.md](./docs/guide.md)
+- **Per-request signing & replay cache:** [docs/request-signing.md](./docs/request-signing.md)
+- **Bound polyfill wire protocol:** [docs/polyfill.md](./docs/polyfill.md)
 - **API reference:** [docs/api-reference.md](./docs/api-reference.md)
 - **Adapters (+ build your own):** [docs/adapters.md](./docs/adapters.md)
 - **Storage:** [docs/storage.md](./docs/storage.md) · **Deployment:** [docs/deployment.md](./docs/deployment.md)

package/dist/electron/create-dbsc.d.ts

@@ -0,0 +1,25 @@
+import { type CreateDbscOptions, type DbscKit } from "../node/create-dbsc.js";
+import { type DbscProtocolResult } from "./index.js";
+export type { CreateDbscOptions } from "../node/create-dbsc.js";
+export interface ElectronDbscKit extends DbscKit {
+    /**
+     * A handler for Electron's `protocol.handle(scheme, handler)`. Pass a Web
+     * `Request`, get the `Response` for DBSC protocol routes:
+     *
+     *   protocol.handle("app", (request) => kit.protocolHandler()(request));
+     *
+     * Non-protocol requests come back as a 404 by default; use
+     * `protocolRoute(request)` if you need the resolved session to serve your own
+     * routes instead.
+     */
+    protocolHandler(): (request: Request) => Promise<Response>;
+    /** Lower-level: returns `{ handled, response, session }` so you can branch. */
+    protocolRoute(request: Request): Promise<DbscProtocolResult>;
+}
+/**
+ * Builds a DBSC kit for an Electron main process. Everything the raw-http kit
+ * offers (`handler`, `bind`, `requireProof`, `requireDpop`, `getSession`) plus a
+ * `protocol.handle`-shaped surface so the routes mount on an Electron scheme.
+ */
+export declare function createElectronDbsc(opts: CreateDbscOptions): ElectronDbscKit;
+//# sourceMappingURL=create-dbsc.d.ts.map

package/dist/electron/create-dbsc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.d.ts","sourceRoot":"","sources":["../../src/electron/create-dbsc.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEzE,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C;;;;;;;;;OASG;IACH,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAa3E"}

package/dist/electron/create-dbsc.js

@@ -0,0 +1,22 @@
+import { createDbsc as createNodeDbsc, } from "../node/create-dbsc.js";
+import { handleDbscProtocol } from "./index.js";
+/**
+ * Builds a DBSC kit for an Electron main process. Everything the raw-http kit
+ * offers (`handler`, `bind`, `requireProof`, `requireDpop`, `getSession`) plus a
+ * `protocol.handle`-shaped surface so the routes mount on an Electron scheme.
+ */
+export function createElectronDbsc(opts) {
+    const kit = createNodeDbsc(opts);
+    const handler = kit.handler();
+    return {
+        ...kit,
+        protocolRoute: (request) => handleDbscProtocol(request, handler),
+        protocolHandler: () => async (request) => {
+            const { handled, response } = await handleDbscProtocol(request, handler);
+            if (handled)
+                return response;
+            return new Response(null, { status: 404 });
+        },
+    };
+}
+//# sourceMappingURL=create-dbsc.js.map

package/dist/electron/create-dbsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.js","sourceRoot":"","sources":["../../src/electron/create-dbsc.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,IAAI,cAAc,GAG7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAA2B,MAAM,YAAY,CAAC;AAoBzE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE9B,OAAO;QACL,GAAG,GAAG;QACN,aAAa,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC;QACzE,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YAChD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzE,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/electron/index.d.ts

@@ -0,0 +1,30 @@
+import { type DbscNodeHandler, type DbscNodeSession } from "../node/index.js";
+export { dbsc, bindSession, getDbscSession, readJsonBody, createDbsc, DBSC_INTERNAL, } from "../node/index.js";
+export type { DbscNodeHandler, DbscNodeSession, DbscNodeOptions, DbscInternal, BindSessionOptions, } from "../node/index.js";
+export type { CreateDbscOptions, DbscKit, BindOptions } from "../node/create-dbsc.js";
+export { requireProof, type ElectronProofGuard } from "./require-proof.js";
+export { requireDpop, type ElectronDpopGuard } from "./require-dpop.js";
+export { createElectronDbsc, type ElectronDbscKit } from "./create-dbsc.js";
+/**
+ * Electron's `protocol.handle(scheme, handler)` hands you a Web `Request` and
+ * wants a `Response`. This adapts that shape onto the existing raw-http handler
+ * (no protocol logic is duplicated): it builds a minimal request/response shim,
+ * runs the node `dbsc()` handler, and converts the captured response back.
+ *
+ * When the request is a DBSC protocol route the returned `Response` is the answer
+ * to send. Otherwise `dbsc()` did not own the route — `handled` is false, the
+ * resolved `session` is provided so the caller can branch, and `respondWith`
+ * lets a guard write into the same response shim.
+ */
+export interface DbscProtocolResult {
+    handled: boolean;
+    response: Response;
+    session: DbscNodeSession | undefined;
+}
+/**
+ * Run a configured `dbsc()` handler against an Electron Web `Request`.
+ * Use the kit's `protocolHandler()` for the common case; this is the lower-level
+ * primitive if you need the resolved session or to chain a guard.
+ */
+export declare function handleDbscProtocol(request: Request, handler: DbscNodeHandler): Promise<DbscProtocolResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/electron/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/electron/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKpG,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,eAAe,GAAG,SAAS,CAAC;CACtC;AAkFD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAM7B"}

package/dist/electron/index.js

@@ -0,0 +1,95 @@
+import { getDbscSession } from "../node/index.js";
+// Re-export the raw-http surface verbatim. In Electron's main process you can run
+// an ordinary localhost http.Server and wire `dbsc()` at the top of the listener
+// exactly as on the node adapter, then read the session with `getDbscSession`.
+export { dbsc, bindSession, getDbscSession, readJsonBody, createDbsc, DBSC_INTERNAL, } from "../node/index.js";
+export { requireProof } from "./require-proof.js";
+export { requireDpop } from "./require-dpop.js";
+export { createElectronDbsc } from "./create-dbsc.js";
+/** Minimal IncomingMessage shim carrying just what the handler + guards read. */
+function makeReq(request, body) {
+    const headers = {};
+    request.headers.forEach((value, key) => {
+        headers[key.toLowerCase()] = value;
+    });
+    const u = new URL(request.url);
+    // host header drives reqUrl/reqOrigin in the node handler; honor it from the URL.
+    if (!headers["host"])
+        headers["host"] = u.host;
+    let consumed = false;
+    const req = {
+        method: request.method,
+        url: u.pathname + u.search,
+        headers,
+        socket: { remoteAddress: "127.0.0.1", encrypted: u.protocol === "https:" },
+        // readJsonBody does `for await (const chunk of req)`; yield the body once.
+        async *[Symbol.asyncIterator]() {
+            if (consumed)
+                return;
+            consumed = true;
+            if (body.length)
+                yield Buffer.from(body);
+        },
+    };
+    return req;
+}
+function makeRes() {
+    let statusCode = 200;
+    const headers = new Map();
+    const chunks = [];
+    const key = (n) => n.toLowerCase();
+    const res = {
+        get statusCode() {
+            return statusCode;
+        },
+        set statusCode(v) {
+            statusCode = v;
+        },
+        setHeader(name, value) {
+            headers.set(key(name), Array.isArray(value) ? value.map(String) : String(value));
+        },
+        getHeader(name) {
+            return headers.get(key(name));
+        },
+        end(chunk) {
+            if (chunk !== undefined) {
+                chunks.push(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+            }
+        },
+    };
+    function toResponse() {
+        const h = new Headers();
+        for (const [name, value] of headers) {
+            if (name === "set-cookie") {
+                const list = Array.isArray(value) ? value : [value];
+                for (const c of list)
+                    h.append("set-cookie", c);
+            }
+            else {
+                h.set(name, Array.isArray(value) ? value.join(", ") : value);
+            }
+        }
+        const total = chunks.reduce((n, c) => n + c.length, 0);
+        const body = new Uint8Array(total);
+        let off = 0;
+        for (const c of chunks) {
+            body.set(c, off);
+            off += c.length;
+        }
+        return new Response(total ? body : null, { status: statusCode, headers: h });
+    }
+    return { res: res, toResponse };
+}
+/**
+ * Run a configured `dbsc()` handler against an Electron Web `Request`.
+ * Use the kit's `protocolHandler()` for the common case; this is the lower-level
+ * primitive if you need the resolved session or to chain a guard.
+ */
+export async function handleDbscProtocol(request, handler) {
+    const raw = new Uint8Array(await request.clone().arrayBuffer());
+    const req = makeReq(request, raw);
+    const { res, toResponse } = makeRes();
+    const handled = await handler(req, res);
+    return { handled, response: toResponse(), session: getDbscSession(req) };
+}
+//# sourceMappingURL=index.js.map

package/dist/electron/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/electron/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,cAAc,EAA8C,MAAM,kBAAkB,CAAC;AAEpG,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,YAAY,EAA2B,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAA0B,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAwB,MAAM,kBAAkB,CAAC;AAmB5E,iFAAiF;AACjF,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAgB;IACjD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAE/C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,GAAG,GAAG;QACV,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;QAC1B,OAAO;QACP,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE;QAC1E,2EAA2E;QAC3E,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;YAC3B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;IACF,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAOD,SAAS,OAAO;IACd,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAG;QACV,IAAI,UAAU;YACZ,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,UAAU,CAAC,CAAS;YACtB,UAAU,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,IAAY,EAAE,KAA0C;YAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,SAAS,CAAC,IAAY;YACpB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,GAAG,CAAC,KAA2B;YAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,UAAU;QACjB,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACpD,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAgC,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,OAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/dist/electron/require-dpop.d.ts

@@ -0,0 +1,2 @@
+export { requireDpop, type NodeDpopGuard as ElectronDpopGuard } from "../node/require-dpop.js";
+//# sourceMappingURL=require-dpop.d.ts.map

package/dist/electron/require-dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dpop.d.ts","sourceRoot":"","sources":["../../src/electron/require-dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/electron/require-dpop.js

@@ -0,0 +1,3 @@
+// DPoP guard is request/response-based like the rest; re-export the node one.
+export { requireDpop } from "../node/require-dpop.js";
+//# sourceMappingURL=require-dpop.js.map

package/dist/electron/require-dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-dpop.js","sourceRoot":"","sources":["../../src/electron/require-dpop.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAA2C,MAAM,yBAAyB,CAAC"}

package/dist/electron/require-proof.d.ts

@@ -0,0 +1,2 @@
+export { requireProof, type NodeProofGuard as ElectronProofGuard } from "../node/require-proof.js";
+//# sourceMappingURL=require-proof.d.ts.map

package/dist/electron/require-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.d.ts","sourceRoot":"","sources":["../../src/electron/require-proof.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/electron/require-proof.js

@@ -0,0 +1,4 @@
+// Electron runs a Node main process, so the per-request guard is exactly the
+// raw-http one. Re-export it under an Electron-flavored type alias.
+export { requireProof } from "../node/require-proof.js";
+//# sourceMappingURL=require-proof.js.map

package/dist/electron/require-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.js","sourceRoot":"","sources":["../../src/electron/require-proof.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oEAAoE;AACpE,OAAO,EAAE,YAAY,EAA6C,MAAM,0BAA0B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dbsc-toolkit",
-  "version": "2.12.0",
+  "version": "2.13.0",
   "description": "Server-side Device Bound Session Credentials (DBSC) for Node.js — Express, Fastify, Hono and Next.js adapters — plus a Web Crypto polyfill for Firefox, Safari, and older Chromium. Cookie-theft protection on every modern browser.",
   "license": "Apache-2.0",
   "type": "module",
@@ -43,6 +43,10 @@
       "import": "./dist/nestjs/index.js",
       "types": "./dist/nestjs/index.d.ts"
     },
+    "./electron": {
+      "import": "./dist/electron/index.js",
+      "types": "./dist/electron/index.d.ts"
+    },
     "./dpop": {
       "import": "./dist/dpop/index.js",
       "types": "./dist/dpop/index.d.ts"
@@ -84,6 +88,7 @@
     "@nestjs/common": ">=10.0.0",
     "@nestjs/core": ">=10.0.0",
     "@sveltejs/kit": ">=2.0.0",
+    "electron": ">=28.0.0",
     "express": ">=5.0.0",
     "fastify": ">=5.0.0",
     "hono": ">=4.0.0",
@@ -111,6 +116,9 @@
     "@sveltejs/kit": {
       "optional": true
     },
+    "electron": {
+      "optional": true
+    },
     "hono": {
       "optional": true
     },