dbsc-toolkit 2.9.12 → 2.11.0

package/dist/node/create-dbsc.js

@@ -0,0 +1,33 @@
+import { dbsc, bindSession, getDbscSession, } from "./index.js";
+import { requireProof } from "./require-proof.js";
+/**
+ * Builds a configured DBSC kit for raw `node:http`. There is no `install()`
+ * because raw http has no router — wire `handler()` at the top of your request
+ * listener and branch on its boolean return.
+ */
+export function createDbsc(opts) {
+    const secure = opts.secure ?? true;
+    const cookieScope = opts.cookieScope;
+    const cookieDomain = opts.cookieDomain;
+    const registrationPath = opts.registrationPath ?? "/dbsc/registration";
+    const handler = dbsc(opts);
+    async function bind(res, sessionId, bindOpts) {
+        await bindSession(res, sessionId, opts.storage, {
+            userId: bindOpts.userId,
+            secure,
+            ...(cookieScope !== undefined && { cookieScope }),
+            ...(cookieDomain !== undefined && { cookieDomain }),
+            registrationPath,
+            ...(opts.registrationCookieTtl !== undefined && { registrationCookieTtl: opts.registrationCookieTtl }),
+            ...(opts.sessionTtl !== undefined && { sessionTtl: opts.sessionTtl }),
+        });
+        return sessionId;
+    }
+    return {
+        handler: () => handler,
+        getSession: getDbscSession,
+        bind,
+        requireProof,
+    };
+}
+//# sourceMappingURL=create-dbsc.js.map

package/dist/node/create-dbsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-dbsc.js","sourceRoot":"","sources":["../../src/node/create-dbsc.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,GAIf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAuBvE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3B,KAAK,UAAU,IAAI,CAAC,GAAmB,EAAE,SAAiB,EAAE,QAAqB;QAC/E,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM;YACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,gBAAgB;YAChB,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;QACtB,UAAU,EAAE,cAAc;QAC1B,IAAI;QACJ,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/node/index.d.ts

@@ -0,0 +1,53 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type DbscOptions, type StorageAdapter, type ProofReplayCache, type ProtectionTier, type SkippedEntry, type CookieScope } from "../core/index.js";
+export { requireProof } from "./require-proof.js";
+export { createDbsc } from "./create-dbsc.js";
+export type { CreateDbscOptions, DbscKit, BindOptions } from "./create-dbsc.js";
+/** Internal carrier so `requireProof()` can reach storage without re-passing it. */
+export interface DbscInternal {
+    storage: StorageAdapter;
+    secure: boolean;
+    /** When false, `requireProof()` auto-relaxes the native dbsc tier. */
+    boundEnabled: boolean;
+    replayCache?: ProofReplayCache;
+}
+export declare const DBSC_INTERNAL: unique symbol;
+export interface DbscNodeOptions extends DbscOptions {
+    secure?: boolean;
+    boundStatePath?: string;
+    boundChallengePath?: string;
+    boundRegistrationPath?: string;
+    boundRefreshPath?: string;
+}
+export interface DbscNodeSession {
+    sessionId: string | null;
+    tier: ProtectionTier;
+    skipped: SkippedEntry[];
+    revoke: () => Promise<void>;
+}
+/**
+ * The dbsc handler for raw `node:http`. Call it first in your request
+ * pipeline: it returns `true` when it has fully answered a DBSC protocol route
+ * (the response is ended — stop), and `false` otherwise, having attached the
+ * resolved session to the request. Read it back with `getDbscSession(req)`.
+ */
+export type DbscNodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+/** Reads the session the `dbsc()` handler attached to this request. */
+export declare function getDbscSession(req: IncomingMessage): DbscNodeSession | undefined;
+/** Reads and JSON-parses the raw request body. Returns `{}` on empty/invalid. */
+export declare function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>>;
+export interface BindSessionOptions {
+    userId: string;
+    /** Match the value passed to dbsc({ secure }). Defaults true. */
+    secure?: boolean;
+    /** Match the value passed to dbsc({ cookieScope }). Defaults "host". */
+    cookieScope?: CookieScope;
+    /** Match the value passed to dbsc({ cookieDomain }). Required for cookieScope: "site". */
+    cookieDomain?: string;
+    registrationPath?: string;
+    registrationCookieTtl?: number;
+    sessionTtl?: number;
+}
+export declare function bindSession(res: ServerResponse, sessionId: string, storage: StorageAdapter, opts: BindSessionOptions): Promise<void>;
+export declare function dbsc(opts: DbscNodeOptions): DbscNodeHandler;
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAwBL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEhF,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AACD,eAAO,MAAM,aAAa,EAAE,OAAO,MAA6C,CAAC;AAejF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9F,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAEhF;AAmED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiBzF;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAwT3D"}

package/dist/node/index.js

@@ -0,0 +1,412 @@
+import { handleRegistration, handleRefresh, handleBoundRegistration, handleBoundRefresh, issueChallenge, buildRegistrationHeader, buildChallengeHeader, readSessionResponseHeader, parseSessionSkippedHeader, REGISTRATION_HEADER, CHALLENGE_HEADER, LEGACY_REGISTRATION_HEADER, LEGACY_CHALLENGE_HEADER, NoopRateLimiter, emit, maybeEmitPolyfillMissing, parseCookieHeader, resolveCookieNames, cookieAttributesString, resolveCookieScope, DbscProtocolError, DbscVerificationError, ErrorCodes, } from "../core/index.js";
+export { requireProof } from "./require-proof.js";
+export { createDbsc } from "./create-dbsc.js";
+export const DBSC_INTERNAL = Symbol("dbsc-toolkit.node.internal");
+const DBSC_SESSION = Symbol("dbsc-toolkit.node.session");
+const cookieNames = (s) => resolveCookieNames(s);
+const DEFAULT_BOUND_TTL = 10 * 60 * 1000;
+const DEFAULT_REG_TTL = 24 * 60 * 60 * 1000;
+const DEFAULT_SESSION_TTL = 24 * 60 * 60 * 1000;
+/** Reads the session the `dbsc()` handler attached to this request. */
+export function getDbscSession(req) {
+    return req[DBSC_SESSION];
+}
+function cookieOpts(ttlMs, scope) {
+    const { domain } = resolveCookieScope(scope);
+    return {
+        httpOnly: true,
+        secure: scope.secure,
+        sameSite: "lax",
+        maxAge: ttlMs / 1000,
+        path: "/",
+        ...(domain !== undefined && { domain }),
+    };
+}
+function serializeCookie(name, value, opts) {
+    const parts = [`${name}=${value}`, "HttpOnly"];
+    if (opts.secure)
+        parts.push("Secure");
+    const sameSite = opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1);
+    parts.push(`SameSite=${sameSite}`);
+    parts.push(`Max-Age=${opts.maxAge}`);
+    parts.push(`Path=${opts.path}`);
+    if (opts.domain)
+        parts.push(`Domain=${opts.domain}`);
+    return parts.join("; ");
+}
+function appendSetCookie(res, cookies) {
+    const add = Array.isArray(cookies) ? cookies : [cookies];
+    const prior = res.getHeader("Set-Cookie");
+    const priorList = Array.isArray(prior)
+        ? prior.map(String)
+        : prior !== undefined
+            ? [String(prior)]
+            : [];
+    res.setHeader("Set-Cookie", [...priorList, ...add]);
+}
+function reqUrl(req) {
+    return new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+}
+function reqOrigin(req) {
+    const xfp = req.headers["x-forwarded-proto"];
+    const proto = (Array.isArray(xfp) ? xfp[0] : xfp)?.split(",")[0]?.trim() ??
+        (req.socket.encrypted ? "https" : "http");
+    return `${proto}://${req.headers.host ?? "localhost"}`;
+}
+function reqIp(req) {
+    return req.socket?.remoteAddress ?? "unknown";
+}
+function reqCookies(req) {
+    return parseCookieHeader(req.headers.cookie);
+}
+function sendJson(res, status, body) {
+    res.setHeader("Content-Type", "application/json");
+    res.statusCode = status;
+    res.end(JSON.stringify(body));
+}
+function sendStatus(res, status) {
+    res.statusCode = status;
+    res.end();
+}
+/** Reads and JSON-parses the raw request body. Returns `{}` on empty/invalid. */
+export async function readJsonBody(req) {
+    const cached = req["__dbscRawBody"];
+    let raw;
+    if (Buffer.isBuffer(cached)) {
+        raw = cached;
+    }
+    else {
+        const chunks = [];
+        for await (const chunk of req)
+            chunks.push(chunk);
+        raw = Buffer.concat(chunks);
+        req["__dbscRawBody"] = raw;
+    }
+    if (raw.length === 0)
+        return {};
+    try {
+        return JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export async function bindSession(res, sessionId, storage, opts) {
+    const secure = opts.secure ?? true;
+    const registrationPath = opts.registrationPath ?? "/dbsc/registration";
+    const regCookieTtl = opts.registrationCookieTtl ?? DEFAULT_REG_TTL;
+    const sessionTtl = opts.sessionTtl ?? DEFAULT_SESSION_TTL;
+    const scope = {
+        secure,
+        ...(opts.cookieScope !== undefined && { cookieScope: opts.cookieScope }),
+        ...(opts.cookieDomain !== undefined && { cookieDomain: opts.cookieDomain }),
+    };
+    const COOKIES = cookieNames(scope);
+    const existing = await storage.getSession(sessionId);
+    const now = Date.now();
+    if (!existing) {
+        await storage.setSession({
+            id: sessionId,
+            userId: opts.userId,
+            tier: "none",
+            createdAt: now,
+            expiresAt: now + sessionTtl,
+            lastRefreshAt: 0,
+        });
+    }
+    const challenge = await issueChallenge(sessionId, storage);
+    const regHeader = buildRegistrationHeader({
+        registrationPath,
+        challenge: challenge.jti,
+        cookieName: COOKIES.bound,
+    });
+    res.setHeader(REGISTRATION_HEADER, regHeader);
+    res.setHeader(LEGACY_REGISTRATION_HEADER, regHeader);
+    appendSetCookie(res, [
+        serializeCookie(COOKIES.reg, sessionId, cookieOpts(regCookieTtl, scope)),
+        serializeCookie(COOKIES.challenge, challenge.jti, cookieOpts(5 * 60 * 1000, scope)),
+    ]);
+}
+export function dbsc(opts) {
+    const { storage, registrationPath = "/dbsc/registration", refreshPath = "/dbsc/refresh", boundStatePath = "/dbsc-bound/state", boundChallengePath = "/dbsc-bound/challenge", boundRegistrationPath = "/dbsc-bound/registration", boundRefreshPath = "/dbsc-bound/refresh", bound = true, boundCookieTtl = DEFAULT_BOUND_TTL, refreshGraceMs = 30_000, registrationCookieTtl = DEFAULT_REG_TTL, rateLimiter = new NoopRateLimiter(), replayCache, onEvent, autoBind, secure = true, cookieScope, cookieDomain, } = opts;
+    const scope = {
+        secure,
+        ...(cookieScope !== undefined && { cookieScope }),
+        ...(cookieDomain !== undefined && { cookieDomain }),
+    };
+    resolveCookieScope(scope);
+    const cookieAttrs = cookieAttributesString(scope);
+    const COOKIES = cookieNames(scope);
+    const polyfillMissingEmitted = new Set();
+    function configBody(sessionId, origin, refreshUrl) {
+        return {
+            session_identifier: sessionId,
+            refresh_url: refreshUrl,
+            scope: { origin, include_site: true, scope_specification: [] },
+            credentials: [{ type: "cookie", name: COOKIES.bound, attributes: cookieAttrs }],
+        };
+    }
+    async function handleRegistrationRoute(req, res) {
+        const ip = reqIp(req);
+        const allowed = await rateLimiter.checkRegistration(ip);
+        if (!allowed)
+            return sendJson(res, 429, { error: "rate limited" });
+        const cookies = reqCookies(req);
+        const sessionId = cookies[COOKIES.reg];
+        const expectedJti = cookies[COOKIES.challenge];
+        if (!sessionId || !expectedJti) {
+            return sendJson(res, 400, { error: "missing session or challenge cookie" });
+        }
+        try {
+            await handleRegistration({
+                sessionId,
+                secSessionResponseHeader: readSessionResponseHeader(req.headers),
+                expectedJti,
+            }, storage);
+            emit(onEvent, { type: "registration", sessionId, tier: "dbsc", timestamp: Date.now(), algorithm: "ES256", ip });
+            appendSetCookie(res, [
+                serializeCookie(COOKIES.bound, sessionId, cookieOpts(boundCookieTtl, scope)),
+                serializeCookie(COOKIES.challenge, "", { ...cookieOpts(0, scope), maxAge: 0 }),
+            ]);
+            sendJson(res, 200, configBody(sessionId, reqOrigin(req), refreshPath));
+        }
+        catch (err) {
+            await rateLimiter.recordFailure(ip, sessionId);
+            if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                emit(onEvent, { type: "verification_failure", sessionId, tier: "dbsc", timestamp: Date.now(), reason: err.code, ip });
+                return sendJson(res, 400, { error: err.message });
+            }
+            throw err;
+        }
+    }
+    async function handleRefreshRoute(req, res) {
+        const ip = reqIp(req);
+        const cookies = reqCookies(req);
+        const idHeader = req.headers["sec-secure-session-id"];
+        const sessionId = (Array.isArray(idHeader) ? idHeader[0] : idHeader) ?? cookies[COOKIES.bound];
+        if (!sessionId)
+            return sendStatus(res, 403);
+        const allowed = await rateLimiter.checkRefresh(ip, sessionId);
+        if (!allowed)
+            return sendJson(res, 429, { error: "rate limited" });
+        const responseHeader = readSessionResponseHeader(req.headers);
+        const expectedJti = cookies[COOKIES.challenge];
+        if (!responseHeader || !expectedJti) {
+            const challenge = await issueChallenge(sessionId, storage);
+            res.setHeader(CHALLENGE_HEADER, buildChallengeHeader(challenge.jti, sessionId));
+            res.setHeader(LEGACY_CHALLENGE_HEADER, buildChallengeHeader(challenge.jti, sessionId));
+            appendSetCookie(res, serializeCookie(COOKIES.challenge, challenge.jti, cookieOpts(5 * 60 * 1000, scope)));
+            return sendStatus(res, 403);
+        }
+        try {
+            await handleRefresh({ sessionId, secSessionResponseHeader: responseHeader, expectedJti }, storage);
+            emit(onEvent, { type: "refresh", sessionId, tier: "dbsc", timestamp: Date.now(), ip });
+            appendSetCookie(res, [
+                serializeCookie(COOKIES.bound, sessionId, cookieOpts(boundCookieTtl, scope)),
+                serializeCookie(COOKIES.challenge, "", { ...cookieOpts(0, scope), maxAge: 0 }),
+            ]);
+            sendJson(res, 200, configBody(sessionId, reqOrigin(req), refreshPath));
+        }
+        catch (err) {
+            await rateLimiter.recordFailure(ip, sessionId);
+            const stolenCheck = await storage.getBoundKey(sessionId);
+            if (stolenCheck && err instanceof DbscVerificationError && err.code === ErrorCodes.SIGNATURE_INVALID) {
+                emit(onEvent, { type: "session_stolen", sessionId, tier: "dbsc", timestamp: Date.now(), ip });
+            }
+            if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                emit(onEvent, { type: "verification_failure", sessionId, tier: "dbsc", timestamp: Date.now(), reason: err.code, ip });
+                const challenge = await issueChallenge(sessionId, storage);
+                res.setHeader(CHALLENGE_HEADER, buildChallengeHeader(challenge.jti, sessionId));
+                res.setHeader(LEGACY_CHALLENGE_HEADER, buildChallengeHeader(challenge.jti, sessionId));
+                appendSetCookie(res, serializeCookie(COOKIES.challenge, challenge.jti, cookieOpts(5 * 60 * 1000, scope)));
+                return sendJson(res, 403, { error: err.message });
+            }
+            throw err;
+        }
+    }
+    function readBoundSessionId(cookies) {
+        return cookies[COOKIES.bound] ?? cookies[COOKIES.reg];
+    }
+    async function handleBoundStateRoute(req, res) {
+        res.setHeader("X-Server-Time", String(Date.now()));
+        const skipped = parseSessionSkippedHeader(req.headers);
+        const nativeSkipped = skipped.length ? skipped.map((s) => s.reason) : undefined;
+        const sessionId = readBoundSessionId(reqCookies(req));
+        if (!sessionId)
+            return sendJson(res, 200, { phase: "unbound", sessionId: null, ...(nativeSkipped && { nativeSkipped }) });
+        const session = await storage.getSession(sessionId);
+        if (!session)
+            return sendJson(res, 200, { phase: "unbound", sessionId: null, ...(nativeSkipped && { nativeSkipped }) });
+        const nativeKey = await storage.getBoundKey(sessionId, "native");
+        const boundKey = await storage.getBoundKey(sessionId, "bound");
+        if (!nativeKey && !boundKey) {
+            const challenge = await issueChallenge(sessionId, storage);
+            return sendJson(res, 200, { phase: "needs-registration", sessionId, challenge: challenge.jti, ...(nativeSkipped && { nativeSkipped }) });
+        }
+        if (nativeKey && !boundKey) {
+            const challenge = await issueChallenge(sessionId, storage);
+            return sendJson(res, 200, {
+                phase: "needs-bound-registration",
+                sessionId,
+                tier: session.tier,
+                challenge: challenge.jti,
+                refreshIntervalMs: boundCookieTtl,
+                ...(nativeSkipped && { nativeSkipped }),
+            });
+        }
+        sendJson(res, 200, { phase: "bound", sessionId, tier: session.tier, refreshIntervalMs: boundCookieTtl, ...(nativeSkipped && { nativeSkipped }) });
+    }
+    async function handleBoundChallengeRoute(req, res) {
+        res.setHeader("X-Server-Time", String(Date.now()));
+        const sessionId = readBoundSessionId(reqCookies(req));
+        if (!sessionId)
+            return sendJson(res, 403, { error: "no session" });
+        const session = await storage.getSession(sessionId);
+        if (!session)
+            return sendJson(res, 403, { error: "no session" });
+        const challenge = await issueChallenge(sessionId, storage);
+        sendJson(res, 200, { challenge: challenge.jti });
+    }
+    async function handleBoundRegistrationRoute(req, res) {
+        res.setHeader("X-Server-Time", String(Date.now()));
+        const ip = reqIp(req);
+        const allowed = await rateLimiter.checkRegistration(ip);
+        if (!allowed)
+            return sendJson(res, 429, { error: "rate limited" });
+        const sessionId = readBoundSessionId(reqCookies(req));
+        if (!sessionId)
+            return sendJson(res, 400, { error: "missing session cookie" });
+        const body = await readJsonBody(req);
+        if (!body.publicKey || !body.signature || !body.challenge) {
+            return sendJson(res, 400, { error: "publicKey, signature, and challenge are required in JSON body" });
+        }
+        try {
+            await handleBoundRegistration({ sessionId, publicKey: body.publicKey, signature: body.signature, expectedJti: body.challenge }, storage);
+            emit(onEvent, { type: "registration", sessionId, tier: "bound", timestamp: Date.now(), algorithm: "ES256", ip });
+            appendSetCookie(res, serializeCookie(COOKIES.bound, sessionId, cookieOpts(boundCookieTtl, scope)));
+            sendJson(res, 200, { session_identifier: sessionId, refresh_url: boundRefreshPath, tier: "bound" });
+        }
+        catch (err) {
+            await rateLimiter.recordFailure(ip, sessionId);
+            if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                emit(onEvent, { type: "verification_failure", sessionId, tier: "bound", timestamp: Date.now(), reason: err.code, ip });
+                return sendJson(res, 400, { error: err.message });
+            }
+            throw err;
+        }
+    }
+    async function handleBoundRefreshRoute(req, res) {
+        res.setHeader("X-Server-Time", String(Date.now()));
+        const ip = reqIp(req);
+        const sessionId = readBoundSessionId(reqCookies(req));
+        if (!sessionId)
+            return sendJson(res, 403, { error: "no session" });
+        const allowed = await rateLimiter.checkRefresh(ip, sessionId);
+        if (!allowed)
+            return sendJson(res, 429, { error: "rate limited" });
+        const body = await readJsonBody(req);
+        if (!body.challenge || !body.signature || typeof body.timestamp !== "number") {
+            return sendJson(res, 400, { error: "challenge, signature, and timestamp are required" });
+        }
+        try {
+            await handleBoundRefresh({ sessionId, signature: body.signature, expectedJti: body.challenge, timestamp: body.timestamp }, storage);
+            emit(onEvent, { type: "refresh", sessionId, tier: "bound", timestamp: Date.now(), ip });
+            appendSetCookie(res, serializeCookie(COOKIES.bound, sessionId, cookieOpts(boundCookieTtl, scope)));
+            sendJson(res, 200, { session_identifier: sessionId, refresh_url: boundRefreshPath, tier: "bound" });
+        }
+        catch (err) {
+            await rateLimiter.recordFailure(ip, sessionId);
+            const keyStillThere = await storage.getBoundKey(sessionId);
+            if (keyStillThere && err instanceof DbscVerificationError && err.code === ErrorCodes.SIGNATURE_INVALID) {
+                emit(onEvent, { type: "session_stolen", sessionId, tier: "bound", timestamp: Date.now(), ip });
+            }
+            if (err instanceof DbscVerificationError || err instanceof DbscProtocolError) {
+                emit(onEvent, { type: "verification_failure", sessionId, tier: "bound", timestamp: Date.now(), reason: err.code, ip });
+                return sendJson(res, 401, { error: err.message });
+            }
+            throw err;
+        }
+    }
+    return async (req, res) => {
+        const url = reqUrl(req);
+        const method = req.method ?? "GET";
+        if (method === "POST" && url.pathname === registrationPath) {
+            await handleRegistrationRoute(req, res);
+            return true;
+        }
+        if (method === "POST" && url.pathname === refreshPath) {
+            await handleRefreshRoute(req, res);
+            return true;
+        }
+        if (method === "GET" && url.pathname === boundStatePath) {
+            if (bound) {
+                await handleBoundStateRoute(req, res);
+            }
+            else {
+                res.setHeader("X-Server-Time", String(Date.now()));
+                sendJson(res, 200, { phase: "unbound", sessionId: null });
+            }
+            return true;
+        }
+        if (bound) {
+            if (method === "GET" && url.pathname === boundChallengePath) {
+                await handleBoundChallengeRoute(req, res);
+                return true;
+            }
+            if (method === "POST" && url.pathname === boundRegistrationPath) {
+                await handleBoundRegistrationRoute(req, res);
+                return true;
+            }
+            if (method === "POST" && url.pathname === boundRefreshPath) {
+                await handleBoundRefreshRoute(req, res);
+                return true;
+            }
+        }
+        const cookies = reqCookies(req);
+        const sessionId = cookies[COOKIES.bound];
+        const skipped = parseSessionSkippedHeader(req.headers);
+        const session = {
+            sessionId: sessionId ?? null,
+            tier: "none",
+            skipped,
+            revoke: async () => {
+                if (sessionId)
+                    await storage.revokeSession(sessionId);
+                appendSetCookie(res, serializeCookie(COOKIES.bound, "", { ...cookieOpts(0, scope), maxAge: 0 }));
+            },
+        };
+        session[DBSC_INTERNAL] = {
+            storage,
+            secure,
+            boundEnabled: bound,
+            ...(replayCache !== undefined && { replayCache }),
+        };
+        if (sessionId) {
+            const stored = await storage.getSession(sessionId);
+            if (stored) {
+                const staleAfter = stored.lastRefreshAt + boundCookieTtl + refreshGraceMs;
+                const refreshable = stored.tier === "dbsc" || stored.tier === "bound";
+                session.tier = refreshable && Date.now() > staleAfter ? "none" : stored.tier;
+                if (onEvent) {
+                    await maybeEmitPolyfillMissing({ storage, session: stored, ip: reqIp(req), emitted: polyfillMissingEmitted, onEvent });
+                }
+            }
+        }
+        else if (autoBind && !cookies[COOKIES.reg]) {
+            const result = await autoBind(req);
+            if (result) {
+                await bindSession(res, result.sessionId, storage, {
+                    userId: result.userId,
+                    secure,
+                    ...(cookieScope !== undefined && { cookieScope }),
+                    ...(cookieDomain !== undefined && { cookieDomain }),
+                    registrationPath,
+                    registrationCookieTtl,
+                });
+            }
+        }
+        req[DBSC_SESSION] = session;
+        return false;
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,GAOX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAW9C,MAAM,CAAC,MAAM,aAAa,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AACjF,MAAM,YAAY,GAAkB,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAQxE,MAAM,WAAW,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAE5D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAyBhD,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,OAAQ,GAA+C,CAAC,YAAY,CAAgC,CAAC;AACvG,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAgB;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,KAAK,GAAG,IAAI;QACpB,IAAI,EAAE,GAAG;QACT,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,IAAmC;IACvF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,OAA0B;IACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACnB,CAAC,CAAC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;IACT,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,SAAS,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB;IAClC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QAC1D,CAAE,GAAG,CAAC,MAA6C,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,KAAK,CAAC,GAAoB;IACjC,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB,EAAE,MAAc;IACrD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,MAAM,MAAM,GAAI,GAA+C,CAAC,eAAe,CAAC,CAAC;IACjF,IAAI,GAAW,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,GAA+C,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAmB,EACnB,SAAiB,EACjB,OAAuB,EACvB,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,eAAe,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,KAAK,GAAc;QACvB,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC5E,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,UAAU;YAC3B,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC;QACxC,gBAAgB;QAChB,SAAS,EAAE,SAAS,CAAC,GAAG;QACxB,UAAU,EAAE,OAAO,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,SAAS,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IACrD,eAAe,CAAC,GAAG,EAAE;QACnB,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACxE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;KACpF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAqB;IACxC,MAAM,EACJ,OAAO,EACP,gBAAgB,GAAG,oBAAoB,EACvC,WAAW,GAAG,eAAe,EAC7B,cAAc,GAAG,mBAAmB,EACpC,kBAAkB,GAAG,uBAAuB,EAC5C,qBAAqB,GAAG,0BAA0B,EAClD,gBAAgB,GAAG,qBAAqB,EACxC,KAAK,GAAG,IAAI,EACZ,cAAc,GAAG,iBAAiB,EAClC,cAAc,GAAG,MAAM,EACvB,qBAAqB,GAAG,eAAe,EACvC,WAAW,GAAG,IAAI,eAAe,EAAE,EACnC,WAAW,EACX,OAAO,EACP,QAAQ,EACR,MAAM,GAAG,IAAI,EACb,WAAW,EACX,YAAY,GACb,GAAG,IAAI,CAAC;IAET,MAAM,KAAK,GAAc;QACvB,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC;IACF,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,SAAS,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,UAAkB;QACvE,OAAO;YACL,kBAAkB,EAAE,SAAS;YAC7B,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE;YAC9D,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,GAAoB,EAAE,GAAmB;QAC9E,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAkB,CACtB;gBACE,SAAS;gBACT,wBAAwB,EAAE,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAChE,WAAW;aACZ,EACD,OAAO,CACR,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,eAAe,CAAC,GAAG,EAAE;gBACnB,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBAC5E,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;QACzE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/F,IAAI,CAAC,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEnE,MAAM,cAAc,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YAChF,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACvF,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;YACnG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACvF,eAAe,CAAC,GAAG,EAAE;gBACnB,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBAC5E,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,WAAW,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACrG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAG,GAA6B,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACjJ,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChF,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvF,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1G,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,OAA+B;QACzD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,GAAoB,EAAE,GAAmB;QAC5E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1H,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxB,KAAK,EAAE,0BAA0B;gBACjC,SAAS;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,SAAS,CAAC,GAAG;gBACxB,iBAAiB,EAAE,cAAc;gBACjC,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,GAAoB,EAAE,GAAmB;QAChF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,UAAU,4BAA4B,CAAC,GAAoB,EAAE,GAAmB;QACnF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAE/E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAuE,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;YACzI,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACjH,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACnG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,GAAoB,EAAE,GAAmB;QAC9E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAmE,CAAC;QACvG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;YACpI,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACxF,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACnG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,aAAa,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACvG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAoB,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC3D,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC5D,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;gBAChE,MAAM,4BAA4B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC3D,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAoB;YAC/B,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,IAAI,EAAE,MAAM;YACZ,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,IAAI,SAAS;oBAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;gBACtD,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACnG,CAAC;SACF,CAAC;QACD,OAAmD,CAAC,aAAa,CAAC,GAAG;YACpE,OAAO;YACP,MAAM;YACN,YAAY,EAAE,KAAK;YACnB,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;SAC3B,CAAC;QAEzB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,GAAG,cAAc,GAAG,cAAc,CAAC;gBAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;gBACtE,OAAO,CAAC,IAAI,GAAG,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7E,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE;oBAChD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM;oBACN,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;oBACjD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;oBACnD,gBAAgB;oBAChB,qBAAqB;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAEA,GAA+C,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/node/require-proof.d.ts

@@ -0,0 +1,17 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RequireProofOptions } from "../core/index.js";
+/** A node:http proof guard: `true` if the request passed, `false` if it was rejected (403 already written). */
+export type NodeProofGuard = (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+/**
+ * The route guard for raw `node:http`. Run `dbsc()` first so the session is
+ * attached, then:
+ *
+ *   const guard = requireProof();
+ *   if (!(await guard(req, res))) return; // 403 already written
+ *
+ * Requires a bound device + a per-request proof. The verified raw body is
+ * cached on the request, so a downstream handler can re-read it via
+ * `readJsonBody(req)`.
+ */
+export declare function requireProof(opts?: RequireProofOptions): NodeProofGuard;
+//# sourceMappingURL=require-proof.d.ts.map

package/dist/node/require-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-proof.d.ts","sourceRoot":"","sources":["../../src/node/require-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,+GAA+G;AAC/G,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAY7F;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,cAAc,CAsD3E"}

package/dist/node/require-proof.js

@@ -0,0 +1,74 @@
+import { verifyBoundProof, noBindingReason, DbscVerificationError, } from "../core/index.js";
+import { getDbscSession, DBSC_INTERNAL } from "./index.js";
+async function readRawBody(req) {
+    const cached = req["__dbscRawBody"];
+    if (Buffer.isBuffer(cached))
+        return new Uint8Array(cached);
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    const raw = Buffer.concat(chunks);
+    req["__dbscRawBody"] = raw;
+    return new Uint8Array(raw);
+}
+/**
+ * The route guard for raw `node:http`. Run `dbsc()` first so the session is
+ * attached, then:
+ *
+ *   const guard = requireProof();
+ *   if (!(await guard(req, res))) return; // 403 already written
+ *
+ * Requires a bound device + a per-request proof. The verified raw body is
+ * cached on the request, so a downstream handler can re-read it via
+ * `readJsonBody(req)`.
+ */
+export function requireProof(opts = {}) {
+    return async (req, res) => {
+        const session = getDbscSession(req);
+        const tier = session?.tier ?? "none";
+        const skipped = session?.skipped ?? [];
+        if (!session?.sessionId || tier === "none") {
+            res.setHeader("Content-Type", "application/json");
+            res.statusCode = 403;
+            res.end(JSON.stringify({ error: "device-bound session required", currentTier: "none", reason: noBindingReason(skipped), skipped }));
+            return false;
+        }
+        const internal = session[DBSC_INTERNAL];
+        const storage = opts.storage ?? internal?.storage;
+        if (!storage) {
+            res.setHeader("Content-Type", "application/json");
+            res.statusCode = 500;
+            res.end(JSON.stringify({ error: "requireProof: storage unavailable — run dbsc() before the guard, or pass { storage }" }));
+            return false;
+        }
+        const allowDbscWithoutProof = opts.allowDbscWithoutProof ?? (internal?.boundEnabled === false ? true : undefined);
+        if (tier === "dbsc" && allowDbscWithoutProof)
+            return true;
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const proofHeaderRaw = req.headers["x-dbsc-bound-proof"];
+        const proofHeader = Array.isArray(proofHeaderRaw) ? proofHeaderRaw[0] : proofHeaderRaw;
+        try {
+            await verifyBoundProof({
+                sessionId: session.sessionId,
+                proofHeader,
+                method: req.method ?? "GET",
+                path: url.pathname,
+                signBody: true,
+                bodyBytes: await readRawBody(req),
+                ...(opts.timestampWindowMs !== undefined && { timestampWindowMs: opts.timestampWindowMs }),
+                ...(internal?.replayCache !== undefined && { replayCache: internal.replayCache }),
+            }, storage);
+            return true;
+        }
+        catch (err) {
+            if (err instanceof DbscVerificationError) {
+                res.setHeader("Content-Type", "application/json");
+                res.statusCode = 403;
+                res.end(JSON.stringify({ error: err.message, code: err.code }));
+                return false;
+            }
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=require-proof.js.map