@opensyber/tokenforge 0.1.0

package/README.md

@@ -0,0 +1,137 @@
+# @opensyber/tokenforge
+
+Device-bound session security. Add one script tag — every request is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
+
+## Quick Start
+
+### 1. Add the script tag (client — zero code)
+
+```html
+<script
+  src="https://tokenforge-api.opensyber.cloud/sdk.js"
+  data-api-key="tf_your_api_key"
+></script>
+```
+
+That's it. The script auto-generates ECDSA P-256 device keys, binds the session, and signs every `fetch()` request with `X-TF-*` headers.
+
+### 2. Add server middleware (one line)
+
+```bash
+npm install @opensyber/tokenforge
+```
+
+**Express**
+```ts
+import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
+app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
+// req.tf.bound, req.tf.trustScore, req.tf.deviceId
+```
+
+**Next.js**
+```ts
+import { withTokenForge } from '@opensyber/tokenforge/nextjs';
+export const GET = withTokenForge(handler, { apiKey: process.env.TOKENFORGE_API_KEY! });
+```
+
+**Fastify**
+```ts
+import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
+fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });
+```
+
+**Hono**
+```ts
+import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono';
+app.use('/api/*', tokenForgeMiddleware({ apiKey: env.TOKENFORGE_API_KEY }));
+```
+
+### 3. Get your API key
+
+Sign up free at [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud). Free tier: 1,000 verifications/month.
+
+## Why
+
+Authentication protects login. TokenForge protects everything **after** login:
+
+- **Session hijacking** — stolen cookies are useless without the device's private key
+- **AiTM attacks** — relay proxies can't sign requests on behalf of the device
+- **Token theft** — XSS-exfiltrated tokens fail server-side signature verification
+- **Trust scoring** — 7 signals detect anomalies on every request in real time
+
+## How It Works
+
+```
+Browser                        TokenForge API                Your Server
+  │                                │                              │
+  │ 1. Script auto-generates       │                              │
+  │    ECDSA P-256 key pair        │                              │
+  │                                │                              │
+  │ 2. POST /v1/bind ─────────────>│ Store public key             │
+  │ <──────────────────────────────│ Return deviceId              │
+  │                                │                              │
+  │ 3. fetch('/api/data')          │                              │
+  │    + X-TF-Signature header ────────────────────────────────>  │
+  │                                │                              │
+  │                                │ <── POST /v1/edge/verify ──  │
+  │                                │     Verify signature         │
+  │                                │     Check nonce replay       │
+  │                                │     Compute trust score      │
+  │                                │ ── { allow, score: 92 } ──> │
+  │                                │                              │
+  │ <──────────────────────────────────── 200 OK ─────────────── │
+```
+
+All verification runs on TokenForge's infrastructure. Your server sends request context, gets back allow/deny. No crypto libraries, no database, no storage to manage.
+
+## Trust Score
+
+7 signals scored 0-100 on every request:
+
+| Signal | Weight | Detects |
+|--------|--------|---------|
+| Signature | 30 | Tampering, missing device key |
+| IP Address | 15 | IP change since binding |
+| Geo Location | 15 | Country mismatch |
+| Fingerprint | 15 | Browser fingerprint drift |
+| Velocity | 10 | Multiple IPs in short window |
+| Timing | 10 | Clock skew beyond tolerance |
+| Nonce | 5 | Replay attacks |
+
+Score >= 80: allow. Score 40-79: step-up auth. Score < 40: block.
+
+## Advanced: npm Client SDK
+
+For React apps or when you need more control than the script tag:
+
+```tsx
+import { TokenForgeProvider, useTokenForge } from '@opensyber/tokenforge/react';
+
+function App() {
+  return (
+    <TokenForgeProvider config={{
+      apiBase: '/api',
+      getSessionId: () => getSession(),
+    }}>
+      <YourApp />
+    </TokenForgeProvider>
+  );
+}
+```
+
+## Works With Any Auth Provider
+
+Microsoft Entra ID, Clerk, Auth.js, NextAuth, Firebase, Supabase, Okta, or custom JWT. TokenForge runs after authentication — no changes to your auth flow.
+
+## Pricing
+
+| Plan | Price | Verifications/mo |
+|------|-------|-----------------|
+| Free | $0 | 1,000 |
+| Pro | $49/mo | 50,000 |
+| Team | $199/mo | 250,000 |
+| Enterprise | Custom | Unlimited |
+
+## License
+
+Client SDK: MIT | Server verification requires a TokenForge API key from [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud).

package/dist/adapters/express.d.ts

@@ -0,0 +1,48 @@
+/** Express request (minimal interface). */
+interface ExpressRequest {
+    path: string;
+    method: string;
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    tf?: TfContext;
+    [key: string]: unknown;
+}
+interface ExpressResponse {
+    status(code: number): ExpressResponse;
+    json(body: unknown): void;
+}
+/** TokenForge context attached to req.tf */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+type NextFunction = (err?: unknown) => void;
+/** Options for the Express middleware. */
+export interface TokenForgeExpressOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+    /** Paths requiring elevated trust (>90). */
+    sensitiveOps?: string[];
+}
+/**
+ * Express middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
+ * app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
+ * ```
+ *
+ * After middleware runs, `req.tf` contains:
+ * - `bound: boolean` — whether device is bound
+ * - `trustScore: number` — current trust score
+ * - `deviceId: string | null` — device identifier
+ */
+export declare function tokenForgeMiddleware(options: TokenForgeExpressOptions): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => Promise<void>;
+export {};
+//# sourceMappingURL=express.d.ts.map

package/dist/adapters/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F"}

package/dist/adapters/express.js

@@ -0,0 +1,73 @@
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * Express middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
+ * app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
+ * ```
+ *
+ * After middleware runs, `req.tf` contains:
+ * - `bound: boolean` — whether device is bound
+ * - `trustScore: number` — current trust score
+ * - `deviceId: string | null` — device identifier
+ */
+export function tokenForgeMiddleware(options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    return async (req, res, next) => {
+        if (shouldSkip(req.path, options.skipPaths)) {
+            req.tf = { bound: false, trustScore: 0, deviceId: null };
+            next();
+            return;
+        }
+        const header = (name) => {
+            const val = req.headers[name.toLowerCase()];
+            return typeof val === 'string' ? val : null;
+        };
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path: req.path,
+                    method: req.method,
+                    headers: {
+                        signature: header('x-tf-signature'),
+                        nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'),
+                        deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: req.ip ?? header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok) {
+                req.tf = { bound: false, trustScore: 0, deviceId: null };
+                next();
+                return;
+            }
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                res.status(401).json({ error: 'session_blocked', reason: data.reason });
+                return;
+            }
+            req.tf = { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId };
+            next();
+        }
+        catch {
+            req.tf = { bound: false, trustScore: 0, deviceId: null };
+            next();
+        }
+    };
+}
+function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
+}
+//# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/adapters/fastify.d.ts

@@ -0,0 +1,44 @@
+/** TokenForge context attached to request.tf */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+/** Options for the Fastify plugin. */
+export interface TokenForgeFastifyOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+}
+interface FastifyRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    tf?: TfContext;
+}
+interface FastifyReply {
+    code(statusCode: number): FastifyReply;
+    send(payload: unknown): void;
+}
+interface FastifyInstance {
+    addHook(name: 'preHandler', handler: (req: FastifyRequest, reply: FastifyReply) => Promise<void>): void;
+    decorateRequest(name: string, value: unknown): void;
+}
+/**
+ * Fastify plugin for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
+ * fastify.register(tokenForgePlugin, {
+ *   apiKey: process.env.TOKENFORGE_API_KEY!,
+ * });
+ * ```
+ */
+export declare function tokenForgePlugin(fastify: FastifyInstance, options: TokenForgeFastifyOptions, done: (err?: Error) => void): void;
+export {};
+//# sourceMappingURL=fastify.d.ts.map

package/dist/adapters/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAEA,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN"}

package/dist/adapters/fastify.js

@@ -0,0 +1,69 @@
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * Fastify plugin for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
+ * fastify.register(tokenForgePlugin, {
+ *   apiKey: process.env.TOKENFORGE_API_KEY!,
+ * });
+ * ```
+ */
+export function tokenForgePlugin(fastify, options, done) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    fastify.decorateRequest('tf', null);
+    fastify.addHook('preHandler', async (req, reply) => {
+        const path = req.url.split('?')[0] ?? req.url;
+        if (shouldSkip(path, options.skipPaths)) {
+            req.tf = { bound: false, trustScore: 0, deviceId: null };
+            return;
+        }
+        const header = (name) => {
+            const val = req.headers[name.toLowerCase()];
+            return typeof val === 'string' ? val : null;
+        };
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path,
+                    method: req.method,
+                    headers: {
+                        signature: header('x-tf-signature'),
+                        nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'),
+                        deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: req.ip ?? header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok) {
+                req.tf = { bound: false, trustScore: 0, deviceId: null };
+                return;
+            }
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                reply.code(401).send({ error: 'session_blocked', reason: data.reason });
+                return;
+            }
+            req.tf = { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId };
+        }
+        catch {
+            req.tf = { bound: false, trustScore: 0, deviceId: null };
+        }
+    });
+    done();
+}
+function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
+}
+//# sourceMappingURL=fastify.js.map

package/dist/adapters/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAwClE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwB,EACxB,OAAiC,EACjC,IAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/adapters/hono.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Hono adapter — re-export from server/ for the new import path.
+ * Usage: import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono'
+ */
+export { tokenForgeMiddleware } from '../server/middleware.js';
+export { createTokenForgeRoutes } from '../server/binding.js';
+export { createStepUpRoutes } from '../server/step-up.js';
+//# sourceMappingURL=hono.d.ts.map

package/dist/adapters/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/adapters/hono.js

@@ -0,0 +1,8 @@
+/**
+ * Hono adapter — re-export from server/ for the new import path.
+ * Usage: import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono'
+ */
+export { tokenForgeMiddleware } from '../server/middleware.js';
+export { createTokenForgeRoutes } from '../server/binding.js';
+export { createStepUpRoutes } from '../server/step-up.js';
+//# sourceMappingURL=hono.js.map

package/dist/adapters/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/adapters/index.d.ts

@@ -0,0 +1,5 @@
+export { tokenForgeMiddleware as honoMiddleware, createTokenForgeRoutes, createStepUpRoutes } from './hono.js';
+export { tokenForgeMiddleware as expressMiddleware } from './express.js';
+export { withTokenForge, tokenForgeCheck } from './nextjs.js';
+export { tokenForgePlugin } from './fastify.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/index.js

@@ -0,0 +1,5 @@
+export { tokenForgeMiddleware as honoMiddleware, createTokenForgeRoutes, createStepUpRoutes } from './hono.js';
+export { tokenForgeMiddleware as expressMiddleware } from './express.js';
+export { withTokenForge, tokenForgeCheck } from './nextjs.js';
+export { tokenForgePlugin } from './fastify.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/nextjs.d.ts

@@ -0,0 +1,51 @@
+type NextRequest = Request & {
+    nextUrl?: {
+        pathname: string;
+    };
+};
+/** TokenForge context passed to wrapped handlers. */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+/** Options for the Next.js adapter. */
+export interface TokenForgeNextOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+}
+/**
+ * Next.js App Router — wrap an API route handler with TokenForge verification.
+ *
+ * Usage:
+ * ```ts
+ * import { withTokenForge } from '@opensyber/tokenforge/nextjs';
+ *
+ * async function handler(req: Request, tf: TfContext) {
+ *   return Response.json({ bound: tf.bound, score: tf.trustScore });
+ * }
+ * export const GET = withTokenForge(handler, {
+ *   apiKey: process.env.TOKENFORGE_API_KEY!,
+ * });
+ * ```
+ */
+export declare function withTokenForge(handler: (req: NextRequest, tf: TfContext) => Promise<Response>, options: TokenForgeNextOptions): (req: NextRequest) => Promise<Response>;
+/**
+ * Next.js Middleware compatible function.
+ * Use in middleware.ts for edge verification.
+ *
+ * Returns proceed=true with TfContext, or proceed=false with a Response.
+ */
+export declare function tokenForgeCheck(req: NextRequest, options: TokenForgeNextOptions): Promise<{
+    proceed: true;
+    tf: TfContext;
+} | {
+    proceed: false;
+    response: Response;
+}>;
+export {};
+//# sourceMappingURL=nextjs.d.ts.map

package/dist/adapters/nextjs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["../../src/adapters/nextjs.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG,OAAO,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhE,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,OAAO,EAAE,qBAAqB,IAIhB,KAAK,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA8CnD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAgDpF"}

package/dist/adapters/nextjs.js

@@ -0,0 +1,101 @@
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * Next.js App Router — wrap an API route handler with TokenForge verification.
+ *
+ * Usage:
+ * ```ts
+ * import { withTokenForge } from '@opensyber/tokenforge/nextjs';
+ *
+ * async function handler(req: Request, tf: TfContext) {
+ *   return Response.json({ bound: tf.bound, score: tf.trustScore });
+ * }
+ * export const GET = withTokenForge(handler, {
+ *   apiKey: process.env.TOKENFORGE_API_KEY!,
+ * });
+ * ```
+ */
+export function withTokenForge(handler, options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    return async (req) => {
+        const url = new URL(req.url);
+        const header = (name) => req.headers.get(name);
+        const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${options.apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                path: url.pathname,
+                method: req.method,
+                headers: {
+                    signature: header('x-tf-signature'),
+                    nonce: header('x-tf-nonce'),
+                    timestamp: header('x-tf-timestamp'),
+                    deviceId: header('x-tf-device-id'),
+                },
+                ipAddress: header('x-forwarded-for') ?? '',
+                countryCode: header('cf-ipcountry') ?? '',
+                userAgent: header('user-agent') ?? '',
+            }),
+        });
+        if (!apiRes.ok) {
+            return handler(req, { bound: false, trustScore: 0, deviceId: null });
+        }
+        const { data } = (await apiRes.json());
+        if (data.status === 'block') {
+            return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+        }
+        return handler(req, {
+            bound: data.bound,
+            trustScore: data.trustScore,
+            deviceId: data.deviceId,
+        });
+    };
+}
+/**
+ * Next.js Middleware compatible function.
+ * Use in middleware.ts for edge verification.
+ *
+ * Returns proceed=true with TfContext, or proceed=false with a Response.
+ */
+export async function tokenForgeCheck(req, options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    const url = new URL(req.url);
+    const header = (name) => req.headers.get(name);
+    const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${options.apiKey}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            path: url.pathname,
+            method: req.method,
+            headers: {
+                signature: header('x-tf-signature'),
+                nonce: header('x-tf-nonce'),
+                timestamp: header('x-tf-timestamp'),
+                deviceId: header('x-tf-device-id'),
+            },
+            ipAddress: header('x-forwarded-for') ?? '',
+            countryCode: header('cf-ipcountry') ?? '',
+            userAgent: header('user-agent') ?? '',
+        }),
+    });
+    if (!apiRes.ok) {
+        return { proceed: true, tf: { bound: false, trustScore: 0, deviceId: null } };
+    }
+    const { data } = (await apiRes.json());
+    if (data.status === 'block') {
+        return {
+            proceed: false,
+            response: new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } }),
+        };
+    }
+    return {
+        proceed: true,
+        tf: { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId },
+    };
+}
+//# sourceMappingURL=nextjs.js.map

package/dist/adapters/nextjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["../../src/adapters/nextjs.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAqBlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+D,EAC/D,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAgB,EAAqB,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE;oBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;oBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;oBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;oBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;iBACnC;gBACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;gBAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;gBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;aACtC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;YACzC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;aACnC;YACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;KAChF,CAAC;AACJ,CAAC"}

package/dist/client/binding.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Complete device binding flow — called once after authentication.
+ *
+ * 1. Check if we already have a valid key for this session
+ * 2. If not, generate new keypair
+ * 3. Send public key to server to bind to session
+ * 4. Server stores public key and returns device ID
+ * 5. Store keypair + device ID locally
+ */
+export declare function bindDevice(apiBase: string, sessionId: string): Promise<{
+    deviceId: string;
+    keyPair: CryptoKeyPair;
+}>;
+//# sourceMappingURL=binding.d.ts.map

package/dist/client/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/client/binding.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC,CA2CvD"}