@opensyber/tokenforge 0.1.0

package/dist/client/binding.js

@@ -0,0 +1,49 @@
+import { generateDeviceKeyPair, exportPublicKey } from './crypto.js';
+import { storeDeviceKey, getDeviceKey } from './storage.js';
+/**
+ * Complete device binding flow — called once after authentication.
+ *
+ * 1. Check if we already have a valid key for this session
+ * 2. If not, generate new keypair
+ * 3. Send public key to server to bind to session
+ * 4. Server stores public key and returns device ID
+ * 5. Store keypair + device ID locally
+ */
+export async function bindDevice(apiBase, sessionId) {
+    const existing = await getDeviceKey();
+    if (existing && existing.sessionId === sessionId) {
+        return { deviceId: existing.deviceId, keyPair: existing.keyPair };
+    }
+    const keyPair = await generateDeviceKeyPair();
+    const publicKeyJwk = await exportPublicKey(keyPair);
+    const metadata = {
+        userAgent: navigator.userAgent,
+        language: navigator.language,
+        platform: navigator.platform,
+        screenResolution: `${screen.width}x${screen.height}`,
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+        colorDepth: screen.colorDepth,
+    };
+    const response = await fetch(`${apiBase}/api/tf/bind`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify({
+            publicKey: publicKeyJwk,
+            sessionId,
+            metadata,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`TokenForge binding failed: ${response.status}`);
+    }
+    const { deviceId } = (await response.json());
+    await storeDeviceKey({
+        deviceId,
+        keyPair,
+        createdAt: Date.now(),
+        sessionId,
+    });
+    return { deviceId, keyPair };
+}
+//# sourceMappingURL=binding.js.map

package/dist/client/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/client/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QACpD,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;QAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,YAAY;YACvB,SAAS;YACT,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;IAErE,MAAM,cAAc,CAAC;QACnB,QAAQ;QACR,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/client/crypto.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Client-side cryptographic key generation and export.
+ * Uses Web Crypto API with NON-EXTRACTABLE private keys.
+ */
+/**
+ * Generate a new ECDSA P-256 keypair.
+ * The private key is NON-EXTRACTABLE — it can never be read as raw bytes,
+ * only used for signing operations within the browser's crypto engine.
+ */
+export declare function generateDeviceKeyPair(): Promise<CryptoKeyPair>;
+/**
+ * Export the public key as JWK for sending to server during binding.
+ * Only the PUBLIC key is exportable. Private key stays locked.
+ */
+export declare function exportPublicKey(keyPair: CryptoKeyPair): Promise<JsonWebKey>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/client/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,aAAa,CAAC,CAMpE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAErB"}

package/dist/client/crypto.js

@@ -0,0 +1,22 @@
+/**
+ * Client-side cryptographic key generation and export.
+ * Uses Web Crypto API with NON-EXTRACTABLE private keys.
+ */
+const KEY_ALGORITHM = { name: 'ECDSA', namedCurve: 'P-256' };
+/**
+ * Generate a new ECDSA P-256 keypair.
+ * The private key is NON-EXTRACTABLE — it can never be read as raw bytes,
+ * only used for signing operations within the browser's crypto engine.
+ */
+export async function generateDeviceKeyPair() {
+    return await crypto.subtle.generateKey(KEY_ALGORITHM, false, // NON-EXTRACTABLE
+    ['sign', 'verify']);
+}
+/**
+ * Export the public key as JWK for sending to server during binding.
+ * Only the PUBLIC key is exportable. Private key stays locked.
+ */
+export async function exportPublicKey(keyPair) {
+    return await crypto.subtle.exportKey('jwk', keyPair.publicKey);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/client/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACpC,aAAa,EACb,KAAK,EAAE,kBAAkB;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB;IAEtB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,38 @@
+import type { TokenForgeConfig } from '../shared/types.js';
+/**
+ * TokenForge Client SDK — main entry point.
+ *
+ * Usage:
+ *   const tf = createTokenForge({ apiBase: '/api', getSessionId: () => sid });
+ *   await tf.init();
+ */
+export declare class TokenForge {
+    private config;
+    private deviceId;
+    private keyPair;
+    private bound;
+    private cleanupInterceptor;
+    constructor(config: TokenForgeConfig);
+    /**
+     * Initialize — call after user authenticates.
+     * Generates keypair if needed, binds to session, installs interceptor.
+     */
+    init(): Promise<void>;
+    /**
+     * Manually sign a request (if autoIntercept is false).
+     */
+    signRequest(request: Request): Promise<Request>;
+    /** @returns The current device ID, or null if not yet bound. */
+    getDeviceId(): string | null;
+    /** @returns Whether the device has been successfully bound to the session. */
+    isBound(): boolean;
+    /** Clear stored keys and unbind the device. Removes the fetch interceptor. */
+    clearKeys(): Promise<void>;
+    /** Clear existing binding and re-initialize (generate new keypair + bind). */
+    rebind(): Promise<void>;
+}
+/**
+ * Factory function to create a TokenForge instance.
+ */
+export declare function createTokenForge(config: TokenForgeConfig): TokenForge;
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,kBAAkB,CAA6B;gBAE3C,MAAM,EAAE,gBAAgB;IAIpC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC3B;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BrD,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,8EAA8E;IAC9E,OAAO,IAAI,OAAO;IAIlB,8EAA8E;IACxE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAShC,8EAA8E;IACxE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAErE"}

package/dist/client/index.js

@@ -0,0 +1,108 @@
+import { bindDevice } from './binding.js';
+import { clearDeviceKeys } from './storage.js';
+import { installFetchInterceptor } from './interceptor.js';
+/**
+ * TokenForge Client SDK — main entry point.
+ *
+ * Usage:
+ *   const tf = createTokenForge({ apiBase: '/api', getSessionId: () => sid });
+ *   await tf.init();
+ */
+export class TokenForge {
+    config;
+    deviceId = null;
+    keyPair = null;
+    bound = false;
+    cleanupInterceptor = null;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Initialize — call after user authenticates.
+     * Generates keypair if needed, binds to session, installs interceptor.
+     */
+    async init() {
+        const sessionId = this.config.getSessionId();
+        if (!sessionId)
+            return;
+        // Check if Web Crypto is available
+        if (!crypto?.subtle) {
+            console.warn('TokenForge: Web Crypto API not available, running in degraded mode');
+            return;
+        }
+        try {
+            const result = await bindDevice(this.config.apiBase, sessionId);
+            this.deviceId = result.deviceId;
+            this.keyPair = result.keyPair;
+            this.bound = true;
+            this.config.onDeviceBound?.(this.deviceId);
+            if (this.config.autoIntercept !== false) {
+                this.cleanupInterceptor = installFetchInterceptor(this.config, async () => {
+                    if (!this.keyPair || !this.deviceId)
+                        return null;
+                    const sid = this.config.getSessionId();
+                    if (!sid)
+                        return null;
+                    return {
+                        privateKey: this.keyPair.privateKey,
+                        sessionId: sid,
+                        deviceId: this.deviceId,
+                    };
+                });
+            }
+        }
+        catch (err) {
+            console.error('TokenForge: Binding failed', err);
+            // Graceful degradation — app continues without device binding
+        }
+    }
+    /**
+     * Manually sign a request (if autoIntercept is false).
+     */
+    async signRequest(request) {
+        if (!this.keyPair || !this.deviceId)
+            return request;
+        const { signChallenge, generateNonce } = await import('./signer.js');
+        const sessionId = this.config.getSessionId();
+        if (!sessionId)
+            return request;
+        const nonce = generateNonce();
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = await signChallenge(this.keyPair.privateKey, sessionId, nonce, timestamp);
+        const headers = new Headers(request.headers);
+        headers.set(this.config.headers?.signature || 'X-TF-Signature', signature);
+        headers.set(this.config.headers?.nonce || 'X-TF-Nonce', nonce);
+        headers.set(this.config.headers?.timestamp || 'X-TF-Timestamp', timestamp.toString());
+        headers.set(this.config.headers?.deviceId || 'X-TF-Device-ID', this.deviceId);
+        return new Request(request, { headers });
+    }
+    /** @returns The current device ID, or null if not yet bound. */
+    getDeviceId() {
+        return this.deviceId;
+    }
+    /** @returns Whether the device has been successfully bound to the session. */
+    isBound() {
+        return this.bound;
+    }
+    /** Clear stored keys and unbind the device. Removes the fetch interceptor. */
+    async clearKeys() {
+        this.cleanupInterceptor?.();
+        this.cleanupInterceptor = null;
+        this.keyPair = null;
+        this.deviceId = null;
+        this.bound = false;
+        await clearDeviceKeys();
+    }
+    /** Clear existing binding and re-initialize (generate new keypair + bind). */
+    async rebind() {
+        await this.clearKeys();
+        await this.init();
+    }
+}
+/**
+ * Factory function to create a TokenForge instance.
+ */
+export function createTokenForge(config) {
+    return new TokenForge(config);
+}
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAmB;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,OAAO,GAAyB,IAAI,CAAC;IACrC,KAAK,GAAG,KAAK,CAAC;IACd,kBAAkB,GAAwB,IAAI,CAAC;IAEvD,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,mCAAmC;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAC/C,IAAI,CAAC,MAAM,EACX,KAAK,IAAI,EAAE;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEpD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAClD,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EACjD,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/client/interceptor.d.ts

@@ -0,0 +1,13 @@
+import type { TokenForgeConfig } from '../shared/types.js';
+/**
+ * Install a fetch interceptor that automatically signs all requests
+ * to the protected API with TokenForge headers.
+ *
+ * Application code continues to use fetch() normally.
+ */
+export declare function installFetchInterceptor(config: TokenForgeConfig, getSigningMaterial: () => Promise<{
+    privateKey: CryptoKey;
+    sessionId: string;
+    deviceId: string;
+} | null>): () => void;
+//# sourceMappingURL=interceptor.d.ts.map

package/dist/client/interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../../src/client/interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,MAAM,OAAO,CAAC;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAAC,GACR,MAAM,IAAI,CAqFZ"}

package/dist/client/interceptor.js

@@ -0,0 +1,85 @@
+import { signChallenge, generateNonce } from './signer.js';
+/**
+ * Install a fetch interceptor that automatically signs all requests
+ * to the protected API with TokenForge headers.
+ *
+ * Application code continues to use fetch() normally.
+ */
+export function installFetchInterceptor(config, getSigningMaterial) {
+    const originalFetch = window.fetch.bind(window);
+    window.fetch = async function (input, init) {
+        const url = typeof input === 'string'
+            ? input
+            : input instanceof URL
+                ? input.href
+                : input.url;
+        if (!shouldIntercept(url, config)) {
+            return originalFetch(input, init);
+        }
+        const material = await getSigningMaterial();
+        if (!material) {
+            return originalFetch(input, init);
+        }
+        const nonce = generateNonce();
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = await signChallenge(material.privateKey, material.sessionId, nonce, timestamp);
+        const headers = new Headers(init?.headers);
+        headers.set(config.headers?.signature || 'X-TF-Signature', signature);
+        headers.set(config.headers?.nonce || 'X-TF-Nonce', nonce);
+        headers.set(config.headers?.timestamp || 'X-TF-Timestamp', timestamp.toString());
+        headers.set(config.headers?.deviceId || 'X-TF-Device-ID', material.deviceId);
+        const response = await originalFetch(input, { ...init, headers });
+        if (response.status === 403) {
+            const body = await response
+                .clone()
+                .json()
+                .catch(() => null);
+            if (body &&
+                typeof body === 'object' &&
+                'action' in body &&
+                body.action === 'step_up_required') {
+                config.onStepUpRequired?.(('reason' in body ? String(body.reason) : '') || 'trust_score_low');
+            }
+        }
+        if (response.status === 401) {
+            const body = await response
+                .clone()
+                .json()
+                .catch(() => null);
+            if (body &&
+                typeof body === 'object' &&
+                'action' in body &&
+                body.action === 'session_revoked') {
+                config.onSessionRevoked?.();
+            }
+        }
+        return response;
+    };
+    // Return cleanup function
+    return () => {
+        window.fetch = originalFetch;
+    };
+}
+function shouldIntercept(url, config) {
+    // Only intercept requests to the API base
+    if (!url.startsWith(config.apiBase) && !url.startsWith('/')) {
+        return false;
+    }
+    // Skip excluded paths
+    if (config.skipPaths) {
+        const path = url.startsWith('http')
+            ? new URL(url).pathname
+            : url;
+        for (const skip of config.skipPaths) {
+            if (skip.endsWith('*')) {
+                if (path.startsWith(skip.slice(0, -1)))
+                    return false;
+            }
+            else if (path === skip) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=interceptor.js.map

package/dist/client/interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../../src/client/interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,kBAIS;IAET,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,GAAG,KAAK,WAClB,KAAwB,EACxB,IAAkB;QAElB,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAElB,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,SAAS,EAClB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAC7C,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAC5C,QAAQ,CAAC,QAAQ,CAClB,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAClC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,CACvB,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,iBAAiB,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,iBAAiB,EACjC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,0BAA0B;IAC1B,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAwB;IAC5D,0CAA0C;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;YACvB,CAAC,CAAC,GAAG,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACvD,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/client/signer.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Challenge-response signing protocol.
+ * Signs: `${sessionId}:${nonce}:${timestamp}` with the device-bound private key.
+ */
+/**
+ * Sign a challenge payload with the device-bound private key.
+ */
+export declare function signChallenge(privateKey: CryptoKey, sessionId: string, nonce: string, timestamp: number): Promise<string>;
+/**
+ * Generate a client-side nonce.
+ * Server will verify this hasn't been used before.
+ */
+export declare function generateNonce(): string;
+export declare function arrayBufferToBase64Url(buffer: ArrayBuffer): string;
+//# sourceMappingURL=signer.d.ts.map

package/dist/client/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOlE"}

package/dist/client/signer.js

@@ -0,0 +1,31 @@
+/**
+ * Challenge-response signing protocol.
+ * Signs: `${sessionId}:${nonce}:${timestamp}` with the device-bound private key.
+ */
+/**
+ * Sign a challenge payload with the device-bound private key.
+ */
+export async function signChallenge(privateKey, sessionId, nonce, timestamp) {
+    const payload = `${sessionId}:${nonce}:${timestamp}`;
+    const encoded = new TextEncoder().encode(payload);
+    const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, privateKey, encoded);
+    return arrayBufferToBase64Url(signature);
+}
+/**
+ * Generate a client-side nonce.
+ * Server will verify this hasn't been used before.
+ */
+export function generateNonce() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return arrayBufferToBase64Url(bytes.buffer);
+}
+export function arrayBufferToBase64Url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+//# sourceMappingURL=signer.js.map

package/dist/client/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAqB,EACrB,SAAiB,EACjB,KAAa,EACb,SAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,UAAU,EACV,OAAO,CACR,CAAC;IAEF,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAqB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/client/storage.d.ts

@@ -0,0 +1,17 @@
+import type { StoredDevice } from '../shared/types-internal.js';
+/**
+ * Store keypair in IndexedDB.
+ * IndexedDB can store CryptoKey objects directly (structured clone).
+ * The non-extractable property is preserved across storage.
+ */
+export declare function storeDeviceKey(device: StoredDevice): Promise<void>;
+/**
+ * Retrieve stored keypair from IndexedDB.
+ * Returns the CryptoKey handle — still non-extractable.
+ */
+export declare function getDeviceKey(): Promise<StoredDevice | null>;
+/**
+ * Clear all stored keys (on logout or re-bind).
+ */
+export declare function clearDeviceKeys(): Promise<void>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/client/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/client/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxE;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAUjE;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAUrD"}

package/dist/client/storage.js

@@ -0,0 +1,58 @@
+const DB_NAME = 'tokenforge';
+const STORE_NAME = 'device_keys';
+/**
+ * Store keypair in IndexedDB.
+ * IndexedDB can store CryptoKey objects directly (structured clone).
+ * The non-extractable property is preserved across storage.
+ */
+export async function storeDeviceKey(device) {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, 'readwrite');
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.put(device, 'current');
+        req.onsuccess = () => resolve();
+        req.onerror = () => reject(req.error);
+        tx.oncomplete = () => db.close();
+    });
+}
+/**
+ * Retrieve stored keypair from IndexedDB.
+ * Returns the CryptoKey handle — still non-extractable.
+ */
+export async function getDeviceKey() {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, 'readonly');
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.get('current');
+        req.onsuccess = () => resolve(req.result || null);
+        req.onerror = () => reject(req.error);
+        tx.oncomplete = () => db.close();
+    });
+}
+/**
+ * Clear all stored keys (on logout or re-bind).
+ */
+export async function clearDeviceKeys() {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, 'readwrite');
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.clear();
+        req.onsuccess = () => resolve();
+        req.onerror = () => reject(req.error);
+        tx.oncomplete = () => db.close();
+    });
+}
+function openDB() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(DB_NAME, 1);
+        request.onupgradeneeded = () => {
+            request.result.createObjectStore(STORE_NAME);
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+//# sourceMappingURL=storage.js.map

package/dist/client/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/client/storage.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,UAAU,GAAG,aAAa,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB;IACvD,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAE,GAAG,CAAC,MAAuB,IAAI,IAAI,CAAC,CAAC;QACpE,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/react/index.d.ts

@@ -0,0 +1,2 @@
+export { TokenForgeProvider, useTokenForge } from './provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/react/index.js

@@ -0,0 +1,2 @@
+export { TokenForgeProvider, useTokenForge } from './provider.js';
+//# sourceMappingURL=index.js.map

package/dist/react/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/react/provider.d.ts

@@ -0,0 +1,30 @@
+import { type ReactNode } from 'react';
+interface TokenForgeContextValue {
+    isReady: boolean;
+    isBound: boolean;
+    deviceId: string | null;
+    trustScore: number | null;
+}
+interface TokenForgeProviderProps {
+    children: ReactNode;
+    /** The current session ID from your auth provider */
+    sessionId: string | null;
+    /** Whether the user is signed in */
+    isSignedIn: boolean;
+    /** Base URL for the TokenForge-protected API */
+    apiBase: string;
+}
+/**
+ * React context provider for TokenForge device binding.
+ * Initializes the client SDK when the user is signed in and
+ * exposes binding state to descendant components via `useTokenForge`.
+ * @param props - Provider props (children, sessionId, isSignedIn, apiBase).
+ */
+export declare function TokenForgeProvider({ children, sessionId, isSignedIn, apiBase, }: TokenForgeProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * Access the TokenForge device-binding context.
+ * @returns Current binding state (isReady, isBound, deviceId, trustScore).
+ */
+export declare function useTokenForge(): TokenForgeContextValue;
+export {};
+//# sourceMappingURL=provider.d.ts.map

package/dist/react/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/react/provider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAGf,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AASD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,SAAS,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oCAAoC;IACpC,UAAU,EAAE,OAAO,CAAC;IACpB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,SAAS,EACT,UAAU,EACV,OAAO,GACR,EAAE,uBAAuB,2CA8CzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,2BAE5B"}

package/dist/react/provider.js

@@ -0,0 +1,59 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext, useEffect, useState, } from 'react';
+import { createTokenForge } from '../client/index.js';
+const TokenForgeContext = createContext({
+    isReady: false,
+    isBound: false,
+    deviceId: null,
+    trustScore: null,
+});
+/**
+ * React context provider for TokenForge device binding.
+ * Initializes the client SDK when the user is signed in and
+ * exposes binding state to descendant components via `useTokenForge`.
+ * @param props - Provider props (children, sessionId, isSignedIn, apiBase).
+ */
+export function TokenForgeProvider({ children, sessionId, isSignedIn, apiBase, }) {
+    const [state, setState] = useState({
+        isReady: false,
+        isBound: false,
+        deviceId: null,
+        trustScore: null,
+    });
+    useEffect(() => {
+        if (!isSignedIn || !sessionId)
+            return;
+        let tf = null;
+        const setup = async () => {
+            tf = createTokenForge({
+                apiBase,
+                getSessionId: () => sessionId,
+                onStepUpRequired: (reason) => {
+                    window.dispatchEvent(new CustomEvent('tf:step-up', { detail: reason }));
+                },
+                onSessionRevoked: () => {
+                    window.location.href = '/sign-in?reason=session_revoked';
+                },
+                onDeviceBound: (deviceId) => {
+                    setState((s) => ({ ...s, isBound: true, deviceId }));
+                },
+            });
+            await tf.init();
+            setState((s) => ({ ...s, isReady: true }));
+        };
+        setup().catch(console.error);
+        return () => {
+            tf?.clearKeys().catch(console.error);
+        };
+    }, [sessionId, isSignedIn, apiBase]);
+    return (_jsx(TokenForgeContext.Provider, { value: state, children: children }));
+}
+/**
+ * Access the TokenForge device-binding context.
+ * @returns Current binding state (isReady, isBound, deviceId, trustScore).
+ */
+export function useTokenForge() {
+    return useContext(TokenForgeContext);
+}
+//# sourceMappingURL=provider.js.map

package/dist/react/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/react/provider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,aAAa,EACb,UAAU,EACV,SAAS,EACT,QAAQ,GAET,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,gBAAgB,EAAmB,MAAM,oBAAoB,CAAC;AASvE,MAAM,iBAAiB,GAAG,aAAa,CAAyB;IAC9D,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC;AAYH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EACR,SAAS,EACT,UAAU,EACV,OAAO,GACiB;IACxB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyB;QACzD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO;QAEtC,IAAI,EAAE,GAAsB,IAAI,CAAC;QAEjC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,EAAE,GAAG,gBAAgB,CAAC;gBACpB,OAAO;gBACP,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;gBAC7B,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE;oBAC3B,MAAM,CAAC,aAAa,CAClB,IAAI,WAAW,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAClD,CAAC;gBACJ,CAAC;gBACD,gBAAgB,EAAE,GAAG,EAAE;oBACrB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,iCAAiC,CAAC;gBAC3D,CAAC;gBACD,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC1B,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACvD,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC;QAEF,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE7B,OAAO,GAAG,EAAE;YACV,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAErC,OAAO,CACL,KAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YACrC,QAAQ,GACkB,CAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACvC,CAAC"}