@opensyber/tokenforge 0.1.1 → 1.0.0

package/dist/client/index.js

@@ -1,6 +1,7 @@
 import { bindDevice } from './binding.js';
 import { clearDeviceKeys } from './storage.js';
 import { installFetchInterceptor } from './interceptor.js';
+import { signAction as signActionInternal, } from './action-signer.js';
 /**
  * TokenForge Client SDK — main entry point.
  *
@@ -33,7 +34,9 @@ export class TokenForge {
         try {
             const result = await bindDevice(this.config.apiBase, sessionId);
             this.deviceId = result.deviceId;
-            this.keyPair = result.keyPair;
+            // ECDSA path stores the keyPair; WebAuthn path keeps the credential on
+            // the authenticator (signed via navigator.credentials.get on demand).
+            this.keyPair = result.type === 'ecdsa' ? result.keyPair : null;
             this.bound = true;
             this.config.onDeviceBound?.(this.deviceId);
             if (this.config.autoIntercept !== false) {
@@ -98,6 +101,29 @@ export class TokenForge {
         await this.clearKeys();
         await this.init();
     }
+    /**
+     * Sign a high-trust action (checkout, password change, admin grant…) with
+     * the device-bound private key. Returns a compact JWS the server verifies
+     * via `verifyCompactJws` + `actionHash` claim match.
+     *
+     * @throws when the device is not yet bound (call `init()` first).
+     */
+    async signAction(payload, options = {}) {
+        if (!this.keyPair || !this.bound) {
+            throw new Error('TokenForge.signAction: device not bound — call init() first');
+        }
+        const sessionId = this.config.getSessionId();
+        if (!sessionId) {
+            throw new Error('TokenForge.signAction: no sessionId from getSessionId()');
+        }
+        return signActionInternal(payload, {
+            privateKey: this.keyPair.privateKey,
+            sessionId,
+            kid: options.kid,
+            ttlSeconds: options.ttlSeconds,
+            tlsExporter: options.tlsExporter,
+        });
+    }
 }
 /**
  * Factory function to create a TokenForge instance.

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAmB;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,OAAO,GAAyB,IAAI,CAAC;IACrC,KAAK,GAAG,KAAK,CAAC;IACd,kBAAkB,GAAwB,IAAI,CAAC;IAEvD,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,mCAAmC;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAC/C,IAAI,CAAC,MAAM,EACX,KAAK,IAAI,EAAE;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEpD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAClD,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EACjD,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,UAAU,IAAI,kBAAkB,GAGjC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAmB;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,OAAO,GAAyB,IAAI,CAAC;IACrC,KAAK,GAAG,KAAK,CAAC;IACd,kBAAkB,GAAwB,IAAI,CAAC;IAEvD,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,mCAAmC;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAC/C,IAAI,CAAC,MAAM,EACX,KAAK,IAAI,EAAE;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEpD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAClD,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EACjD,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CACd,OAAsB,EACtB,UAAuE,EAAE;QAEzE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,SAAS;YACT,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/client/signer.d.ts

@@ -1,6 +1,11 @@
 /**
  * Challenge-response signing protocol.
  * Signs: `${sessionId}:${nonce}:${timestamp}` with the device-bound private key.
+ *
+ * Also exports `isNativeDbscAvailable()` — feature-detect for the W3C
+ * Device-Bound Session Credentials API (Chrome 146+). When present, the
+ * SDK can defer key generation + binding to the platform; otherwise it
+ * continues using the Web Crypto fallback path implemented here.
  */
 /**
  * Sign a challenge payload with the device-bound private key.
@@ -12,4 +17,16 @@ export declare function signChallenge(privateKey: CryptoKey, sessionId: string,
  */
 export declare function generateNonce(): string;
 export declare function arrayBufferToBase64Url(buffer: ArrayBuffer): string;
+/**
+ * Feature-detect the W3C Device-Bound Session Credentials API.
+ *
+ * Returns `true` when `navigator.deviceBoundSession` is a real object the
+ * SDK could route through. Treats undefined / null / non-object values
+ * (functions, primitives) as unavailable so a downgrade attacker who
+ * shadows `navigator` with a truthy primitive does not flip the SDK into
+ * thinking native DBSC is present.
+ *
+ * Spec: https://w3c.github.io/webappsec-dbsc/ (Chrome 146+)
+ */
+export declare function isNativeDbscAvailable(): boolean;
 //# sourceMappingURL=signer.d.ts.map

package/dist/client/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOlE"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOlE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C"}

package/dist/client/signer.js

@@ -1,6 +1,11 @@
 /**
  * Challenge-response signing protocol.
  * Signs: `${sessionId}:${nonce}:${timestamp}` with the device-bound private key.
+ *
+ * Also exports `isNativeDbscAvailable()` — feature-detect for the W3C
+ * Device-Bound Session Credentials API (Chrome 146+). When present, the
+ * SDK can defer key generation + binding to the platform; otherwise it
+ * continues using the Web Crypto fallback path implemented here.
  */
 /**
  * Sign a challenge payload with the device-bound private key.
@@ -28,4 +33,22 @@ export function arrayBufferToBase64Url(buffer) {
     }
     return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 }
+/**
+ * Feature-detect the W3C Device-Bound Session Credentials API.
+ *
+ * Returns `true` when `navigator.deviceBoundSession` is a real object the
+ * SDK could route through. Treats undefined / null / non-object values
+ * (functions, primitives) as unavailable so a downgrade attacker who
+ * shadows `navigator` with a truthy primitive does not flip the SDK into
+ * thinking native DBSC is present.
+ *
+ * Spec: https://w3c.github.io/webappsec-dbsc/ (Chrome 146+)
+ */
+export function isNativeDbscAvailable() {
+    if (typeof navigator === 'undefined')
+        return false;
+    const nav = navigator;
+    const candidate = nav.deviceBoundSession;
+    return typeof candidate === 'object' && candidate !== null;
+}
 //# sourceMappingURL=signer.js.map

package/dist/client/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAqB,EACrB,SAAiB,EACjB,KAAa,EACb,SAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,UAAU,EACV,OAAO,CACR,CAAC;IAEF,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAqB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAqB,EACrB,SAAiB,EACjB,KAAa,EACb,SAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,UAAU,EACV,OAAO,CACR,CAAC;IAEF,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAqB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,OAAO,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,GAAG,GAAG,SAAyD,CAAC;IACtE,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACzC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC;AAC7D,CAAC"}

package/dist/client/webauthn.d.ts

@@ -0,0 +1,45 @@
+/**
+ * WebAuthn / FIDO2 client flow — alternative to the ECDSA browser key path.
+ *
+ * Coexists with the ECDSA flow in binding.ts. Caller opts in via
+ * `bindDevice(..., { prefer: 'webauthn' })`. The credential private key is
+ * never exposed to JS — it lives on the authenticator (YubiKey, Touch ID,
+ * Windows Hello, platform passkey provider).
+ *
+ * NOTE: WebAuthn signatures are over (authenticatorData || sha256(clientDataJSON)),
+ * not the raw `${sessionId}:${nonce}:${timestamp}` payload. The server reconstructs
+ * the same expected challenge from session/nonce/timestamp and compares it to
+ * the challenge embedded inside clientDataJSON.
+ */
+export interface WebAuthnBindResult {
+    deviceId: string;
+    credentialId: string;
+}
+export interface WebAuthnAssertion {
+    signature: string;
+    authenticatorData: string;
+    clientDataJSON: string;
+    credentialId: string;
+}
+/** base64url encode a buffer (no padding, URL-safe alphabet). */
+export declare function bufferToBase64Url(buffer: ArrayBuffer | Uint8Array): string;
+/** base64url decode to ArrayBuffer. */
+export declare function base64UrlToBuffer(b64url: string): ArrayBuffer;
+/**
+ * Bind a hardware credential to the active session.
+ *
+ * Calls navigator.credentials.create with ES256 (alg -7) + EdDSA (alg -8)
+ * pubKeyCredParams. Sends the attestation to the server, receives the
+ * persisted deviceId.
+ */
+export declare function bindDeviceWebAuthn(apiBase: string, sessionId: string, userId: string, displayName: string): Promise<WebAuthnBindResult>;
+/**
+ * Sign a per-request challenge with the bound hardware credential.
+ *
+ * The challenge is `${sessionId}:${nonce}:${timestamp}` — same payload shape
+ * as the ECDSA path, but the WebAuthn signature is over
+ * (authenticatorData || sha256(clientDataJSON)) where clientDataJSON contains
+ * the challenge. The server reconstructs and compares.
+ */
+export declare function signChallengeWebAuthn(credentialId: string, sessionId: string, nonce: string, timestamp: number): Promise<WebAuthnAssertion>;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/client/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/client/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK1E;AAED,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAO7D;AAOD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAgD7B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CA0B5B"}

package/dist/client/webauthn.js

@@ -0,0 +1,118 @@
+/**
+ * WebAuthn / FIDO2 client flow — alternative to the ECDSA browser key path.
+ *
+ * Coexists with the ECDSA flow in binding.ts. Caller opts in via
+ * `bindDevice(..., { prefer: 'webauthn' })`. The credential private key is
+ * never exposed to JS — it lives on the authenticator (YubiKey, Touch ID,
+ * Windows Hello, platform passkey provider).
+ *
+ * NOTE: WebAuthn signatures are over (authenticatorData || sha256(clientDataJSON)),
+ * not the raw `${sessionId}:${nonce}:${timestamp}` payload. The server reconstructs
+ * the same expected challenge from session/nonce/timestamp and compares it to
+ * the challenge embedded inside clientDataJSON.
+ */
+/** base64url encode a buffer (no padding, URL-safe alphabet). */
+export function bufferToBase64Url(buffer) {
+    const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+/** base64url decode to ArrayBuffer. */
+export function base64UrlToBuffer(b64url) {
+    const base64 = b64url.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes.buffer;
+}
+/** SHA-256 → bytes for the WebAuthn challenge derivation. */
+async function sha256(input) {
+    return crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+}
+/**
+ * Bind a hardware credential to the active session.
+ *
+ * Calls navigator.credentials.create with ES256 (alg -7) + EdDSA (alg -8)
+ * pubKeyCredParams. Sends the attestation to the server, receives the
+ * persisted deviceId.
+ */
+export async function bindDeviceWebAuthn(apiBase, sessionId, userId, displayName) {
+    if (typeof navigator === 'undefined' || !navigator.credentials) {
+        throw new Error('WebAuthn not available in this environment');
+    }
+    // Server-bound challenge: derived from sessionId so a stolen challenge
+    // can't be replayed against another session.
+    const challenge = await sha256(`tf-bind:${sessionId}`);
+    const userIdBytes = new TextEncoder().encode(userId);
+    const publicKey = {
+        challenge,
+        rp: { name: 'TokenForge' },
+        user: { id: userIdBytes, name: userId, displayName },
+        pubKeyCredParams: [
+            { type: 'public-key', alg: -7 }, // ES256
+            { type: 'public-key', alg: -8 }, // EdDSA
+        ],
+        authenticatorSelection: { userVerification: 'preferred' },
+        timeout: 60_000,
+        attestation: 'none',
+    };
+    const credential = (await navigator.credentials.create({ publicKey }));
+    if (!credential)
+        throw new Error('WebAuthn credential creation cancelled');
+    const response = credential.response;
+    const body = {
+        sessionId,
+        userId,
+        credentialId: bufferToBase64Url(credential.rawId),
+        attestationObject: bufferToBase64Url(response.attestationObject),
+        clientDataJSON: bufferToBase64Url(response.clientDataJSON),
+    };
+    const httpResponse = await fetch(`${apiBase}/api/tf/bind/webauthn`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify(body),
+    });
+    if (!httpResponse.ok) {
+        throw new Error(`TokenForge WebAuthn binding failed: ${httpResponse.status}`);
+    }
+    const { deviceId } = (await httpResponse.json());
+    return { deviceId, credentialId: body.credentialId };
+}
+/**
+ * Sign a per-request challenge with the bound hardware credential.
+ *
+ * The challenge is `${sessionId}:${nonce}:${timestamp}` — same payload shape
+ * as the ECDSA path, but the WebAuthn signature is over
+ * (authenticatorData || sha256(clientDataJSON)) where clientDataJSON contains
+ * the challenge. The server reconstructs and compares.
+ */
+export async function signChallengeWebAuthn(credentialId, sessionId, nonce, timestamp) {
+    if (typeof navigator === 'undefined' || !navigator.credentials) {
+        throw new Error('WebAuthn not available in this environment');
+    }
+    const challenge = await sha256(`${sessionId}:${nonce}:${timestamp}`);
+    const publicKey = {
+        challenge,
+        allowCredentials: [
+            { id: base64UrlToBuffer(credentialId), type: 'public-key' },
+        ],
+        userVerification: 'preferred',
+        timeout: 60_000,
+    };
+    const assertion = (await navigator.credentials.get({ publicKey }));
+    if (!assertion)
+        throw new Error('WebAuthn assertion cancelled');
+    const response = assertion.response;
+    return {
+        signature: bufferToBase64Url(response.signature),
+        authenticatorData: bufferToBase64Url(response.authenticatorData),
+        clientDataJSON: bufferToBase64Url(response.clientDataJSON),
+        credentialId: bufferToBase64Url(assertion.rawId),
+    };
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/client/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/client/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,MAAM,CAAC,KAAa;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,IAAI,OAAO,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,SAAS,GAAuC;QACpD,SAAS;QACT,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;QAC1B,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE;QACpD,gBAAgB,EAAE;YAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAG,QAAQ;YAC1C,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAG,QAAQ;SAC3C;QACD,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;QACzD,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,MAAM;KACpB,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IACrG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,SAAS;QACT,MAAM;QACN,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QACjD,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAChE,cAAc,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;KAC3D,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,uBAAuB,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAyB,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,SAAiB;IAEjB,IAAI,OAAO,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;IAErE,MAAM,SAAS,GAAsC;QACnD,SAAS;QACT,gBAAgB,EAAE;YAChB,EAAE,EAAE,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;SAC5D;QACD,gBAAgB,EAAE,WAAW;QAC7B,OAAO,EAAE,MAAM;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IACjG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAA0C,CAAC;IACtE,OAAO;QACL,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAChD,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAChE,cAAc,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1D,YAAY,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/server/action-verify.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Server-side action-signing verifier (Sprint 39).
+ *
+ * Wraps `verifyCompactJws` with two extra invariants the client SDK
+ * promises:
+ *   1. The JWS `action` claim equals the `expectedAction` the route
+ *      handler is enforcing (e.g. POST /checkout asserts "checkout").
+ *   2. The JWS `actionHash` claim equals the SHA-256 of the
+ *      canonicalized request body. This binds the signature to the
+ *      payload — replaying the same JWS against a different body
+ *      (different recipient, amount, etc.) fails.
+ *
+ * Replay prevention against the SAME body is the caller's
+ * responsibility: they should pass `claims.nonce` through
+ * `consumeChallenge` (server/dbsc-challenge.ts) so a second submission
+ * of the same JWS is rejected even within the maxAgeSeconds window.
+ */
+import type { JwsClaims } from './jws-verify.js';
+export interface VerifyActionOptions {
+    /** Bound device public key (JWK JSON or PEM SPKI). */
+    publicKey: string;
+    /** Action verb the route asserts (must equal claims.action). */
+    expectedAction: string;
+    /** Optional request body — when present, must hash to claims.actionHash. */
+    body?: Record<string, unknown> | null;
+    /** Maximum age for the JWS in seconds. Default 60. */
+    maxAgeSeconds?: number;
+    /** Override clock for tests. */
+    now?: Date;
+    /**
+     * RFC 9266 TLS exporter material (hex) extracted from the active TLS
+     * connection by the runtime. When provided, claims.tlsExporter MUST
+     * match it — protects against replay across a different TLS session.
+     * Omit on workerd or any runtime that doesn't expose exporter
+     * material; the server emits Sec-TF-Channel-Bound: 0 in that case
+     * via the route handler.
+     */
+    expectedTlsExporter?: string;
+    /**
+     * If true, reject when claims.tlsExporter is absent. Use this on
+     * sensitive routes when running on a runtime that *does* expose the
+     * exporter — a missing claim then indicates the client signed
+     * without binding the TLS channel.
+     */
+    requireTlsExporter?: boolean;
+}
+export type VerifyActionResult = {
+    ok: true;
+    claims: JwsClaims;
+    protectedHeader: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyAction(jws: string, opts: VerifyActionOptions): Promise<VerifyActionResult>;
+//# sourceMappingURL=action-verify.d.ts.map

package/dist/server/action-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-verify.d.ts","sourceRoot":"","sources":["../../src/server/action-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,cAAc,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B"}

package/dist/server/action-verify.js

@@ -0,0 +1,47 @@
+/**
+ * Server-side action-signing verifier (Sprint 39).
+ *
+ * Wraps `verifyCompactJws` with two extra invariants the client SDK
+ * promises:
+ *   1. The JWS `action` claim equals the `expectedAction` the route
+ *      handler is enforcing (e.g. POST /checkout asserts "checkout").
+ *   2. The JWS `actionHash` claim equals the SHA-256 of the
+ *      canonicalized request body. This binds the signature to the
+ *      payload — replaying the same JWS against a different body
+ *      (different recipient, amount, etc.) fails.
+ *
+ * Replay prevention against the SAME body is the caller's
+ * responsibility: they should pass `claims.nonce` through
+ * `consumeChallenge` (server/dbsc-challenge.ts) so a second submission
+ * of the same JWS is rejected even within the maxAgeSeconds window.
+ */
+import { verifyCompactJws } from './jws-verify.js';
+import { hashActionPayload } from '../shared/action-hash.js';
+export async function verifyAction(jws, opts) {
+    const inner = await verifyCompactJws(jws, {
+        publicKey: opts.publicKey,
+        maxAgeSeconds: opts.maxAgeSeconds,
+        now: opts.now,
+    });
+    if (!inner.ok)
+        return inner;
+    if (inner.claims.action !== opts.expectedAction) {
+        return { ok: false, reason: 'action_mismatch' };
+    }
+    if (opts.body !== undefined && opts.body !== null) {
+        const expectedHash = await hashActionPayload(opts.body);
+        if (inner.claims.actionHash !== expectedHash) {
+            return { ok: false, reason: 'action_hash_mismatch' };
+        }
+    }
+    if (opts.expectedTlsExporter !== undefined) {
+        if (inner.claims.tlsExporter !== opts.expectedTlsExporter) {
+            return { ok: false, reason: 'tls_exporter_mismatch' };
+        }
+    }
+    else if (opts.requireTlsExporter && !inner.claims.tlsExporter) {
+        return { ok: false, reason: 'tls_exporter_missing' };
+    }
+    return inner;
+}
+//# sourceMappingURL=action-verify.js.map

package/dist/server/action-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-verify.js","sourceRoot":"","sources":["../../src/server/action-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAmC7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,IAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;QACxC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/aitm-heuristics.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Adversary-in-the-middle (AitM) heuristic engine. Pure module.
+ * Compares a bind-time fingerprint vs. current request, emits anomalies.
+ * trust-score subtracts the delta; device-telemetry surfaces the list.
+ */
+export interface ClientFingerprint {
+    userAgent: string;
+    language: string;
+    timezone: string;
+    colorDepth: number;
+    screenWidth: number;
+    screenHeight: number;
+    /** Optional — only present on protected routes that capture them. */
+    origin?: string;
+    sni?: string;
+    host?: string;
+    rttMs?: number;
+    /** True when TLS exporter binding succeeded for this request. */
+    channelBound?: boolean;
+}
+export type AitmAnomalyKind = 'origin_mismatch' | 'latency_floor' | 'ua_drift' | 'tz_drift' | 'color_drift' | 'resolution_swap' | 'locale_drift' | 'channel_unbound';
+export type AitmConfidence = 'low' | 'medium' | 'high';
+export interface AitmAnomaly {
+    kind: AitmAnomalyKind;
+    confidence: AitmConfidence;
+    details?: Record<string, unknown>;
+}
+export interface AitmEvalOptions {
+    /**
+     * Persistent latency floor delta (ms) above baseline that's considered
+     * suspicious. Default 40ms — typical AitM proxy adds at least this much
+     * even after EWMA smoothing.
+     */
+    rttFloorDeltaMs?: number;
+    /**
+     * When true, missing TLS-exporter binding emits `channel_unbound`.
+     * Default true. Disable on routes that don't require channel binding.
+     */
+    requireChannelBinding?: boolean;
+}
+/**
+ * Evaluate the eight AitM heuristics. Pure function.
+ *
+ * @param baseline - fingerprint captured at device-bind time
+ * @param current - fingerprint of the current request
+ * @param opts - thresholds (override per route / tenant)
+ * @returns list of anomalies; empty when nothing trips
+ */
+export declare function evaluateAitm(baseline: ClientFingerprint, current: ClientFingerprint, opts?: AitmEvalOptions): AitmAnomaly[];
+/**
+ * Convert anomalies to a trust-score delta. Negative number; used by
+ * TrustScoreEngine to drop score on suspicious sessions. Cap at -60 so
+ * a single anomalous request can never block a clean baseline outright
+ * — that's the trust score's job once it falls below `step_up_threshold`.
+ */
+export declare function aitmScoreDelta(anomalies: AitmAnomaly[]): number;
+//# sourceMappingURL=aitm-heuristics.d.ts.map

package/dist/server/aitm-heuristics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aitm-heuristics.d.ts","sourceRoot":"","sources":["../../src/server/aitm-heuristics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,eAAe,GACf,UAAU,GACV,UAAU,GACV,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,iBAAiB,CAAC;AAEtB,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,eAAoB,GACzB,WAAW,EAAE,CA0Ff;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAQ/D"}

package/dist/server/aitm-heuristics.js

@@ -0,0 +1,120 @@
+/**
+ * Adversary-in-the-middle (AitM) heuristic engine. Pure module.
+ * Compares a bind-time fingerprint vs. current request, emits anomalies.
+ * trust-score subtracts the delta; device-telemetry surfaces the list.
+ */
+const DEFAULT_RTT_FLOOR_DELTA_MS = 40;
+/**
+ * Evaluate the eight AitM heuristics. Pure function.
+ *
+ * @param baseline - fingerprint captured at device-bind time
+ * @param current - fingerprint of the current request
+ * @param opts - thresholds (override per route / tenant)
+ * @returns list of anomalies; empty when nothing trips
+ */
+export function evaluateAitm(baseline, current, opts = {}) {
+    const out = [];
+    const rttFloorDelta = opts.rttFloorDeltaMs ?? DEFAULT_RTT_FLOOR_DELTA_MS;
+    const requireChannel = opts.requireChannelBinding ?? true;
+    if (current.origin && current.sni && current.host) {
+        const originHost = safeHost(current.origin);
+        const sni = current.sni.toLowerCase();
+        const host = current.host.toLowerCase();
+        const all = [originHost, sni, host].filter(Boolean);
+        const allMatch = all.every((h) => h === all[0]);
+        if (!allMatch) {
+            out.push({
+                kind: 'origin_mismatch',
+                confidence: 'high',
+                details: { origin: originHost, sni, host },
+            });
+        }
+    }
+    if (baseline.userAgent !== current.userAgent) {
+        out.push({
+            kind: 'ua_drift',
+            confidence: 'high',
+            details: { from: baseline.userAgent, to: current.userAgent },
+        });
+    }
+    if (baseline.timezone !== current.timezone) {
+        out.push({
+            kind: 'tz_drift',
+            confidence: 'medium',
+            details: { from: baseline.timezone, to: current.timezone },
+        });
+    }
+    if (baseline.language !== current.language) {
+        out.push({
+            kind: 'locale_drift',
+            confidence: 'medium',
+            details: { from: baseline.language, to: current.language },
+        });
+    }
+    if (baseline.colorDepth !== current.colorDepth) {
+        out.push({
+            kind: 'color_drift',
+            confidence: 'low',
+            details: { from: baseline.colorDepth, to: current.colorDepth },
+        });
+    }
+    const baseDim = `${baseline.screenWidth}x${baseline.screenHeight}`;
+    const curDim = `${current.screenWidth}x${current.screenHeight}`;
+    const swapped = baseline.screenWidth === current.screenHeight &&
+        baseline.screenHeight === current.screenWidth &&
+        baseline.screenWidth !== baseline.screenHeight;
+    if (swapped) {
+        out.push({
+            kind: 'resolution_swap',
+            confidence: 'medium',
+            details: { from: baseDim, to: curDim },
+        });
+    }
+    if (typeof baseline.rttMs === 'number' &&
+        typeof current.rttMs === 'number' &&
+        current.rttMs - baseline.rttMs >= rttFloorDelta) {
+        out.push({
+            kind: 'latency_floor',
+            confidence: 'medium',
+            details: {
+                baselineMs: baseline.rttMs,
+                currentMs: current.rttMs,
+                deltaMs: current.rttMs - baseline.rttMs,
+            },
+        });
+    }
+    if (requireChannel && current.channelBound === false) {
+        out.push({
+            kind: 'channel_unbound',
+            confidence: 'high',
+        });
+    }
+    return out;
+}
+/**
+ * Convert anomalies to a trust-score delta. Negative number; used by
+ * TrustScoreEngine to drop score on suspicious sessions. Cap at -60 so
+ * a single anomalous request can never block a clean baseline outright
+ * — that's the trust score's job once it falls below `step_up_threshold`.
+ */
+export function aitmScoreDelta(anomalies) {
+    let delta = 0;
+    for (const a of anomalies) {
+        if (a.confidence === 'high')
+            delta -= 25;
+        else if (a.confidence === 'medium')
+            delta -= 12;
+        else
+            delta -= 5;
+    }
+    return Math.max(delta, -60);
+}
+function safeHost(originUrl) {
+    try {
+        return new URL(originUrl).host.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=aitm-heuristics.js.map

package/dist/server/aitm-heuristics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aitm-heuristics.js","sourceRoot":"","sources":["../../src/server/aitm-heuristics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkDH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA2B,EAC3B,OAA0B,EAC1B,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,0BAA0B,CAAC;IACzE,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,iBAAiB;gBACvB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAChE,MAAM,OAAO,GACX,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;QAC7C,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW;QAC7C,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,YAAY,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,aAAa,EAC/C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE;gBACP,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,OAAO,EAAE,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK;aACxC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAwB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM;YAAE,KAAK,IAAI,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,KAAK,IAAI,EAAE,CAAC;;YAC3C,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}