@opensyber/tokenforge 0.1.1 → 1.0.0

package/dist/server/webauthn-verify.js

@@ -0,0 +1,175 @@
+/**
+ * Server-side WebAuthn verifier — runs in Cloudflare Workers (Web Crypto only).
+ *
+ * Limitations (intentional, documented):
+ *  - We use attestation: 'none' on the client, so attestation statement
+ *    verification is skipped (only the authData → COSE_Key extraction matters).
+ *  - Only ES256 (alg -7, ECDSA P-256) keys are accepted on the server. EdDSA
+ *    is offered to the client for forward-compat but Web Crypto support is
+ *    spotty in Workers; reject EdDSA at verify time with a clear error.
+ *  - Counter check is not enforced here. Callers can read the 4-byte counter
+ *    out of authenticatorData[33..37] if they want to persist + compare.
+ */
+import { decodeCbor } from './cbor.js';
+/** base64url → ArrayBuffer */
+export function b64uToBuf(b64url) {
+    const base64 = b64url.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes.buffer;
+}
+/** Uint8Array → base64url (no padding). */
+export function bufToB64u(buf) {
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+/** Parse clientDataJSON and verify challenge + origin. */
+export function verifyClientDataJSON(clientDataJSON, expectedChallenge, expectedOrigin, expectedType) {
+    let json;
+    try {
+        const text = new TextDecoder().decode(b64uToBuf(clientDataJSON));
+        json = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: 'clientDataJSON malformed' };
+    }
+    if (json.type !== expectedType)
+        return { ok: false, reason: `type mismatch: ${json.type}` };
+    if (json.challenge !== expectedChallenge)
+        return { ok: false, reason: 'challenge mismatch' };
+    if (json.origin !== expectedOrigin)
+        return { ok: false, reason: `origin mismatch: ${json.origin}` };
+    return { ok: true };
+}
+/**
+ * Verify a WebAuthn attestation (registration). Returns the extracted
+ * public key as JWK plus the credentialId for persistence.
+ */
+export async function verifyWebAuthnAttestation(attestationObjectB64u, clientDataJSONB64u, expectedChallenge, expectedOrigin) {
+    const cd = verifyClientDataJSON(clientDataJSONB64u, expectedChallenge, expectedOrigin, 'webauthn.create');
+    if (!cd.ok)
+        throw new Error(`webauthn.create: ${cd.reason}`);
+    const attBuf = new Uint8Array(b64uToBuf(attestationObjectB64u));
+    const decoded = decodeCbor(attBuf);
+    if (!(decoded instanceof Map))
+        throw new Error('attestationObject: not a CBOR map');
+    const authData = decoded.get('authData');
+    if (!(authData instanceof Uint8Array))
+        throw new Error('attestationObject: authData missing');
+    return parseAuthDataAttestedCredential(authData);
+}
+/** Pull rpIdHash + credentialId + COSE_Key out of attested authData. */
+function parseAuthDataAttestedCredential(authData) {
+    if (authData.length < 37 + 18)
+        throw new Error('authData too short for attested credential');
+    const rpIdHash = authData.slice(0, 32);
+    const flags = authData[32] ?? 0;
+    if ((flags & 0x40) === 0)
+        throw new Error('authData: AT (attested credential) flag not set');
+    // skip signCount (4 bytes), aaguid (16 bytes)
+    let p = 37 + 16;
+    const credIdLen = ((authData[p] ?? 0) << 8) | (authData[p + 1] ?? 0);
+    p += 2;
+    const credentialId = authData.slice(p, p + credIdLen);
+    p += credIdLen;
+    const cosePublicKey = decodeCbor(authData.slice(p));
+    return { publicKeyJwk: coseToJwk(cosePublicKey), credentialId, rpIdHash };
+}
+/** Convert a COSE_Key (CBOR map) → JWK. ES256 only. */
+function coseToJwk(cose) {
+    if (!(cose instanceof Map))
+        throw new Error('COSE_Key: not a map');
+    const kty = cose.get(1);
+    const alg = cose.get(3);
+    if (kty !== 2)
+        throw new Error(`COSE_Key kty=${String(kty)} unsupported (need EC2)`);
+    if (alg !== -7)
+        throw new Error(`COSE_Key alg=${String(alg)} unsupported (need ES256/-7)`);
+    const x = cose.get(-2);
+    const y = cose.get(-3);
+    if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array)) {
+        throw new Error('COSE_Key: x/y missing');
+    }
+    return { kty: 'EC', crv: 'P-256', x: bufToB64u(x), y: bufToB64u(y) };
+}
+/**
+ * Verify a WebAuthn assertion. The signature is over
+ * (authenticatorData || sha256(clientDataJSON)).
+ */
+export async function verifyWebAuthnAssertion(signatureB64u, authenticatorDataB64u, clientDataJSONB64u, publicKeyJwk, expectedChallenge, expectedOrigin) {
+    const cd = verifyClientDataJSON(clientDataJSONB64u, expectedChallenge, expectedOrigin, 'webauthn.get');
+    if (!cd.ok)
+        return false;
+    const authData = new Uint8Array(b64uToBuf(authenticatorDataB64u));
+    const clientDataBuf = new Uint8Array(b64uToBuf(clientDataJSONB64u));
+    const clientDataHash = new Uint8Array(await crypto.subtle.digest('SHA-256', clientDataBuf));
+    const signed = new Uint8Array(authData.length + clientDataHash.length);
+    signed.set(authData, 0);
+    signed.set(clientDataHash, authData.length);
+    const key = await crypto.subtle.importKey('jwk', publicKeyJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    const sigDer = new Uint8Array(b64uToBuf(signatureB64u));
+    let sigRaw;
+    try {
+        sigRaw = derToRawEcdsa(sigDer);
+    }
+    catch {
+        return false;
+    }
+    try {
+        return await crypto.subtle.verify({ name: 'ECDSA', hash: { name: 'SHA-256' } }, key, copyToArrayBuffer(sigRaw), copyToArrayBuffer(signed));
+    }
+    catch {
+        return false;
+    }
+}
+/** Copy a Uint8Array into a freshly allocated ArrayBuffer (escapes SharedArrayBuffer typing). */
+function copyToArrayBuffer(src) {
+    const out = new ArrayBuffer(src.byteLength);
+    new Uint8Array(out).set(src);
+    return out;
+}
+/** WebAuthn ECDSA sigs are DER-encoded; Web Crypto wants raw r||s. */
+export function derToRawEcdsa(der) {
+    // SEQUENCE 0x30, total len, INTEGER 0x02, rLen, r, INTEGER 0x02, sLen, s
+    const at = (i) => {
+        const v = der[i];
+        if (v === undefined)
+            throw new Error('DER: truncated');
+        return v;
+    };
+    if (at(0) !== 0x30)
+        throw new Error('DER: not a SEQUENCE');
+    let p = 2;
+    if (at(1) & 0x80)
+        p = 2 + (at(1) & 0x7f);
+    if (at(p) !== 0x02)
+        throw new Error('DER: r not INTEGER');
+    let rLen = at(p + 1);
+    let rStart = p + 2;
+    if (rLen > 32) {
+        rStart += rLen - 32;
+        rLen = 32;
+    }
+    const r = der.slice(rStart, rStart + rLen);
+    p = rStart + rLen;
+    if (at(p) !== 0x02)
+        throw new Error('DER: s not INTEGER');
+    let sLen = at(p + 1);
+    let sStart = p + 2;
+    if (sLen > 32) {
+        sStart += sLen - 32;
+        sLen = 32;
+    }
+    const s = der.slice(sStart, sStart + sLen);
+    const raw = new Uint8Array(64);
+    raw.set(r, 32 - r.length);
+    raw.set(s, 64 - s.length);
+    return raw;
+}
+//# sourceMappingURL=webauthn-verify.js.map

package/dist/server/webauthn-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.js","sourceRoot":"","sources":["../../src/server/webauthn-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,8BAA8B;AAC9B,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,GAA6B;IACrD,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,iBAAyB,EACzB,cAAsB,EACtB,YAAgD;IAEhD,IAAI,IAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5F,IAAI,IAAI,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,qBAA6B,EAC7B,kBAA0B,EAC1B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,EAAE,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC1G,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAE9F,OAAO,+BAA+B,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,+BAA+B,CAAC,QAAoB;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC7F,8CAA8C;IAC9C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC,IAAI,CAAC,CAAC;IACP,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IACtD,CAAC,IAAI,SAAS,CAAC;IACf,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACrF,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,qBAA6B,EAC7B,kBAA0B,EAC1B,YAAwB,EACxB,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,EAAE,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IACvG,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC/E,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAE/D,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,GAAG,EACH,iBAAiB,CAAC,MAAM,CAAC,EACzB,iBAAiB,CAAC,MAAM,CAAC,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,GAAe;IACxC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,yEAAyE;IACzE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/webauthn-verify.test-helpers.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Test-only helpers — inverse of derToRawEcdsa for synthesizing valid
+ * assertions in tests. NOT exported from the package.
+ */
+export declare function makeP256Keypair(): Promise<CryptoKeyPair>;
+/** Convert raw r||s ECDSA signature into the DER form WebAuthn produces. */
+export declare function rawToDerEcdsa(raw: Uint8Array): Uint8Array;
+//# sourceMappingURL=webauthn-verify.test-helpers.d.ts.map

package/dist/server/webauthn-verify.test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.test-helpers.d.ts","sourceRoot":"","sources":["../../src/server/webauthn-verify.test-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAI9D;AAkBD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAYzD"}

package/dist/server/webauthn-verify.test-helpers.js

@@ -0,0 +1,39 @@
+/**
+ * Test-only helpers — inverse of derToRawEcdsa for synthesizing valid
+ * assertions in tests. NOT exported from the package.
+ */
+export async function makeP256Keypair() {
+    return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+}
+function stripLeading(b) {
+    let i = 0;
+    while (i < b.length - 1 && b[i] === 0)
+        i++;
+    return b.slice(i);
+}
+function derInteger(b) {
+    const first = b[0] ?? 0;
+    const needsPad = first & 0x80;
+    const content = needsPad ? new Uint8Array([0x00, ...b]) : b;
+    const out = new Uint8Array(2 + content.length);
+    out[0] = 0x02;
+    out[1] = content.length;
+    out.set(content, 2);
+    return out;
+}
+/** Convert raw r||s ECDSA signature into the DER form WebAuthn produces. */
+export function rawToDerEcdsa(raw) {
+    const r = stripLeading(raw.slice(0, 32));
+    const s = stripLeading(raw.slice(32, 64));
+    const rTLV = derInteger(r);
+    const sTLV = derInteger(s);
+    const body = new Uint8Array(rTLV.length + sTLV.length);
+    body.set(rTLV, 0);
+    body.set(sTLV, rTLV.length);
+    const out = new Uint8Array(2 + body.length);
+    out[0] = 0x30;
+    out[1] = body.length;
+    out.set(body, 2);
+    return out;
+}
+//# sourceMappingURL=webauthn-verify.test-helpers.js.map

package/dist/server/webauthn-verify.test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.test-helpers.js","sourceRoot":"","sources":["../../src/server/webauthn-verify.test-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAC9B,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/webhooks.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Webhook receiver helpers for TokenForge cloud deliveries.
+ *
+ * Every delivery carries three relevant headers:
+ *   X-TF-Signature: "v1,<hex>" (one or more, space-separated during rotation)
+ *   X-TF-Timestamp: ISO-8601 string — the moment dispatcher built the payload
+ *   X-TF-Delivery-Id: UUID — per-attempt id, use for idempotency
+ *
+ * The signed string is `${timestamp}.${rawBody}` (no whitespace). During
+ * rotation, the dispatcher may send two `v1,<hex>` signatures — accept if
+ * either matches.
+ *
+ * Example (Node.js, Hono):
+ *
+ *   import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+ *
+ *   app.post('/webhooks/tokenforge', async (c) => {
+ *     const rawBody = await c.req.text();
+ *     const ok = await verifyWebhookSignature({
+ *       body: rawBody,
+ *       signatureHeader: c.req.header('X-TF-Signature') ?? '',
+ *       timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+ *       secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+ *     });
+ *     if (!ok) return c.json({ error: 'bad_signature' }, 401);
+ *     const event = JSON.parse(rawBody);
+ *     // handle event.event, event.data ...
+ *     return c.json({ received: true });
+ *   });
+ */
+export interface VerifyOptions {
+    body: string;
+    signatureHeader: string;
+    timestampHeader: string;
+    secret: string;
+    /** Max allowed clock skew in ms. Default 300000 (5 min). */
+    toleranceMs?: number;
+    /** Accept requests with missing timestamp (legacy). Default false. */
+    allowMissingTimestamp?: boolean;
+}
+export declare function verifyWebhookSignature(opts: VerifyOptions): Promise<boolean>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/server/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/server/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBlF"}

package/dist/server/webhooks.js

@@ -0,0 +1,77 @@
+/**
+ * Webhook receiver helpers for TokenForge cloud deliveries.
+ *
+ * Every delivery carries three relevant headers:
+ *   X-TF-Signature: "v1,<hex>" (one or more, space-separated during rotation)
+ *   X-TF-Timestamp: ISO-8601 string — the moment dispatcher built the payload
+ *   X-TF-Delivery-Id: UUID — per-attempt id, use for idempotency
+ *
+ * The signed string is `${timestamp}.${rawBody}` (no whitespace). During
+ * rotation, the dispatcher may send two `v1,<hex>` signatures — accept if
+ * either matches.
+ *
+ * Example (Node.js, Hono):
+ *
+ *   import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+ *
+ *   app.post('/webhooks/tokenforge', async (c) => {
+ *     const rawBody = await c.req.text();
+ *     const ok = await verifyWebhookSignature({
+ *       body: rawBody,
+ *       signatureHeader: c.req.header('X-TF-Signature') ?? '',
+ *       timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+ *       secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+ *     });
+ *     if (!ok) return c.json({ error: 'bad_signature' }, 401);
+ *     const event = JSON.parse(rawBody);
+ *     // handle event.event, event.data ...
+ *     return c.json({ received: true });
+ *   });
+ */
+export async function verifyWebhookSignature(opts) {
+    const { body, signatureHeader, timestampHeader, secret } = opts;
+    const tolerance = opts.toleranceMs ?? 5 * 60_000;
+    if (!signatureHeader || !secret)
+        return false;
+    if (!timestampHeader) {
+        if (!opts.allowMissingTimestamp)
+            return false;
+    }
+    else {
+        const ts = Date.parse(timestampHeader);
+        if (Number.isNaN(ts))
+            return false;
+        if (Math.abs(Date.now() - ts) > tolerance)
+            return false;
+    }
+    const signedString = timestampHeader ? `${timestampHeader}.${body}` : body;
+    const expected = await hmacSha256Hex(secret, signedString);
+    // Signature header is space-separated list of "v1,<hex>" entries.
+    const entries = signatureHeader.split(/\s+/).filter(Boolean);
+    for (const entry of entries) {
+        const [version, hex] = entry.split(',');
+        if (version !== 'v1' || !hex)
+            continue;
+        if (timingSafeEqual(hex.toLowerCase(), expected))
+            return true;
+    }
+    return false;
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+async function hmacSha256Hex(secret, data) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(data));
+    const bytes = new Uint8Array(sig);
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++)
+        hex += bytes[i].toString(16).padStart(2, '0');
+    return hex;
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/server/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/server/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAaH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAmB;IAC9D,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC;IAEjD,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,qBAAqB;YAAE,OAAO,KAAK,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE3D,kEAAkE;IAClE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG;YAAE,SAAS;QACvC,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/shared/action-hash.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared canonicalization + hash helper for action signing.
+ *
+ * Client (`client/action-signer.ts`) and server
+ * (`server/action-verify.ts`) MUST agree on these byte-for-byte;
+ * sharing this file is the simplest enforcement.
+ */
+export interface ActionLikePayload {
+    action: string;
+    [key: string]: unknown;
+}
+/**
+ * Stable JSON serialization — sorts top-level keys so `{a:1,b:2}` and
+ * `{b:2,a:1}` produce the same string. JS object literals preserve
+ * insertion order, so without this two semantically-identical
+ * payloads from different code paths would hash differently and the
+ * server would reject one of them as a tamper.
+ */
+export declare function canonicalizeAction(payload: Record<string, unknown>): string;
+export declare function sha256B64Url(input: string): Promise<string>;
+export declare function hashActionPayload(payload: Record<string, unknown>): Promise<string>;
+export declare function b64UrlEncodeBytes(bytes: Uint8Array): string;
+//# sourceMappingURL=action-hash.d.ts.map

package/dist/shared/action-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-hash.d.ts","sourceRoot":"","sources":["../../src/shared/action-hash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3E;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI3D"}

package/dist/shared/action-hash.js

@@ -0,0 +1,35 @@
+/**
+ * Shared canonicalization + hash helper for action signing.
+ *
+ * Client (`client/action-signer.ts`) and server
+ * (`server/action-verify.ts`) MUST agree on these byte-for-byte;
+ * sharing this file is the simplest enforcement.
+ */
+/**
+ * Stable JSON serialization — sorts top-level keys so `{a:1,b:2}` and
+ * `{b:2,a:1}` produce the same string. JS object literals preserve
+ * insertion order, so without this two semantically-identical
+ * payloads from different code paths would hash differently and the
+ * server would reject one of them as a tamper.
+ */
+export function canonicalizeAction(payload) {
+    const keys = Object.keys(payload).sort();
+    const ordered = {};
+    for (const k of keys)
+        ordered[k] = payload[k];
+    return JSON.stringify(ordered);
+}
+export async function sha256B64Url(input) {
+    const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+    return b64UrlEncodeBytes(new Uint8Array(buf));
+}
+export async function hashActionPayload(payload) {
+    return sha256B64Url(canonicalizeAction(payload));
+}
+export function b64UrlEncodeBytes(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=action-hash.js.map

package/dist/shared/action-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-hash.js","sourceRoot":"","sources":["../../src/shared/action-hash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,OAAO,iBAAiB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgC;IACtE,OAAO,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAiB;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/shared/types.d.ts

@@ -118,6 +118,8 @@ export interface ScoreBreakdown {
     velocityScore: number;
     timeScore: number;
     nonceScore: number;
+    /** Negative number — subtracted from total when AitM anomalies present. */
+    aitmDelta?: number;
     total: number;
     reasons: string[];
 }

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}

package/dist/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAgKlC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAkKlC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opensyber/tokenforge",
-  "version": "0.1.1",
-  "description": "Device-bound session security — ECDSA P-256 signatures for every request after login",
+  "version": "1.0.0",
+  "description": "Device-bound session security — W3C DBSC + ECDSA P-256 signatures + AitM detection. Drop-in for Auth0 / Okta / Clerk / Entra ID.",
   "private": false,
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -21,13 +21,16 @@
     "session-security",
     "tokenforge",
     "device-binding",
+    "dbsc",
     "ecdsa",
-    "device-binding",
     "trust-score",
     "session-management",
     "web-crypto",
-    "anti-session-hijacking"
+    "anti-session-hijacking",
+    "cookie-theft-protection",
+    "cisco-duo-alternative"
   ],
+  "sideEffects": false,
   "exports": {
     "./client": {
       "import": "./dist/client/index.js",
@@ -37,6 +40,22 @@
       "import": "./dist/server/index.js",
       "types": "./dist/server/index.d.ts"
     },
+    "./server/internal": {
+      "import": "./dist/server/internal.js",
+      "types": "./dist/server/internal.d.ts"
+    },
+    "./server/storage": {
+      "import": "./dist/server/storage/index.js",
+      "types": "./dist/server/storage/index.d.ts"
+    },
+    "./storage/internal": {
+      "import": "./dist/server/storage/internal.js",
+      "types": "./dist/server/storage/internal.d.ts"
+    },
+    "./webhooks": {
+      "import": "./dist/server/webhooks.js",
+      "types": "./dist/server/webhooks.d.ts"
+    },
     "./react": {
       "import": "./dist/react/index.js",
       "types": "./dist/react/index.d.ts"
@@ -61,17 +80,13 @@
       "import": "./dist/adapters/fastify.js",
       "types": "./dist/adapters/fastify.d.ts"
     },
-    "./storage": {
-      "import": "./dist/server/storage/index.js",
-      "types": "./dist/server/storage/index.d.ts"
+    "./sveltekit": {
+      "import": "./dist/adapters/sveltekit.js",
+      "types": "./dist/adapters/sveltekit.d.ts"
     },
-    "./storage/internal": {
-      "import": "./src/server/storage/internal.ts",
-      "types": "./src/server/storage/internal.ts"
-    },
-    "./server/internal": {
-      "import": "./src/server/internal.ts",
-      "types": "./src/server/internal.ts"
+    "./astro": {
+      "import": "./dist/adapters/astro.js",
+      "types": "./dist/adapters/astro.d.ts"
     }
   },
   "files": [
@@ -84,8 +99,12 @@
     "!dist/server/crypto.*",
     "!dist/server/trust-score.*",
     "!dist/server/verify.*",
+    "!dist/server/binding.*",
+    "!dist/server/step-up.*",
+    "!dist/server/totp.*",
     "!dist/server/middleware-internal.*",
     "!dist/server/internal.*",
+    "!dist/server/storage/**",
     "README.md",
     "LICENSE.md"
   ],
@@ -93,12 +112,15 @@
     "build": "tsc",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
+    "lint": "eslint",
     "test": "vitest run",
+    "test:e2e": "playwright test",
+    "test:e2e:ui": "playwright test --ui",
     "clean": "rm -rf dist .turbo",
     "prepublishOnly": "pnpm run clean && pnpm run build"
   },
   "dependencies": {
-    "hono": "^4.7.0"
+    "hono": "^4.12.14"
   },
   "peerDependencies": {
     "react": ">=18.0.0"
@@ -109,10 +131,16 @@
     }
   },
   "devDependencies": {
+    "@hono/node-server": "^1.19.13",
+    "@playwright/test": "^1.58.2",
+    "tsx": "^4.20.6",
     "@cloudflare/workers-types": "^4.20250214.0",
+    "@eslint/js": "^9.39.0",
     "@types/react": "^19.0.0",
+    "eslint": "^9",
     "react": "^19.0.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^4.0.0"
   }
 }

package/dist/server/binding.d.ts

@@ -1,19 +0,0 @@
-import { Hono } from 'hono';
-import type { TokenForgeServerOptions } from '../shared/types.js';
-interface Variables {
-    userId: string;
-    sessionId: string;
-}
-/**
- * TokenForge binding and session management routes.
- * Mount at /api/tf on the main Hono app.
- * @param options - Server options (storage, thresholds, callbacks).
- * @returns A Hono sub-app with /bind, /sessions, /events, /trust-score routes.
- */
-export declare function createTokenForgeRoutes(options: TokenForgeServerOptions): Hono<{
-    Variables: Variables;
-}>;
-/** @deprecated Use createTokenForgeRoutes(options) instead */
-export declare const tokenForgeRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
-export {};
-//# sourceMappingURL=binding.d.ts.map

package/dist/server/binding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/server/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,uBAAuB,EAAiB,MAAM,oBAAoB,CAAC;AAEjF,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAsFvG;AAED,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,4EAAa,CAAC"}