@opensyber/tokenforge 0.1.2 → 1.0.0

package/dist/server/oidc-verify.d.ts

@@ -0,0 +1,56 @@
+/**
+ * OIDC ID-token verifier (Sprint 40 — workforce mode).
+ *
+ * Verifies an OIDC ID token against an IdP's JWKS by `kid`. Supports
+ * RS256 + ES256 — the algorithms that Okta, Entra, Google Workspace,
+ * and Auth0 ship by default. Stateless: the JWKS is passed in, so
+ * caching/HTTP lives one layer up (see jwks-cache.ts).
+ *
+ * Validates signature, `iss`, `aud`, `exp`, `nbf`, `iat`. Returns the
+ * verified claims so the caller can extract `sub` and link it to a
+ * subject row before issuing a DBSC challenge.
+ */
+export interface OidcClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nbf?: number;
+    email?: string;
+    name?: string;
+    groups?: string[];
+    [key: string]: unknown;
+}
+export interface JwksKey {
+    kid: string;
+    kty: 'RSA' | 'EC';
+    alg?: string;
+    use?: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+}
+export interface VerifyOidcOptions {
+    expectedIssuer: string;
+    expectedAudience: string;
+    jwks: {
+        keys: JwksKey[];
+    };
+    /** Override for tests. */
+    now?: Date;
+    /** Clock skew tolerance in seconds (default 60). */
+    clockSkewSeconds?: number;
+}
+export type VerifyOidcResult = {
+    ok: true;
+    claims: OidcClaims;
+    protectedHeader: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyOidcIdToken(jwt: string, opts: VerifyOidcOptions): Promise<VerifyOidcResult>;
+//# sourceMappingURL=oidc-verify.d.ts.map

package/dist/server/oidc-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verify.d.ts","sourceRoot":"","sources":["../../src/server/oidc-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC1B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC1E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlC,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAyD3B"}

package/dist/server/oidc-verify.js

@@ -0,0 +1,107 @@
+/**
+ * OIDC ID-token verifier (Sprint 40 — workforce mode).
+ *
+ * Verifies an OIDC ID token against an IdP's JWKS by `kid`. Supports
+ * RS256 + ES256 — the algorithms that Okta, Entra, Google Workspace,
+ * and Auth0 ship by default. Stateless: the JWKS is passed in, so
+ * caching/HTTP lives one layer up (see jwks-cache.ts).
+ *
+ * Validates signature, `iss`, `aud`, `exp`, `nbf`, `iat`. Returns the
+ * verified claims so the caller can extract `sub` and link it to a
+ * subject row before issuing a DBSC challenge.
+ */
+const SUPPORTED_ALGS = new Set(['RS256', 'ES256']);
+export async function verifyOidcIdToken(jwt, opts) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return { ok: false, reason: 'jwt_malformed' };
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(b64UrlDecodeString(headerB64));
+        claims = JSON.parse(b64UrlDecodeString(payloadB64));
+    }
+    catch {
+        return { ok: false, reason: 'jwt_malformed' };
+    }
+    const alg = header.alg;
+    const kid = header.kid;
+    if (typeof alg !== 'string' || !SUPPORTED_ALGS.has(alg)) {
+        return { ok: false, reason: 'jwt_unsupported_alg' };
+    }
+    if (typeof kid !== 'string')
+        return { ok: false, reason: 'jwt_missing_kid' };
+    const key = opts.jwks.keys.find((k) => k.kid === kid);
+    if (!key)
+        return { ok: false, reason: 'jwks_kid_not_found' };
+    if (claims.iss !== opts.expectedIssuer)
+        return { ok: false, reason: 'iss_mismatch' };
+    const audMatch = Array.isArray(claims.aud)
+        ? claims.aud.includes(opts.expectedAudience)
+        : claims.aud === opts.expectedAudience;
+    if (!audMatch)
+        return { ok: false, reason: 'aud_mismatch' };
+    const now = opts.now ?? new Date();
+    const nowSec = Math.floor(now.getTime() / 1000);
+    const skew = opts.clockSkewSeconds ?? 60;
+    if (typeof claims.exp !== 'number' || claims.exp + skew < nowSec) {
+        return { ok: false, reason: 'jwt_expired' };
+    }
+    if (typeof claims.nbf === 'number' && claims.nbf - skew > nowSec) {
+        return { ok: false, reason: 'jwt_not_yet_valid' };
+    }
+    if (typeof claims.iat !== 'number' || claims.iat - skew > nowSec) {
+        return { ok: false, reason: 'jwt_future_iat' };
+    }
+    const cryptoKey = await importJwk(key, alg);
+    if (!cryptoKey)
+        return { ok: false, reason: 'jwks_bad_key' };
+    const signingInput = toAb(new TextEncoder().encode(`${headerB64}.${payloadB64}`));
+    const signatureBytes = base64UrlToBytes(sigB64);
+    if (!signatureBytes)
+        return { ok: false, reason: 'jwt_bad_signature' };
+    const signature = toAb(signatureBytes);
+    const verified = alg === 'RS256'
+        ? await crypto.subtle.verify('RSASSA-PKCS1-v1_5', cryptoKey, signature, signingInput)
+        : await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, cryptoKey, signature, signingInput);
+    if (!verified)
+        return { ok: false, reason: 'jwt_bad_signature' };
+    return { ok: true, claims, protectedHeader: header };
+}
+async function importJwk(key, alg) {
+    try {
+        if (alg === 'RS256') {
+            return await crypto.subtle.importKey('jwk', { kty: key.kty, n: key.n, e: key.e, alg, ext: true }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+        }
+        return await crypto.subtle.importKey('jwk', { kty: key.kty, crv: key.crv, x: key.x, y: key.y, ext: true }, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    }
+    catch {
+        return null;
+    }
+}
+function b64UrlDecodeString(b64) {
+    const s = b64.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = s + '='.repeat((4 - (s.length % 4)) % 4);
+    return atob(padded);
+}
+function toAb(u8) {
+    const buf = new ArrayBuffer(u8.byteLength);
+    new Uint8Array(buf).set(u8);
+    return buf;
+}
+function base64UrlToBytes(b64) {
+    const s = b64.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = s + '='.repeat((4 - (s.length % 4)) % 4);
+    try {
+        const bin = atob(padded);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oidc-verify.js.map

package/dist/server/oidc-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verify.js","sourceRoot":"","sources":["../../src/server/oidc-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyCH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,IAAuB;IAEvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAA+B,CAAC;IACpC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAe,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE7E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE7D,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,GAAG,KAAK,OAAO;QAC9B,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC;QACrF,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACvG,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAgB,EAClE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAgB,EAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,IAAI,CAAC,EAAc;IAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/server/policy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Policy DSL evaluator (Sprint 38).
+ *
+ * Each policy is a JSON object: { if_any?: Rule[]; if_all?: Rule[]; then: Action }.
+ * Rules are predicate atoms over a flat `PolicyContext` describing the
+ * current refresh attempt. The evaluator is pure and synchronous — no
+ * IO, no time, no surprises — so it stays unit-testable and safe to
+ * call inside the request critical path.
+ *
+ * Action precedence: block > revoke_session > step_up > allow.
+ * Multiple policies for the same tenant are folded with `combineActions`
+ * so the most restrictive verdict wins.
+ */
+export type PolicyAction = 'allow' | 'step_up' | 'block' | 'revoke_session';
+export interface PolicyContext {
+    geoCountry: string | null;
+    asn: string | null;
+    bindingClass: 'native_dbsc' | 'webauthn' | 'webcrypto' | null;
+    signals: string[];
+    sensitivePath: boolean;
+    isoHour: number;
+}
+export type Rule = {
+    geo_country_in: string[];
+} | {
+    geo_country_not_in: string[];
+} | {
+    asn_in: string[];
+} | {
+    binding_class: PolicyContext['bindingClass'];
+} | {
+    has_signal: string;
+} | {
+    sensitive_path: boolean;
+} | {
+    hour_between: [number, number];
+};
+export interface Policy {
+    if_any?: Rule[];
+    if_all?: Rule[];
+    then: PolicyAction;
+}
+export declare function evaluatePolicy(policy: Policy, ctx: PolicyContext): PolicyAction;
+export declare function evaluatePolicies(policies: Policy[], ctx: PolicyContext): PolicyAction;
+export declare function combineActions(a: PolicyAction, b: PolicyAction): PolicyAction;
+export declare function parsePolicyRules(raw: string): Policy | null;
+//# sourceMappingURL=policy.d.ts.map

package/dist/server/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/server/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,YAAY,EAAE,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,IAAI,GACZ;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5B;IAAE,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GACpB;IAAE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CAAE,GAChD;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACtB;IAAE,cAAc,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,MAAM;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB;AASD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAU/E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAIrF;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CAE7E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D"}

package/dist/server/policy.js

@@ -0,0 +1,84 @@
+/**
+ * Policy DSL evaluator (Sprint 38).
+ *
+ * Each policy is a JSON object: { if_any?: Rule[]; if_all?: Rule[]; then: Action }.
+ * Rules are predicate atoms over a flat `PolicyContext` describing the
+ * current refresh attempt. The evaluator is pure and synchronous — no
+ * IO, no time, no surprises — so it stays unit-testable and safe to
+ * call inside the request critical path.
+ *
+ * Action precedence: block > revoke_session > step_up > allow.
+ * Multiple policies for the same tenant are folded with `combineActions`
+ * so the most restrictive verdict wins.
+ */
+const PRECEDENCE = {
+    allow: 0,
+    step_up: 1,
+    revoke_session: 2,
+    block: 3,
+};
+export function evaluatePolicy(policy, ctx) {
+    const anyRules = policy.if_any ?? [];
+    const allRules = policy.if_all ?? [];
+    const anyMatch = anyRules.length > 0 && anyRules.some((r) => evalRule(r, ctx));
+    const allMatch = allRules.length > 0 && allRules.every((r) => evalRule(r, ctx));
+    const conditionTriggered = (anyRules.length > 0 && anyMatch) ||
+        (allRules.length > 0 && allMatch) ||
+        (anyRules.length === 0 && allRules.length === 0);
+    return conditionTriggered ? policy.then : 'allow';
+}
+export function evaluatePolicies(policies, ctx) {
+    return policies
+        .map((p) => evaluatePolicy(p, ctx))
+        .reduce(combineActions, 'allow');
+}
+export function combineActions(a, b) {
+    return PRECEDENCE[a] >= PRECEDENCE[b] ? a : b;
+}
+export function parsePolicyRules(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const p = parsed;
+        if (p.then !== 'allow' && p.then !== 'step_up' && p.then !== 'block' && p.then !== 'revoke_session') {
+            return null;
+        }
+        if (p.if_any !== undefined && !Array.isArray(p.if_any))
+            return null;
+        if (p.if_all !== undefined && !Array.isArray(p.if_all))
+            return null;
+        return p;
+    }
+    catch {
+        return null;
+    }
+}
+function evalRule(rule, ctx) {
+    if ('geo_country_in' in rule) {
+        return ctx.geoCountry !== null && rule.geo_country_in.includes(ctx.geoCountry);
+    }
+    if ('geo_country_not_in' in rule) {
+        return ctx.geoCountry !== null && !rule.geo_country_not_in.includes(ctx.geoCountry);
+    }
+    if ('asn_in' in rule) {
+        return ctx.asn !== null && rule.asn_in.includes(ctx.asn);
+    }
+    if ('binding_class' in rule) {
+        return ctx.bindingClass === rule.binding_class;
+    }
+    if ('has_signal' in rule) {
+        return ctx.signals.includes(rule.has_signal);
+    }
+    if ('sensitive_path' in rule) {
+        return ctx.sensitivePath === rule.sensitive_path;
+    }
+    if ('hour_between' in rule) {
+        const [start, end] = rule.hour_between;
+        if (start <= end)
+            return ctx.isoHour >= start && ctx.isoHour < end;
+        return ctx.isoHour >= start || ctx.isoHour < end;
+    }
+    return false;
+}
+//# sourceMappingURL=policy.js.map

package/dist/server/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/server/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,MAAM,UAAU,GAAiC;IAC/C,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,CAAC;IACjB,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAkB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC;QACjC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC;QACjC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,GAAkB;IACrE,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAClC,MAAM,CAAe,cAAc,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe,EAAE,CAAe;IAC7D,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,CAAC,GAAG,MAAyB,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,CAAW,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,GAAkB;IAC9C,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QACnE,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/step-up-policy.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-action step-up policy (Sprint 39).
+ *
+ * Tenant-scoped JSON config describing which routes require fresh PoP
+ * (a recent action-signing JWS) vs WebAuthn re-prompt vs nothing
+ * special. Will eventually live on `tf_tenants.stepUpActions` (per
+ * CISCO-dua spec) — schema migration pending. The pure logic here
+ * is independent of where the actions blob is stored.
+ *
+ * Shape (validated by `parseStepUpActions`):
+ *   [
+ *     { path: '/checkout',  requireFreshSig: true,  freshSigMaxAgeSec: 60 },
+ *     { path: '/admin/*',   requireFreshSig: true,  freshSigMaxAgeSec: 30, requireWebAuthn: true },
+ *     { path: '/health',    requireFreshSig: false, requireWebAuthn: false }
+ *   ]
+ *
+ * Matching rules:
+ *   - exact path match wins over glob-prefix
+ *   - longest glob-prefix wins among prefix-matches
+ *   - no match → default verdict (no step-up, no WebAuthn, default 60s)
+ */
+export interface StepUpAction {
+    path: string;
+    requireFreshSig?: boolean;
+    freshSigMaxAgeSec?: number;
+    requireWebAuthn?: boolean;
+}
+export interface StepUpVerdict {
+    matched: boolean;
+    requireFreshSig: boolean;
+    freshSigMaxAgeSec: number;
+    requireWebAuthn: boolean;
+}
+export declare function parseStepUpActions(raw: string): StepUpAction[] | null;
+export declare function evaluateStepUpPolicy(actions: readonly StepUpAction[], requestPath: string): StepUpVerdict;
+//# sourceMappingURL=step-up-policy.d.ts.map

package/dist/server/step-up-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-policy.d.ts","sourceRoot":"","sources":["../../src/server/step-up-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,GAAG,IAAI,CA4BrE;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,WAAW,EAAE,MAAM,GAClB,aAAa,CAiBf"}

package/dist/server/step-up-policy.js

@@ -0,0 +1,101 @@
+/**
+ * Per-action step-up policy (Sprint 39).
+ *
+ * Tenant-scoped JSON config describing which routes require fresh PoP
+ * (a recent action-signing JWS) vs WebAuthn re-prompt vs nothing
+ * special. Will eventually live on `tf_tenants.stepUpActions` (per
+ * CISCO-dua spec) — schema migration pending. The pure logic here
+ * is independent of where the actions blob is stored.
+ *
+ * Shape (validated by `parseStepUpActions`):
+ *   [
+ *     { path: '/checkout',  requireFreshSig: true,  freshSigMaxAgeSec: 60 },
+ *     { path: '/admin/*',   requireFreshSig: true,  freshSigMaxAgeSec: 30, requireWebAuthn: true },
+ *     { path: '/health',    requireFreshSig: false, requireWebAuthn: false }
+ *   ]
+ *
+ * Matching rules:
+ *   - exact path match wins over glob-prefix
+ *   - longest glob-prefix wins among prefix-matches
+ *   - no match → default verdict (no step-up, no WebAuthn, default 60s)
+ */
+const DEFAULT_FRESH_SIG_MAX_AGE_SEC = 60;
+const MAX_ACTIONS = 50;
+const MIN_FRESH_SIG_SEC = 5;
+const MAX_FRESH_SIG_SEC = 600;
+const DEFAULT_VERDICT = {
+    matched: false,
+    requireFreshSig: false,
+    freshSigMaxAgeSec: DEFAULT_FRESH_SIG_MAX_AGE_SEC,
+    requireWebAuthn: false,
+};
+export function parseStepUpActions(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(parsed))
+        return null;
+    if (parsed.length > MAX_ACTIONS)
+        return null;
+    const actions = [];
+    for (const candidate of parsed) {
+        if (!candidate || typeof candidate !== 'object')
+            return null;
+        const c = candidate;
+        if (typeof c.path !== 'string' || c.path.length === 0 || c.path.length > 256)
+            return null;
+        const action = { path: c.path };
+        if (c.requireFreshSig !== undefined) {
+            if (typeof c.requireFreshSig !== 'boolean')
+                return null;
+            action.requireFreshSig = c.requireFreshSig;
+        }
+        if (c.freshSigMaxAgeSec !== undefined) {
+            if (typeof c.freshSigMaxAgeSec !== 'number' || !Number.isInteger(c.freshSigMaxAgeSec))
+                return null;
+            if (c.freshSigMaxAgeSec < MIN_FRESH_SIG_SEC || c.freshSigMaxAgeSec > MAX_FRESH_SIG_SEC)
+                return null;
+            action.freshSigMaxAgeSec = c.freshSigMaxAgeSec;
+        }
+        if (c.requireWebAuthn !== undefined) {
+            if (typeof c.requireWebAuthn !== 'boolean')
+                return null;
+            action.requireWebAuthn = c.requireWebAuthn;
+        }
+        actions.push(action);
+    }
+    return actions;
+}
+export function evaluateStepUpPolicy(actions, requestPath) {
+    // Exact match wins outright.
+    for (const a of actions) {
+        if (!a.path.endsWith('*') && a.path === requestPath)
+            return verdictFrom(a, true);
+    }
+    // Otherwise, longest matching glob-prefix wins.
+    let best = null;
+    let bestLen = -1;
+    for (const a of actions) {
+        if (!a.path.endsWith('*'))
+            continue;
+        const prefix = a.path.slice(0, -1);
+        if (requestPath.startsWith(prefix) && prefix.length > bestLen) {
+            best = a;
+            bestLen = prefix.length;
+        }
+    }
+    return best ? verdictFrom(best, true) : DEFAULT_VERDICT;
+}
+function verdictFrom(a, matched) {
+    return {
+        matched,
+        requireFreshSig: a.requireFreshSig ?? false,
+        freshSigMaxAgeSec: a.freshSigMaxAgeSec ?? DEFAULT_FRESH_SIG_MAX_AGE_SEC,
+        requireWebAuthn: a.requireWebAuthn ?? false,
+    };
+}
+//# sourceMappingURL=step-up-policy.js.map

package/dist/server/step-up-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-policy.js","sourceRoot":"","sources":["../../src/server/step-up-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,eAAe,GAAkB;IACrC,OAAO,EAAE,KAAK;IACd,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,6BAA6B;IAChD,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,CAAC,GAAG,SAAoC,CAAC;QAC/C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,CAAC,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,GAAG,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACpG,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAChC,WAAmB;IAEnB,6BAA6B;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,gDAAgD;IAChD,IAAI,IAAI,GAAwB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,CAAC;YACT,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,CAAe,EAAE,OAAgB;IACpD,OAAO;QACL,OAAO;QACP,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,KAAK;QAC3C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,6BAA6B;QACvE,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,KAAK;KAC5C,CAAC;AACJ,CAAC"}

package/dist/server/trust-score-fixtures.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Shared test signals for `trust-score.test.ts`.
+ *
+ * Pulled out so the test file fits the 200L cap. Pure factory — no
+ * side effects, returns a TrustSignals shape with sensible defaults.
+ */
+import type { TrustSignals } from '../shared/types.js';
+export declare function makeSignals(overrides?: Partial<TrustSignals>): TrustSignals;
+//# sourceMappingURL=trust-score-fixtures.d.ts.map

package/dist/server/trust-score-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-score-fixtures.d.ts","sourceRoot":"","sources":["../../src/server/trust-score-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,WAAW,CAAC,SAAS,GAAE,OAAO,CAAC,YAAY,CAAM,GAAG,YAAY,CAc/E"}

package/dist/server/trust-score-fixtures.js

@@ -0,0 +1,23 @@
+/**
+ * Shared test signals for `trust-score.test.ts`.
+ *
+ * Pulled out so the test file fits the 200L cap. Pure factory — no
+ * side effects, returns a TrustSignals shape with sensible defaults.
+ */
+import { hashFingerprint } from './trust-score.js';
+export function makeSignals(overrides = {}) {
+    const ua = 'Mozilla/5.0 TestAgent';
+    return {
+        signatureValid: true,
+        ipAddress: '192.168.1.10',
+        originalIp: '192.168.1.10',
+        countryCode: 'US',
+        originalCountry: 'US',
+        userAgent: ua,
+        originalFingerprint: hashFingerprint(ua),
+        requestTimestamp: 1000,
+        sessionCreatedAt: 900,
+        ...overrides,
+    };
+}
+//# sourceMappingURL=trust-score-fixtures.js.map

package/dist/server/trust-score-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-score-fixtures.js","sourceRoot":"","sources":["../../src/server/trust-score-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,UAAU,WAAW,CAAC,YAAmC,EAAE;IAC/D,MAAM,EAAE,GAAG,uBAAuB,CAAC;IACnC,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,cAAc;QACzB,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,EAAE;QACb,mBAAmB,EAAE,eAAe,CAAC,EAAE,CAAC;QACxC,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,GAAG;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/server/webauthn-verify.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Server-side WebAuthn verifier — runs in Cloudflare Workers (Web Crypto only).
+ *
+ * Limitations (intentional, documented):
+ *  - We use attestation: 'none' on the client, so attestation statement
+ *    verification is skipped (only the authData → COSE_Key extraction matters).
+ *  - Only ES256 (alg -7, ECDSA P-256) keys are accepted on the server. EdDSA
+ *    is offered to the client for forward-compat but Web Crypto support is
+ *    spotty in Workers; reject EdDSA at verify time with a clear error.
+ *  - Counter check is not enforced here. Callers can read the 4-byte counter
+ *    out of authenticatorData[33..37] if they want to persist + compare.
+ */
+export interface AttestationVerifyResult {
+    publicKeyJwk: JsonWebKey;
+    credentialId: Uint8Array;
+    rpIdHash: Uint8Array;
+}
+/** base64url → ArrayBuffer */
+export declare function b64uToBuf(b64url: string): ArrayBuffer;
+/** Uint8Array → base64url (no padding). */
+export declare function bufToB64u(buf: ArrayBuffer | Uint8Array): string;
+/** Parse clientDataJSON and verify challenge + origin. */
+export declare function verifyClientDataJSON(clientDataJSON: string, expectedChallenge: string, expectedOrigin: string, expectedType: 'webauthn.create' | 'webauthn.get'): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify a WebAuthn attestation (registration). Returns the extracted
+ * public key as JWK plus the credentialId for persistence.
+ */
+export declare function verifyWebAuthnAttestation(attestationObjectB64u: string, clientDataJSONB64u: string, expectedChallenge: string, expectedOrigin: string): Promise<AttestationVerifyResult>;
+/**
+ * Verify a WebAuthn assertion. The signature is over
+ * (authenticatorData || sha256(clientDataJSON)).
+ */
+export declare function verifyWebAuthnAssertion(signatureB64u: string, authenticatorDataB64u: string, clientDataJSONB64u: string, publicKeyJwk: JsonWebKey, expectedChallenge: string, expectedOrigin: string): Promise<boolean>;
+/** WebAuthn ECDSA sigs are DER-encoded; Web Crypto wants raw r||s. */
+export declare function derToRawEcdsa(der: Uint8Array): Uint8Array;
+//# sourceMappingURL=webauthn-verify.d.ts.map

package/dist/server/webauthn-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.d.ts","sourceRoot":"","sources":["../../src/server/webauthn-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,8BAA8B;AAC9B,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAOrD;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK/D;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,iBAAiB,GAAG,cAAc,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAWlC;AAiCD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,UAAU,EACxB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CA4BlB;AASD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAuBzD"}