@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/server/webhooks.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Webhook receiver helpers for TokenForge cloud deliveries.
+ *
+ * Every delivery carries three relevant headers:
+ *   X-TF-Signature: "v1,<hex>" (one or more, space-separated during rotation)
+ *   X-TF-Timestamp: ISO-8601 string — the moment dispatcher built the payload
+ *   X-TF-Delivery-Id: UUID — per-attempt id, use for idempotency
+ *
+ * The signed string is `${timestamp}.${rawBody}` (no whitespace). During
+ * rotation, the dispatcher may send two `v1,<hex>` signatures — accept if
+ * either matches.
+ *
+ * Example (Node.js, Hono):
+ *
+ *   import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+ *
+ *   app.post('/webhooks/tokenforge', async (c) => {
+ *     const rawBody = await c.req.text();
+ *     const ok = await verifyWebhookSignature({
+ *       body: rawBody,
+ *       signatureHeader: c.req.header('X-TF-Signature') ?? '',
+ *       timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+ *       secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+ *     });
+ *     if (!ok) return c.json({ error: 'bad_signature' }, 401);
+ *     const event = JSON.parse(rawBody);
+ *     // handle event.event, event.data ...
+ *     return c.json({ received: true });
+ *   });
+ */
+export interface VerifyOptions {
+    body: string;
+    signatureHeader: string;
+    timestampHeader: string;
+    secret: string;
+    /** Max allowed clock skew in ms. Default 300000 (5 min). */
+    toleranceMs?: number;
+    /** Accept requests with missing timestamp (legacy). Default false. */
+    allowMissingTimestamp?: boolean;
+}
+export declare function verifyWebhookSignature(opts: VerifyOptions): Promise<boolean>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/server/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"../src/","sources":["server/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBlF"}

package/dist/server/webhooks.js

@@ -0,0 +1,77 @@
+/**
+ * Webhook receiver helpers for TokenForge cloud deliveries.
+ *
+ * Every delivery carries three relevant headers:
+ *   X-TF-Signature: "v1,<hex>" (one or more, space-separated during rotation)
+ *   X-TF-Timestamp: ISO-8601 string — the moment dispatcher built the payload
+ *   X-TF-Delivery-Id: UUID — per-attempt id, use for idempotency
+ *
+ * The signed string is `${timestamp}.${rawBody}` (no whitespace). During
+ * rotation, the dispatcher may send two `v1,<hex>` signatures — accept if
+ * either matches.
+ *
+ * Example (Node.js, Hono):
+ *
+ *   import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+ *
+ *   app.post('/webhooks/tokenforge', async (c) => {
+ *     const rawBody = await c.req.text();
+ *     const ok = await verifyWebhookSignature({
+ *       body: rawBody,
+ *       signatureHeader: c.req.header('X-TF-Signature') ?? '',
+ *       timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+ *       secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+ *     });
+ *     if (!ok) return c.json({ error: 'bad_signature' }, 401);
+ *     const event = JSON.parse(rawBody);
+ *     // handle event.event, event.data ...
+ *     return c.json({ received: true });
+ *   });
+ */
+export async function verifyWebhookSignature(opts) {
+    const { body, signatureHeader, timestampHeader, secret } = opts;
+    const tolerance = opts.toleranceMs ?? 5 * 60_000;
+    if (!signatureHeader || !secret)
+        return false;
+    if (!timestampHeader) {
+        if (!opts.allowMissingTimestamp)
+            return false;
+    }
+    else {
+        const ts = Date.parse(timestampHeader);
+        if (Number.isNaN(ts))
+            return false;
+        if (Math.abs(Date.now() - ts) > tolerance)
+            return false;
+    }
+    const signedString = timestampHeader ? `${timestampHeader}.${body}` : body;
+    const expected = await hmacSha256Hex(secret, signedString);
+    // Signature header is space-separated list of "v1,<hex>" entries.
+    const entries = signatureHeader.split(/\s+/).filter(Boolean);
+    for (const entry of entries) {
+        const [version, hex] = entry.split(',');
+        if (version !== 'v1' || !hex)
+            continue;
+        if (timingSafeEqual(hex.toLowerCase(), expected))
+            return true;
+    }
+    return false;
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+async function hmacSha256Hex(secret, data) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(data));
+    const bytes = new Uint8Array(sig);
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++)
+        hex += bytes[i].toString(16).padStart(2, '0');
+    return hex;
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/server/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"../src/","sources":["server/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAaH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAmB;IAC9D,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC;IAEjD,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,qBAAqB;YAAE,OAAO,KAAK,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE3D,kEAAkE;IAClE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG;YAAE,SAAS;QACvC,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/shared/action-hash.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared canonicalization + hash helper for action signing.
+ *
+ * Client (`client/action-signer.ts`) and server
+ * (`server/action-verify.ts`) MUST agree on these byte-for-byte;
+ * sharing this file is the simplest enforcement.
+ */
+export interface ActionLikePayload {
+    action: string;
+    [key: string]: unknown;
+}
+/**
+ * Stable JSON serialization — sorts top-level keys so `{a:1,b:2}` and
+ * `{b:2,a:1}` produce the same string. JS object literals preserve
+ * insertion order, so without this two semantically-identical
+ * payloads from different code paths would hash differently and the
+ * server would reject one of them as a tamper.
+ */
+export declare function canonicalizeAction(payload: Record<string, unknown>): string;
+export declare function sha256B64Url(input: string): Promise<string>;
+export declare function hashActionPayload(payload: Record<string, unknown>): Promise<string>;
+export declare function b64UrlEncodeBytes(bytes: Uint8Array): string;
+//# sourceMappingURL=action-hash.d.ts.map

package/dist/shared/action-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-hash.d.ts","sourceRoot":"../src/","sources":["shared/action-hash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3E;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI3D"}

package/dist/shared/action-hash.js

@@ -0,0 +1,35 @@
+/**
+ * Shared canonicalization + hash helper for action signing.
+ *
+ * Client (`client/action-signer.ts`) and server
+ * (`server/action-verify.ts`) MUST agree on these byte-for-byte;
+ * sharing this file is the simplest enforcement.
+ */
+/**
+ * Stable JSON serialization — sorts top-level keys so `{a:1,b:2}` and
+ * `{b:2,a:1}` produce the same string. JS object literals preserve
+ * insertion order, so without this two semantically-identical
+ * payloads from different code paths would hash differently and the
+ * server would reject one of them as a tamper.
+ */
+export function canonicalizeAction(payload) {
+    const keys = Object.keys(payload).sort();
+    const ordered = {};
+    for (const k of keys)
+        ordered[k] = payload[k];
+    return JSON.stringify(ordered);
+}
+export async function sha256B64Url(input) {
+    const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+    return b64UrlEncodeBytes(new Uint8Array(buf));
+}
+export async function hashActionPayload(payload) {
+    return sha256B64Url(canonicalizeAction(payload));
+}
+export function b64UrlEncodeBytes(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=action-hash.js.map

package/dist/shared/action-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-hash.js","sourceRoot":"../src/","sources":["shared/action-hash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,OAAO,iBAAiB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgC;IACtE,OAAO,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAiB;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/shared/identity.d.ts

@@ -0,0 +1,45 @@
+/** Version marker for the canonical Cloud v2 bind identity envelope. */
+export declare const TOKENFORGE_IDENTITY_PROTOCOL: "tf-identity-v1";
+/** Assurance is assigned by TokenForge after evaluating trusted evidence. */
+export type TokenForgeIdentityAssurance = 'verified' | 'attested' | 'declared' | 'derived';
+/** Optional display metadata supplied by an authenticated consumer backend. */
+export interface TokenForgeIdentityProfile {
+    displayName?: string;
+    email?: string;
+}
+export type TokenForgeIdentityProfileField = 'displayName' | 'email';
+/**
+ * Identity evidence attached to a Cloud v2 bind by trusted server code.
+ * The envelope intentionally has no caller-controlled assurance field.
+ */
+export interface TokenForgeIdentity {
+    protocol: typeof TOKENFORGE_IDENTITY_PROTOCOL;
+    externalUserRef: string;
+    externalUserRefVersion?: string;
+    profile?: TokenForgeIdentityProfile;
+    /** Explicitly delete stored display metadata; omission preserves prior values. */
+    clearProfile?: TokenForgeIdentityProfileField[];
+    idToken?: string;
+    workforceAppId?: string;
+    userIdSource?: string;
+}
+export interface DeriveExternalUserRefInput {
+    /** Dedicated project correlation secret. Must contain at least 32 bytes. */
+    correlationSecret: Uint8Array;
+    projectId: string;
+    canonicalUserId: string;
+    /** Stable identifier for the active correlation key. Defaults to `v1`. */
+    version?: string;
+}
+export interface DerivedExternalUserRef {
+    externalUserRef: string;
+    externalUserRefVersion: string;
+}
+/**
+ * Derive a non-reversible, project-scoped user reference with HMAC-SHA-256.
+ * The dedicated secret must remain server-side and distinct from API keys.
+ */
+export declare function deriveTokenForgeExternalUserRef(input: DeriveExternalUserRefInput): Promise<DerivedExternalUserRef>;
+/** Parse and validate an untrusted Cloud v2 identity envelope. */
+export declare function validateTokenForgeIdentity(input: unknown): TokenForgeIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/shared/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"../src/","sources":["shared/identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,4BAA4B,EAAG,gBAAyB,CAAC;AAqBtE,6EAA6E;AAC7E,MAAM,MAAM,2BAA2B,GACnC,UAAU,GACV,UAAU,GACV,UAAU,GACV,SAAS,CAAC;AAEd,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,8BAA8B,GAAG,aAAa,GAAG,OAAO,CAAC;AAErE;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,4BAA4B,CAAC;IAC9C,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,kFAAkF;IAClF,YAAY,CAAC,EAAE,8BAA8B,EAAE,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,iBAAiB,EAAE,UAAU,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAwCjC;AAED,kEAAkE;AAClE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAsD7E"}

package/dist/shared/identity.js

@@ -0,0 +1,176 @@
+/** Version marker for the canonical Cloud v2 bind identity envelope. */
+export const TOKENFORGE_IDENTITY_PROTOCOL = 'tf-identity-v1';
+const EXTERNAL_USER_REF_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const EXTERNAL_USER_REF_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,32}$/;
+const PROJECT_ID_PATTERN = /^[A-Za-z0-9_-]{8,256}$/;
+const SOURCE_PATTERN = /^[A-Za-z0-9._:-]{1,64}$/;
+const WORKFORCE_APP_ID_PATTERN = /^[A-Za-z0-9._:/-]{1,256}$/;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+const IDENTITY_KEYS = new Set([
+    'protocol',
+    'externalUserRef',
+    'externalUserRefVersion',
+    'profile',
+    'clearProfile',
+    'idToken',
+    'workforceAppId',
+    'userIdSource',
+]);
+const PROFILE_KEYS = new Set(['displayName', 'email']);
+const PROFILE_FIELD_KEYS = new Set(['displayName', 'email']);
+/**
+ * Derive a non-reversible, project-scoped user reference with HMAC-SHA-256.
+ * The dedicated secret must remain server-side and distinct from API keys.
+ */
+export async function deriveTokenForgeExternalUserRef(input) {
+    const version = input.version ?? 'v1';
+    if (!(input.correlationSecret instanceof Uint8Array) || input.correlationSecret.byteLength < 32) {
+        throw new Error('TokenForge correlation secret must contain at least 32 bytes');
+    }
+    if (!PROJECT_ID_PATTERN.test(input.projectId)) {
+        throw new Error('TokenForge project ID is invalid');
+    }
+    if (typeof input.canonicalUserId !== 'string' ||
+        input.canonicalUserId.length < 1 ||
+        input.canonicalUserId.length > 1024 ||
+        input.canonicalUserId !== input.canonicalUserId.trim() ||
+        containsControlCharacter(input.canonicalUserId)) {
+        throw new Error('TokenForge canonical user ID is invalid');
+    }
+    if (!EXTERNAL_USER_REF_VERSION_PATTERN.test(version)) {
+        throw new Error('TokenForge external user reference version is invalid');
+    }
+    if (!globalThis.crypto?.subtle) {
+        throw new Error('TokenForge correlation requires Web Crypto');
+    }
+    const key = await globalThis.crypto.subtle.importKey('raw', new Uint8Array(input.correlationSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const message = new TextEncoder().encode(`tokenforge:user:v1\0${input.projectId}\0${input.canonicalUserId}`);
+    const digest = await globalThis.crypto.subtle.sign('HMAC', key, message);
+    return {
+        externalUserRef: base64Url(new Uint8Array(digest)),
+        externalUserRefVersion: version,
+    };
+}
+/** Parse and validate an untrusted Cloud v2 identity envelope. */
+export function validateTokenForgeIdentity(input) {
+    const identity = requireRecord(input, 'TokenForge identity');
+    rejectUnknownKeys(identity, IDENTITY_KEYS, 'TokenForge identity');
+    if (identity.protocol !== TOKENFORGE_IDENTITY_PROTOCOL) {
+        throw new Error('Unsupported TokenForge identity protocol');
+    }
+    if (typeof identity.externalUserRef !== 'string' || !EXTERNAL_USER_REF_PATTERN.test(identity.externalUserRef)) {
+        throw new Error('TokenForge external user reference is invalid');
+    }
+    const output = {
+        protocol: TOKENFORGE_IDENTITY_PROTOCOL,
+        externalUserRef: identity.externalUserRef,
+    };
+    if (identity.externalUserRefVersion !== undefined) {
+        if (typeof identity.externalUserRefVersion !== 'string' ||
+            !EXTERNAL_USER_REF_VERSION_PATTERN.test(identity.externalUserRefVersion)) {
+            throw new Error('TokenForge external user reference version is invalid');
+        }
+        output.externalUserRefVersion = identity.externalUserRefVersion;
+    }
+    if (identity.profile !== undefined) {
+        output.profile = validateProfile(identity.profile);
+    }
+    if (identity.clearProfile !== undefined) {
+        output.clearProfile = validateClearProfile(identity.clearProfile);
+        for (const field of output.clearProfile) {
+            if (output.profile?.[field] !== undefined) {
+                throw new Error(`TokenForge identity cannot set and clear ${field}`);
+            }
+        }
+    }
+    if (identity.idToken !== undefined) {
+        output.idToken = requireBoundedString(identity.idToken, 'TokenForge ID token', 16_384);
+    }
+    if (identity.workforceAppId !== undefined) {
+        if (typeof identity.workforceAppId !== 'string' || !WORKFORCE_APP_ID_PATTERN.test(identity.workforceAppId)) {
+            throw new Error('TokenForge workforce application ID is invalid');
+        }
+        output.workforceAppId = identity.workforceAppId;
+    }
+    if (identity.userIdSource !== undefined) {
+        if (typeof identity.userIdSource !== 'string' || !SOURCE_PATTERN.test(identity.userIdSource)) {
+            throw new Error('TokenForge user ID source is invalid');
+        }
+        output.userIdSource = identity.userIdSource;
+    }
+    return output;
+}
+function validateClearProfile(input) {
+    if (!Array.isArray(input) || input.length < 1 || input.length > PROFILE_FIELD_KEYS.size) {
+        throw new Error('TokenForge clearProfile is invalid');
+    }
+    const fields = input.map((field) => {
+        if (typeof field !== 'string' || !PROFILE_FIELD_KEYS.has(field)) {
+            throw new Error('TokenForge clearProfile is invalid');
+        }
+        return field;
+    });
+    if (new Set(fields).size !== fields.length) {
+        throw new Error('TokenForge clearProfile contains duplicate fields');
+    }
+    return fields;
+}
+function validateProfile(input) {
+    const profile = requireRecord(input, 'TokenForge identity profile');
+    rejectUnknownKeys(profile, PROFILE_KEYS, 'TokenForge identity profile');
+    const output = {};
+    if (profile.displayName !== undefined) {
+        const displayName = requireBoundedString(profile.displayName, 'TokenForge display name', 200);
+        if (containsControlCharacter(displayName)) {
+            throw new Error('TokenForge display name contains control characters');
+        }
+        output.displayName = displayName;
+    }
+    if (profile.email !== undefined) {
+        const email = requireBoundedString(profile.email, 'TokenForge email', 254);
+        if (containsControlCharacter(email) || !EMAIL_PATTERN.test(email)) {
+            throw new Error('TokenForge email is invalid');
+        }
+        output.email = email;
+    }
+    if (output.displayName === undefined && output.email === undefined) {
+        throw new Error('TokenForge identity profile must contain displayName or email');
+    }
+    return output;
+}
+function containsControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function requireRecord(input, label) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error(`${label} must be an object`);
+    }
+    return input;
+}
+function rejectUnknownKeys(input, allowed, label) {
+    for (const key of Object.keys(input)) {
+        if (!allowed.has(key))
+            throw new Error(`${label} contains unsupported field: ${key}`);
+    }
+}
+function requireBoundedString(input, label, maxLength) {
+    if (typeof input !== 'string' ||
+        input.length < 1 ||
+        input.length > maxLength ||
+        input !== input.trim()) {
+        throw new Error(`${label} is invalid`);
+    }
+    return input;
+}
+function base64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+//# sourceMappingURL=identity.js.map

package/dist/shared/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"../src/","sources":["shared/identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAyB,CAAC;AAEtE,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AACnE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,iBAAiB;IACjB,wBAAwB;IACxB,SAAS;IACT,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AA+C7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiC;IAEjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IACE,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACzC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAChC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI;QACnC,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE;QACtD,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,IAAI,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACtC,uBAAuB,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,eAAe,EAAE,CACnE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO;QACL,eAAe,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAClD,sBAAsB,EAAE,OAAO;KAChC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC7D,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAElE,IAAI,QAAQ,CAAC,QAAQ,KAAK,4BAA4B,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAuB;QACjC,QAAQ,EAAE,4BAA4B;QACtC,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAC;IAEF,IAAI,QAAQ,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAClD,IACE,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;YACnD,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;IAClD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAuC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACpE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAE7C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC9F,IAAI,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,OAA4B,EAC5B,KAAa;IAEb,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IAC5E,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,GAAG,SAAS;QACxB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/shared/types-internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types-internal.d.ts","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAGA,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types-internal.d.ts","sourceRoot":"../src/","sources":["shared/types-internal.ts"],"names":[],"mappings":"AAGA,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/shared/types-internal.js.map

@@ -1 +1 @@
-{"version":3,"file":"types-internal.js","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sEAAsE"}
+{"version":3,"file":"types-internal.js","sourceRoot":"../src/","sources":["shared/types-internal.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sEAAsE"}

package/dist/shared/types.d.ts

@@ -16,12 +16,26 @@ export interface TokenForgeConfig {
         nonce?: string;
         timestamp?: string;
         deviceId?: string;
+        sessionId?: string;
+        version?: string;
+        bodyHash?: string;
     };
     /** Enable automatic fetch interception (default: true) */
     autoIntercept?: boolean;
     /** Paths to skip (no signing needed) */
     skipPaths?: string[];
 }
+export { TOKENFORGE_IDENTITY_PROTOCOL, deriveTokenForgeExternalUserRef, validateTokenForgeIdentity, } from './identity.js';
+export type { DerivedExternalUserRef, DeriveExternalUserRefInput, TokenForgeIdentity, TokenForgeIdentityAssurance, TokenForgeIdentityProfile, } from './identity.js';
+/** DBSC (Device Bound Session Credentials) configuration. */
+export interface DbscConfig {
+    /** Enable DBSC bound-cookie verification in the pipeline. */
+    enabled: boolean;
+    /** Cookie name (default: '__Secure-tf-bound'). */
+    cookieName?: string;
+    /** Cookie rotation interval in seconds (default: 300). */
+    rotationInterval?: number;
+}
 /** Configuration for the TokenForge server middleware */
 export interface TokenForgeServerOptions {
     storage: TokenForgeStorageRef;
@@ -35,10 +49,23 @@ export interface TokenForgeServerOptions {
     sessionMaxAge: number;
     /** Nonce expiry in seconds (default: 60) */
     nonceExpiry: number;
-    /** Paths that skip TokenForge verification */
+    /** Paths that skip TokenForge verification (public allowlist) */
     skipPaths?: string[];
     /** Paths requiring elevated trust (>90) */
     sensitiveOps?: string[];
+    /**
+     * Behavior when a request cannot be positively verified — missing
+     * signature on a protected (non-skip) path, or an unreachable/erroring
+     * verification backend.
+     *
+     * - `'closed'` (default): default-deny. Unsigned protected requests and
+     *   backend failures are REJECTED. This is the bulletproof posture.
+     * - `'open'`: legacy fail-open. Unsigned requests degrade through and
+     *   backend failures pass. Use only for staged rollout behind an alarm.
+     */
+    failMode?: 'closed' | 'open';
+    /** DBSC bound-cookie settings (disabled by default). */
+    dbsc?: DbscConfig;
     /** Called on security events */
     onSecurityEvent?: (event: SecurityEvent) => Promise<void>;
     /** Email delivery callback for OTP step-up */
@@ -62,6 +89,7 @@ export interface TokenForgeStorageRef {
     getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
     createSession(session: DeviceSession): Promise<void>;
     updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    updateBoundCookieHash(deviceId: string, hash: string, expiresAt: string): Promise<void>;
     revokeSession(deviceId: string, reason: string): Promise<void>;
     revokeUserSessions(userId: string): Promise<void>;
     listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
@@ -79,6 +107,14 @@ export interface TokenForgeStorageRef {
     getChallenge(challengeId: string, userId: string): Promise<unknown>;
     updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
     countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    getActivityHistogram(userId: string): Promise<{
+        buckets: number[];
+        totalRequests: number;
+    } | null>;
+    setActivityHistogram(userId: string, histogram: {
+        buckets: number[];
+        totalRequests: number;
+    }): Promise<void>;
     storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
     getOtp(challengeId: string): Promise<string | null>;
     deleteOtp(challengeId: string): Promise<void>;
@@ -96,7 +132,7 @@ export interface SecurityEvent {
     metadata: Record<string, unknown>;
 }
 /** All possible security event types */
-export type SecurityEventType = 'DEVICE_BOUND' | 'SIGNATURE_INVALID' | 'IP_CHANGE' | 'GEO_ANOMALY' | 'TRUST_DROP' | 'TRUST_SCORE_CHANGE' | 'SESSION_REVOKED' | 'SESSION_EXPIRED' | 'STEP_UP_TRIGGERED' | 'STEP_UP_COMPLETED' | 'STEP_UP_FAILED' | 'NONCE_REPLAY' | 'DEVICE_MISMATCH' | 'DEVICE_NOT_FOUND' | 'TIMESTAMP_SKEW';
+export type SecurityEventType = 'DEVICE_BOUND' | 'SIGNATURE_INVALID' | 'IP_CHANGE' | 'GEO_ANOMALY' | 'TRUST_DROP' | 'TRUST_SCORE_CHANGE' | 'SESSION_REVOKED' | 'SESSION_EXPIRED' | 'STEP_UP_TRIGGERED' | 'STEP_UP_COMPLETED' | 'STEP_UP_FAILED' | 'NONCE_REPLAY' | 'DEVICE_MISMATCH' | 'DEVICE_NOT_FOUND' | 'TIMESTAMP_SKEW' | 'DBSC_COOKIE_MISSING' | 'DBSC_COOKIE_INVALID';
 /** Signals used by the trust score engine */
 export interface TrustSignals {
     signatureValid: boolean;
@@ -108,6 +144,11 @@ export interface TrustSignals {
     originalFingerprint: string;
     requestTimestamp: number;
     sessionCreatedAt: number;
+    /** Activity histogram for time-of-day anomaly detection (optional). */
+    activityHistogram?: {
+        buckets: number[];
+        totalRequests: number;
+    };
 }
 /** Breakdown of trust score components */
 export interface ScoreBreakdown {
@@ -118,6 +159,8 @@ export interface ScoreBreakdown {
     velocityScore: number;
     timeScore: number;
     nonceScore: number;
+    /** Negative number — subtracted from total when AitM anomalies present. */
+    aitmDelta?: number;
     total: number;
     reasons: string[];
 }
@@ -137,6 +180,10 @@ export interface DeviceSession {
     revoked: number;
     revoked_reason: string | null;
     created_at: string;
+    /** SHA-256 hash of the DBSC bound cookie (if DBSC enabled). */
+    bound_cookie_hash?: string | null;
+    /** ISO timestamp when the bound cookie expires. */
+    bound_cookie_expires_at?: string | null;
 }
 /** Default header names */
 export declare const TF_HEADERS: {

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"../src/","sources":["shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,wDAAwD;IACxD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7G,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}

package/dist/shared/types.js

@@ -1,4 +1,5 @@
 // ─── TokenForge Shared Types ───
+export { TOKENFORGE_IDENTITY_PROTOCOL, deriveTokenForgeExternalUserRef, validateTokenForgeIdentity, } from './identity.js';
 /** Default header names */
 export const TF_HEADERS = {
     SIGNATURE: 'X-TF-Signature',

package/dist/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAgKlC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"../src/","sources":["shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AA8BlC,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAkLvB,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}