@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/adapters/nextjs.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Next.js App Router — wrap an API route handler with TokenForge verification.
@@ -18,39 +19,36 @@ export function withTokenForge(handler, options) {
     const apiBase = options.apiBase ?? DEFAULT_API_BASE;
     return async (req) => {
         const url = new URL(req.url);
-        const header = (name) => req.headers.get(name);
-        const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${options.apiKey}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                path: url.pathname,
-                method: req.method,
-                headers: {
-                    signature: header('x-tf-signature'),
-                    nonce: header('x-tf-nonce'),
-                    timestamp: header('x-tf-timestamp'),
-                    deviceId: header('x-tf-device-id'),
-                },
-                ipAddress: header('x-forwarded-for') ?? '',
-                countryCode: header('cf-ipcountry') ?? '',
-                userAgent: header('user-agent') ?? '',
-            }),
-        });
-        if (!apiRes.ok) {
+        if (shouldSkip(url.pathname, options.skipPaths)) {
             return handler(req, { bound: false, trustScore: 0, deviceId: null });
         }
-        const { data } = (await apiRes.json());
-        if (data.status === 'block') {
-            return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+        const header = (name) => req.headers.get(name);
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${options.apiKey}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    path: url.pathname, method: req.method,
+                    headers: {
+                        signature: header('x-tf-signature'), nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'), deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok)
+                return handler(req, { bound: false, trustScore: 0, deviceId: null });
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            }
+            return handler(req, { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId });
+        }
+        catch {
+            return handler(req, { bound: false, trustScore: 0, deviceId: null });
         }
-        return handler(req, {
-            bound: data.bound,
-            trustScore: data.trustScore,
-            deviceId: data.deviceId,
-        });
     };
 }
 /**
@@ -62,6 +60,9 @@ export function withTokenForge(handler, options) {
 export async function tokenForgeCheck(req, options) {
     const apiBase = options.apiBase ?? DEFAULT_API_BASE;
     const url = new URL(req.url);
+    if (shouldSkip(url.pathname, options.skipPaths)) {
+        return { proceed: true, tf: { bound: false, trustScore: 0, deviceId: null } };
+    }
     const header = (name) => req.headers.get(name);
     const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
         method: 'POST',
@@ -98,4 +99,56 @@ export async function tokenForgeCheck(req, options) {
         tf: { bound: data.bound, trustScore: data.trustScore, deviceId: data.deviceId },
     };
 }
+/**
+ * Per-route step-up gate. Wrap an inner handler that already received a
+ * `TfContext` (typically via `withTokenForge`). Returns 403 with
+ * `elevated_trust_required` when the device's `trustScore` is below the
+ * threshold (default 90).
+ *
+ * ```ts
+ * export const POST = withTokenForge(
+ *   withFreshSig(adminHandler, { minTrustScore: 90 }),
+ *   { apiKey: process.env.TOKENFORGE_API_KEY! },
+ * );
+ * ```
+ */
+export function withFreshSig(handler, opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    return async (req, tf) => {
+        if (!tf || tf.trustScore < min) {
+            return new Response(JSON.stringify({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: tf?.trustScore ?? 0,
+            }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+        }
+        return handler(req, tf);
+    };
+}
+/**
+ * Cross-adapter alias for {@link withFreshSig}. The 5 non-Next.js adapters
+ * (astro / express / fastify / hono / sveltekit) all export `requireFreshSig`;
+ * exposing the same name here keeps the per-adapter docs uniform so the
+ * Sprint 39 step-up snippet doesn't fork by framework.
+ */
+export const requireFreshSig = withFreshSig;
+function shouldSkip(path, skipPaths) {
+    return skipPaths?.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p) ?? false;
+}
+/** Wrap a Next.js route handler with the Cloud v2 local and remote gates. */
+export function withTokenForgeCloudV2(handler, options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (request) => {
+        const rejection = await gate(request);
+        return rejection ?? handler(request);
+    };
+}
+/** Run only the Cloud v2 authorization decision for middleware composition. */
+export function tokenForgeCloudV2Check(options) {
+    return createTokenForgeCloudV2Gate(options);
+}
+/** Expose the generic Cloud v2 bind handler as a Next.js route handler. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return handler;
+}
 //# sourceMappingURL=nextjs.js.map

package/dist/adapters/nextjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["../../src/adapters/nextjs.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAqBlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+D,EAC/D,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAgB,EAAqB,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE;oBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;oBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;oBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;oBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;iBACnC;gBACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;gBAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;gBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;aACtC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;YACzC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;aACnC;YACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;KAChF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"nextjs.js","sourceRoot":"../src/","sources":["adapters/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAqBlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+D,EAC/D,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAgB,EAAqB,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;oBACtC,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAChE,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACxE;oBACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;YACzC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;aACnC;YACD,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA+D,EAC/D,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE;QACvB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,EAAE,EAAE,UAAU,IAAI,CAAC;aAChC,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;AACzG,CAAC;AAID,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CACnC,OAA4D,EAC5D,OAAqC;IAErC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,OAAiB,EAAqB,EAAE;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CACpC,OAAqC;IAErC,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/adapters/sveltekit.d.ts

@@ -0,0 +1,66 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
+/** TokenForge context attached to event.locals.tf */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+/** Options for the SvelteKit adapter. */
+export interface TokenForgeSvelteKitOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+}
+/** Minimal SvelteKit Handle event surface — avoids @sveltejs/kit dep. */
+interface RequestEvent {
+    request: Request;
+    url: URL;
+    locals: {
+        tf?: TfContext;
+    };
+    getClientAddress?: () => string;
+}
+type Handle = (input: {
+    event: RequestEvent;
+    resolve: (event: RequestEvent) => Promise<Response>;
+}) => Promise<Response>;
+/**
+ * SvelteKit `handle` hook for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/hooks.server.ts
+ * import { tokenForgeHandle } from '@opensyber/tokenforge/sveltekit';
+ * export const handle = tokenForgeHandle({ apiKey: process.env.TOKENFORGE_API_KEY! });
+ * ```
+ *
+ * Reads `event.locals.tf` for downstream `+page.server.ts` / `+server.ts` use.
+ */
+export declare function tokenForgeHandle(options: TokenForgeSvelteKitOptions): Handle;
+/**
+ * Per-route step-up gate. Call inside a `+page.server.ts` `load` or
+ * `+server.ts` handler after `tokenForgeHandle` set `event.locals.tf`.
+ *
+ * Throws a 403 `Response` when below threshold; SvelteKit propagates it
+ * up. Returns `void` on pass.
+ */
+export declare function requireFreshSig(event: {
+    locals: {
+        tf?: TfContext;
+    };
+}, opts?: {
+    minTrustScore?: number;
+}): void;
+export type TokenForgeSvelteKitCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** SvelteKit handle hook backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Handle(options: TokenForgeSvelteKitCloudV2Options): Handle;
+export interface TokenForgeSvelteKitCloudV2RouteEvent {
+    request: Request;
+}
+/** Adapt the generic Cloud v2 bind handler to a SvelteKit server route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (event: TokenForgeSvelteKitCloudV2RouteEvent) => Promise<Response>;
+export {};
+//# sourceMappingURL=sveltekit.d.ts.map

package/dist/adapters/sveltekit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"../src/","sources":["adapters/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IACzC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yEAAyE;AACzE,UAAU,YAAY;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrD,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAqE5E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;CAAE,EACrC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,IAAI,CAaN;AASD,MAAM,MAAM,iCAAiC,GAAG,+BAA+B,CAAC;AAEhF,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iCAAiC,GACzC,MAAM,CAOR;AAED,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAGtC,OAAO,oCAAoC,KAC1C,OAAO,CAAC,QAAQ,CAAC,CACrB"}

package/dist/adapters/sveltekit.js

@@ -0,0 +1,101 @@
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * SvelteKit `handle` hook for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/hooks.server.ts
+ * import { tokenForgeHandle } from '@opensyber/tokenforge/sveltekit';
+ * export const handle = tokenForgeHandle({ apiKey: process.env.TOKENFORGE_API_KEY! });
+ * ```
+ *
+ * Reads `event.locals.tf` for downstream `+page.server.ts` / `+server.ts` use.
+ */
+export function tokenForgeHandle(options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    return async ({ event, resolve }) => {
+        const path = event.url.pathname;
+        if (shouldSkip(path, options.skipPaths)) {
+            event.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return resolve(event);
+        }
+        const header = (name) => event.request.headers.get(name);
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path,
+                    method: event.request.method,
+                    headers: {
+                        signature: header('x-tf-signature'),
+                        nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'),
+                        deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: event.getClientAddress?.() ?? header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok) {
+                event.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+                return resolve(event);
+            }
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            }
+            event.locals.tf = {
+                bound: data.bound,
+                trustScore: data.trustScore,
+                deviceId: data.deviceId,
+            };
+            return resolve(event);
+        }
+        catch {
+            event.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return resolve(event);
+        }
+    };
+}
+/**
+ * Per-route step-up gate. Call inside a `+page.server.ts` `load` or
+ * `+server.ts` handler after `tokenForgeHandle` set `event.locals.tf`.
+ *
+ * Throws a 403 `Response` when below threshold; SvelteKit propagates it
+ * up. Returns `void` on pass.
+ */
+export function requireFreshSig(event, opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    const score = event.locals.tf?.trustScore ?? 0;
+    if (score < min) {
+        throw new Response(JSON.stringify({
+            error: 'elevated_trust_required',
+            action: 'step_up_required',
+            trustScore: score,
+        }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+    }
+}
+function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
+}
+/** SvelteKit handle hook backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Handle(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async ({ event, resolve }) => {
+        const rejection = await gate(event.request);
+        return rejection ?? resolve(event);
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to a SvelteKit server route. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return async (event) => handler(event.request);
+}
+//# sourceMappingURL=sveltekit.js.map

package/dist/adapters/sveltekit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.js","sourceRoot":"../src/","sources":["adapters/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAgClE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;oBAC5B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EACP,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC/D,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqC,EACrC,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC;AAID,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,OAA0C;IAE1C,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAMD,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,KAAK,EACV,KAA2C,EACxB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/client/action-signer.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Action signing client SDK (Sprint 39).
+ *
+ * Produces a compact-form JWS that binds the user's intent to perform a
+ * specific action (e.g. `checkout`, `password_change`, `admin_grant`) to
+ * their device-bound private key. Server verifies via the existing
+ * `verifyCompactJws` (server/jws-verify.ts), then asserts the
+ * `action` + `actionHash` claims match the request body.
+ *
+ * Even if a session cookie is stolen and replayed, the action signature
+ * is bound to the action payload — replay against a different action
+ * fails actionHash match; replay against the same action fails the
+ * one-shot nonce check (caller's responsibility, see action-verify.ts
+ * for the server side).
+ */
+export interface ActionPayload {
+    /** Required action verb the server will assert. */
+    action: string;
+    /** Arbitrary payload fields (e.g. amount, recipient). Hashed into actionHash. */
+    [key: string]: unknown;
+}
+export interface SignActionOptions {
+    /** Device-bound private key from the bind ceremony (CryptoKey). */
+    privateKey: CryptoKey;
+    /** Bound DBSC sessionId — becomes the JWS `sub` claim. */
+    sessionId: string;
+    /** Public-key id (optional `kid` header). */
+    kid?: string;
+    /** TTL in seconds (default 60). */
+    ttlSeconds?: number;
+    /** Test override for clock. */
+    now?: () => Date;
+    /** Test override for nonce (default: crypto.randomUUID()). */
+    nonce?: string;
+    /**
+     * RFC 9266 TLS channel-binding token (hex). When the runtime exposes
+     * the TLS exporter (e.g. self-host node:tls) the caller can mix it
+     * into the signed claims so the JWS cannot be replayed across a
+     * different TLS connection. workerd does not expose this material;
+     * pass undefined and the server emits Sec-TF-Channel-Bound: 0.
+     */
+    tlsExporter?: string;
+}
+export interface SignActionResult {
+    /** Compact-form JWS string `<header>.<payload>.<signature>`. */
+    jws: string;
+    /** Server-side hash of the action payload — also embedded in claims. */
+    actionHash: string;
+    /** Per-call nonce — server should verify it has not been seen before. */
+    nonce: string;
+}
+export declare function signAction(payload: ActionPayload, opts: SignActionOptions): Promise<SignActionResult>;
+//# sourceMappingURL=action-signer.d.ts.map

package/dist/client/action-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-signer.d.ts","sourceRoot":"../src/","sources":["client/action-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,UAAU,EAAE,SAAS,CAAC;IACtB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAqC3B"}

package/dist/client/action-signer.js

@@ -0,0 +1,48 @@
+/**
+ * Action signing client SDK (Sprint 39).
+ *
+ * Produces a compact-form JWS that binds the user's intent to perform a
+ * specific action (e.g. `checkout`, `password_change`, `admin_grant`) to
+ * their device-bound private key. Server verifies via the existing
+ * `verifyCompactJws` (server/jws-verify.ts), then asserts the
+ * `action` + `actionHash` claims match the request body.
+ *
+ * Even if a session cookie is stolen and replayed, the action signature
+ * is bound to the action payload — replay against a different action
+ * fails actionHash match; replay against the same action fails the
+ * one-shot nonce check (caller's responsibility, see action-verify.ts
+ * for the server side).
+ */
+import { canonicalizeAction, sha256B64Url, b64UrlEncodeBytes, } from '../shared/action-hash.js';
+const DEFAULT_TTL = 60;
+export async function signAction(payload, opts) {
+    if (!payload || typeof payload.action !== 'string' || payload.action.length === 0) {
+        throw new Error('signAction: payload.action is required');
+    }
+    const now = opts.now?.() ?? new Date();
+    const iat = Math.floor(now.getTime() / 1000);
+    const exp = iat + (opts.ttlSeconds ?? DEFAULT_TTL);
+    const nonce = opts.nonce ?? crypto.randomUUID();
+    const actionHash = await sha256B64Url(canonicalizeAction(payload));
+    const header = { alg: 'ES256', typ: 'JWT' };
+    if (opts.kid)
+        header.kid = opts.kid;
+    const claims = {
+        sub: opts.sessionId,
+        iat,
+        exp,
+        nonce,
+        action: payload.action,
+        actionHash,
+    };
+    if (opts.tlsExporter)
+        claims.tlsExporter = opts.tlsExporter;
+    const enc = new TextEncoder();
+    const headerB64 = b64UrlEncodeBytes(enc.encode(JSON.stringify(header)));
+    const claimsB64 = b64UrlEncodeBytes(enc.encode(JSON.stringify(claims)));
+    const signingInput = `${headerB64}.${claimsB64}`;
+    const sigBuf = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, opts.privateKey, enc.encode(signingInput));
+    const jws = `${signingInput}.${b64UrlEncodeBytes(new Uint8Array(sigBuf))}`;
+    return { jws, actionHash, nonce };
+}
+//# sourceMappingURL=action-signer.js.map

package/dist/client/action-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-signer.js","sourceRoot":"../src/","sources":["client/action-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAyClC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,IAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnE,MAAM,MAAM,GAA4B,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACrE,IAAI,IAAI,CAAC,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAEpC,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,SAAS;QACnB,GAAG;QACH,GAAG;QACH,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC5C,IAAI,CAAC,UAAU,EACf,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CACzB,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,iBAAiB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/client/binding.d.ts

@@ -1,14 +1,31 @@
+/** Optional per-call options for {@link bindDevice}. */
+export interface BindDeviceOptions {
+    /** Bind algorithm preference. Default 'ecdsa' (existing behavior). */
+    prefer?: 'webauthn' | 'ecdsa';
+    /** Required when prefer === 'webauthn'. */
+    userId?: string;
+    /** Required when prefer === 'webauthn'. */
+    displayName?: string;
+}
+/** Result of a successful bind. WebAuthn binds have no in-memory keypair. */
+export type BindDeviceResult = {
+    type: 'ecdsa';
+    deviceId: string;
+    keyPair: CryptoKeyPair;
+} | {
+    type: 'webauthn';
+    deviceId: string;
+    credentialId: string;
+};
 /**
  * Complete device binding flow — called once after authentication.
  *
  * 1. Check if we already have a valid key for this session
- * 2. If not, generate new keypair
- * 3. Send public key to server to bind to session
+ * 2. If not, generate new keypair (or invoke WebAuthn ceremony)
+ * 3. Send public key / attestation to server to bind to session
  * 4. Server stores public key and returns device ID
- * 5. Store keypair + device ID locally
+ * 5. Store keypair + device ID locally (ECDSA path only — WebAuthn lives
+ *    on the authenticator)
  */
-export declare function bindDevice(apiBase: string, sessionId: string): Promise<{
-    deviceId: string;
-    keyPair: CryptoKeyPair;
-}>;
+export declare function bindDevice(apiBase: string, sessionId: string, options?: BindDeviceOptions): Promise<BindDeviceResult>;
 //# sourceMappingURL=binding.d.ts.map

package/dist/client/binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/client/binding.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC,CA2CvD"}
+{"version":3,"file":"binding.d.ts","sourceRoot":"../src/","sources":["client/binding.ts"],"names":[],"mappings":"AAKA,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAwD3B"}

package/dist/client/binding.js

@@ -1,18 +1,29 @@
 import { generateDeviceKeyPair, exportPublicKey } from './crypto.js';
 import { storeDeviceKey, getDeviceKey } from './storage.js';
+import { bindDeviceWebAuthn } from './webauthn.js';
 /**
  * Complete device binding flow — called once after authentication.
  *
  * 1. Check if we already have a valid key for this session
- * 2. If not, generate new keypair
- * 3. Send public key to server to bind to session
+ * 2. If not, generate new keypair (or invoke WebAuthn ceremony)
+ * 3. Send public key / attestation to server to bind to session
  * 4. Server stores public key and returns device ID
- * 5. Store keypair + device ID locally
+ * 5. Store keypair + device ID locally (ECDSA path only — WebAuthn lives
+ *    on the authenticator)
  */
-export async function bindDevice(apiBase, sessionId) {
+export async function bindDevice(apiBase, sessionId, options) {
+    const prefer = options?.prefer ?? 'ecdsa';
+    if (prefer === 'webauthn') {
+        if (!options?.userId || !options?.displayName) {
+            throw new Error('bindDevice(webauthn): userId and displayName are required');
+        }
+        const { deviceId, credentialId } = await bindDeviceWebAuthn(apiBase, sessionId, options.userId, options.displayName);
+        return { type: 'webauthn', deviceId, credentialId };
+    }
+    // ── ECDSA path (unchanged) ──
     const existing = await getDeviceKey();
     if (existing && existing.sessionId === sessionId) {
-        return { deviceId: existing.deviceId, keyPair: existing.keyPair };
+        return { type: 'ecdsa', deviceId: existing.deviceId, keyPair: existing.keyPair };
     }
     const keyPair = await generateDeviceKeyPair();
     const publicKeyJwk = await exportPublicKey(keyPair);
@@ -44,6 +55,6 @@ export async function bindDevice(apiBase, sessionId) {
         createdAt: Date.now(),
         sessionId,
     });
-    return { deviceId, keyPair };
+    return { type: 'ecdsa', deviceId, keyPair };
 }
 //# sourceMappingURL=binding.js.map

package/dist/client/binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/client/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QACpD,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;QAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,YAAY;YACvB,SAAS;YACT,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;IAErE,MAAM,cAAc,CAAC;QACnB,QAAQ;QACR,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"binding.js","sourceRoot":"../src/","sources":["client/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAkBnD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,SAAiB,EACjB,OAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC;IAE1C,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CACzD,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CACxD,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QACpD,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;QAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,YAAY;YACvB,SAAS;YACT,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;IAErE,MAAM,cAAc,CAAC;QACnB,QAAQ;QACR,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC"}

package/dist/client/cloud-device.d.ts

@@ -0,0 +1,54 @@
+import { PROTOCOL_V2 } from '../protocol/v2.js';
+export interface BrowserDeviceRecord {
+    keyPair: CryptoKeyPair;
+    localDeviceId: string;
+    projectId?: string;
+    deviceId?: string;
+    sessionId?: string;
+    expiresAt?: string;
+}
+export interface BrowserDeviceStore {
+    load(): Promise<BrowserDeviceRecord | null>;
+    save(record: BrowserDeviceRecord): Promise<void>;
+    clear(): Promise<void>;
+}
+export interface TokenForgeDeviceOptions {
+    /** Authenticated application endpoint. This endpoint, not the browser, owns the bearer key. */
+    bindEndpoint: string;
+    /** Existing application fetch wrapper carrying its normal cookie/session authentication. */
+    fetch: typeof fetch;
+    /** Expected browser origin. Defaults to location.origin or the bind endpoint origin. */
+    origin?: string;
+    /** API origins allowed to receive TokenForge proof headers. Defaults to the bind origin. */
+    allowedOrigins?: readonly string[];
+    /** Exact URL paths that must pass through without TokenForge proof headers. */
+    skipPaths?: readonly string[];
+    /** Test/custom storage adapter. Production defaults to IndexedDB. */
+    store?: BrowserDeviceStore;
+}
+export interface BoundResult {
+    protocol: typeof PROTOCOL_V2;
+    mode: 'monitor' | 'enforce';
+    bound: true;
+    projectId: string;
+    deviceId: string;
+    sessionId: string;
+    expiresAt: string;
+}
+export interface UnboundResult {
+    protocol: typeof PROTOCOL_V2;
+    mode: 'off' | 'monitor';
+    bound: false;
+    status?: 'unavailable';
+}
+export type BindResult = BoundResult | UnboundResult;
+export declare class TokenForgeDevice {
+    #private;
+    private constructor();
+    static open(options: TokenForgeDeviceOptions): Promise<TokenForgeDevice>;
+    get privateKeyExtractable(): boolean;
+    get deviceId(): string | null;
+    bindAuthenticatedSession(): Promise<BindResult>;
+    wrapFetch(authenticatedFetch?: typeof fetch): typeof fetch;
+}
+//# sourceMappingURL=cloud-device.d.ts.map

package/dist/client/cloud-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-device.d.ts","sourceRoot":"../src/","sources":["client/cloud-device.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAMZ,MAAM,mBAAmB,CAAC;AAkB3B,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,+FAA+F;IAC/F,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,IAAI,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,qBAAa,gBAAgB;;IAO3B,OAAO;WAcM,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8C9E,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAE5B;IAEK,wBAAwB,IAAI,OAAO,CAAC,UAAU,CAAC;IAwCrD,SAAS,CAAC,kBAAkB,GAAE,OAAO,KAA2B,GAAG,OAAO,KAAK;CAuDhF"}