@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/client/cloud-device.js

@@ -0,0 +1,301 @@
+import { PROTOCOL_V2, base64Url, canonicalizeOrigin, encodeRequestProof, sha256Base64Url, } from '../protocol/v2.js';
+const DB_NAME = 'tokenforge-cloud';
+const STORE_NAME = 'device';
+const RECORD_KEY = 'current';
+const MAX_BIND_RESPONSE_BYTES = 64 * 1024;
+const PROOF_HEADERS = [
+    'X-TF-Protocol',
+    'X-TF-Project-ID',
+    'X-TF-Device-ID',
+    'X-TF-Session-ID',
+    'X-TF-Body-SHA256',
+    'X-TF-Origin',
+    'X-TF-Nonce',
+    'X-TF-Timestamp',
+    'X-TF-Signature',
+];
+export class TokenForgeDevice {
+    #options;
+    #store;
+    #allowedOrigins;
+    #skipPaths;
+    #record;
+    constructor(options, store, record, allowedOrigins, skipPaths) {
+        this.#options = options;
+        this.#store = store;
+        this.#record = record;
+        this.#allowedOrigins = allowedOrigins;
+        this.#skipPaths = skipPaths;
+    }
+    static async open(options) {
+        const unsafe = options;
+        if ('apiKey' in unsafe || 'APIKey' in unsafe || 'tokenForgeApiKey' in unsafe) {
+            throw new Error('TokenForgeDevice never accepts an API key; bind through the authenticated server endpoint');
+        }
+        if (!options?.bindEndpoint || typeof options.fetch !== 'function') {
+            throw new Error('TokenForgeDevice requires bindEndpoint and authenticated fetch');
+        }
+        const expectedOrigin = resolveExpectedOrigin(options);
+        const bindOrigin = canonicalizeOrigin(new URL(options.bindEndpoint, expectedOrigin).origin);
+        const configuredOrigins = options.allowedOrigins ?? [bindOrigin];
+        if (configuredOrigins.length === 0) {
+            throw new Error('TokenForgeDevice requires at least one allowed API origin');
+        }
+        const allowedOrigins = new Set(configuredOrigins.map((origin) => canonicalizeOrigin(origin)));
+        const skipPaths = new Set(options.skipPaths ?? []);
+        for (const path of skipPaths) {
+            if (!path.startsWith('/') || path.includes('?') || path.includes('#')) {
+                throw new Error('TokenForgeDevice skip paths must be exact absolute URL paths');
+            }
+        }
+        const store = options.store ?? new IndexedDBDeviceStore();
+        let record = null;
+        try {
+            record = await store.load();
+        }
+        catch {
+            // Corrupt/unavailable browser storage degrades to a fresh in-memory key.
+        }
+        if (record && !validRecord(record)) {
+            try {
+                await store.clear();
+            }
+            catch { /* storage may be unavailable */ }
+            record = null;
+        }
+        if (!record) {
+            const keyPair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+            record = { keyPair, localDeviceId: `tf_local_${crypto.randomUUID()}` };
+            try {
+                await store.save(record);
+            }
+            catch { /* memory record remains usable */ }
+        }
+        return new TokenForgeDevice(options, store, record, allowedOrigins, skipPaths);
+    }
+    get privateKeyExtractable() {
+        return this.#record.keyPair.privateKey.extractable;
+    }
+    get deviceId() {
+        return this.#record.deviceId ?? null;
+    }
+    async bindAuthenticatedSession() {
+        const publicKey = await crypto.subtle.exportKey('jwk', this.#record.keyPair.publicKey);
+        const idempotencyKey = await sha256Base64Url(new TextEncoder().encode(`${this.#record.localDeviceId}\0${publicKey.x ?? ''}\0${publicKey.y ?? ''}`));
+        const response = await this.#options.fetch(this.#options.bindEndpoint, {
+            method: 'POST',
+            credentials: 'include',
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+                'Idempotency-Key': idempotencyKey,
+            },
+            body: JSON.stringify({
+                protocol: PROTOCOL_V2,
+                localDeviceId: this.#record.localDeviceId,
+                publicKey,
+            }),
+        });
+        if (!response.ok)
+            throw new Error(`TokenForge bind failed with status ${response.status}`);
+        const raw = await response.text();
+        if (new TextEncoder().encode(raw).length > MAX_BIND_RESPONSE_BYTES) {
+            throw new Error('TokenForge bind returned an oversized response');
+        }
+        let decoded;
+        try {
+            decoded = JSON.parse(raw);
+        }
+        catch {
+            throw new Error('TokenForge bind returned invalid JSON');
+        }
+        const result = parseBindResult(decoded);
+        if (result.bound) {
+            this.#record = {
+                ...this.#record,
+                projectId: result.projectId,
+                deviceId: result.deviceId,
+                sessionId: result.sessionId,
+                expiresAt: result.expiresAt,
+            };
+            try {
+                await this.#store.save(this.#record);
+            }
+            catch { /* current page remains bound */ }
+        }
+        return result;
+    }
+    wrapFetch(authenticatedFetch = this.#options.fetch) {
+        return async (input, init) => {
+            const request = new Request(input, init);
+            const url = new URL(request.url);
+            if (!this.#allowedOrigins.has(url.origin.toLowerCase()) ||
+                this.#skipPaths.has(url.pathname)) {
+                return authenticatedFetch(withoutProofHeaders(request));
+            }
+            const binding = currentBinding(this.#record);
+            if (!binding)
+                return authenticatedFetch(withoutProofHeaders(request));
+            const method = request.method.toUpperCase();
+            const body = method === 'GET' || method === 'HEAD'
+                ? new Uint8Array()
+                : new Uint8Array(await request.clone().arrayBuffer());
+            const nonceBytes = new Uint8Array(32);
+            crypto.getRandomValues(nonceBytes);
+            const proof = {
+                protocol: PROTOCOL_V2,
+                projectId: binding.projectId,
+                deviceId: binding.deviceId,
+                sessionId: binding.sessionId,
+                method,
+                path: url.pathname,
+                query: url.search.slice(1),
+                bodySha256: await sha256Base64Url(body),
+                origin: this.#origin(),
+                nonce: base64Url(nonceBytes),
+                timestamp: Date.now().toString(),
+            };
+            const canonical = encodeRequestProof(proof);
+            const signature = new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, this.#record.keyPair.privateKey, canonical));
+            if (signature.length !== 64)
+                throw new Error('TokenForge browser produced an unsupported signature encoding');
+            const headers = new Headers(request.headers);
+            headers.set('X-TF-Protocol', proof.protocol);
+            headers.set('X-TF-Project-ID', proof.projectId);
+            headers.set('X-TF-Device-ID', proof.deviceId);
+            headers.set('X-TF-Session-ID', proof.sessionId);
+            headers.set('X-TF-Body-SHA256', proof.bodySha256);
+            headers.set('X-TF-Origin', proof.origin);
+            headers.set('X-TF-Nonce', proof.nonce);
+            headers.set('X-TF-Timestamp', proof.timestamp);
+            headers.set('X-TF-Signature', base64Url(signature));
+            return authenticatedFetch(new Request(request, { headers }));
+        };
+    }
+    #origin() {
+        return resolveExpectedOrigin(this.#options);
+    }
+}
+function resolveExpectedOrigin(options) {
+    if (options.origin)
+        return canonicalizeOrigin(options.origin);
+    if (typeof location !== 'undefined' && location.origin)
+        return canonicalizeOrigin(location.origin);
+    return canonicalizeOrigin(new URL(options.bindEndpoint, 'https://localhost').origin);
+}
+function withoutProofHeaders(request) {
+    const headers = new Headers(request.headers);
+    for (const header of PROOF_HEADERS)
+        headers.delete(header);
+    return new Request(request, { headers });
+}
+class IndexedDBDeviceStore {
+    async load() {
+        const store = await openStore('readonly');
+        return requestResult(store.get(RECORD_KEY)).then((value) => value ?? null);
+    }
+    async save(record) {
+        const store = await openStore('readwrite');
+        await requestResult(store.put(record, RECORD_KEY));
+    }
+    async clear() {
+        const store = await openStore('readwrite');
+        await requestResult(store.delete(RECORD_KEY));
+    }
+}
+function openStore(mode) {
+    return new Promise((resolve, reject) => {
+        if (typeof indexedDB === 'undefined')
+            return reject(new Error('IndexedDB unavailable'));
+        const request = indexedDB.open(DB_NAME, 1);
+        request.onupgradeneeded = () => request.result.createObjectStore(STORE_NAME);
+        request.onerror = () => reject(new Error('IndexedDB unavailable'));
+        request.onsuccess = () => {
+            try {
+                resolve(request.result.transaction(STORE_NAME, mode).objectStore(STORE_NAME));
+            }
+            catch {
+                reject(new Error('IndexedDB unavailable'));
+            }
+        };
+    });
+}
+function requestResult(request) {
+    return new Promise((resolve, reject) => {
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(new Error('IndexedDB operation failed'));
+    });
+}
+function validRecord(record) {
+    const privateKey = record.keyPair?.privateKey;
+    const publicKey = record.keyPair?.publicKey;
+    return Boolean(privateKey && publicKey && privateKey.type === 'private' && publicKey.type === 'public' &&
+        !privateKey.extractable && privateKey.algorithm.name === 'ECDSA' &&
+        publicKey.algorithm.name === 'ECDSA' && /^tf_local_[A-Za-z0-9-]{8,}$/.test(record.localDeviceId));
+}
+function parseBindResult(input) {
+    const root = input && typeof input === 'object' ? input : {};
+    const value = root.data && typeof root.data === 'object' ? root.data : root;
+    if (value.protocol === PROTOCOL_V2 && value.bound === false &&
+        (value.mode === 'off' || value.mode === 'monitor') &&
+        (value.status === undefined || value.status === 'unavailable')) {
+        return {
+            protocol: PROTOCOL_V2,
+            mode: value.mode,
+            bound: false,
+            ...(value.status === 'unavailable' ? { status: value.status } : {}),
+        };
+    }
+    const result = {
+        protocol: value.protocol,
+        mode: value.mode,
+        bound: value.bound,
+        projectId: value.projectId,
+        deviceId: value.deviceId,
+        sessionId: value.sessionId,
+        expiresAt: value.expiresAt,
+    };
+    if (result.protocol !== PROTOCOL_V2 || result.bound !== true ||
+        (result.mode !== 'monitor' && result.mode !== 'enforce') || typeof result.projectId !== 'string' ||
+        typeof result.deviceId !== 'string' || typeof result.sessionId !== 'string' ||
+        typeof result.expiresAt !== 'string') {
+        throw new Error('TokenForge bind returned an invalid response');
+    }
+    // Reuse the canonical encoder's strict identifiers with harmless request fields.
+    encodeRequestProof({
+        protocol: PROTOCOL_V2,
+        projectId: result.projectId,
+        deviceId: result.deviceId,
+        sessionId: result.sessionId,
+        method: 'GET', path: '/', query: '',
+        bodySha256: '47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU',
+        origin: '', nonce: 'AAAAAAAAAAAAAAAAAAAAAA', timestamp: '0000000000000',
+    });
+    if (Number.isNaN(Date.parse(result.expiresAt)))
+        throw new Error('TokenForge bind returned an invalid expiry');
+    return result;
+}
+function currentBinding(record) {
+    if (!record.projectId || !record.deviceId || !record.sessionId) {
+        return null;
+    }
+    if (!record.expiresAt || Number.isNaN(Date.parse(record.expiresAt)) || Date.parse(record.expiresAt) <= Date.now()) {
+        return null;
+    }
+    try {
+        encodeRequestProof({
+            protocol: PROTOCOL_V2,
+            projectId: record.projectId,
+            deviceId: record.deviceId,
+            sessionId: record.sessionId,
+            method: 'GET', path: '/', query: '',
+            bodySha256: '47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU',
+            origin: '', nonce: 'AAAAAAAAAAAAAAAAAAAAAA', timestamp: '0000000000000',
+        });
+    }
+    catch {
+        return null;
+    }
+    return { projectId: record.projectId, deviceId: record.deviceId, sessionId: record.sessionId };
+}
+//# sourceMappingURL=cloud-device.js.map

package/dist/client/cloud-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-device.js","sourceRoot":"../src/","sources":["client/cloud-device.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,aAAa,GAAG;IACpB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAmDX,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAA0B;IAClC,MAAM,CAAqB;IAC3B,eAAe,CAAsB;IACrC,UAAU,CAAsB;IACzC,OAAO,CAAsB;IAE7B,YACE,OAAgC,EAChC,KAAyB,EACzB,MAA2B,EAC3B,cAAmC,EACnC,SAA8B;QAE9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAgC;QAChD,MAAM,MAAM,GAAG,OAA4D,CAAC;QAC5E,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,IAAI,kBAAkB,IAAI,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5F,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,oBAAoB,EAAE,CAAC;QAC1D,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACvE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;YACF,MAAM,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YACvE,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,wBAAwB;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CACnE,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5E,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,cAAc;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,WAAW;gBACrB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;gBACzC,SAAS;aACV,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG;gBACb,GAAG,IAAI,CAAC,OAAO;gBACf,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YACF,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,qBAAmC,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC9D,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;YAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IACE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EACjC,CAAC;gBACD,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAChD,CAAC,CAAC,IAAI,UAAU,EAAE;gBAClB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,KAAK,GAAmB;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM;gBACN,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1B,UAAU,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;gBACtB,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;aACjC,CAAC;YACF,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACvD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAC/B,SAAyB,CAC1B,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YAC9G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,OAAO,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,OAAgC;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,aAAa;QAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,oBAAoB;IACxB,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO,aAAa,CAAkC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAA2B;QACpC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,SAAS,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7E,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;YAAC,CAAC;YACtF,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAAC,CAAC;QACvD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAI,OAAsB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA2B;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5C,OAAO,OAAO,CACZ,UAAU,IAAI,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QACvF,CAAC,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAChE,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QACvD,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClD,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QACxD,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAChG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAC3E,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,iFAAiF;IACjF,kBAAkB,CAAC;QACjB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnC,UAAU,EAAE,6CAA6C;QACzD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,eAAe;KACxE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC9G,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,MAA2B;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,kBAAkB,CAAC;YACjB,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,UAAU,EAAE,6CAA6C;YACzD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,eAAe;SACxE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACjG,CAAC"}

package/dist/client/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,aAAa,CAAC,CAMpE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAErB"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"../src/","sources":["client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,aAAa,CAAC,CAMpE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAErB"}

package/dist/client/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACpC,aAAa,EACb,KAAK,EAAE,kBAAkB;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB;IAEtB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"../src/","sources":["client/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACpC,aAAa,EACb,KAAK,EAAE,kBAAkB;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB;IAEtB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC"}

package/dist/client/index.d.ts

@@ -1,4 +1,6 @@
 import type { TokenForgeConfig } from '../shared/types.js';
+import { type ActionPayload, type SignActionResult } from './action-signer.js';
+export { TokenForgeDevice, type TokenForgeDeviceOptions, type BrowserDeviceRecord, type BrowserDeviceStore, type BindResult, type BoundResult, type UnboundResult, } from './cloud-device.js';
 /**
  * TokenForge Client SDK — main entry point.
  *
@@ -30,6 +32,18 @@ export declare class TokenForge {
     clearKeys(): Promise<void>;
     /** Clear existing binding and re-initialize (generate new keypair + bind). */
     rebind(): Promise<void>;
+    /**
+     * Sign a high-trust action (checkout, password change, admin grant…) with
+     * the device-bound private key. Returns a compact JWS the server verifies
+     * via `verifyCompactJws` + `actionHash` claim match.
+     *
+     * @throws when the device is not yet bound (call `init()` first).
+     */
+    signAction(payload: ActionPayload, options?: {
+        ttlSeconds?: number;
+        kid?: string;
+        tlsExporter?: string;
+    }): Promise<SignActionResult>;
 }
 /**
  * Factory function to create a TokenForge instance.

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,kBAAkB,CAA6B;gBAE3C,MAAM,EAAE,gBAAgB;IAIpC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC3B;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA+BrD,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,8EAA8E;IAC9E,OAAO,IAAI,OAAO;IAIlB,8EAA8E;IACxE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAShC,8EAA8E;IACxE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAErE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../src/","sources":["client/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,kBAAkB,CAA6B;gBAE3C,MAAM,EAAE,gBAAgB;IAIpC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyC3B;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCrD,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,8EAA8E;IAC9E,OAAO,IAAI,OAAO;IAIlB,8EAA8E;IACxE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAShC,8EAA8E;IACxE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B;;;;;;OAMG;IACG,UAAU,CACd,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACxE,OAAO,CAAC,gBAAgB,CAAC;CAgB7B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAErE"}

package/dist/client/index.js

@@ -1,6 +1,8 @@
 import { bindDevice } from './binding.js';
 import { clearDeviceKeys } from './storage.js';
 import { installFetchInterceptor } from './interceptor.js';
+import { signAction as signActionInternal, } from './action-signer.js';
+export { TokenForgeDevice, } from './cloud-device.js';
 /**
  * TokenForge Client SDK — main entry point.
  *
@@ -33,7 +35,9 @@ export class TokenForge {
         try {
             const result = await bindDevice(this.config.apiBase, sessionId);
             this.deviceId = result.deviceId;
-            this.keyPair = result.keyPair;
+            // ECDSA path stores the keyPair; WebAuthn path keeps the credential on
+            // the authenticator (signed via navigator.credentials.get on demand).
+            this.keyPair = result.type === 'ecdsa' ? result.keyPair : null;
             this.bound = true;
             this.config.onDeviceBound?.(this.deviceId);
             if (this.config.autoIntercept !== false) {
@@ -68,7 +72,8 @@ export class TokenForge {
             return request;
         const nonce = generateNonce();
         const timestamp = Math.floor(Date.now() / 1000);
-        const signature = await signChallenge(this.keyPair.privateKey, sessionId, nonce, timestamp);
+        const result = await signChallenge(this.keyPair.privateKey, sessionId, nonce, timestamp);
+        const signature = typeof result === 'string' ? result : result.signature;
         const headers = new Headers(request.headers);
         headers.set(this.config.headers?.signature || 'X-TF-Signature', signature);
         headers.set(this.config.headers?.nonce || 'X-TF-Nonce', nonce);
@@ -98,6 +103,29 @@ export class TokenForge {
         await this.clearKeys();
         await this.init();
     }
+    /**
+     * Sign a high-trust action (checkout, password change, admin grant…) with
+     * the device-bound private key. Returns a compact JWS the server verifies
+     * via `verifyCompactJws` + `actionHash` claim match.
+     *
+     * @throws when the device is not yet bound (call `init()` first).
+     */
+    async signAction(payload, options = {}) {
+        if (!this.keyPair || !this.bound) {
+            throw new Error('TokenForge.signAction: device not bound — call init() first');
+        }
+        const sessionId = this.config.getSessionId();
+        if (!sessionId) {
+            throw new Error('TokenForge.signAction: no sessionId from getSessionId()');
+        }
+        return signActionInternal(payload, {
+            privateKey: this.keyPair.privateKey,
+            sessionId,
+            kid: options.kid,
+            ttlSeconds: options.ttlSeconds,
+            tlsExporter: options.tlsExporter,
+        });
+    }
 }
 /**
  * Factory function to create a TokenForge instance.

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAmB;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,OAAO,GAAyB,IAAI,CAAC;IACrC,KAAK,GAAG,KAAK,CAAC;IACd,kBAAkB,GAAwB,IAAI,CAAC;IAEvD,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,mCAAmC;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAC/C,IAAI,CAAC,MAAM,EACX,KAAK,IAAI,EAAE;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEpD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAClD,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EACjD,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"../src/","sources":["client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,UAAU,IAAI,kBAAkB,GAGjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,GAOjB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAmB;IACzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,OAAO,GAAyB,IAAI,CAAC;IACrC,KAAK,GAAG,KAAK,CAAC;IACd,kBAAkB,GAAwB,IAAI,CAAC;IAEvD,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,mCAAmC;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAC/C,IAAI,CAAC,MAAM,EACX,KAAK,IAAI,EAAE;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEpD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,SAAS,EACT,KAAK,EACL,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAEzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAClD,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EACjD,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CACd,OAAsB,EACtB,UAAuE,EAAE;QAEzE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,SAAS;YACT,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/client/interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../../src/client/interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,MAAM,OAAO,CAAC;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAAC,GACR,MAAM,IAAI,CAqFZ"}
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"../src/","sources":["client/interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,MAAM,OAAO,CAAC;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAAC,GACR,MAAM,IAAI,CAoGZ"}

package/dist/client/interceptor.js

@@ -1,4 +1,4 @@
-import { signChallenge, generateNonce } from './signer.js';
+import { signChallenge, generateNonce, TF_PROTOCOL_VERSION } from './signer.js';
 /**
  * Install a fetch interceptor that automatically signs all requests
  * to the protected API with TokenForge headers.
@@ -22,12 +22,19 @@ export function installFetchInterceptor(config, getSigningMaterial) {
         }
         const nonce = generateNonce();
         const timestamp = Math.floor(Date.now() / 1000);
-        const signature = await signChallenge(material.privateKey, material.sessionId, nonce, timestamp);
+        const method = (init?.method ?? 'GET').toUpperCase();
+        const parsedUrl = url.startsWith('http') ? new URL(url) : new URL(url, location.origin);
+        const path = parsedUrl.pathname;
+        const body = await extractBody(input, init);
+        const result = await signChallenge(material.privateKey, material.sessionId, nonce, timestamp, method, path, body);
         const headers = new Headers(init?.headers);
-        headers.set(config.headers?.signature || 'X-TF-Signature', signature);
+        headers.set(config.headers?.signature || 'X-TF-Signature', result.signature);
         headers.set(config.headers?.nonce || 'X-TF-Nonce', nonce);
         headers.set(config.headers?.timestamp || 'X-TF-Timestamp', timestamp.toString());
         headers.set(config.headers?.deviceId || 'X-TF-Device-ID', material.deviceId);
+        headers.set(config.headers?.sessionId || 'X-TF-Session-ID', material.sessionId);
+        headers.set(config.headers?.version || 'X-TF-Version', TF_PROTOCOL_VERSION);
+        headers.set(config.headers?.bodyHash || 'X-TF-Body-Hash', result.bodyHash);
         const response = await originalFetch(input, { ...init, headers });
         if (response.status === 403) {
             const body = await response
@@ -60,6 +67,23 @@ export function installFetchInterceptor(config, getSigningMaterial) {
         window.fetch = originalFetch;
     };
 }
+/**
+ * Extract the body as a string from the fetch arguments.
+ * For streaming bodies or non-string types, returns null (hashed as empty).
+ */
+async function extractBody(input, init) {
+    const raw = init?.body ?? (input instanceof Request ? input.body : null);
+    if (raw == null)
+        return null;
+    if (typeof raw === 'string')
+        return raw;
+    if (raw instanceof ArrayBuffer)
+        return new TextDecoder().decode(raw);
+    if (raw instanceof Uint8Array)
+        return new TextDecoder().decode(raw);
+    // ReadableStream or FormData — cannot consume without side effects
+    return null;
+}
 function shouldIntercept(url, config) {
     // Only intercept requests to the API base
     if (!url.startsWith(config.apiBase) && !url.startsWith('/')) {

package/dist/client/interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../../src/client/interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,kBAIS;IAET,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,GAAG,KAAK,WAClB,KAAwB,EACxB,IAAkB;QAElB,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAElB,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,SAAS,EAClB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAC7C,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAC5C,QAAQ,CAAC,QAAQ,CAClB,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAClC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,CACvB,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,iBAAiB,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,iBAAiB,EACjC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,0BAA0B;IAC1B,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAwB;IAC5D,0CAA0C;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;YACvB,CAAC,CAAC,GAAG,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACvD,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"interceptor.js","sourceRoot":"../src/","sources":["client/interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,kBAIS;IAET,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,GAAG,KAAK,WAClB,KAAwB,EACxB,IAAkB;QAElB,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAElB,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,SAAS,EAClB,KAAK,EACL,SAAS,EACT,MAAM,EACN,IAAI,EACJ,IAAI,CACL,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAC7C,SAAS,CAAC,QAAQ,EAAE,CACrB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAC5C,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,iBAAiB,EAC9C,QAAQ,CAAC,SAAS,CACnB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,mBAAmB,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE3E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAClC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,CACvB,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,iBAAiB,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,QAAQ,IAAI,IAAI;gBAChB,IAAI,CAAC,MAAM,KAAK,iBAAiB,EACjC,CAAC;gBACD,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,0BAA0B;IAC1B,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,KAAwB,EACxB,IAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAwB;IAC5D,0CAA0C;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;YACvB,CAAC,CAAC,GAAG,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACvD,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/client/signer.d.ts

@@ -1,15 +1,52 @@
 /**
  * Challenge-response signing protocol.
- * Signs: `${sessionId}:${nonce}:${timestamp}` with the device-bound private key.
+ *
+ * **v2** signs: `${method}:${path}:${bodyHash}:${sessionId}:${nonce}:${timestamp}`
+ * where bodyHash is the hex SHA-256 of the request body (empty string for GET/HEAD).
+ *
+ * **v1** (legacy) signs: `${sessionId}:${nonce}:${timestamp}`.
+ *
+ * Also exports `isNativeDbscAvailable()` — feature-detect for the W3C
+ * Device-Bound Session Credentials API (Chrome 146+). When present, the
+ * SDK can defer key generation + binding to the platform; otherwise it
+ * continues using the Web Crypto fallback path implemented here.
  */
+/** Protocol version — determines signature input format. */
+export declare const TF_PROTOCOL_VERSION = "2";
 /**
- * Sign a challenge payload with the device-bound private key.
+ * Compute hex-encoded SHA-256 of arbitrary text.
+ * Uses Web Crypto — works in browsers and Cloudflare Workers.
  */
-export declare function signChallenge(privateKey: CryptoKey, sessionId: string, nonce: string, timestamp: number): Promise<string>;
+export declare function sha256Hex(data: string): Promise<string>;
+/**
+ * Build the v2 signature input that covers HTTP method, path, and body.
+ * @returns The string to be signed with ECDSA P-256.
+ */
+export declare function buildSignatureInput(sessionId: string, nonce: string, timestamp: string, method: string, path: string, body: string | null): Promise<string>;
+/**
+ * Sign a challenge payload with the device-bound private key (v2 format).
+ * Includes HTTP method, URL path, and body hash in the signed payload.
+ */
+export declare function signChallenge(privateKey: CryptoKey, sessionId: string, nonce: string, timestamp: number, method?: string, path?: string, body?: string | null): Promise<{
+    signature: string;
+    bodyHash: string;
+}>;
 /**
  * Generate a client-side nonce.
  * Server will verify this hasn't been used before.
  */
 export declare function generateNonce(): string;
 export declare function arrayBufferToBase64Url(buffer: ArrayBuffer): string;
+/**
+ * Feature-detect the W3C Device-Bound Session Credentials API.
+ *
+ * Returns `true` when `navigator.deviceBoundSession` is a real object the
+ * SDK could route through. Treats undefined / null / non-object values
+ * (functions, primitives) as unavailable so a downgrade attacker who
+ * shadows `navigator` with a truthy primitive does not flip the SDK into
+ * thinking native DBSC is present.
+ *
+ * Spec: https://w3c.github.io/webappsec-dbsc/ (Chrome 146+)
+ */
+export declare function isNativeDbscAvailable(): boolean;
 //# sourceMappingURL=signer.d.ts.map

package/dist/client/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOlE"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"../src/","sources":["client/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7D;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EACnD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAChD,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAclD;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOlE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C"}