@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/server/activity-histogram.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Activity Histogram — 24-bucket time-of-day anomaly detector.
+ *
+ * Tracks request counts per hour-of-day and scores how unusual the
+ * current hour is relative to the user's historical pattern.
+ *
+ * Storage key pattern: `tf:activity:{userId}`
+ */
+/** 24-bucket histogram (index 0-23 = hour of day). */
+export interface ActivityHistogram {
+    /** Request counts per hour (index = hour 0-23). */
+    buckets: number[];
+    /** Sum of all buckets — avoids recomputing on every call. */
+    totalRequests: number;
+}
+/** Storage key prefix for activity histograms. */
+export declare const ACTIVITY_KEY_PREFIX = "tf:activity:";
+/**
+ * Create an empty histogram with 24 zero-filled buckets.
+ * @returns A fresh ActivityHistogram with no recorded activity.
+ */
+export declare function emptyHistogram(): ActivityHistogram;
+/**
+ * Record a request at the given hour, returning the updated histogram.
+ * Pure function — does not mutate the input.
+ * @param histogram - Current histogram state.
+ * @param hour - Hour of day (0-23).
+ * @returns New histogram with the incremented bucket.
+ */
+export declare function recordActivity(histogram: ActivityHistogram, hour: number): ActivityHistogram;
+/**
+ * Score the current hour against the user's historical activity pattern.
+ *
+ * Returns 0-5 points:
+ *   5 — hour is within normal range (<=1 stddev from mean)
+ *   3 — hour is slightly unusual (1-2 stddev from mean)
+ *   1 — hour is very unusual (>2 stddev from mean)
+ *   0 — hour has zero historical requests AND histogram has >=30 total
+ *
+ * If totalRequests < 30, returns 5 (not enough data to penalize).
+ *
+ * @param histogram - The user's activity histogram.
+ * @param currentHour - Current hour of day (0-23).
+ * @returns Trust score contribution (0-5).
+ */
+export declare function scoreTimeOfDay(histogram: ActivityHistogram, currentHour: number): number;
+//# sourceMappingURL=activity-histogram.d.ts.map

package/dist/server/activity-histogram.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-histogram.d.ts","sourceRoot":"../src/","sources":["server/activity-histogram.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,MAAM,GACX,iBAAiB,CAKnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,iBAAiB,EAC5B,WAAW,EAAE,MAAM,GAClB,MAAM,CAiBR"}

package/dist/server/activity-histogram.js

@@ -0,0 +1,76 @@
+/**
+ * Activity Histogram — 24-bucket time-of-day anomaly detector.
+ *
+ * Tracks request counts per hour-of-day and scores how unusual the
+ * current hour is relative to the user's historical pattern.
+ *
+ * Storage key pattern: `tf:activity:{userId}`
+ */
+/** Storage key prefix for activity histograms. */
+export const ACTIVITY_KEY_PREFIX = 'tf:activity:';
+/**
+ * Create an empty histogram with 24 zero-filled buckets.
+ * @returns A fresh ActivityHistogram with no recorded activity.
+ */
+export function emptyHistogram() {
+    return { buckets: new Array(24).fill(0), totalRequests: 0 };
+}
+/**
+ * Record a request at the given hour, returning the updated histogram.
+ * Pure function — does not mutate the input.
+ * @param histogram - Current histogram state.
+ * @param hour - Hour of day (0-23).
+ * @returns New histogram with the incremented bucket.
+ */
+export function recordActivity(histogram, hour) {
+    const h = Math.max(0, Math.min(23, Math.floor(hour)));
+    const buckets = [...histogram.buckets];
+    buckets[h] = (buckets[h] ?? 0) + 1;
+    return { buckets, totalRequests: histogram.totalRequests + 1 };
+}
+/**
+ * Score the current hour against the user's historical activity pattern.
+ *
+ * Returns 0-5 points:
+ *   5 — hour is within normal range (<=1 stddev from mean)
+ *   3 — hour is slightly unusual (1-2 stddev from mean)
+ *   1 — hour is very unusual (>2 stddev from mean)
+ *   0 — hour has zero historical requests AND histogram has >=30 total
+ *
+ * If totalRequests < 30, returns 5 (not enough data to penalize).
+ *
+ * @param histogram - The user's activity histogram.
+ * @param currentHour - Current hour of day (0-23).
+ * @returns Trust score contribution (0-5).
+ */
+export function scoreTimeOfDay(histogram, currentHour) {
+    if (histogram.totalRequests < 30)
+        return 5;
+    const h = Math.max(0, Math.min(23, Math.floor(currentHour)));
+    const count = histogram.buckets[h];
+    if (count === 0)
+        return 0;
+    const { mean, stddev } = bucketStats(histogram.buckets);
+    if (stddev === 0)
+        return 5;
+    const deviations = Math.abs((count ?? 0) - mean) / stddev;
+    if (deviations <= 1)
+        return 5;
+    if (deviations <= 2)
+        return 3;
+    return 1;
+}
+/**
+ * Compute mean and standard deviation of non-zero buckets.
+ * @param buckets - 24-element array of request counts.
+ * @returns Object with mean and stddev of non-zero buckets.
+ */
+function bucketStats(buckets) {
+    const nonZero = buckets.filter((b) => b > 0);
+    if (nonZero.length === 0)
+        return { mean: 0, stddev: 0 };
+    const mean = nonZero.reduce((a, b) => a + b, 0) / nonZero.length;
+    const variance = nonZero.reduce((sum, b) => sum + (b - mean) ** 2, 0) / nonZero.length;
+    return { mean, stddev: Math.sqrt(variance) };
+}
+//# sourceMappingURL=activity-histogram.js.map

package/dist/server/activity-histogram.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-histogram.js","sourceRoot":"../src/","sources":["server/activity-histogram.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,kDAAkD;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA4B,EAC5B,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA4B,EAC5B,WAAmB;IAEnB,IAAI,SAAS,CAAC,aAAa,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAE1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAE1D,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAiB;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAExE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/server/aitm-heuristics.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Adversary-in-the-middle (AitM) heuristic engine. Pure module.
+ * Compares a bind-time fingerprint vs. current request, emits anomalies.
+ * trust-score subtracts the delta; device-telemetry surfaces the list.
+ */
+export interface ClientFingerprint {
+    userAgent: string;
+    language: string;
+    timezone: string;
+    colorDepth: number;
+    screenWidth: number;
+    screenHeight: number;
+    /** Optional — only present on protected routes that capture them. */
+    origin?: string;
+    sni?: string;
+    host?: string;
+    rttMs?: number;
+    /** True when TLS exporter binding succeeded for this request. */
+    channelBound?: boolean;
+}
+export type AitmAnomalyKind = 'origin_mismatch' | 'latency_floor' | 'ua_drift' | 'tz_drift' | 'color_drift' | 'resolution_swap' | 'locale_drift' | 'channel_unbound';
+export type AitmConfidence = 'low' | 'medium' | 'high';
+export interface AitmAnomaly {
+    kind: AitmAnomalyKind;
+    confidence: AitmConfidence;
+    details?: Record<string, unknown>;
+}
+export interface AitmEvalOptions {
+    /**
+     * Persistent latency floor delta (ms) above baseline that's considered
+     * suspicious. Default 40ms — typical AitM proxy adds at least this much
+     * even after EWMA smoothing.
+     */
+    rttFloorDeltaMs?: number;
+    /**
+     * When true, missing TLS-exporter binding emits `channel_unbound`.
+     * Default true. Disable on routes that don't require channel binding.
+     */
+    requireChannelBinding?: boolean;
+}
+/**
+ * Evaluate the eight AitM heuristics. Pure function.
+ *
+ * @param baseline - fingerprint captured at device-bind time
+ * @param current - fingerprint of the current request
+ * @param opts - thresholds (override per route / tenant)
+ * @returns list of anomalies; empty when nothing trips
+ */
+export declare function evaluateAitm(baseline: ClientFingerprint, current: ClientFingerprint, opts?: AitmEvalOptions): AitmAnomaly[];
+/**
+ * Convert anomalies to a trust-score delta. Negative number; used by
+ * TrustScoreEngine to drop score on suspicious sessions. Cap at -60 so
+ * a single anomalous request can never block a clean baseline outright
+ * — that's the trust score's job once it falls below `step_up_threshold`.
+ */
+export declare function aitmScoreDelta(anomalies: AitmAnomaly[]): number;
+//# sourceMappingURL=aitm-heuristics.d.ts.map

package/dist/server/aitm-heuristics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aitm-heuristics.d.ts","sourceRoot":"../src/","sources":["server/aitm-heuristics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,eAAe,GACf,UAAU,GACV,UAAU,GACV,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,iBAAiB,CAAC;AAEtB,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,eAAoB,GACzB,WAAW,EAAE,CA0Ff;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAQ/D"}

package/dist/server/aitm-heuristics.js

@@ -0,0 +1,120 @@
+/**
+ * Adversary-in-the-middle (AitM) heuristic engine. Pure module.
+ * Compares a bind-time fingerprint vs. current request, emits anomalies.
+ * trust-score subtracts the delta; device-telemetry surfaces the list.
+ */
+const DEFAULT_RTT_FLOOR_DELTA_MS = 40;
+/**
+ * Evaluate the eight AitM heuristics. Pure function.
+ *
+ * @param baseline - fingerprint captured at device-bind time
+ * @param current - fingerprint of the current request
+ * @param opts - thresholds (override per route / tenant)
+ * @returns list of anomalies; empty when nothing trips
+ */
+export function evaluateAitm(baseline, current, opts = {}) {
+    const out = [];
+    const rttFloorDelta = opts.rttFloorDeltaMs ?? DEFAULT_RTT_FLOOR_DELTA_MS;
+    const requireChannel = opts.requireChannelBinding ?? true;
+    if (current.origin && current.sni && current.host) {
+        const originHost = safeHost(current.origin);
+        const sni = current.sni.toLowerCase();
+        const host = current.host.toLowerCase();
+        const all = [originHost, sni, host].filter(Boolean);
+        const allMatch = all.every((h) => h === all[0]);
+        if (!allMatch) {
+            out.push({
+                kind: 'origin_mismatch',
+                confidence: 'high',
+                details: { origin: originHost, sni, host },
+            });
+        }
+    }
+    if (baseline.userAgent !== current.userAgent) {
+        out.push({
+            kind: 'ua_drift',
+            confidence: 'high',
+            details: { from: baseline.userAgent, to: current.userAgent },
+        });
+    }
+    if (baseline.timezone !== current.timezone) {
+        out.push({
+            kind: 'tz_drift',
+            confidence: 'medium',
+            details: { from: baseline.timezone, to: current.timezone },
+        });
+    }
+    if (baseline.language !== current.language) {
+        out.push({
+            kind: 'locale_drift',
+            confidence: 'medium',
+            details: { from: baseline.language, to: current.language },
+        });
+    }
+    if (baseline.colorDepth !== current.colorDepth) {
+        out.push({
+            kind: 'color_drift',
+            confidence: 'low',
+            details: { from: baseline.colorDepth, to: current.colorDepth },
+        });
+    }
+    const baseDim = `${baseline.screenWidth}x${baseline.screenHeight}`;
+    const curDim = `${current.screenWidth}x${current.screenHeight}`;
+    const swapped = baseline.screenWidth === current.screenHeight &&
+        baseline.screenHeight === current.screenWidth &&
+        baseline.screenWidth !== baseline.screenHeight;
+    if (swapped) {
+        out.push({
+            kind: 'resolution_swap',
+            confidence: 'medium',
+            details: { from: baseDim, to: curDim },
+        });
+    }
+    if (typeof baseline.rttMs === 'number' &&
+        typeof current.rttMs === 'number' &&
+        current.rttMs - baseline.rttMs >= rttFloorDelta) {
+        out.push({
+            kind: 'latency_floor',
+            confidence: 'medium',
+            details: {
+                baselineMs: baseline.rttMs,
+                currentMs: current.rttMs,
+                deltaMs: current.rttMs - baseline.rttMs,
+            },
+        });
+    }
+    if (requireChannel && current.channelBound === false) {
+        out.push({
+            kind: 'channel_unbound',
+            confidence: 'high',
+        });
+    }
+    return out;
+}
+/**
+ * Convert anomalies to a trust-score delta. Negative number; used by
+ * TrustScoreEngine to drop score on suspicious sessions. Cap at -60 so
+ * a single anomalous request can never block a clean baseline outright
+ * — that's the trust score's job once it falls below `step_up_threshold`.
+ */
+export function aitmScoreDelta(anomalies) {
+    let delta = 0;
+    for (const a of anomalies) {
+        if (a.confidence === 'high')
+            delta -= 25;
+        else if (a.confidence === 'medium')
+            delta -= 12;
+        else
+            delta -= 5;
+    }
+    return Math.max(delta, -60);
+}
+function safeHost(originUrl) {
+    try {
+        return new URL(originUrl).host.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=aitm-heuristics.js.map

package/dist/server/aitm-heuristics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aitm-heuristics.js","sourceRoot":"../src/","sources":["server/aitm-heuristics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkDH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA2B,EAC3B,OAA0B,EAC1B,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,0BAA0B,CAAC;IACzE,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,iBAAiB;gBACvB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAChE,MAAM,OAAO,GACX,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;QAC7C,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW;QAC7C,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,YAAY,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,aAAa,EAC/C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE;gBACP,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,OAAO,EAAE,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK;aACxC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAwB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM;YAAE,KAAK,IAAI,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,KAAK,IAAI,EAAE,CAAC;;YAC3C,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/server/bind-with-id-token.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Server-side device bind using an IdP-issued ID token.
+ *
+ * The device keypair is generated in the browser and is non-extractable, so
+ * the public key must originate there. The *identity*, however, should not:
+ * a browser holds only a publishable key and can assert any user id. Relaying
+ * the bind through your own backend — which holds a secret API key and already
+ * knows who is signed in — is what makes the resulting identity trustworthy.
+ *
+ * With an ID token attached, TokenForge verifies it against the workforce
+ * app's JWKS and records a `verified` identity. Without one, the bind still
+ * succeeds but is graded `attested` rather than `verified`.
+ */
+export interface BindWithIdTokenInput {
+    /** TokenForge API base, e.g. https://tokenforge-api.opensyber.cloud */
+    apiBase: string;
+    /** Secret `tf_` API key. Must never reach the browser. */
+    apiKey: string;
+    /** JWK exported from the browser's non-extractable device keypair. */
+    publicKey: string;
+    /** Your application's session identifier for this user. */
+    sessionId: string;
+    /** IdP-issued OIDC ID token. Omit for an `attested` bind. */
+    idToken?: string;
+    /** Workforce app the token was issued for. Required with `idToken`. */
+    workforceAppId?: string;
+    /** Your authenticated user id. Used when no ID token is supplied. */
+    userId?: string;
+    /** Optional device fingerprint from the browser SDK. */
+    fingerprint?: string;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+}
+export type BindWithIdTokenResult = {
+    ok: true;
+    deviceId: string;
+    sessionId: string;
+    expiresAt: string;
+    trustScore: number;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/**
+ * Bind a device from your backend, attaching a verified identity when possible.
+ *
+ * @param input Connection details plus the browser-generated public key.
+ * @returns The created device session, or a structured failure. Never throws
+ *   on an API error — network faults still reject.
+ * @throws {Error} When `idToken` is supplied without `workforceAppId`, which is
+ *   always a caller mistake rather than a runtime condition.
+ */
+export declare function bindDeviceWithIdToken(input: BindWithIdTokenInput): Promise<BindWithIdTokenResult>;
+//# sourceMappingURL=bind-with-id-token.d.ts.map

package/dist/server/bind-with-id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind-with-id-token.d.ts","sourceRoot":"../src/","sources":["server/bind-with-id-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAoDhC"}

package/dist/server/bind-with-id-token.js

@@ -0,0 +1,70 @@
+/**
+ * Server-side device bind using an IdP-issued ID token.
+ *
+ * The device keypair is generated in the browser and is non-extractable, so
+ * the public key must originate there. The *identity*, however, should not:
+ * a browser holds only a publishable key and can assert any user id. Relaying
+ * the bind through your own backend — which holds a secret API key and already
+ * knows who is signed in — is what makes the resulting identity trustworthy.
+ *
+ * With an ID token attached, TokenForge verifies it against the workforce
+ * app's JWKS and records a `verified` identity. Without one, the bind still
+ * succeeds but is graded `attested` rather than `verified`.
+ */
+/**
+ * Bind a device from your backend, attaching a verified identity when possible.
+ *
+ * @param input Connection details plus the browser-generated public key.
+ * @returns The created device session, or a structured failure. Never throws
+ *   on an API error — network faults still reject.
+ * @throws {Error} When `idToken` is supplied without `workforceAppId`, which is
+ *   always a caller mistake rather than a runtime condition.
+ */
+export async function bindDeviceWithIdToken(input) {
+    if (input.idToken && !input.workforceAppId) {
+        throw new Error('workforceAppId is required when idToken is supplied');
+    }
+    if (!input.idToken && !input.userId) {
+        throw new Error('either idToken or userId must be supplied');
+    }
+    const doFetch = input.fetchImpl ?? fetch;
+    const body = {
+        publicKey: input.publicKey,
+        sessionId: input.sessionId,
+    };
+    if (input.fingerprint)
+        body.fingerprint = input.fingerprint;
+    if (input.idToken) {
+        body.idToken = input.idToken;
+        body.workforceAppId = input.workforceAppId;
+        // The verified subject from the token supersedes this, but the field is
+        // required by the API contract.
+        body.userId = input.userId ?? 'pending-idp-resolution';
+    }
+    else {
+        body.userId = input.userId;
+        // A server-relayed bind is an explicit identity assertion, not the SDK's
+        // cookie fallback.
+        body.userIdSource = 'declared';
+    }
+    const res = await doFetch(`${input.apiBase.replace(/\/+$/, '')}/v1/bind`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${input.apiKey}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    const payload = (await res.json().catch(() => ({})));
+    if (!res.ok || !payload.data) {
+        return { ok: false, status: res.status, error: payload.error ?? 'bind_failed' };
+    }
+    return {
+        ok: true,
+        deviceId: payload.data.deviceId,
+        sessionId: payload.data.sessionId,
+        expiresAt: payload.data.expiresAt,
+        trustScore: payload.data.trustScore,
+    };
+}
+//# sourceMappingURL=bind-with-id-token.js.map

package/dist/server/bind-with-id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind-with-id-token.js","sourceRoot":"../src/","sources":["server/bind-with-id-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2BH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B;IAE3B,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAA4B;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,wEAAwE;QACxE,gCAAgC;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,wBAAwB,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC;IACjC,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGlD,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAClF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;QACjC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;QACjC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC"}

package/dist/server/bound-cookie.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Short-lived bound-cookie issuer for DBSC.
+ *
+ * Cookie value = base64url(random 32 bytes). We never store the value
+ * itself — only its SHA-256 hash. On every refresh the cookie rotates,
+ * so a leaked cookie expires within `maxAgeSeconds` and cannot be
+ * extended without a fresh JWS-signed refresh.
+ *
+ * The TLS-exporter binding hook is exposed but optional: workerd does
+ * not yet expose RFC 9266 channel-binding material, so we fall through
+ * gracefully and emit a `Sec-TF-Channel-Bound: 0` warning header at the
+ * route layer when the runtime cannot bind.
+ */
+export interface BoundCookie {
+    /** Opaque value sent to the client. */
+    value: string;
+    /** SHA-256 hash of value — store this, never the value. */
+    hash: string;
+    /** Max-Age in seconds. */
+    maxAgeSeconds: number;
+    /** Issued-at ISO timestamp. */
+    issuedAt: string;
+    /** Expires-at ISO timestamp. */
+    expiresAt: string;
+}
+export interface IssueBoundCookieOptions {
+    maxAgeSeconds?: number;
+    /**
+     * Optional RFC 9266 TLS exporter material. If present, the cookie
+     * hash mixes the exporter so a session can't be replayed across
+     * a different TLS connection.
+     */
+    tlsExporterHex?: string;
+}
+export declare function issueBoundCookie(opts?: IssueBoundCookieOptions): Promise<BoundCookie>;
+export declare function hashBoundCookie(value: string, tlsExporterHex?: string): Promise<string>;
+export declare function setBoundCookieHeader(cookie: BoundCookie): string;
+export declare const BOUND_COOKIE_NAME = "__Secure-tf-bound";
+//# sourceMappingURL=bound-cookie.d.ts.map

package/dist/server/bound-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-cookie.d.ts","sourceRoot":"../src/","sources":["server/bound-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7F;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAShE;AAED,eAAO,MAAM,iBAAiB,sBAAc,CAAC"}

package/dist/server/bound-cookie.js

@@ -0,0 +1,59 @@
+/**
+ * Short-lived bound-cookie issuer for DBSC.
+ *
+ * Cookie value = base64url(random 32 bytes). We never store the value
+ * itself — only its SHA-256 hash. On every refresh the cookie rotates,
+ * so a leaked cookie expires within `maxAgeSeconds` and cannot be
+ * extended without a fresh JWS-signed refresh.
+ *
+ * The TLS-exporter binding hook is exposed but optional: workerd does
+ * not yet expose RFC 9266 channel-binding material, so we fall through
+ * gracefully and emit a `Sec-TF-Channel-Bound: 0` warning header at the
+ * route layer when the runtime cannot bind.
+ */
+const COOKIE_BYTES = 32;
+const DEFAULT_MAX_AGE_SECONDS = 300;
+const COOKIE_NAME = '__Secure-tf-bound';
+export async function issueBoundCookie(opts = {}) {
+    const bytes = new Uint8Array(COOKIE_BYTES);
+    crypto.getRandomValues(bytes);
+    const value = bytesToBase64Url(bytes);
+    const hash = await hashWithExporter(value, opts.tlsExporterHex);
+    const maxAge = opts.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+    const issued = new Date();
+    const expires = new Date(issued.getTime() + maxAge * 1000);
+    return {
+        value,
+        hash,
+        maxAgeSeconds: maxAge,
+        issuedAt: issued.toISOString(),
+        expiresAt: expires.toISOString(),
+    };
+}
+export async function hashBoundCookie(value, tlsExporterHex) {
+    return hashWithExporter(value, tlsExporterHex);
+}
+export function setBoundCookieHeader(cookie) {
+    return [
+        `${COOKIE_NAME}=${cookie.value}`,
+        `Max-Age=${cookie.maxAgeSeconds}`,
+        'Path=/',
+        'HttpOnly',
+        'Secure',
+        'SameSite=Strict',
+    ].join('; ');
+}
+export const BOUND_COOKIE_NAME = COOKIE_NAME;
+async function hashWithExporter(value, exporterHex) {
+    const enc = new TextEncoder();
+    const input = exporterHex ? `${value}|${exporterHex}` : value;
+    const buf = await crypto.subtle.digest('SHA-256', enc.encode(input));
+    return bytesToBase64Url(new Uint8Array(buf));
+}
+function bytesToBase64Url(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=bound-cookie.js.map

package/dist/server/bound-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-cookie.js","sourceRoot":"../src/","sources":["server/bound-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAyBxC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO;QACL,KAAK;QACL,IAAI;QACJ,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE;QAC9B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,cAAuB;IAC1E,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,OAAO;QACL,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE;QAChC,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAE7C,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,WAA+B;IAC5E,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/cbor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal CBOR decoder — supports just enough of RFC 8949 to parse
+ * WebAuthn `attestationObject` and embedded COSE_Key structures.
+ *
+ * Supported major types:
+ *   0 (uint), 1 (negative int), 2 (byte string), 3 (text string),
+ *   4 (array), 5 (map).
+ * Unsupported: tags, floats, indefinite-length, simple values other than
+ * true/false/null.
+ *
+ * This is intentionally small (no npm dep) because the only inputs we ever
+ * decode are WebAuthn attestation blobs with a known structure. If you feed
+ * arbitrary CBOR you may hit `unsupported` errors — that is by design.
+ */
+export type CborValue = number | bigint | string | Uint8Array | boolean | null | CborValue[] | {
+    [key: string]: CborValue;
+} | Map<CborValue, CborValue>;
+/** Decode a CBOR-encoded buffer. Throws on unsupported encodings. */
+export declare function decodeCbor(input: ArrayBuffer | Uint8Array): CborValue;
+//# sourceMappingURL=cbor.d.ts.map

package/dist/server/cbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor.d.ts","sourceRoot":"../src/","sources":["server/cbor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC5B,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAI9B,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAKrE"}