@opensyber/tokenforge 1.0.0 → 1.1.0

package/dist/server/dbsc-endpoint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * DBSC challenge endpoint — issues and consumes DBSC challenges.
+ * Mount at /api/tf/dbsc on the main Hono app alongside the binding routes.
+ */
+import { Hono } from 'hono';
+import type { TokenForgeServerOptions } from '../shared/types.js';
+interface Variables {
+    userId: string;
+    sessionId: string;
+}
+/**
+ * Create DBSC challenge routes.
+ * @param options - Server options (storage, DBSC config).
+ * @returns A Hono sub-app with /challenge (POST) and /verify (POST) routes.
+ */
+export declare function createDbscRoutes(options: TokenForgeServerOptions): Hono<{
+    Variables: Variables;
+}>;
+export {};
+//# sourceMappingURL=dbsc-endpoint.d.ts.map

package/dist/server/dbsc-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbsc-endpoint.d.ts","sourceRoot":"../src/","sources":["server/dbsc-endpoint.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAwDjG"}

package/dist/server/dbsc-endpoint.js

@@ -0,0 +1,85 @@
+/**
+ * DBSC challenge endpoint — issues and consumes DBSC challenges.
+ * Mount at /api/tf/dbsc on the main Hono app alongside the binding routes.
+ */
+import { Hono } from 'hono';
+import { issueChallenge, consumeChallenge } from './dbsc-challenge.js';
+import { issueBoundCookie, setBoundCookieHeader } from './bound-cookie.js';
+/**
+ * Adapter that bridges TokenForgeStorageRef to the ChallengeStore interface
+ * expected by the dbsc-challenge module.
+ */
+function makeChallengeStore(options) {
+    return {
+        async put(record) {
+            await options.storage.createChallenge(record);
+        },
+        async takeIfFresh(hash, now) {
+            // Use storage.getChallenge with hash as the ID lookup key.
+            // The memory storage and D1 storage both support this pattern.
+            const record = await options.storage.getChallenge(hash, '');
+            if (!record)
+                return null;
+            const typed = record;
+            if (new Date(typed.expiresAt) < now)
+                return null;
+            return record;
+        },
+    };
+}
+/**
+ * Create DBSC challenge routes.
+ * @param options - Server options (storage, DBSC config).
+ * @returns A Hono sub-app with /challenge (POST) and /verify (POST) routes.
+ */
+export function createDbscRoutes(options) {
+    const app = new Hono();
+    const store = makeChallengeStore(options);
+    /** POST /challenge — issue a new DBSC challenge for the client to sign. */
+    app.post('/challenge', async (c) => {
+        const userId = c.get('userId');
+        const sessionId = c.get('sessionId');
+        if (!userId || !sessionId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const body = await c.req.json().catch(() => ({}));
+        const purpose = body.purpose ?? 'refresh';
+        const result = await issueChallenge(store, {
+            tenantId: userId,
+            purpose,
+            sessionId,
+        });
+        return c.json({
+            challenge: result.challenge,
+            expiresAt: result.record.expiresAt,
+        });
+    });
+    /** POST /verify — consume a signed challenge and rotate the bound cookie. */
+    app.post('/verify', async (c) => {
+        const userId = c.get('userId');
+        const sessionId = c.get('sessionId');
+        if (!userId || !sessionId)
+            return c.json({ error: 'unauthorized' }, 401);
+        const body = await c.req.json();
+        if (!body.challenge)
+            return c.json({ error: 'missing_challenge' }, 400);
+        const purpose = body.purpose ?? 'refresh';
+        const result = await consumeChallenge(store, body.challenge, {
+            tenantId: userId,
+            purpose,
+            sessionId,
+        });
+        if (!result.ok)
+            return c.json({ error: result.reason }, 400);
+        // On successful verification, rotate the bound cookie
+        const deviceId = c.req.header('X-TF-Device-ID');
+        if (deviceId && options.dbsc?.enabled) {
+            const rotationInterval = options.dbsc.rotationInterval ?? 300;
+            const cookie = await issueBoundCookie({ maxAgeSeconds: rotationInterval });
+            await options.storage.updateBoundCookieHash(deviceId, cookie.hash, cookie.expiresAt);
+            c.header('Set-Cookie', setBoundCookieHeader(cookie));
+        }
+        return c.json({ verified: true });
+    });
+    return app;
+}
+//# sourceMappingURL=dbsc-endpoint.js.map

package/dist/server/dbsc-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbsc-endpoint.js","sourceRoot":"../src/","sources":["server/dbsc-endpoint.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAuB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAQ3E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAgC;IAC1D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG;YACzB,2DAA2D;YAC3D,+DAA+D;YAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,KAAK,GAAG,MAAkD,CAAC;YACjE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjD,OAAO,MAA4D,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAA4B,CAAC;IACjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE1C,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAoD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAuD,CAAA,CAAC,CAAC;QACxJ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE;YACzC,QAAQ,EAAE,MAAM;YAChB,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAuE,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3D,QAAQ,EAAE,MAAM;YAChB,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,sDAAsD;QACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/dbsc-verify.d.ts

@@ -0,0 +1,32 @@
+/**
+ * DBSC (Device Bound Session Credentials) verification for the
+ * verifyRequest pipeline. Additive check — never blocks when ECDSA
+ * already passed, but sets degraded status and rotation flags.
+ */
+import type { DbscConfig, DeviceSession } from '../shared/types.js';
+/** Result of the DBSC cookie verification step. */
+export interface DbscCheckResult {
+    /** Whether the bound cookie is valid. */
+    cookieValid: boolean;
+    /** Reason for degradation (if any). */
+    reason?: 'cookie_missing' | 'cookie_invalid';
+    /** True if the cookie should be rotated (near expiry). */
+    rotateCookie: boolean;
+}
+/**
+ * Parse a specific cookie value from a raw Cookie header string.
+ * @param cookieHeader - Raw `Cookie` header value (e.g. "a=1; b=2").
+ * @param name - Cookie name to look up.
+ * @returns The cookie value, or null if not found.
+ */
+export declare function parseCookie(cookieHeader: string | null, name: string): string | null;
+/**
+ * Run the DBSC bound-cookie check against a device session.
+ *
+ * @param cookieHeader - Raw Cookie header from the request.
+ * @param session - The device session (must include bound_cookie_hash).
+ * @param dbsc - DBSC configuration.
+ * @returns Check result with validity, reason, and rotation flag.
+ */
+export declare function verifyDbscCookie(cookieHeader: string | null, session: DeviceSession, dbsc: DbscConfig): Promise<DbscCheckResult>;
+//# sourceMappingURL=dbsc-verify.d.ts.map

package/dist/server/dbsc-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbsc-verify.d.ts","sourceRoot":"../src/","sources":["server/dbsc-verify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKpE,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,uCAAuC;IACvC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;IAC7C,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,eAAe,CAAC,CA0B1B"}

package/dist/server/dbsc-verify.js

@@ -0,0 +1,65 @@
+/**
+ * DBSC (Device Bound Session Credentials) verification for the
+ * verifyRequest pipeline. Additive check — never blocks when ECDSA
+ * already passed, but sets degraded status and rotation flags.
+ */
+import { hashBoundCookie, BOUND_COOKIE_NAME } from './bound-cookie.js';
+const DEFAULT_COOKIE_NAME = BOUND_COOKIE_NAME;
+const DEFAULT_ROTATION_INTERVAL = 300;
+/**
+ * Parse a specific cookie value from a raw Cookie header string.
+ * @param cookieHeader - Raw `Cookie` header value (e.g. "a=1; b=2").
+ * @param name - Cookie name to look up.
+ * @returns The cookie value, or null if not found.
+ */
+export function parseCookie(cookieHeader, name) {
+    if (!cookieHeader)
+        return null;
+    const pairs = cookieHeader.split(';');
+    for (const pair of pairs) {
+        const eqIdx = pair.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const key = pair.slice(0, eqIdx).trim();
+        if (key === name)
+            return pair.slice(eqIdx + 1).trim();
+    }
+    return null;
+}
+/**
+ * Run the DBSC bound-cookie check against a device session.
+ *
+ * @param cookieHeader - Raw Cookie header from the request.
+ * @param session - The device session (must include bound_cookie_hash).
+ * @param dbsc - DBSC configuration.
+ * @returns Check result with validity, reason, and rotation flag.
+ */
+export async function verifyDbscCookie(cookieHeader, session, dbsc) {
+    const cookieName = dbsc.cookieName ?? DEFAULT_COOKIE_NAME;
+    const rotationInterval = dbsc.rotationInterval ?? DEFAULT_ROTATION_INTERVAL;
+    const cookieValue = parseCookie(cookieHeader, cookieName);
+    if (!cookieValue) {
+        return { cookieValid: false, reason: 'cookie_missing', rotateCookie: false };
+    }
+    const storedHash = session.bound_cookie_hash;
+    if (!storedHash) {
+        return { cookieValid: false, reason: 'cookie_missing', rotateCookie: false };
+    }
+    const computedHash = await hashBoundCookie(cookieValue);
+    if (computedHash !== storedHash) {
+        return { cookieValid: false, reason: 'cookie_invalid', rotateCookie: false };
+    }
+    // Check if cookie is near expiry (< half rotation interval remaining)
+    const rotateCookie = isCookieNearExpiry(session.bound_cookie_expires_at, rotationInterval);
+    return { cookieValid: true, rotateCookie };
+}
+/** True when the cookie has less than half its rotation interval remaining. */
+function isCookieNearExpiry(expiresAt, rotationInterval) {
+    if (!expiresAt)
+        return true;
+    const expiresMs = new Date(expiresAt).getTime();
+    const now = Date.now();
+    const remainingSeconds = (expiresMs - now) / 1000;
+    return remainingSeconds < rotationInterval / 2;
+}
+//# sourceMappingURL=dbsc-verify.js.map

package/dist/server/dbsc-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbsc-verify.js","sourceRoot":"../src/","sources":["server/dbsc-verify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAYtC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,YAA2B,EAAE,IAAY;IACnE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAA2B,EAC3B,OAAsB,EACtB,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IAE5E,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,MAAM,YAAY,GAAG,kBAAkB,CACrC,OAAO,CAAC,uBAAuB,EAC/B,gBAAgB,CACjB,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CACzB,SAAoC,EACpC,gBAAwB;IAExB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,gBAAgB,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;IAClD,OAAO,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/server/identity-profile.d.ts

@@ -0,0 +1,18 @@
+import { type TokenForgeIdentity, type TokenForgeIdentityProfileField } from '../shared/identity.js';
+export interface ClearTokenForgeIdentityProfileOptions {
+    apiKey: string;
+    identity: TokenForgeIdentity;
+    apiBase?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+export interface ClearTokenForgeIdentityProfileResult {
+    externalUserRef: string;
+    cleared: TokenForgeIdentityProfileField[];
+}
+export declare class TokenForgeIdentityProfileRejectedError extends Error {
+}
+export declare class TokenForgeIdentityProfileUnavailableError extends Error {
+}
+export declare function clearTokenForgeIdentityProfile(options: ClearTokenForgeIdentityProfileOptions): Promise<ClearTokenForgeIdentityProfileResult>;
+//# sourceMappingURL=identity-profile.d.ts.map

package/dist/server/identity-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-profile.d.ts","sourceRoot":"../src/","sources":["server/identity-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACpC,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,qCAAqC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oCAAoC;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,qBAAa,sCAAuC,SAAQ,KAAK;CAAG;AACpE,qBAAa,yCAA0C,SAAQ,KAAK;CAAG;AAEvE,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,oCAAoC,CAAC,CA4E/C"}

package/dist/server/identity-profile.js

@@ -0,0 +1,113 @@
+import { validateTokenForgeIdentity, } from '../shared/identity.js';
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+const MAX_RESPONSE_BYTES = 64 * 1024;
+export class TokenForgeIdentityProfileRejectedError extends Error {
+}
+export class TokenForgeIdentityProfileUnavailableError extends Error {
+}
+export async function clearTokenForgeIdentityProfile(options) {
+    if (!/^tf_[0-9a-f]{32}$/.test(options.apiKey)) {
+        throw new TokenForgeIdentityProfileUnavailableError('TokenForge API key is invalid');
+    }
+    let identity;
+    try {
+        identity = validateTokenForgeIdentity(options.identity);
+    }
+    catch {
+        throw new TokenForgeIdentityProfileRejectedError('TokenForge profile clear request is invalid');
+    }
+    if (identity.profile !== undefined ||
+        !identity.clearProfile?.length ||
+        identity.idToken !== undefined ||
+        identity.workforceAppId !== undefined) {
+        throw new TokenForgeIdentityProfileRejectedError('TokenForge profile clear request is invalid');
+    }
+    const base = new URL(options.apiBase ?? DEFAULT_API_BASE);
+    if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash) {
+        throw new TokenForgeIdentityProfileUnavailableError('TokenForge API URL is invalid');
+    }
+    const request = options.fetch ?? globalThis.fetch;
+    const timeoutMs = Number.isSafeInteger(options.timeoutMs) && (options.timeoutMs ?? 0) > 0
+        ? options.timeoutMs
+        : 1500;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await request(new URL('/v2/identity/profile', base), {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${options.apiKey}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ identity }),
+            signal: controller.signal,
+        });
+        const raw = await readBoundedResponse(response, MAX_RESPONSE_BYTES);
+        if (!response.ok) {
+            if (response.status >= 400 && response.status < 500 && response.status !== 429) {
+                throw new TokenForgeIdentityProfileRejectedError('TokenForge profile clear was rejected');
+            }
+            throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear is unavailable');
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear response is invalid');
+        }
+        const data = parsed.data;
+        if (!data ||
+            data.externalUserRef !== identity.externalUserRef ||
+            !Array.isArray(data.cleared) ||
+            data.cleared.length !== identity.clearProfile.length ||
+            !data.cleared.every((field, index) => field === identity.clearProfile?.[index])) {
+            throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear response is invalid');
+        }
+        return data;
+    }
+    catch (error) {
+        if (error instanceof TokenForgeIdentityProfileRejectedError ||
+            error instanceof TokenForgeIdentityProfileUnavailableError) {
+            throw error;
+        }
+        throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear is unavailable');
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function readBoundedResponse(response, limit) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > limit) {
+                await reader.cancel();
+                throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear response is invalid');
+            }
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        if (error instanceof TokenForgeIdentityProfileUnavailableError)
+            throw error;
+        throw new TokenForgeIdentityProfileUnavailableError('TokenForge profile clear response is invalid');
+    }
+    const joined = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(joined);
+}
+//# sourceMappingURL=identity-profile.js.map

package/dist/server/identity-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-profile.js","sourceRoot":"../src/","sources":["server/identity-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAClE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAerC,MAAM,OAAO,sCAAuC,SAAQ,KAAK;CAAG;AACpE,MAAM,OAAO,yCAA0C,SAAQ,KAAK;CAAG;AAEvE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAA8C;IAE9C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,yCAAyC,CAAC,+BAA+B,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sCAAsC,CAAC,6CAA6C,CAAC,CAAC;IAClG,CAAC;IACD,IACE,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM;QAC9B,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,QAAQ,CAAC,cAAc,KAAK,SAAS,EACrC,CAAC;QACD,MAAM,IAAI,sCAAsC,CAAC,6CAA6C,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7F,MAAM,IAAI,yCAAyC,CAAC,+BAA+B,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC;QACvF,CAAC,CAAC,OAAO,CAAC,SAAmB;QAC7B,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/E,MAAM,IAAI,sCAAsC,CAAC,uCAAuC,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,yCAAyC,CAAC,yCAAyC,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yCAAyC,CAAC,8CAA8C,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAiE,CAAC;QAC9G,IACE,CAAC,IAAI;YACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAAC,MAAM;YACpD,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAC/E,CAAC;YACD,MAAM,IAAI,yCAAyC,CAAC,8CAA8C,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAA4C,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,sCAAsC;YACvD,KAAK,YAAY,yCAAyC,EAC1D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,yCAAyC,CAAC,yCAAyC,CAAC,CAAC;IACjG,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,KAAa;IAClE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,yCAAyC,CAAC,8CAA8C,CAAC,CAAC;YACtG,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yCAAyC;YAAE,MAAM,KAAK,CAAC;QAC5E,MAAM,IAAI,yCAAyC,CAAC,8CAA8C,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/server/index.d.ts

@@ -2,4 +2,14 @@ export { tokenForgeMiddleware } from './middleware.js';
 export type { TokenForgeOptions } from './middleware.js';
 export { verifyWebAuthnAttestation, verifyWebAuthnAssertion, verifyClientDataJSON, } from './webauthn-verify.js';
 export type { AttestationVerifyResult } from './webauthn-verify.js';
+export { bindDeviceWithIdToken } from './bind-with-id-token.js';
+export type { BindWithIdTokenInput, BindWithIdTokenResult, } from './bind-with-id-token.js';
+export { createTokenForgeCloudBindHandler } from './cloud-bind.js';
+export type { CloudBindHandlerOptions, CloudBinding, CloudBindingStore, CloudIdentityResolver, CloudSession, CloudSessionResolver, TokenForgeCloudMode, } from './cloud-bind.js';
+export { readTokenForgeProof, verifyTokenForgeCloudRequest, } from './cloud-verify.js';
+export { clearTokenForgeIdentityProfile, TokenForgeIdentityProfileRejectedError, TokenForgeIdentityProfileUnavailableError, } from './identity-profile.js';
+export type { ClearTokenForgeIdentityProfileOptions, ClearTokenForgeIdentityProfileResult, } from './identity-profile.js';
+export { createTokenForgeCloudMiddleware } from './cloud-middleware.js';
+export type { CloudCircuitState, CloudTelemetryEvent, CloudTelemetryHook, CloudVerifyDecision, TokenForgeCloudMiddlewareOptions, TokenForgeRequestHandler, } from './cloud-middleware.js';
+export type { CloudReplayStore, CloudVerificationBindingStore, CloudVerifyOptions, TokenForgeLocalVerification, TokenForgeProofWithSignature, } from './cloud-verify.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../src/","sources":["server/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EACV,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EACV,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,yCAAyC,GAC1C,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC"}

package/dist/server/index.js

@@ -5,4 +5,9 @@
 export { tokenForgeMiddleware } from './middleware.js';
 // FIDO2/WebAuthn server-side verification (Sprint E1).
 export { verifyWebAuthnAttestation, verifyWebAuthnAssertion, verifyClientDataJSON, } from './webauthn-verify.js';
+export { bindDeviceWithIdToken } from './bind-with-id-token.js';
+export { createTokenForgeCloudBindHandler } from './cloud-bind.js';
+export { readTokenForgeProof, verifyTokenForgeCloudRequest, } from './cloud-verify.js';
+export { clearTokenForgeIdentityProfile, TokenForgeIdentityProfileRejectedError, TokenForgeIdentityProfileUnavailableError, } from './identity-profile.js';
+export { createTokenForgeCloudMiddleware } from './cloud-middleware.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,+EAA+E;AAC/E,oFAAoF;AACpF,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,uDAAuD;AACvD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"../src/","sources":["server/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,+EAA+E;AAC/E,oFAAoF;AACpF,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,uDAAuD;AACvD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAMhE,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAC;AAWnE,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,yCAAyC,GAC1C,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/server/jws-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jws-verify.d.ts","sourceRoot":"","sources":["../../src/server/jws-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlC,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CA0C1B"}
+{"version":3,"file":"jws-verify.d.ts","sourceRoot":"../src/","sources":["server/jws-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlC,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CA0C1B"}

package/dist/server/jws-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"jws-verify.js","sourceRoot":"","sources":["../../src/server/jws-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,OAA6B,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAE3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"jws-verify.js","sourceRoot":"../src/","sources":["server/jws-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,OAA6B,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAE3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/dist/server/middleware.d.ts

@@ -13,6 +13,15 @@ export interface TokenForgeOptions {
     allowThreshold?: number;
     /** Trust score threshold for step-up (default: 40). */
     stepUpThreshold?: number;
+    /**
+     * Behavior when the request cannot be positively verified — missing TF
+     * headers on a protected path, or an unreachable/erroring TokenForge API.
+     *
+     * - `'closed'` (default): default-deny. Reject with 401 (missing binding)
+     *   or 503 (backend unavailable). Bulletproof posture.
+     * - `'open'`: legacy fail-open — degrade through. Staged rollout only.
+     */
+    failMode?: 'closed' | 'open';
 }
 /**
  * TokenForge Hono middleware — verifies device-bound sessions via the

package/dist/server/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAgFnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,iBAAiB,CAcxF;AAED,gBAAgB;AAChB,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAMtE;AAED,gBAAgB;AAChB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAaT"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/","sources":["server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC9B;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAwGnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,iBAAiB,CAcxF;AAsBD,gBAAgB;AAChB,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAMtE;AAED,gBAAgB;AAChB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAaT"}

package/dist/server/middleware.js

@@ -11,6 +11,7 @@ export function tokenForgeMiddleware(options) {
     const apiBase = options.apiBase ?? DEFAULT_API_BASE;
     const allowThreshold = options.allowThreshold ?? 80;
     const stepUpThreshold = options.stepUpThreshold ?? 40;
+    const failMode = options.failMode ?? 'closed';
     return async (c, next) => {
         if (shouldSkip(c.req.path, options.skipPaths))
             return next();
@@ -20,30 +21,52 @@ export function tokenForgeMiddleware(options) {
             timestamp: c.req.header('X-TF-Timestamp') ?? null,
             deviceId: c.req.header('X-TF-Device-ID') ?? null,
         };
+        // Default-deny: a protected path (not in skipPaths) with no TF headers
+        // cannot be verified. Reject locally before spending an API round-trip.
+        if (!headers.signature || !headers.nonce || !headers.timestamp || !headers.deviceId) {
+            if (failMode === 'open') {
+                c.set('tf', { bound: false, trustScore: 0, deviceId: null });
+                return next();
+            }
+            return c.json({
+                error: 'device_binding_required',
+                action: 'bind',
+                message: 'This operation requires device verification',
+            }, 401);
+        }
         // Call TokenForge API for verification
-        const res = await fetch(`${apiBase}/v1/edge/verify`, {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${options.apiKey}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                path: c.req.path,
-                method: c.req.method,
-                headers,
-                ipAddress: c.req.header('cf-connecting-ip')
-                    ?? c.req.header('x-forwarded-for') ?? '',
-                countryCode: c.req.header('cf-ipcountry') ?? '',
-                userAgent: c.req.header('user-agent') ?? '',
-            }),
-        });
+        let res;
+        try {
+            res = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path: c.req.path,
+                    method: c.req.method,
+                    headers,
+                    ipAddress: c.req.header('cf-connecting-ip')
+                        ?? c.req.header('x-forwarded-for') ?? '',
+                    countryCode: c.req.header('cf-ipcountry') ?? '',
+                    userAgent: c.req.header('user-agent') ?? '',
+                }),
+            });
+        }
+        catch (err) {
+            // Network failure reaching the verification backend.
+            return handleUnavailable(c, next, failMode, `fetch: ${String(err)}`);
+        }
         if (!res.ok) {
-            // API unreachable — degrade gracefully
-            console.error('[TokenForge] API error:', res.status);
-            c.set('tf', { bound: false, trustScore: 0, deviceId: null });
-            return next();
+            return handleUnavailable(c, next, failMode, `status ${res.status}`);
         }
         const { data } = (await res.json());
+        // Backend could not complete verification. Under fail-closed this must
+        // NOT pass — an unverifiable session is treated as unavailable.
+        if (data.status === 'degraded') {
+            return handleUnavailable(c, next, failMode, 'edge_degraded');
+        }
         if (data.status === 'block') {
             return c.json({
                 error: 'session_blocked',
@@ -104,6 +127,23 @@ export function requireFreshSig(opts = {}) {
         await next();
     };
 }
+/**
+ * Handle an unverifiable request caused by a backend failure (network error,
+ * non-2xx, or `degraded` verdict). Fail-closed → 503; fail-open → proceed.
+ * @internal
+ */
+function handleUnavailable(c, next, failMode, detail) {
+    console.error('[TokenForge] verification unavailable:', detail);
+    if (failMode === 'open') {
+        c.set('tf', { bound: false, trustScore: 0, deviceId: null });
+        return next();
+    }
+    return c.json({
+        error: 'verification_unavailable',
+        action: 'retry',
+        message: 'Session verification is temporarily unavailable',
+    }, 503);
+}
 /** @internal */
 export function shouldSkip(path, skipPaths) {
     if (!skipPaths)

package/dist/server/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AA8BlE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAEtD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;SACjD,CAAC;QAEF,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;uBACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;gBAC1C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;gBAC/C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;aAC5C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,uCAAuC;YACvC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YACD,oDAAoD;QACtD,CAAC;QAED,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;eAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,EACvB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAoB;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,YAAuB;IAEvB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"../src/","sources":["server/middleware.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAuClE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAE9C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;SACjD,CAAC;QAEF,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,6CAA6C;aACvD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,uCAAuC;QACvC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;oBAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;oBACpB,OAAO;oBACP,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;2BACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC1C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBAC/C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBAC5C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YACD,oDAAoD;QACtD,CAAC;QAED,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;eAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,EACvB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,CAAU,EAAE,IAAU,EAAE,QAA2B,EAAE,MAAc;IAEnE,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,iDAAiD;KAC3D,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAoB;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,YAAuB;IAEvB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/oidc-verify.d.ts

@@ -20,6 +20,8 @@ export interface OidcClaims {
     email?: string;
     name?: string;
     groups?: string[];
+    /** Google Workspace hosted domain. Absent for personal Google accounts. */
+    hd?: string;
     [key: string]: unknown;
 }
 export interface JwksKey {
@@ -34,8 +36,21 @@ export interface JwksKey {
     y?: string;
 }
 export interface VerifyOidcOptions {
-    expectedIssuer: string;
+    /**
+     * Accepted `iss` value(s). A list is required because Google issues ID tokens
+     * with either `https://accounts.google.com` or the bare `accounts.google.com`
+     * — both documented as valid — so strict equality against one form rejects
+     * a large share of legitimate Google tokens.
+     */
+    expectedIssuer: string | string[];
     expectedAudience: string;
+    /**
+     * Required Google Workspace hosted domain (`hd` claim). When set, a token
+     * without a matching `hd` is rejected: a Workspace app that skips this check
+     * accepts any Google account, including personal gmail.com, as a verified
+     * corporate identity.
+     */
+    expectedHostedDomain?: string;
     jwks: {
         keys: JwksKey[];
     };