@opensyber/tokenforge 1.0.0 → 1.1.0

package/dist/shared/identity.js

@@ -0,0 +1,176 @@
+/** Version marker for the canonical Cloud v2 bind identity envelope. */
+export const TOKENFORGE_IDENTITY_PROTOCOL = 'tf-identity-v1';
+const EXTERNAL_USER_REF_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const EXTERNAL_USER_REF_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,32}$/;
+const PROJECT_ID_PATTERN = /^[A-Za-z0-9_-]{8,256}$/;
+const SOURCE_PATTERN = /^[A-Za-z0-9._:-]{1,64}$/;
+const WORKFORCE_APP_ID_PATTERN = /^[A-Za-z0-9._:/-]{1,256}$/;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+const IDENTITY_KEYS = new Set([
+    'protocol',
+    'externalUserRef',
+    'externalUserRefVersion',
+    'profile',
+    'clearProfile',
+    'idToken',
+    'workforceAppId',
+    'userIdSource',
+]);
+const PROFILE_KEYS = new Set(['displayName', 'email']);
+const PROFILE_FIELD_KEYS = new Set(['displayName', 'email']);
+/**
+ * Derive a non-reversible, project-scoped user reference with HMAC-SHA-256.
+ * The dedicated secret must remain server-side and distinct from API keys.
+ */
+export async function deriveTokenForgeExternalUserRef(input) {
+    const version = input.version ?? 'v1';
+    if (!(input.correlationSecret instanceof Uint8Array) || input.correlationSecret.byteLength < 32) {
+        throw new Error('TokenForge correlation secret must contain at least 32 bytes');
+    }
+    if (!PROJECT_ID_PATTERN.test(input.projectId)) {
+        throw new Error('TokenForge project ID is invalid');
+    }
+    if (typeof input.canonicalUserId !== 'string' ||
+        input.canonicalUserId.length < 1 ||
+        input.canonicalUserId.length > 1024 ||
+        input.canonicalUserId !== input.canonicalUserId.trim() ||
+        containsControlCharacter(input.canonicalUserId)) {
+        throw new Error('TokenForge canonical user ID is invalid');
+    }
+    if (!EXTERNAL_USER_REF_VERSION_PATTERN.test(version)) {
+        throw new Error('TokenForge external user reference version is invalid');
+    }
+    if (!globalThis.crypto?.subtle) {
+        throw new Error('TokenForge correlation requires Web Crypto');
+    }
+    const key = await globalThis.crypto.subtle.importKey('raw', new Uint8Array(input.correlationSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const message = new TextEncoder().encode(`tokenforge:user:v1\0${input.projectId}\0${input.canonicalUserId}`);
+    const digest = await globalThis.crypto.subtle.sign('HMAC', key, message);
+    return {
+        externalUserRef: base64Url(new Uint8Array(digest)),
+        externalUserRefVersion: version,
+    };
+}
+/** Parse and validate an untrusted Cloud v2 identity envelope. */
+export function validateTokenForgeIdentity(input) {
+    const identity = requireRecord(input, 'TokenForge identity');
+    rejectUnknownKeys(identity, IDENTITY_KEYS, 'TokenForge identity');
+    if (identity.protocol !== TOKENFORGE_IDENTITY_PROTOCOL) {
+        throw new Error('Unsupported TokenForge identity protocol');
+    }
+    if (typeof identity.externalUserRef !== 'string' || !EXTERNAL_USER_REF_PATTERN.test(identity.externalUserRef)) {
+        throw new Error('TokenForge external user reference is invalid');
+    }
+    const output = {
+        protocol: TOKENFORGE_IDENTITY_PROTOCOL,
+        externalUserRef: identity.externalUserRef,
+    };
+    if (identity.externalUserRefVersion !== undefined) {
+        if (typeof identity.externalUserRefVersion !== 'string' ||
+            !EXTERNAL_USER_REF_VERSION_PATTERN.test(identity.externalUserRefVersion)) {
+            throw new Error('TokenForge external user reference version is invalid');
+        }
+        output.externalUserRefVersion = identity.externalUserRefVersion;
+    }
+    if (identity.profile !== undefined) {
+        output.profile = validateProfile(identity.profile);
+    }
+    if (identity.clearProfile !== undefined) {
+        output.clearProfile = validateClearProfile(identity.clearProfile);
+        for (const field of output.clearProfile) {
+            if (output.profile?.[field] !== undefined) {
+                throw new Error(`TokenForge identity cannot set and clear ${field}`);
+            }
+        }
+    }
+    if (identity.idToken !== undefined) {
+        output.idToken = requireBoundedString(identity.idToken, 'TokenForge ID token', 16_384);
+    }
+    if (identity.workforceAppId !== undefined) {
+        if (typeof identity.workforceAppId !== 'string' || !WORKFORCE_APP_ID_PATTERN.test(identity.workforceAppId)) {
+            throw new Error('TokenForge workforce application ID is invalid');
+        }
+        output.workforceAppId = identity.workforceAppId;
+    }
+    if (identity.userIdSource !== undefined) {
+        if (typeof identity.userIdSource !== 'string' || !SOURCE_PATTERN.test(identity.userIdSource)) {
+            throw new Error('TokenForge user ID source is invalid');
+        }
+        output.userIdSource = identity.userIdSource;
+    }
+    return output;
+}
+function validateClearProfile(input) {
+    if (!Array.isArray(input) || input.length < 1 || input.length > PROFILE_FIELD_KEYS.size) {
+        throw new Error('TokenForge clearProfile is invalid');
+    }
+    const fields = input.map((field) => {
+        if (typeof field !== 'string' || !PROFILE_FIELD_KEYS.has(field)) {
+            throw new Error('TokenForge clearProfile is invalid');
+        }
+        return field;
+    });
+    if (new Set(fields).size !== fields.length) {
+        throw new Error('TokenForge clearProfile contains duplicate fields');
+    }
+    return fields;
+}
+function validateProfile(input) {
+    const profile = requireRecord(input, 'TokenForge identity profile');
+    rejectUnknownKeys(profile, PROFILE_KEYS, 'TokenForge identity profile');
+    const output = {};
+    if (profile.displayName !== undefined) {
+        const displayName = requireBoundedString(profile.displayName, 'TokenForge display name', 200);
+        if (containsControlCharacter(displayName)) {
+            throw new Error('TokenForge display name contains control characters');
+        }
+        output.displayName = displayName;
+    }
+    if (profile.email !== undefined) {
+        const email = requireBoundedString(profile.email, 'TokenForge email', 254);
+        if (containsControlCharacter(email) || !EMAIL_PATTERN.test(email)) {
+            throw new Error('TokenForge email is invalid');
+        }
+        output.email = email;
+    }
+    if (output.displayName === undefined && output.email === undefined) {
+        throw new Error('TokenForge identity profile must contain displayName or email');
+    }
+    return output;
+}
+function containsControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function requireRecord(input, label) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error(`${label} must be an object`);
+    }
+    return input;
+}
+function rejectUnknownKeys(input, allowed, label) {
+    for (const key of Object.keys(input)) {
+        if (!allowed.has(key))
+            throw new Error(`${label} contains unsupported field: ${key}`);
+    }
+}
+function requireBoundedString(input, label, maxLength) {
+    if (typeof input !== 'string' ||
+        input.length < 1 ||
+        input.length > maxLength ||
+        input !== input.trim()) {
+        throw new Error(`${label} is invalid`);
+    }
+    return input;
+}
+function base64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+//# sourceMappingURL=identity.js.map

package/dist/shared/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"../src/","sources":["shared/identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAyB,CAAC;AAEtE,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AACnE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,iBAAiB;IACjB,wBAAwB;IACxB,SAAS;IACT,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AA+C7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiC;IAEjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IACE,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACzC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAChC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI;QACnC,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE;QACtD,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,IAAI,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACtC,uBAAuB,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,eAAe,EAAE,CACnE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO;QACL,eAAe,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAClD,sBAAsB,EAAE,OAAO;KAChC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC7D,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAElE,IAAI,QAAQ,CAAC,QAAQ,KAAK,4BAA4B,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAuB;QACjC,QAAQ,EAAE,4BAA4B;QACtC,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAC;IAEF,IAAI,QAAQ,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAClD,IACE,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;YACnD,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;IAClD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAuC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACpE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAE7C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC9F,IAAI,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,OAA4B,EAC5B,KAAa;IAEb,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IAC5E,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,GAAG,SAAS;QACxB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/shared/types-internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types-internal.d.ts","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAGA,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types-internal.d.ts","sourceRoot":"../src/","sources":["shared/types-internal.ts"],"names":[],"mappings":"AAGA,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/shared/types-internal.js.map

@@ -1 +1 @@
-{"version":3,"file":"types-internal.js","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sEAAsE"}
+{"version":3,"file":"types-internal.js","sourceRoot":"../src/","sources":["shared/types-internal.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sEAAsE"}

package/dist/shared/types.d.ts

@@ -16,12 +16,26 @@ export interface TokenForgeConfig {
         nonce?: string;
         timestamp?: string;
         deviceId?: string;
+        sessionId?: string;
+        version?: string;
+        bodyHash?: string;
     };
     /** Enable automatic fetch interception (default: true) */
     autoIntercept?: boolean;
     /** Paths to skip (no signing needed) */
     skipPaths?: string[];
 }
+export { TOKENFORGE_IDENTITY_PROTOCOL, deriveTokenForgeExternalUserRef, validateTokenForgeIdentity, } from './identity.js';
+export type { DerivedExternalUserRef, DeriveExternalUserRefInput, TokenForgeIdentity, TokenForgeIdentityAssurance, TokenForgeIdentityProfile, } from './identity.js';
+/** DBSC (Device Bound Session Credentials) configuration. */
+export interface DbscConfig {
+    /** Enable DBSC bound-cookie verification in the pipeline. */
+    enabled: boolean;
+    /** Cookie name (default: '__Secure-tf-bound'). */
+    cookieName?: string;
+    /** Cookie rotation interval in seconds (default: 300). */
+    rotationInterval?: number;
+}
 /** Configuration for the TokenForge server middleware */
 export interface TokenForgeServerOptions {
     storage: TokenForgeStorageRef;
@@ -35,10 +49,23 @@ export interface TokenForgeServerOptions {
     sessionMaxAge: number;
     /** Nonce expiry in seconds (default: 60) */
     nonceExpiry: number;
-    /** Paths that skip TokenForge verification */
+    /** Paths that skip TokenForge verification (public allowlist) */
     skipPaths?: string[];
     /** Paths requiring elevated trust (>90) */
     sensitiveOps?: string[];
+    /**
+     * Behavior when a request cannot be positively verified — missing
+     * signature on a protected (non-skip) path, or an unreachable/erroring
+     * verification backend.
+     *
+     * - `'closed'` (default): default-deny. Unsigned protected requests and
+     *   backend failures are REJECTED. This is the bulletproof posture.
+     * - `'open'`: legacy fail-open. Unsigned requests degrade through and
+     *   backend failures pass. Use only for staged rollout behind an alarm.
+     */
+    failMode?: 'closed' | 'open';
+    /** DBSC bound-cookie settings (disabled by default). */
+    dbsc?: DbscConfig;
     /** Called on security events */
     onSecurityEvent?: (event: SecurityEvent) => Promise<void>;
     /** Email delivery callback for OTP step-up */
@@ -62,6 +89,7 @@ export interface TokenForgeStorageRef {
     getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
     createSession(session: DeviceSession): Promise<void>;
     updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    updateBoundCookieHash(deviceId: string, hash: string, expiresAt: string): Promise<void>;
     revokeSession(deviceId: string, reason: string): Promise<void>;
     revokeUserSessions(userId: string): Promise<void>;
     listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
@@ -79,6 +107,14 @@ export interface TokenForgeStorageRef {
     getChallenge(challengeId: string, userId: string): Promise<unknown>;
     updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
     countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    getActivityHistogram(userId: string): Promise<{
+        buckets: number[];
+        totalRequests: number;
+    } | null>;
+    setActivityHistogram(userId: string, histogram: {
+        buckets: number[];
+        totalRequests: number;
+    }): Promise<void>;
     storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
     getOtp(challengeId: string): Promise<string | null>;
     deleteOtp(challengeId: string): Promise<void>;
@@ -96,7 +132,7 @@ export interface SecurityEvent {
     metadata: Record<string, unknown>;
 }
 /** All possible security event types */
-export type SecurityEventType = 'DEVICE_BOUND' | 'SIGNATURE_INVALID' | 'IP_CHANGE' | 'GEO_ANOMALY' | 'TRUST_DROP' | 'TRUST_SCORE_CHANGE' | 'SESSION_REVOKED' | 'SESSION_EXPIRED' | 'STEP_UP_TRIGGERED' | 'STEP_UP_COMPLETED' | 'STEP_UP_FAILED' | 'NONCE_REPLAY' | 'DEVICE_MISMATCH' | 'DEVICE_NOT_FOUND' | 'TIMESTAMP_SKEW';
+export type SecurityEventType = 'DEVICE_BOUND' | 'SIGNATURE_INVALID' | 'IP_CHANGE' | 'GEO_ANOMALY' | 'TRUST_DROP' | 'TRUST_SCORE_CHANGE' | 'SESSION_REVOKED' | 'SESSION_EXPIRED' | 'STEP_UP_TRIGGERED' | 'STEP_UP_COMPLETED' | 'STEP_UP_FAILED' | 'NONCE_REPLAY' | 'DEVICE_MISMATCH' | 'DEVICE_NOT_FOUND' | 'TIMESTAMP_SKEW' | 'DBSC_COOKIE_MISSING' | 'DBSC_COOKIE_INVALID';
 /** Signals used by the trust score engine */
 export interface TrustSignals {
     signatureValid: boolean;
@@ -108,6 +144,11 @@ export interface TrustSignals {
     originalFingerprint: string;
     requestTimestamp: number;
     sessionCreatedAt: number;
+    /** Activity histogram for time-of-day anomaly detection (optional). */
+    activityHistogram?: {
+        buckets: number[];
+        totalRequests: number;
+    };
 }
 /** Breakdown of trust score components */
 export interface ScoreBreakdown {
@@ -139,6 +180,10 @@ export interface DeviceSession {
     revoked: number;
     revoked_reason: string | null;
     created_at: string;
+    /** SHA-256 hash of the DBSC bound cookie (if DBSC enabled). */
+    bound_cookie_hash?: string | null;
+    /** ISO timestamp when the bound cookie expires. */
+    bound_cookie_expires_at?: string | null;
 }
 /** Default header names */
 export declare const TF_HEADERS: {

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"../src/","sources":["shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,wDAAwD;IACxD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7G,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}

package/dist/shared/types.js

@@ -1,4 +1,5 @@
 // ─── TokenForge Shared Types ───
+export { TOKENFORGE_IDENTITY_PROTOCOL, deriveTokenForgeExternalUserRef, validateTokenForgeIdentity, } from './identity.js';
 /** Default header names */
 export const TF_HEADERS = {
     SIGNATURE: 'X-TF-Signature',

package/dist/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAkKlC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"../src/","sources":["shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AA8BlC,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAkLvB,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensyber/tokenforge",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Device-bound session security — W3C DBSC + ECDSA P-256 signatures + AitM detection. Drop-in for Auth0 / Okta / Clerk / Entra ID.",
   "private": false,
   "type": "module",
@@ -40,18 +40,10 @@
       "import": "./dist/server/index.js",
       "types": "./dist/server/index.d.ts"
     },
-    "./server/internal": {
-      "import": "./dist/server/internal.js",
-      "types": "./dist/server/internal.d.ts"
-    },
     "./server/storage": {
       "import": "./dist/server/storage/index.js",
       "types": "./dist/server/storage/index.d.ts"
     },
-    "./storage/internal": {
-      "import": "./dist/server/storage/internal.js",
-      "types": "./dist/server/storage/internal.d.ts"
-    },
     "./webhooks": {
       "import": "./dist/server/webhooks.js",
       "types": "./dist/server/webhooks.d.ts"
@@ -64,6 +56,14 @@
       "import": "./dist/shared/types.js",
       "types": "./dist/shared/types.d.ts"
     },
+    "./identity": {
+      "import": "./dist/shared/identity.js",
+      "types": "./dist/shared/identity.d.ts"
+    },
+    "./protocol/v2": {
+      "import": "./dist/protocol/v2.js",
+      "types": "./dist/protocol/v2.d.ts"
+    },
     "./hono": {
       "import": "./dist/adapters/hono.js",
       "types": "./dist/adapters/hono.d.ts"
@@ -91,34 +91,9 @@
   },
   "files": [
     "dist",
-    "!dist/server/storage/d1.*",
-    "!dist/server/storage/postgres.*",
-    "!dist/server/storage/redis.*",
-    "!dist/server/storage/cloud.*",
-    "!dist/server/storage/internal.*",
-    "!dist/server/crypto.*",
-    "!dist/server/trust-score.*",
-    "!dist/server/verify.*",
-    "!dist/server/binding.*",
-    "!dist/server/step-up.*",
-    "!dist/server/totp.*",
-    "!dist/server/middleware-internal.*",
-    "!dist/server/internal.*",
-    "!dist/server/storage/**",
     "README.md",
     "LICENSE.md"
   ],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint",
-    "test": "vitest run",
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui",
-    "clean": "rm -rf dist .turbo",
-    "prepublishOnly": "pnpm run clean && pnpm run build"
-  },
   "dependencies": {
     "hono": "^4.12.14"
   },
@@ -129,18 +104,5 @@
     "react": {
       "optional": true
     }
-  },
-  "devDependencies": {
-    "@hono/node-server": "^1.19.13",
-    "@playwright/test": "^1.58.2",
-    "tsx": "^4.20.6",
-    "@cloudflare/workers-types": "^4.20250214.0",
-    "@eslint/js": "^9.39.0",
-    "@types/react": "^19.0.0",
-    "eslint": "^9",
-    "react": "^19.0.0",
-    "typescript": "^5.7.0",
-    "typescript-eslint": "^8.0.0",
-    "vitest": "^4.0.0"
   }
 }

package/dist/server/trust-score-fixtures.d.ts

@@ -1,9 +0,0 @@
-/**
- * Shared test signals for `trust-score.test.ts`.
- *
- * Pulled out so the test file fits the 200L cap. Pure factory — no
- * side effects, returns a TrustSignals shape with sensible defaults.
- */
-import type { TrustSignals } from '../shared/types.js';
-export declare function makeSignals(overrides?: Partial<TrustSignals>): TrustSignals;
-//# sourceMappingURL=trust-score-fixtures.d.ts.map

package/dist/server/trust-score-fixtures.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-score-fixtures.d.ts","sourceRoot":"","sources":["../../src/server/trust-score-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,WAAW,CAAC,SAAS,GAAE,OAAO,CAAC,YAAY,CAAM,GAAG,YAAY,CAc/E"}

package/dist/server/trust-score-fixtures.js

@@ -1,23 +0,0 @@
-/**
- * Shared test signals for `trust-score.test.ts`.
- *
- * Pulled out so the test file fits the 200L cap. Pure factory — no
- * side effects, returns a TrustSignals shape with sensible defaults.
- */
-import { hashFingerprint } from './trust-score.js';
-export function makeSignals(overrides = {}) {
-    const ua = 'Mozilla/5.0 TestAgent';
-    return {
-        signatureValid: true,
-        ipAddress: '192.168.1.10',
-        originalIp: '192.168.1.10',
-        countryCode: 'US',
-        originalCountry: 'US',
-        userAgent: ua,
-        originalFingerprint: hashFingerprint(ua),
-        requestTimestamp: 1000,
-        sessionCreatedAt: 900,
-        ...overrides,
-    };
-}
-//# sourceMappingURL=trust-score-fixtures.js.map

package/dist/server/trust-score-fixtures.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-score-fixtures.js","sourceRoot":"","sources":["../../src/server/trust-score-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,UAAU,WAAW,CAAC,YAAmC,EAAE;IAC/D,MAAM,EAAE,GAAG,uBAAuB,CAAC;IACnC,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,cAAc;QACzB,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,EAAE;QACb,mBAAmB,EAAE,eAAe,CAAC,EAAE,CAAC;QACxC,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,GAAG;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/server/webauthn-verify.test-helpers.d.ts

@@ -1,8 +0,0 @@
-/**
- * Test-only helpers — inverse of derToRawEcdsa for synthesizing valid
- * assertions in tests. NOT exported from the package.
- */
-export declare function makeP256Keypair(): Promise<CryptoKeyPair>;
-/** Convert raw r||s ECDSA signature into the DER form WebAuthn produces. */
-export declare function rawToDerEcdsa(raw: Uint8Array): Uint8Array;
-//# sourceMappingURL=webauthn-verify.test-helpers.d.ts.map

package/dist/server/webauthn-verify.test-helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn-verify.test-helpers.d.ts","sourceRoot":"","sources":["../../src/server/webauthn-verify.test-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAI9D;AAkBD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAYzD"}

package/dist/server/webauthn-verify.test-helpers.js

@@ -1,39 +0,0 @@
-/**
- * Test-only helpers — inverse of derToRawEcdsa for synthesizing valid
- * assertions in tests. NOT exported from the package.
- */
-export async function makeP256Keypair() {
-    return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
-}
-function stripLeading(b) {
-    let i = 0;
-    while (i < b.length - 1 && b[i] === 0)
-        i++;
-    return b.slice(i);
-}
-function derInteger(b) {
-    const first = b[0] ?? 0;
-    const needsPad = first & 0x80;
-    const content = needsPad ? new Uint8Array([0x00, ...b]) : b;
-    const out = new Uint8Array(2 + content.length);
-    out[0] = 0x02;
-    out[1] = content.length;
-    out.set(content, 2);
-    return out;
-}
-/** Convert raw r||s ECDSA signature into the DER form WebAuthn produces. */
-export function rawToDerEcdsa(raw) {
-    const r = stripLeading(raw.slice(0, 32));
-    const s = stripLeading(raw.slice(32, 64));
-    const rTLV = derInteger(r);
-    const sTLV = derInteger(s);
-    const body = new Uint8Array(rTLV.length + sTLV.length);
-    body.set(rTLV, 0);
-    body.set(sTLV, rTLV.length);
-    const out = new Uint8Array(2 + body.length);
-    out[0] = 0x30;
-    out[1] = body.length;
-    out.set(body, 2);
-    return out;
-}
-//# sourceMappingURL=webauthn-verify.test-helpers.js.map

package/dist/server/webauthn-verify.test-helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn-verify.test-helpers.js","sourceRoot":"","sources":["../../src/server/webauthn-verify.test-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAC9B,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}