open-index/open-npm huggingface dataset:
npm package: @sigil-security/client
Description: Experimental browser SDK — silent refresh, multi-tab sync, leader election, fetch interceptor
Latest version: 2.0.0

# @sigil-security/client

Experimental browser-side Sigil helpers.

## Status

This package is implemented and tested, but still published under the `experimental` tag.

## What it contains

- token storage helpers
- silent refresh controller
- multi-tab sync via BroadcastChannel and storage fallback
- leader election for coordinated refresh
- fetch interception and one-shot token helper

## Install

```bash
pnpm add @sigil-security/client
```

## Example

```ts
import { createSigilClient } from '@sigil-security/client'

const sigilClient = createSigilClient({
  autoStart: true,
  tokenEndpointPath: '/api/csrf/token',
  oneShotEndpointPath: '/api/csrf/one-shot',
})

await sigilClient.refreshToken(true)

const response = await sigilClient.fetch('/api/account', {
  method: 'POST',
  body: JSON.stringify({ displayName: 'Ada' }),
})
```

## Use it when

Use `client` if you want Sigil-managed token refresh and browser fetch wrapping. If you only need server-side enforcement, `@sigil-security/runtime` is enough.
npm package: @sigil-security/core
Description: Cryptographic request intent verification primitive — core
Latest version: 2.0.0

# @sigil-security/core

Low-level cryptographic primitives used by the higher Sigil layers.

## What it contains

- HKDF-based domain-separated key derivation
- HMAC token generation and validation
- constant-time comparison helpers
- one-shot token primitives with nonce-cache replay protection
- zero external runtime dependencies

## Install

```bash
pnpm add @sigil-security/core
```

## Example

```ts
import {
  WebCryptoCryptoProvider,
  createKeyring,
  getActiveKey,
  generateToken,
  validateToken,
} from '@sigil-security/core'

const provider = new WebCryptoCryptoProvider()
const masterSecret = new TextEncoder().encode(process.env.SIGIL_MASTER_SECRET!).buffer
const keyring = await createKeyring(provider, masterSecret, 1, 'csrf')
const key = getActiveKey(keyring)
if (key === undefined) throw new Error('missing active key')

const issued = await generateToken(provider, key)
if (!issued.success) throw new Error(issued.reason)

const validation = await validateToken(provider, keyring, issued.token)
```

## When to use it directly

Use `core` only if you are building a custom runtime, custom adapter, or doing low-level security experimentation. Most applications should start with `@sigil-security/runtime`.
npm package: @sigil-security/ops
Description: Experimental telemetry, monitoring, and anomaly detection — optional observability layer
Latest version: 2.0.0

# @sigil-security/ops

Experimental telemetry and observability helpers for Sigil.

## Status

This package is implemented and tested, but still published under the `experimental` tag.

## What it contains

- pluggable metrics collector interface
- no-op metrics collector
- anomaly detection helpers
- structured logger with secret redaction
- telemetry wrapper around a `SigilInstance`

## Install

```bash
pnpm add @sigil-security/ops
```

## Example

```ts
import { createTelemetryMiddleware, createNoopMetricsCollector } from '@sigil-security/ops'

const observedSigil = createTelemetryMiddleware(sigil, {
  metrics: createNoopMetricsCollector(),
})
```

## Use it when

Use `ops` when you want Sigil metrics and structured security logging without changing your runtime integration code.
npm package: @sigil-security/policy
Description: Validation policies for request metadata — Fetch Metadata, Origin, context binding
Latest version: 2.0.0

# @sigil-security/policy

Request-metadata policy building blocks for Sigil.

## What it contains

- Fetch Metadata validation
- Origin / Referer validation
- method and content-type policies
- client mode detection
- composable policy chains

## Install

```bash
pnpm add @sigil-security/policy
```

## Example

```ts
import {
  createFetchMetadataPolicy,
  createOriginPolicy,
  createPolicyChain,
} from '@sigil-security/policy'

const chain = createPolicyChain([
  createFetchMetadataPolicy({ legacyBrowserMode: 'degraded' }),
  createOriginPolicy({ allowedOrigins: ['https://app.example.com'] }),
])

const result = chain.validate({
  method: 'POST',
  origin: 'https://app.example.com',
  referer: null,
  secFetchSite: 'same-origin',
  secFetchMode: 'cors',
  secFetchDest: 'empty',
  contentType: 'application/json',
  tokenSource: { from: 'header', value: 'token' },
})
```

## When to use it directly

Use `policy` when you want to compose or test request-validation rules independently. Application teams usually consume these rules through `@sigil-security/runtime`.
npm package: @sigil-security/runtime
Description: Framework adapters — Express, Fastify, Elysia, native fetch
Latest version: 2.0.0

# @sigil-security/runtime

Framework-facing Sigil package for server integration.

## What it contains

- `createSigil()` orchestration entry point
- Express, Fastify, Elysia, and native Fetch adapters
- built-in token endpoint handling
- request metadata extraction and protection flow

## Install

```bash
pnpm add @sigil-security/runtime
```

Optional peer adapters:

```bash
pnpm add express
pnpm add fastify
pnpm add elysia
```

## Example

```ts
import express from 'express'
import { createSigil } from '@sigil-security/runtime'
import { createExpressMiddleware } from '@sigil-security/runtime/express'

const sigil = await createSigil({
  masterSecret: process.env.SIGIL_MASTER_SECRET!,
  allowedOrigins: ['https://app.example.com'],
  oneShotEnabled: true,
})

const app = express()
app.use(express.json())
app.use(createExpressMiddleware(sigil, {
  excludePaths: ['/health'],
}))
```

## Built-in endpoints

- `GET /api/csrf/token`
- `POST /api/csrf/one-shot` when `oneShotEnabled` is true

## Adapter imports

- `@sigil-security/runtime/express`
- `@sigil-security/runtime/fastify`
- `@sigil-security/runtime/elysia`
- `@sigil-security/runtime/fetch`

## Notes

- Oak and Hono adapters are intentionally not shipped right now.
- Most users should start here, then optionally add `@sigil-security/client` or `@sigil-security/ops`.