@bajustone/fortress 1.0.0-rc.1

package/dist/express.d.cts

@@ -0,0 +1,333 @@
+export { C as ConvertRoutesOptions, E as ExternalRoute, T as ToJSONSchemaConverter, c as convertRoutes } from './convert-routes-BdMvP2_X.cjs';
+import { F as Fortress } from './fortress-BmSvFfqK.cjs';
+import { D as DatabaseAdapter } from './index-CxEkfCA0.cjs';
+import { M as MiddlewareDefinition, E as EndpointDefinition, S as StandardSchemaV1 } from './config-GtlVt6ZD.cjs';
+import { S as Subject, T as TokenClaims } from './types-et0R8tsC.cjs';
+import { P as ProtectedRouteContext, a as ProtectOptions } from './protect-D1v_0upK.cjs';
+export { b as ProtectedRouteTarget } from './protect-D1v_0upK.cjs';
+import './index-D054pcb-.cjs';
+import './auth-service-BcyQ2PuZ.cjs';
+import './plugins/api-key.cjs';
+import './jwt.cjs';
+import './plugins/audit-log.cjs';
+import './plugins/data-isolation.cjs';
+import './plugins/email-verification.cjs';
+import './plugins/magic-link.cjs';
+import './plugins/oauth.cjs';
+import './plugins/social-login.cjs';
+import './plugins/tenancy.cjs';
+import './plugins/two-factor.cjs';
+import './plugins/webauthn.cjs';
+import '@simplewebauthn/server';
+
+/**
+ * Fortress-specific fields attached to the Express `Request` by
+ * {@link createAuthMiddleware}. Exported so host apps can declaration-merge
+ * them into express's native `Request` type for typed access without casts.
+ *
+ * @example
+ * ```ts
+ * // src/types/express.d.ts
+ * import type { FortressExpressFields } from '@bajustone/fortress/express';
+ *
+ * declare module 'express-serve-static-core' {
+ *   interface Request extends FortressExpressFields {}
+ * }
+ * ```
+ */
+interface FortressExpressFields {
+    /**
+     * The resolved principal — set for every authenticated request regardless
+     * of credential type (JWT, api-key, future OAuth client_credentials, mTLS).
+     */
+    fortressSubject?: Subject;
+    /**
+     * Convenience alias — populated **only** when the subject is a `USER`.
+     * Non-USER subjects (e.g. `SERVICE_ACCOUNT` via api-key) leave this
+     * undefined; fall back to {@link fortressSubject}.
+     */
+    fortressUserId?: string;
+    fortressClaims?: TokenClaims;
+    fortressScopes?: string[] | null;
+    fortressDb?: DatabaseAdapter;
+    fortressGetScopedDb?: (model: string) => Promise<DatabaseAdapter>;
+}
+/** Minimal Express request shape fortress reads from. Compatible with any modern Express version. */
+interface ExpressRequest extends FortressExpressFields {
+    headers: Record<string, string | string[] | undefined>;
+    method: string;
+    /** Express's route path without the query string. */
+    path: string;
+    /** Original path including query string, when supplied by Express. */
+    originalUrl?: string;
+    /** Node/Express request URL fallback, usually including the query string. */
+    url?: string;
+    /** Resolved request protocol (`http`/`https`) when supplied by Express. */
+    protocol?: string;
+    /** Parsed request body, if body middleware ran before this slot. */
+    body?: unknown;
+}
+/** Minimal Express response shape fortress writes to. */
+interface ExpressResponse {
+    status: (code: number) => ExpressResponse;
+    json: (body: unknown) => void;
+    setHeader: (name: string, value: string) => void;
+}
+/** The `next(err?)` callback Express middleware signs off with. */
+type ExpressNextFunction = (err?: unknown) => void;
+/** Express middleware signature fortress's adapter exports use. */
+type ExpressMiddleware = (req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void;
+/** A `(resource, action)` IAM mapping for an HTTP route. */
+interface RouteMapping {
+    resource: string;
+    action: string;
+}
+/** Options accepted by {@link createRbacMiddleware} (and the express adapter factory). */
+interface RbacOptions {
+    routeMap?: Record<string, RouteMapping>;
+    mapRequest?: (method: string, path: string) => RouteMapping | null;
+    skipPaths?: string[];
+    /**
+     * Behavior when a non-skipped route matches no `routeMap`/`mapRequest`
+     * entry. `'allow'` (default) treats it as public; `'deny'` fails closed
+     * with a 403 so a forgotten mapping can't silently expose a user route.
+     * List genuinely public routes in {@link RbacOptions.skipPaths} when using
+     * `'deny'`.
+     */
+    unmappedRoutes?: 'allow' | 'deny';
+}
+/**
+ * Build the Express auth middleware. Resolves the request principal via
+ * `fortress.resolvePrincipal`, which tries plugin `resolvePrincipal` hooks
+ * (api-key, future OAuth client_credentials, mTLS) first and then falls
+ * back to the JWT bearer token (cookie-first, `Authorization: Bearer`
+ * second). Populates `fortressSubject`, `fortressUserId` (USER alias),
+ * `fortressClaims`, `fortressDb`, and `fortressGetScopedDb` on the request.
+ */
+declare function createAuthMiddleware(fortress: Fortress): ExpressMiddleware;
+/** Options accepted by {@link createCsrfMiddleware}. */
+interface CsrfConfig {
+    /** Header name required on unsafe methods. Default: `X-Fortress-CSRF`. */
+    headerName?: string;
+    /** Paths/subtrees exempt from CSRF checking. A trailing `/*` is accepted. */
+    skipPaths?: string[];
+    /** Methods exempt from CSRF checking. Default: GET, HEAD, OPTIONS. */
+    safeMethods?: string[];
+}
+/**
+ * Build standalone Express CSRF middleware for host-owned routes. Fortress-
+ * managed routes already enforce cookie-aware CSRF inside `handleRequest`.
+ * This middleware uses the custom-header strategy and rejects cross-site
+ * browser requests on unsafe methods.
+ */
+declare function createCsrfMiddleware(config?: CsrfConfig): ExpressMiddleware;
+/**
+ * Build the Express RBAC middleware for **user-owned routes**. Resolves a
+ * `(resource, action)` mapping via `routeMap` / `mapRequest` and enforces
+ * the IAM permission check. Fortress-managed routes (`/auth/*`, `/iam/*`,
+ * plugin paths) are protected automatically inside `fortress.handleRequest`
+ * — this middleware only handles routes the caller registered themselves.
+ */
+declare function createRbacMiddleware(fortress: Fortress, options?: RbacOptions): ExpressMiddleware;
+/**
+ * Build the Express error handler. Translates {@link FortressError} into the
+ * appropriate HTTP response with `Retry-After` for rate-limited responses,
+ * and returns a generic 500 for everything else.
+ *
+ * Stays synchronous so it composes naturally with Express's `(err, req,
+ * res, next)` signature. Shares the response *shape* with core's
+ * `errorToResponse` via {@link FortressError.toJSON}. When a `Fortress`
+ * instance is provided, unhandled errors are routed to its configured
+ * {@link FortressLogger}; otherwise they're silently swallowed (matching
+ * the silent-by-default posture of the library).
+ */
+declare function createErrorHandler(fortress?: Fortress): (err: unknown, req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void;
+/**
+ * Express middleware that executes plugin-defined middleware for a given
+ * position (`before-auth`, `after-auth`, `after-rbac`). Used internally by
+ * {@link createExpressMiddleware}; expose if you want to mount the plugin
+ * middleware slots manually.
+ */
+declare function createExpressPluginMiddleware(fortress: Fortress, position: MiddlewareDefinition['position']): ExpressMiddleware;
+/** Options for {@link createExpressMiddleware}. Extends {@link RbacOptions}. */
+interface ExpressAdapterOptions extends RbacOptions {
+    /** Standalone CSRF middleware options for host-owned Express routes. */
+    csrf?: CsrfConfig;
+}
+/**
+ * Build the full set of fortress Express middleware: auth, CSRF, RBAC, error
+ * handler, and the three plugin middleware slots (`beforeAuth`, `afterAuth`,
+ * `afterRbac`). Mount each in the corresponding place in your Express app.
+ */
+declare function createExpressMiddleware(fortress: Fortress, options?: ExpressAdapterOptions): {
+    authMiddleware: ExpressMiddleware;
+    csrfMiddleware: ExpressMiddleware;
+    rbacMiddleware: ExpressMiddleware;
+    errorHandler: ReturnType<typeof createErrorHandler>;
+    pluginMiddleware: {
+        beforeAuth: ExpressMiddleware;
+        afterAuth: ExpressMiddleware;
+        afterRbac: ExpressMiddleware;
+    };
+};
+/**
+ * Read the resolved request principal. Works for every subject kind
+ * (`USER`, `SERVICE_ACCOUNT`, ...). Throws 401 if the auth middleware did
+ * not run or no credential was present.
+ */
+declare function getSubject(req: ExpressRequest): Subject;
+/**
+ * Read the authenticated user ID. Throws 401 if the request was
+ * authenticated by a non-USER subject (e.g. a service account via
+ * api-key) — use {@link getSubject} for handlers that accept any
+ * principal.
+ */
+declare function getUserId(req: ExpressRequest): string;
+/**
+ * Read the verified JWT claims. Only populated when the request was
+ * authenticated via a JWT — api-key principals have no JWT claims and
+ * this helper throws 401.
+ */
+declare function getClaims(req: ExpressRequest): TokenClaims;
+/** Read the per-request fortress database adapter (with plugin wrappers applied). */
+declare function getDb(req: ExpressRequest): DatabaseAdapter;
+/** Read the per-request fortress database adapter scoped to a specific model (applies any active row-level scope rules). */
+declare function getScopedDb(req: ExpressRequest, model: string): Promise<DatabaseAdapter>;
+
+/**
+ * Modern entry point for the Express adapter: register a single fortress
+ * middleware that detects Fortress-managed paths and delegates to
+ * `fortress.handleRequest`.
+ *
+ * Bridges Express's `(req, res, next)` callback style to/from web-standard
+ * `Request`/`Response`. User routes registered before `mountFortress` keep
+ * working — Express's middleware order means earlier handlers win.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { mountFortress } from '@bajustone/fortress/express';
+ *
+ * const app = express();
+ * app.use(express.json());
+ * mountFortress(app, fortress);
+ * ```
+ */
+
+interface ExpressApp {
+    use: (path: string | ExpressMiddleware, handler?: ExpressMiddleware) => void;
+}
+/** Options for {@link mountFortress}. */
+interface MountFortressOptions {
+    /** Optional path prefix (e.g. `/api`). Stripped before delegating to core. */
+    prefix?: string;
+}
+/**
+ * Mount a single Express middleware that delegates Fortress-managed paths to
+ * `fortress.handleRequest` and otherwise calls `next()` so user routes run
+ * normally.
+ *
+ * Cookies emitted by login/refresh/impersonate are passed through verbatim
+ * via `Set-Cookie` headers, the way the browser expects them.
+ */
+declare function mountFortress(app: ExpressApp, fortress: Fortress, options?: MountFortressOptions): void;
+
+/**
+ * Express-flavoured host callback. `E` flows in from the endpoint passed to
+ * `protectedRoute()`, so `ctx.body` / `ctx.query` / `ctx.params` / `ctx.input`
+ * are typed from the endpoint's phantom generics. String targets degrade to
+ * the loose default.
+ */
+type ExpressProtectedRouteHandler<E extends EndpointDefinition<any, any, any, any> = EndpointDefinition, TResult = unknown> = (req: ExpressRequest, res: ExpressResponse, ctx: ProtectedRouteContext<E>) => TResult | Response | Promise<TResult | Response>;
+/**
+ * Wrap a host-owned Express route in Fortress's protection pipeline.
+ *
+ * Two overloads, mirroring `protect()`:
+ *
+ * - **Typed target** — passing an `EndpointDefinition` flows its phantom
+ *   generics through `ctx`.
+ * - **String target** — passing a unique `handler` name keeps the loose
+ *   `Record<string, unknown>` / `unknown` typing.
+ */
+declare function protectedRoute<E extends EndpointDefinition<any, any, any, any>, TResult = unknown>(fortress: Fortress, target: E, handler: ExpressProtectedRouteHandler<E, TResult>, options?: ProtectOptions): ExpressMiddleware;
+declare function protectedRoute<TResult = unknown>(fortress: Fortress, target: string, handler: ExpressProtectedRouteHandler<EndpointDefinition, TResult>, options?: ProtectOptions): ExpressMiddleware;
+
+/**
+ * Typed extraction-and-validation helpers for Express handlers.
+ *
+ * These helpers extract request data (body, params, query) **and validate
+ * it at runtime** against the supplied Standard Schema. On success they
+ * return the parsed value with full TypeScript inference; on failure they
+ * throw `FortressError('VALIDATION_ERROR', 422)` — the same shape every
+ * fortress-managed endpoint produces — so the existing Express error
+ * handler (`createErrorHandler`) formats it identically.
+ *
+ * Works with any Standard Schema V1 library: Zod, Valibot, ArkType, or
+ * fortress's built-in schema builders.
+ *
+ * Assumes body-parsing middleware (e.g. `app.use(express.json())`) has
+ * already populated `req.body` for `vBody` to read.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { vBody, vParam, vQuery, createErrorHandler } from '@bajustone/fortress/express';
+ * import { obj, str } from '@bajustone/fortress';
+ *
+ * const app = express();
+ * app.use(express.json());
+ *
+ * const Body  = obj({ name: str() }, 'name');
+ * const Param = obj({ id: str() }, 'id');
+ *
+ * app.patch('/users/:id', async (req, res, next) => {
+ *   try {
+ *     const { id }   = await vParam(req, Param);
+ *     const { name } = await vBody(req, Body);
+ *     res.json({ id, name });
+ *   }
+ *   catch (err) { next(err); }
+ * });
+ *
+ * app.use(createErrorHandler());
+ * ```
+ *
+ * Validation runs per call, so the first failing helper throws and any
+ * downstream helpers in the same handler do not run. If you need to
+ * aggregate body+query+params issues into a single response, use the
+ * framework-agnostic `validateRequest` from `@bajustone/fortress` instead.
+ */
+
+/** Infer the output type of a Standard Schema V1 schema. */
+type InferOutput<T extends StandardSchemaV1> = StandardSchemaV1.InferOutput<T>;
+/**
+ * Structural shape of an Express `Request` accepted by these helpers.
+ * Defined locally instead of importing from `express` so fortress can ship
+ * without a hard `express` dependency. Compatible by structural typing with
+ * the real `express.Request` — consumers pass their `req` directly.
+ */
+interface ExpressRequestLike {
+    body?: unknown;
+    params?: unknown;
+    query?: unknown;
+}
+/**
+ * Extract and validate the request body. Assumes body-parsing middleware
+ * (e.g. `express.json()`) populated `req.body`. Returns the parsed value
+ * typed as `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vBody<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate route parameters from `req.params`. Returns the
+ * parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vParam<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate query parameters from `req.query`. Returns the
+ * parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vQuery<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+
+export { type CsrfConfig, type ExpressAdapterOptions, type ExpressMiddleware, type ExpressNextFunction, type ExpressProtectedRouteHandler, type ExpressRequest, type ExpressRequestLike, type ExpressResponse, type FortressExpressFields, type InferOutput, type MountFortressOptions, ProtectOptions, ProtectedRouteContext, type RbacOptions, type RouteMapping, createAuthMiddleware, createCsrfMiddleware, createErrorHandler, createExpressMiddleware, createExpressPluginMiddleware, createRbacMiddleware, getClaims, getDb, getScopedDb, getSubject, getUserId, mountFortress, protectedRoute, vBody, vParam, vQuery };

package/dist/express.d.ts

@@ -0,0 +1,333 @@
+export { C as ConvertRoutesOptions, E as ExternalRoute, T as ToJSONSchemaConverter, c as convertRoutes } from './convert-routes-BLCQT57f.js';
+import { F as Fortress } from './fortress-uA-_cheR.js';
+import { D as DatabaseAdapter } from './index-CxEkfCA0.js';
+import { M as MiddlewareDefinition, E as EndpointDefinition, S as StandardSchemaV1 } from './config-B2366s_G.js';
+import { S as Subject, T as TokenClaims } from './types-et0R8tsC.js';
+import { P as ProtectedRouteContext, a as ProtectOptions } from './protect-DsxV_-dJ.js';
+export { b as ProtectedRouteTarget } from './protect-DsxV_-dJ.js';
+import './index-jAMbbUAY.js';
+import './auth-service-BkzZkWfH.js';
+import './plugins/api-key.js';
+import './jwt.js';
+import './plugins/audit-log.js';
+import './plugins/data-isolation.js';
+import './plugins/email-verification.js';
+import './plugins/magic-link.js';
+import './plugins/oauth.js';
+import './plugins/social-login.js';
+import './plugins/tenancy.js';
+import './plugins/two-factor.js';
+import './plugins/webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * Fortress-specific fields attached to the Express `Request` by
+ * {@link createAuthMiddleware}. Exported so host apps can declaration-merge
+ * them into express's native `Request` type for typed access without casts.
+ *
+ * @example
+ * ```ts
+ * // src/types/express.d.ts
+ * import type { FortressExpressFields } from '@bajustone/fortress/express';
+ *
+ * declare module 'express-serve-static-core' {
+ *   interface Request extends FortressExpressFields {}
+ * }
+ * ```
+ */
+interface FortressExpressFields {
+    /**
+     * The resolved principal — set for every authenticated request regardless
+     * of credential type (JWT, api-key, future OAuth client_credentials, mTLS).
+     */
+    fortressSubject?: Subject;
+    /**
+     * Convenience alias — populated **only** when the subject is a `USER`.
+     * Non-USER subjects (e.g. `SERVICE_ACCOUNT` via api-key) leave this
+     * undefined; fall back to {@link fortressSubject}.
+     */
+    fortressUserId?: string;
+    fortressClaims?: TokenClaims;
+    fortressScopes?: string[] | null;
+    fortressDb?: DatabaseAdapter;
+    fortressGetScopedDb?: (model: string) => Promise<DatabaseAdapter>;
+}
+/** Minimal Express request shape fortress reads from. Compatible with any modern Express version. */
+interface ExpressRequest extends FortressExpressFields {
+    headers: Record<string, string | string[] | undefined>;
+    method: string;
+    /** Express's route path without the query string. */
+    path: string;
+    /** Original path including query string, when supplied by Express. */
+    originalUrl?: string;
+    /** Node/Express request URL fallback, usually including the query string. */
+    url?: string;
+    /** Resolved request protocol (`http`/`https`) when supplied by Express. */
+    protocol?: string;
+    /** Parsed request body, if body middleware ran before this slot. */
+    body?: unknown;
+}
+/** Minimal Express response shape fortress writes to. */
+interface ExpressResponse {
+    status: (code: number) => ExpressResponse;
+    json: (body: unknown) => void;
+    setHeader: (name: string, value: string) => void;
+}
+/** The `next(err?)` callback Express middleware signs off with. */
+type ExpressNextFunction = (err?: unknown) => void;
+/** Express middleware signature fortress's adapter exports use. */
+type ExpressMiddleware = (req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void;
+/** A `(resource, action)` IAM mapping for an HTTP route. */
+interface RouteMapping {
+    resource: string;
+    action: string;
+}
+/** Options accepted by {@link createRbacMiddleware} (and the express adapter factory). */
+interface RbacOptions {
+    routeMap?: Record<string, RouteMapping>;
+    mapRequest?: (method: string, path: string) => RouteMapping | null;
+    skipPaths?: string[];
+    /**
+     * Behavior when a non-skipped route matches no `routeMap`/`mapRequest`
+     * entry. `'allow'` (default) treats it as public; `'deny'` fails closed
+     * with a 403 so a forgotten mapping can't silently expose a user route.
+     * List genuinely public routes in {@link RbacOptions.skipPaths} when using
+     * `'deny'`.
+     */
+    unmappedRoutes?: 'allow' | 'deny';
+}
+/**
+ * Build the Express auth middleware. Resolves the request principal via
+ * `fortress.resolvePrincipal`, which tries plugin `resolvePrincipal` hooks
+ * (api-key, future OAuth client_credentials, mTLS) first and then falls
+ * back to the JWT bearer token (cookie-first, `Authorization: Bearer`
+ * second). Populates `fortressSubject`, `fortressUserId` (USER alias),
+ * `fortressClaims`, `fortressDb`, and `fortressGetScopedDb` on the request.
+ */
+declare function createAuthMiddleware(fortress: Fortress): ExpressMiddleware;
+/** Options accepted by {@link createCsrfMiddleware}. */
+interface CsrfConfig {
+    /** Header name required on unsafe methods. Default: `X-Fortress-CSRF`. */
+    headerName?: string;
+    /** Paths/subtrees exempt from CSRF checking. A trailing `/*` is accepted. */
+    skipPaths?: string[];
+    /** Methods exempt from CSRF checking. Default: GET, HEAD, OPTIONS. */
+    safeMethods?: string[];
+}
+/**
+ * Build standalone Express CSRF middleware for host-owned routes. Fortress-
+ * managed routes already enforce cookie-aware CSRF inside `handleRequest`.
+ * This middleware uses the custom-header strategy and rejects cross-site
+ * browser requests on unsafe methods.
+ */
+declare function createCsrfMiddleware(config?: CsrfConfig): ExpressMiddleware;
+/**
+ * Build the Express RBAC middleware for **user-owned routes**. Resolves a
+ * `(resource, action)` mapping via `routeMap` / `mapRequest` and enforces
+ * the IAM permission check. Fortress-managed routes (`/auth/*`, `/iam/*`,
+ * plugin paths) are protected automatically inside `fortress.handleRequest`
+ * — this middleware only handles routes the caller registered themselves.
+ */
+declare function createRbacMiddleware(fortress: Fortress, options?: RbacOptions): ExpressMiddleware;
+/**
+ * Build the Express error handler. Translates {@link FortressError} into the
+ * appropriate HTTP response with `Retry-After` for rate-limited responses,
+ * and returns a generic 500 for everything else.
+ *
+ * Stays synchronous so it composes naturally with Express's `(err, req,
+ * res, next)` signature. Shares the response *shape* with core's
+ * `errorToResponse` via {@link FortressError.toJSON}. When a `Fortress`
+ * instance is provided, unhandled errors are routed to its configured
+ * {@link FortressLogger}; otherwise they're silently swallowed (matching
+ * the silent-by-default posture of the library).
+ */
+declare function createErrorHandler(fortress?: Fortress): (err: unknown, req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void;
+/**
+ * Express middleware that executes plugin-defined middleware for a given
+ * position (`before-auth`, `after-auth`, `after-rbac`). Used internally by
+ * {@link createExpressMiddleware}; expose if you want to mount the plugin
+ * middleware slots manually.
+ */
+declare function createExpressPluginMiddleware(fortress: Fortress, position: MiddlewareDefinition['position']): ExpressMiddleware;
+/** Options for {@link createExpressMiddleware}. Extends {@link RbacOptions}. */
+interface ExpressAdapterOptions extends RbacOptions {
+    /** Standalone CSRF middleware options for host-owned Express routes. */
+    csrf?: CsrfConfig;
+}
+/**
+ * Build the full set of fortress Express middleware: auth, CSRF, RBAC, error
+ * handler, and the three plugin middleware slots (`beforeAuth`, `afterAuth`,
+ * `afterRbac`). Mount each in the corresponding place in your Express app.
+ */
+declare function createExpressMiddleware(fortress: Fortress, options?: ExpressAdapterOptions): {
+    authMiddleware: ExpressMiddleware;
+    csrfMiddleware: ExpressMiddleware;
+    rbacMiddleware: ExpressMiddleware;
+    errorHandler: ReturnType<typeof createErrorHandler>;
+    pluginMiddleware: {
+        beforeAuth: ExpressMiddleware;
+        afterAuth: ExpressMiddleware;
+        afterRbac: ExpressMiddleware;
+    };
+};
+/**
+ * Read the resolved request principal. Works for every subject kind
+ * (`USER`, `SERVICE_ACCOUNT`, ...). Throws 401 if the auth middleware did
+ * not run or no credential was present.
+ */
+declare function getSubject(req: ExpressRequest): Subject;
+/**
+ * Read the authenticated user ID. Throws 401 if the request was
+ * authenticated by a non-USER subject (e.g. a service account via
+ * api-key) — use {@link getSubject} for handlers that accept any
+ * principal.
+ */
+declare function getUserId(req: ExpressRequest): string;
+/**
+ * Read the verified JWT claims. Only populated when the request was
+ * authenticated via a JWT — api-key principals have no JWT claims and
+ * this helper throws 401.
+ */
+declare function getClaims(req: ExpressRequest): TokenClaims;
+/** Read the per-request fortress database adapter (with plugin wrappers applied). */
+declare function getDb(req: ExpressRequest): DatabaseAdapter;
+/** Read the per-request fortress database adapter scoped to a specific model (applies any active row-level scope rules). */
+declare function getScopedDb(req: ExpressRequest, model: string): Promise<DatabaseAdapter>;
+
+/**
+ * Modern entry point for the Express adapter: register a single fortress
+ * middleware that detects Fortress-managed paths and delegates to
+ * `fortress.handleRequest`.
+ *
+ * Bridges Express's `(req, res, next)` callback style to/from web-standard
+ * `Request`/`Response`. User routes registered before `mountFortress` keep
+ * working — Express's middleware order means earlier handlers win.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { mountFortress } from '@bajustone/fortress/express';
+ *
+ * const app = express();
+ * app.use(express.json());
+ * mountFortress(app, fortress);
+ * ```
+ */
+
+interface ExpressApp {
+    use: (path: string | ExpressMiddleware, handler?: ExpressMiddleware) => void;
+}
+/** Options for {@link mountFortress}. */
+interface MountFortressOptions {
+    /** Optional path prefix (e.g. `/api`). Stripped before delegating to core. */
+    prefix?: string;
+}
+/**
+ * Mount a single Express middleware that delegates Fortress-managed paths to
+ * `fortress.handleRequest` and otherwise calls `next()` so user routes run
+ * normally.
+ *
+ * Cookies emitted by login/refresh/impersonate are passed through verbatim
+ * via `Set-Cookie` headers, the way the browser expects them.
+ */
+declare function mountFortress(app: ExpressApp, fortress: Fortress, options?: MountFortressOptions): void;
+
+/**
+ * Express-flavoured host callback. `E` flows in from the endpoint passed to
+ * `protectedRoute()`, so `ctx.body` / `ctx.query` / `ctx.params` / `ctx.input`
+ * are typed from the endpoint's phantom generics. String targets degrade to
+ * the loose default.
+ */
+type ExpressProtectedRouteHandler<E extends EndpointDefinition<any, any, any, any> = EndpointDefinition, TResult = unknown> = (req: ExpressRequest, res: ExpressResponse, ctx: ProtectedRouteContext<E>) => TResult | Response | Promise<TResult | Response>;
+/**
+ * Wrap a host-owned Express route in Fortress's protection pipeline.
+ *
+ * Two overloads, mirroring `protect()`:
+ *
+ * - **Typed target** — passing an `EndpointDefinition` flows its phantom
+ *   generics through `ctx`.
+ * - **String target** — passing a unique `handler` name keeps the loose
+ *   `Record<string, unknown>` / `unknown` typing.
+ */
+declare function protectedRoute<E extends EndpointDefinition<any, any, any, any>, TResult = unknown>(fortress: Fortress, target: E, handler: ExpressProtectedRouteHandler<E, TResult>, options?: ProtectOptions): ExpressMiddleware;
+declare function protectedRoute<TResult = unknown>(fortress: Fortress, target: string, handler: ExpressProtectedRouteHandler<EndpointDefinition, TResult>, options?: ProtectOptions): ExpressMiddleware;
+
+/**
+ * Typed extraction-and-validation helpers for Express handlers.
+ *
+ * These helpers extract request data (body, params, query) **and validate
+ * it at runtime** against the supplied Standard Schema. On success they
+ * return the parsed value with full TypeScript inference; on failure they
+ * throw `FortressError('VALIDATION_ERROR', 422)` — the same shape every
+ * fortress-managed endpoint produces — so the existing Express error
+ * handler (`createErrorHandler`) formats it identically.
+ *
+ * Works with any Standard Schema V1 library: Zod, Valibot, ArkType, or
+ * fortress's built-in schema builders.
+ *
+ * Assumes body-parsing middleware (e.g. `app.use(express.json())`) has
+ * already populated `req.body` for `vBody` to read.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { vBody, vParam, vQuery, createErrorHandler } from '@bajustone/fortress/express';
+ * import { obj, str } from '@bajustone/fortress';
+ *
+ * const app = express();
+ * app.use(express.json());
+ *
+ * const Body  = obj({ name: str() }, 'name');
+ * const Param = obj({ id: str() }, 'id');
+ *
+ * app.patch('/users/:id', async (req, res, next) => {
+ *   try {
+ *     const { id }   = await vParam(req, Param);
+ *     const { name } = await vBody(req, Body);
+ *     res.json({ id, name });
+ *   }
+ *   catch (err) { next(err); }
+ * });
+ *
+ * app.use(createErrorHandler());
+ * ```
+ *
+ * Validation runs per call, so the first failing helper throws and any
+ * downstream helpers in the same handler do not run. If you need to
+ * aggregate body+query+params issues into a single response, use the
+ * framework-agnostic `validateRequest` from `@bajustone/fortress` instead.
+ */
+
+/** Infer the output type of a Standard Schema V1 schema. */
+type InferOutput<T extends StandardSchemaV1> = StandardSchemaV1.InferOutput<T>;
+/**
+ * Structural shape of an Express `Request` accepted by these helpers.
+ * Defined locally instead of importing from `express` so fortress can ship
+ * without a hard `express` dependency. Compatible by structural typing with
+ * the real `express.Request` — consumers pass their `req` directly.
+ */
+interface ExpressRequestLike {
+    body?: unknown;
+    params?: unknown;
+    query?: unknown;
+}
+/**
+ * Extract and validate the request body. Assumes body-parsing middleware
+ * (e.g. `express.json()`) populated `req.body`. Returns the parsed value
+ * typed as `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vBody<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate route parameters from `req.params`. Returns the
+ * parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vParam<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate query parameters from `req.query`. Returns the
+ * parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vQuery<T extends StandardSchemaV1>(req: ExpressRequestLike, schema: T): Promise<InferOutput<T>>;
+
+export { type CsrfConfig, type ExpressAdapterOptions, type ExpressMiddleware, type ExpressNextFunction, type ExpressProtectedRouteHandler, type ExpressRequest, type ExpressRequestLike, type ExpressResponse, type FortressExpressFields, type InferOutput, type MountFortressOptions, ProtectOptions, ProtectedRouteContext, type RbacOptions, type RouteMapping, createAuthMiddleware, createCsrfMiddleware, createErrorHandler, createExpressMiddleware, createExpressPluginMiddleware, createRbacMiddleware, getClaims, getDb, getScopedDb, getSubject, getUserId, mountFortress, protectedRoute, vBody, vParam, vQuery };