@bajustone/fortress 1.0.0-rc.1

package/dist/hono.d.ts

@@ -0,0 +1,514 @@
+import { F as Fortress } from './fortress-uA-_cheR.js';
+import { Env, Context, MiddlewareHandler, ErrorHandler, Hono } from 'hono';
+import { D as DatabaseAdapter } from './index-CxEkfCA0.js';
+import { S as Subject, T as TokenClaims } from './types-et0R8tsC.js';
+import { M as MiddlewareDefinition, J as JSONSchema, E as EndpointDefinition, S as StandardSchemaV1 } from './config-B2366s_G.js';
+import { T as ToJSONSchemaConverter } from './convert-routes-BLCQT57f.js';
+export { C as ConvertRoutesOptions, E as ExternalRoute, c as convertRoutes } from './convert-routes-BLCQT57f.js';
+import { P as ProtectedRouteContext, a as ProtectOptions } from './protect-DsxV_-dJ.js';
+export { c as ProtectedRouteHandler, b as ProtectedRouteTarget } from './protect-DsxV_-dJ.js';
+import './index-jAMbbUAY.js';
+import './auth-service-BkzZkWfH.js';
+import './plugins/api-key.js';
+import './jwt.js';
+import './plugins/audit-log.js';
+import './plugins/data-isolation.js';
+import './plugins/email-verification.js';
+import './plugins/magic-link.js';
+import './plugins/oauth.js';
+import './plugins/social-login.js';
+import './plugins/tenancy.js';
+import './plugins/two-factor.js';
+import './plugins/webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * Hono `Variables` slot populated by the fortress auth middleware.
+ *
+ * `fortressSubject` is the authoritative principal — set for every
+ * authenticated request regardless of credential type (JWT, api-key, future
+ * OAuth client_credentials, mTLS, ...). `fortressUserId` is a convenience
+ * alias populated **only** when the subject is a `USER`; non-USER subjects
+ * (e.g. `SERVICE_ACCOUNT` via api-key) leave it `undefined`.
+ *
+ * Use {@link FortressEnv} to compose this with your own Hono env types
+ * without casts.
+ */
+interface FortressVariables {
+    fortressSubject: Subject;
+    fortressUserId?: string;
+    fortressClaims?: TokenClaims;
+    fortressScopes?: string[] | null;
+    fortressDb: DatabaseAdapter;
+    fortressGetScopedDb: (model: string) => Promise<DatabaseAdapter>;
+}
+type ExtractVariables<E> = E extends {
+    Variables: infer V;
+} ? V : Record<string, never>;
+type ExtractBindings<E> = E extends {
+    Bindings: infer B;
+} ? B : Record<string, never>;
+/**
+ * Generic Hono env that composes {@link FortressVariables} with the host
+ * app's own env types. Use it directly (`Hono<FortressEnv>`) for a
+ * Fortress-only app, or parameterize with your existing env
+ * (`Hono<FortressEnv<MyEnv>>`) to add Fortress's variables on top of
+ * yours — no `Context<AppEnv>` ↔ `Context<FortressEnv>` casts.
+ *
+ * @example
+ * ```ts
+ * interface MyEnv {
+ *   Variables: { requestId: string };
+ *   Bindings: { DB: D1Database };
+ * }
+ *
+ * const app = new Hono<FortressEnv<MyEnv>>();
+ * app.use(createAuthMiddleware(fortress));
+ * app.get('/me', (c) => {
+ *   const requestId = c.get('requestId');     // host-defined, typed
+ *   const subject = getSubject(c);            // fortress-defined, typed
+ *   return c.json({ requestId, subject });
+ * });
+ * ```
+ */
+interface FortressEnv<TAppEnv extends Env = Env> {
+    Variables: FortressVariables & ExtractVariables<TAppEnv>;
+    Bindings: ExtractBindings<TAppEnv>;
+}
+/** Minimum-viable context shape the typed helpers need — works with any `Context<E>` whose `Variables` include {@link FortressVariables}. */
+type FortressContext<E extends Env = FortressEnv> = Context<E>;
+/**
+ * Hono middleware that resolves the request principal and populates the
+ * Hono context with `fortressSubject`, `fortressUserId` (USER alias),
+ * `fortressClaims`, `fortressDb`, and `fortressGetScopedDb`.
+ *
+ * Principal resolution goes through `fortress.resolvePrincipal`, which
+ * tries plugin `resolvePrincipal` hooks (api-key, future OAuth
+ * client_credentials, mTLS) first and then falls back to the JWT bearer
+ * token (cookie-first, `Authorization: Bearer` second). This means the
+ * same Hono app can authenticate browsers (cookies), SPA clients (Bearer),
+ * and service accounts (`Authorization: ApiKey ...` or `X-API-Key`)
+ * without extra wiring on any route.
+ *
+ * `fortressDb` has plugin `wrapAdapter` applied (e.g. tenancy schema
+ * switching). `fortressGetScopedDb(model)` additionally applies
+ * `scopeRules` for the requested model.
+ */
+declare function createAuthMiddleware(fortress: Fortress): MiddlewareHandler<FortressEnv>;
+/**
+ * Get the authenticated principal from the Hono context. Works for every
+ * subject kind (`USER`, `SERVICE_ACCOUNT`, ...). Generic in the env type
+ * so host apps can pass their own `Context<FortressEnv<MyEnv>>` without
+ * casts.
+ */
+declare function getSubject<E extends Env = FortressEnv>(c: Context<E>): Subject;
+/**
+ * Get the authenticated user ID from Hono context. Throws 401 if the
+ * request was authenticated by a non-USER subject (e.g. a service account
+ * via api-key) — use {@link getSubject} for handlers that need to accept
+ * any principal.
+ */
+declare function getUserId<E extends Env = FortressEnv>(c: Context<E>): string;
+/**
+ * Get the authenticated user's JWT claims from Hono context. Claims are
+ * only populated when the request was authenticated via a JWT — api-key
+ * principals have no JWT claims. Throws 401 if unavailable.
+ *
+ * Pass a `TCustomClaims` type parameter to narrow `customClaims` to your
+ * deployment's plugin-augmented claim shape (e.g. tenancy adds
+ * `tenantId` / `tenantCode`).
+ *
+ * @example
+ * ```ts
+ * interface MyClaims { tenantId: string; tenantCode: string }
+ * const claims = getClaims<MyClaims>(c);
+ * claims.customClaims?.tenantCode; // string | undefined
+ * ```
+ */
+declare function getClaims<TCustomClaims extends object = Record<string, unknown>, E extends Env = FortressEnv>(c: Context<E>): TokenClaims & {
+    customClaims?: TCustomClaims;
+};
+/**
+ * Get the request-scoped database adapter with plugin wrapAdapter applied.
+ */
+declare function getDb<E extends Env = FortressEnv>(c: Context<E>): DatabaseAdapter;
+/**
+ * Get a model-scoped database adapter with both wrapAdapter and scopeRules applied.
+ */
+declare function getScopedDb<E extends Env = FortressEnv>(c: Context<E>, model: string): Promise<DatabaseAdapter>;
+
+/** A `(resource, action)` IAM mapping for an HTTP route. */
+interface RouteMapping {
+    resource: string;
+    action: string;
+}
+/** Options accepted by {@link createRbacMiddleware} (and the Hono adapter factory). */
+interface RbacOptions {
+    /** Declarative route-to-resource mapping: 'METHOD /path' → { resource, action } */
+    routeMap?: Record<string, RouteMapping>;
+    /** Dynamic mapping function (used if routeMap doesn't match) */
+    mapRequest?: (method: string, path: string) => RouteMapping | null;
+    /** Paths that skip permission checks entirely (supports * wildcards) */
+    skipPaths?: string[];
+    /** Behavior for non-skipped routes absent from routeMap/mapRequest. */
+    unmappedRoutes?: 'allow' | 'deny';
+    /** @deprecated Use `unmappedRoutes: 'deny'`. */
+    defaultDeny?: boolean;
+}
+/**
+ * Hono middleware that checks IAM permissions for **user-owned routes**
+ * via a declarative route map. Fortress-managed routes (`/auth/*`,
+ * `/iam/*`, plugin paths) are protected automatically inside
+ * `fortress.handleRequest` — this middleware only handles routes the
+ * caller registered themselves.
+ *
+ * Lookup order:
+ * 1. {@link RbacOptions.skipPaths} — if matched, allow.
+ * 2. {@link RbacOptions.routeMap} — exact `'METHOD /path'` then
+ *    parameterized match.
+ * 3. {@link RbacOptions.mapRequest} — dynamic resolver fallback.
+ * 4. No mapping found → allow, unless {@link RbacOptions.defaultDeny} is set,
+ *    in which case the route is refused with a 403 (fail closed).
+ *
+ * Throws {@link FortressError} on missing/insufficient permissions.
+ */
+declare function createRbacMiddleware(fortress: Fortress, options?: RbacOptions): MiddlewareHandler<FortressEnv>;
+
+/**
+ * Hono error handler that maps FortressError to HTTP responses.
+ * Delegates to the framework-agnostic `errorToResponse` in core so the
+ * mapping (status codes, `Retry-After`, sanitized 500s) stays consistent
+ * across Hono / Express / SvelteKit / `fortress.handleRequest`.
+ */
+declare function createErrorHandler(): ErrorHandler;
+
+/**
+ * Hono middleware that executes plugin-defined middleware for a given position.
+ *
+ * Normalizes Hono's context to the shared {@link PluginRequestContext}, so
+ * plugin middleware receives the same web-standard Request and resolved auth
+ * fields under core, Hono, and Express.
+ */
+declare function createPluginMiddleware(fortress: Fortress, position: MiddlewareDefinition['position']): MiddlewareHandler<FortressEnv>;
+
+/**
+ * Hono OpenAPI adapter for Fortress.
+ *
+ * Schema-library agnostic — accepts a converter function from the user.
+ * Users pass their own JSON Schema → schema-library converter (Zod, Valibot, etc.).
+ *
+ * Users pass their schema library's JSON Schema converter:
+ *   - Zod v4: `z.fromJSONSchema`
+ *   - TypeBox: schemas are JSON Schema natively
+ *   - ArkType: `@ark/jsonschema`
+ */
+
+/**
+ * A function that converts a JSON Schema to whatever schema type your
+ * framework adapter expects (e.g. Zod schema, Valibot schema). Used by
+ * {@link buildRouteDefinition} so fortress's OpenAPI generator stays
+ * schema-library agnostic.
+ */
+type SchemaConverter<T = unknown> = (jsonSchema: JSONSchema) => T;
+interface MountOptions<T = unknown> {
+    /** Convert JSON Schema → your schema library (e.g., jsonSchemaToZod from '@bajustone/fortress/zod') */
+    schemaConverter: SchemaConverter<T>;
+    /** Paths to skip (won't be mounted) */
+    skipPaths?: string[];
+    /** Function to create a route definition from an endpoint (framework-specific) */
+    createRoute: (def: Record<string, unknown>) => unknown;
+    /** Function to register security schemes on the app */
+    registerSecuritySchemes?: (app: unknown) => void;
+}
+interface GenericOpenAPIApp {
+    openapi: (route: unknown, handler: (...args: any[]) => any) => void;
+}
+/**
+ * Build a framework-agnostic route definition object from an EndpointDefinition.
+ * The schemaConverter transforms JSON Schema into whatever the target framework expects.
+ */
+declare function buildRouteDefinition<T>(ep: EndpointDefinition, schemaConverter: SchemaConverter<T>): Record<string, unknown>;
+/**
+ * Auto-mount all Fortress endpoints on an OpenAPI-compatible Hono app.
+ *
+ * Schema-library agnostic: you provide the converter.
+ *
+ * @example
+ * ```ts
+ * import { OpenAPIHono, createRoute } from '@hono/zod-openapi';
+ * import { mountFortressOpenAPI } from '@bajustone/fortress/hono';
+ * import { jsonSchemaToZod } from '@bajustone/fortress/zod';
+ *
+ * const app = new OpenAPIHono();
+ * mountFortressOpenAPI(app, fortress, {
+ *   schemaConverter: jsonSchemaToZod,
+ *   createRoute,
+ * });
+ * ```
+ */
+declare function mountFortressOpenAPI<T>(app: GenericOpenAPIApp & {
+    openAPIRegistry?: {
+        registerComponent: (type: string, name: string, schema: Record<string, unknown>) => void;
+    };
+}, fortress: Fortress, options: MountOptions<T>): void;
+/**
+ * Get all Fortress endpoint definitions as framework route definitions.
+ * Returns a map of `{ [handlerName]: routeDef }`.
+ */
+declare function getFortressRoutes<T>(fortress: Fortress, schemaConverter: SchemaConverter<T>, createRoute: (def: Record<string, unknown>) => unknown): Record<string, unknown>;
+
+/**
+ * Default schema converters for the Hono OpenAPI integration — so you can mount
+ * fortress endpoints (or import external routes) **without pulling in Zod**.
+ *
+ * fortress's builder schemas (and `@bajustone/fetcher`'s builder schemas) ARE
+ * JSON Schema, so the converters are trivial: identity for the JSON-Schema
+ * direction, and `fromJSONSchema` when the target wants a validating Standard
+ * Schema V1. Existing Zod callers are unaffected — these are opt-in defaults.
+ *
+ * @module
+ */
+
+/**
+ * A {@link SchemaConverter} that passes JSON Schema through unchanged. Use with
+ * OpenAPI tooling that consumes JSON Schema directly, or for raw spec
+ * generation. Requires no schema library.
+ */
+declare const identitySchemaConverter: SchemaConverter<JSONSchema>;
+/**
+ * A {@link SchemaConverter} that compiles JSON Schema into a validating
+ * `@bajustone/fetcher` Standard Schema V1. Use with Hono OpenAPI tooling that
+ * accepts Standard Schema (e.g. `hono-openapi` / `@hono/standard-validator`) —
+ * no Zod required.
+ */
+declare const fetcherSchemaConverter: SchemaConverter<StandardSchemaV1>;
+/**
+ * A {@link ToJSONSchemaConverter} for importing external routes authored with
+ * fortress's or fetcher's builder (both ARE JSON Schema). Extracts clean JSON
+ * Schema (runtime-only `~`-prefixed props are dropped at OpenAPI emission).
+ * Pass to {@link convertRoutes} so such routes import without Zod.
+ */
+declare const toJSONSchemaConverter: ToJSONSchemaConverter;
+
+/**
+ * Primary entry point for the Hono adapter: register a single fortress
+ * middleware that detects Fortress-managed paths and delegates to
+ * `fortress.handleRequest`. Custom user routes registered *before*
+ * `mountFortress` keep working — Hono's first-match routing means user
+ * handlers win over the catch-all.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { mountFortress } from '@bajustone/fortress/hono';
+ *
+ * const app = new Hono();
+ * mountFortress(app, fortress);
+ * // POST /auth/login, POST /auth/refresh, GET /auth/me, /iam/*, /oauth/* …
+ * // are all handled automatically. Cookies for login/refresh are set on
+ * // the response without any extra wiring.
+ * ```
+ */
+
+/** Options for {@link mountFortress}. */
+interface MountFortressOptions {
+    /**
+     * Optional path prefix to mount Fortress under (e.g. `/api`). When set,
+     * a request to `/api/auth/login` is internally rewritten to `/auth/login`
+     * before being passed to `fortress.handleRequest`.
+     */
+    prefix?: string;
+}
+/**
+ * Mount a single Hono middleware that delegates Fortress-managed paths to
+ * `fortress.handleRequest` and otherwise calls `next()` so user-route
+ * handlers run normally.
+ *
+ * Cookies emitted by login/refresh/impersonate are honored automatically:
+ * the `Response` returned by `fortress.handleRequest` already carries the
+ * `Set-Cookie` headers built by core, and Hono returns it verbatim.
+ */
+declare function mountFortress<E extends Env = Env>(app: Hono<E>, fortress: Fortress, options?: MountFortressOptions): void;
+
+/** Options accepted by {@link createCsrfMiddleware}. */
+interface CsrfConfig {
+    /** Header name to check. Default: 'X-Fortress-CSRF'. */
+    headerName?: string;
+    /** Paths to skip CSRF checking. */
+    skipPaths?: string[];
+    /** HTTP methods that don't need CSRF checking. Default: ['GET', 'HEAD', 'OPTIONS']. */
+    safeMethods?: string[];
+}
+/**
+ * CSRF middleware using the custom-header strategy.
+ *
+ * Browsers enforce CORS preflight on custom headers, so cross-origin requests
+ * cannot set them without explicit server permission. This middleware requires
+ * a specific header to be present on non-safe HTTP methods.
+ *
+ * Additionally checks `Sec-Fetch-Site` to reject cross-site requests.
+ */
+declare function createCsrfMiddleware(config?: CsrfConfig): MiddlewareHandler;
+
+/** Options accepted by {@link createSecurityHeadersMiddleware}. */
+interface SecurityHeadersConfig {
+    /** Strict-Transport-Security max-age in seconds. Default: 63072000 (2 years). Set to 0 to disable. */
+    hstsMaxAge?: number;
+    /** Include subdomains in HSTS. Default: true. */
+    hstsIncludeSubdomains?: boolean;
+    /** HSTS preload flag. Default: false. */
+    hstsPreload?: boolean;
+    /** X-Frame-Options value. Default: 'DENY'. Set to false to disable. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /** X-Content-Type-Options nosniff. Default: true. */
+    noSniff?: boolean;
+    /** Content-Security-Policy value. Default: "default-src 'self'". Set to false to disable. */
+    contentSecurityPolicy?: string | false;
+    /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin'. Set to false to disable. */
+    referrerPolicy?: string | false;
+    /** X-Permitted-Cross-Domain-Policies value. Default: 'none'. Set to false to disable. */
+    permittedCrossDomainPolicies?: string | false;
+}
+/**
+ * Hono middleware that sets security-related HTTP headers.
+ * All headers are enabled by default with secure values.
+ */
+declare function createSecurityHeadersMiddleware(config?: SecurityHeadersConfig): MiddlewareHandler;
+
+/**
+ * Hono-flavoured host callback. `E` flows in from the endpoint passed to
+ * `protectedRoute()`, so `ctx.body` / `ctx.query` / `ctx.params` / `ctx.input`
+ * are typed from the endpoint's phantom generics.
+ *
+ * `HEnv` is Hono's environment generic (renamed from `E` so it no longer
+ * collides with the endpoint generic). String targets degrade to the
+ * loose default just like the core helper.
+ */
+type HonoProtectedRouteHandler<E extends EndpointDefinition<any, any, any, any> = EndpointDefinition, HEnv extends Env = Env, TResult = unknown> = (c: Context<HEnv>, ctx: ProtectedRouteContext<E>) => TResult | Response | Promise<TResult | Response>;
+/**
+ * Wrap a host-owned Hono route in Fortress's route protection pipeline.
+ *
+ * Two overloads, mirroring `protect()`:
+ *
+ * - **Typed target** — passing an `EndpointDefinition` flows its phantom
+ *   generics through `ctx.body` / `ctx.query` / `ctx.params` / `ctx.input`.
+ * - **String target** — passing a unique `handler` name keeps the loose
+ *   `Record<string, unknown>` / `unknown` typing.
+ */
+declare function protectedRoute<E extends EndpointDefinition<any, any, any, any>, HEnv extends Env = Env, TResult = unknown>(fortress: Fortress, target: E, handler: HonoProtectedRouteHandler<E, HEnv, TResult>, options?: ProtectOptions): MiddlewareHandler<HEnv>;
+declare function protectedRoute<HEnv extends Env = Env, TResult = unknown>(fortress: Fortress, target: string, handler: HonoProtectedRouteHandler<EndpointDefinition, HEnv, TResult>, options?: ProtectOptions): MiddlewareHandler<HEnv>;
+
+/**
+ * Typed extraction-and-validation helpers for Hono handlers.
+ *
+ * These helpers extract request data (body, params, query) **and validate
+ * it at runtime** against the supplied Standard Schema. On success they
+ * return the parsed value with full TypeScript inference; on failure they
+ * throw `FortressError('VALIDATION_ERROR', 422)` — the same shape every
+ * fortress-managed endpoint produces — so the existing Hono error handler
+ * formats it identically.
+ *
+ * Works with any Standard Schema V1 library: Zod, Valibot, ArkType, or
+ * fortress's built-in schema builders.
+ *
+ * @example
+ * ```ts
+ * import { vBody, vParam, vQuery } from '@bajustone/fortress/hono';
+ *
+ * app.post('/users/:id', async (c) => {
+ *   const body     = await vBody(c, CreateUserBody);
+ *   const { id }   = await vParam(c, IdParam);
+ *   const { page } = await vQuery(c, PaginationQuery);
+ *   // ...
+ * });
+ * ```
+ *
+ * Validation runs per call, so the first failing helper throws and any
+ * downstream helpers in the same handler do not run. If you need to
+ * aggregate body+query+params issues into a single response, use the
+ * framework-agnostic `validateRequest` from `@bajustone/fortress` instead.
+ */
+
+/** Infer the output type of a Standard Schema V1 schema. */
+type InferOutput<T extends StandardSchemaV1> = StandardSchemaV1.InferOutput<T>;
+/**
+ * Extract and validate the request body. Returns the parsed value typed as
+ * `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vBody<T extends StandardSchemaV1>(c: Context, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate route parameters. Returns the parsed value typed as
+ * `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vParam<T extends StandardSchemaV1>(c: Context, schema: T): Promise<InferOutput<T>>;
+/**
+ * Extract and validate query parameters. Returns the parsed value typed as
+ * `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+declare function vQuery<T extends StandardSchemaV1>(c: Context, schema: T): Promise<InferOutput<T>>;
+
+/**
+ * Hono adapter for fortress.
+ *
+ * Provides {@link mountFortress}, the modern entry point that delegates to
+ * `fortress.handleRequest`, plus the lower-level middleware factories
+ * (`createHonoMiddleware`, `createAuthMiddleware`, `createRbacMiddleware`,
+ * `createCsrfMiddleware`, `createSecurityHeadersMiddleware`, etc.) for
+ * user-owned routes. Also exports `vBody` / `vParam` / `vQuery` typed
+ * extraction helpers for custom routes.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { mountFortress, createHonoMiddleware } from '@bajustone/fortress/hono';
+ *
+ * const app = new Hono();
+ *
+ * // One-line mount: handles all Fortress routes (auth, IAM, plugins, OAuth, OpenAPI).
+ * mountFortress(app, fortress);
+ *
+ * // Optional: protect your own routes with the IAM middleware.
+ * const { authMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+ *   routeMap: { 'GET /api/users': { resource: 'user', action: 'list' } },
+ * });
+ * app.use('/api/*', authMiddleware, rbacMiddleware);
+ * app.onError(errorHandler);
+ * ```
+ *
+ * @module
+ */
+
+/**
+ * Options for {@link createHonoMiddleware}. Currently extends {@link RbacOptions}
+ * so callers can override which IAM resource/action a route maps to.
+ */
+interface HonoAdapterOptions extends RbacOptions {
+}
+/**
+ * Create Hono middleware from a Fortress instance.
+ *
+ * Usage:
+ *   const { authMiddleware, pluginMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+ *     routeMap: { 'POST /api/users': { resource: 'user', action: 'create' } },
+ *     skipPaths: ['/health', '/auth/*'],
+ *   });
+ *
+ *   app.onError(errorHandler);
+ *   app.use('/api/*', pluginMiddleware.beforeAuth);
+ *   app.use('/api/*', authMiddleware);
+ *   app.use('/api/*', pluginMiddleware.afterAuth);
+ *   app.use('/api/*', rbacMiddleware);
+ *   app.use('/api/*', pluginMiddleware.afterRbac);
+ */
+declare function createHonoMiddleware(fortress: Fortress, options?: HonoAdapterOptions): {
+    authMiddleware: ReturnType<typeof createAuthMiddleware>;
+    rbacMiddleware: ReturnType<typeof createRbacMiddleware>;
+    errorHandler: ReturnType<typeof createErrorHandler>;
+    pluginMiddleware: {
+        beforeAuth: ReturnType<typeof createPluginMiddleware>;
+        afterAuth: ReturnType<typeof createPluginMiddleware>;
+        afterRbac: ReturnType<typeof createPluginMiddleware>;
+    };
+};
+
+export { type CsrfConfig, type FortressContext, type FortressEnv, type FortressVariables, type HonoAdapterOptions, type HonoProtectedRouteHandler, type InferOutput, type MountFortressOptions, ProtectOptions, ProtectedRouteContext, type RbacOptions, type RouteMapping, type SchemaConverter, type SecurityHeadersConfig, ToJSONSchemaConverter, buildRouteDefinition, createCsrfMiddleware, createHonoMiddleware, createPluginMiddleware, createSecurityHeadersMiddleware, fetcherSchemaConverter, getClaims, getDb, getFortressRoutes, getScopedDb, getSubject, getUserId, identitySchemaConverter, mountFortress, mountFortressOpenAPI, protectedRoute, toJSONSchemaConverter, vBody, vParam, vQuery };