@opensyber/tokenforge 0.1.1 → 1.0.0

package/LICENSE.md

@@ -0,0 +1,32 @@
+MIT License
+
+Copyright (c) 2026 OpenSyber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+## Note on the hosted verification service
+
+The TokenForge SDK code in this repository is MIT-licensed. The TokenForge
+verification service hosted at `tokenforge.opensyber.cloud` requires a
+TokenForge API key and is governed by the OpenSyber Terms of Service at
+https://tokenforge.opensyber.cloud/terms. You are free to self-host the
+server adapters using your own database / KV storage backend (see
+`@opensyber/tokenforge/server/storage`) under MIT terms.

package/README.md

@@ -1,10 +1,20 @@
 # @opensyber/tokenforge
 
-Device-bound session security. Add one script tag — every request is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
+[![npm](https://img.shields.io/npm/v/@opensyber/tokenforge.svg)](https://www.npmjs.com/package/@opensyber/tokenforge)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
+
+**Device-bound session security for the post-AiTM era.** W3C [DBSC](https://w3c.github.io/webappsec-dbsc/)–aligned, ECDSA P-256 + WebAuthn, drop-in for Auth0 / Okta / Clerk / Microsoft Entra ID. Every request after login is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
+
+## Why this matters in 2026
+
+- **Session hijacking attacks grew 127% YoY** ([Microsoft, May 2026](https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/))
+- Adversary-in-the-Middle (AiTM) toolkits — EvilProxy, Tycoon — bypass MFA in real time
+- Chrome 146 (April 2026) shipped browser-native DBSC for Windows; macOS/Linux pending
+- Auth0 and Okta's "session protection" features rely on IP/ASN/UA fingerprinting — defeated by VPN-equipped attackers. **TokenForge uses cryptographic device binding — defeats them.**
 
 ## Quick Start
 
-### 1. Add the script tag (client — zero code)
+### 1. Add the script tag (zero-code path)
 
 ```html
 <script
@@ -13,96 +23,199 @@ Device-bound session security. Add one script tag — every request is cryptogra
 ></script>
 ```
 
-That's it. The script auto-generates ECDSA P-256 device keys, binds the session, and signs every `fetch()` request with `X-TF-*` headers.
+The script auto-generates ECDSA P-256 device keys (non-extractable, IndexedDB-stored), binds the session, and signs every `fetch()` request with `X-TF-Signature`, `X-TF-Nonce`, `X-TF-Timestamp` headers. On Chrome 146+ Windows it transparently uses the browser's native DBSC; on other browsers it polyfills via Web Crypto.
 
-### 2. Add server middleware (one line)
+### 2. Add server middleware
 
 ```bash
 npm install @opensyber/tokenforge
 ```
 
-**Express**
 ```ts
+// Express
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
 app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
 // req.tf.bound, req.tf.trustScore, req.tf.deviceId
-```
 
-**Next.js**
-```ts
+// Next.js (App Router)
 import { withTokenForge } from '@opensyber/tokenforge/nextjs';
 export const GET = withTokenForge(handler, { apiKey: process.env.TOKENFORGE_API_KEY! });
-```
 
-**Fastify**
-```ts
+// Fastify
 import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
 fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });
-```
 
-**Hono**
-```ts
+// Hono
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono';
 app.use('/api/*', tokenForgeMiddleware({ apiKey: env.TOKENFORGE_API_KEY }));
 ```
 
 ### 3. Get your API key
 
-Sign up free at [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud). Free tier: 1,000 verifications/month.
+Sign up at [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud) — free tier: 1,000 verifications/month, no credit card.
+
+## What's new in v1.0.0 (May 2026)
+
+This release graduates the protocol surface from beta. Subsequent 1.x is backward-compatible additions only.
+
+### W3C DBSC protocol (Sprint 37)
+
+Aligned with the W3C draft + Chrome 146 native rollout:
+
+```
+POST /v1/dbsc/challenge        — issue one-shot challenge (register/refresh/step_up)
+POST /v1/dbsc/register         — bind device with JWS-signed challenge response
+POST /v1/dbsc/refresh          — rotate bound cookie, run risk policy
+POST /v1/dbsc/sessions/:id/revoke — admin soft-revoke
+GET  /.well-known/tokenforge/jwks — public verifier keys (5-min edge cache)
+GET  /.well-known/tokenforge/dbsc — service descriptor for SDK auto-discovery
+```
+
+### Workforce SSO replaces Cisco Duo Premier (Sprint 36)
+
+Five OIDC IdPs + SAML 2.0:
+
+```ts
+import { exchangeSso } from '@opensyber/tokenforge/server/internal';
+
+// After Okta / Entra / Google Workspace / Auth0 / generic OIDC login
+const result = await exchangeSso(db, store, {
+  tenantId, workforceAppId,
+  idToken: req.body.idToken,  // from your IdP
+  jwks,                        // cached via getJwks()
+});
+// result: { ok: true, subjectId, externalSubject, email, challenge, challengeExpiresAt }
+```
+
+JWKS cache: 24-hour freshness with stale-fallback when IdP is unreachable. xmlsoap claim namespace for Microsoft AD FS / Azure AD compatibility built in.
+
+### AitM detection + per-route step-up (Sprint 39)
+
+```ts
+import { requireFreshSig } from '@opensyber/tokenforge/server';
+
+app.use('/admin/*', requireFreshSig({ minTrustScore: 90 }));
+app.use('/billing/*', requireFreshSig({
+  minTrustScore: 95,
+  requireWebAuthn: true,
+}));
+```
+
+Per-tenant policy via `tf_tenants.step_up_actions` JSON:
+
+```json
+[
+  { "path": "/admin/billing", "requireFreshSig": true, "freshSigMaxAgeSec": 30 },
+  { "path": "/admin/*", "requireFreshSig": true, "requireWebAuthn": true }
+]
+```
+
+Exact match wins over glob. Glob /admin/* matches /admin/users but not /admin (no segment past prefix).
+
+### Action signing for sensitive operations
+
+```ts
+// Client
+const sig = await tokenforge.signAction({
+  action: 'transfer',
+  body: { fromAccount, toAccount, amount },
+});
+fetch('/api/transfer', {
+  method: 'POST',
+  headers: { 'X-TF-Action-Signature': sig },
+  body: JSON.stringify({ fromAccount, toAccount, amount }),
+});
+```
 
-## Why
+5-second freshness window. JWS claims include `actionHash` (SHA-256 over canonicalized body) so an attacker can't replay the signature with a different transfer amount.
 
-Authentication protects login. TokenForge protects everything **after** login:
+### Webhook event stream
 
-- **Session hijacking** — stolen cookies are useless without the device's private key
-- **AiTM attacks** — relay proxies can't sign requests on behalf of the device
-- **Token theft** — XSS-exfiltrated tokens fail server-side signature verification
-- **Trust scoring** — 7 signals detect anomalies on every request in real time
+12 events, HMAC-SHA256 signed, retried with [1s, 4s, 15s] backoff, stable `X-TF-Delivery-Id` across retries:
 
-## How It Works
+```
+session.bound          session.verified         session.revoked
+trust_score.degraded   trust_score.critical     session.hijack_attempt
+usage.cap_exceeded     dbsc.risk_signal         dbsc.policy_block
+dbsc.session_step_up   dbsc.session_revoked     webhook.test
+```
+
+```ts
+import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+
+app.post('/webhooks/tokenforge', async (c) => {
+  const rawBody = await c.req.text();
+  const ok = await verifyWebhookSignature({
+    body: rawBody,
+    signatureHeader: c.req.header('X-TF-Signature') ?? '',
+    timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+    secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+  });
+  if (!ok) return c.json({ error: 'bad_signature' }, 401);
+  // handle event ...
+});
+```
+
+Secret rotation grace window: 24 hours. Send the new secret while the old one stays valid; receivers verify against either.
+
+## How it works
 
 ```
 Browser                        TokenForge API                Your Server
   │                                │                              │
-  │ 1. Script auto-generates       │                              │
-  │    ECDSA P-256 key pair        │                              │
+  │ 1. Generate ECDSA P-256        │                              │
+  │    keypair (non-extractable)   │                              │
   │                                │                              │
-  │ 2. POST /v1/bind ─────────────>│ Store public key             │
-  │ <──────────────────────────────│ Return deviceId              │
+  │ 2. POST /v1/dbsc/challenge ───>│                              │
+  │ <─────── { challenge } ────────│                              │
   │                                │                              │
-  │ 3. fetch('/api/data')          │                              │
-  │    + X-TF-Signature header ────────────────────────────────>  │
+  │ 3. POST /v1/dbsc/register ────>│ Store public key             │
+  │    + JWS over challenge        │                              │
+  │ <─── { sessionId, deviceId } ──│                              │
+  │                                │                              │
+  │ 4. fetch('/api/data')          │                              │
+  │    + X-TF-Signature ──────────────────────────────────────>   │
   │                                │                              │
   │                                │ <── POST /v1/edge/verify ──  │
   │                                │     Verify signature         │
-  │                                │     Check nonce replay       │
+  │                                │     Run AitM heuristics      │
   │                                │     Compute trust score      │
-  │                                │ ── { allow, score: 92 } ──> │
-  │                                │                              │
-  │ <──────────────────────────────────── 200 OK ─────────────── │
+  │                                │ ──> { allow, score: 92 }     │
+  │ <──────────────────────────────────── 200 OK ───────────────  │
 ```
 
-All verification runs on TokenForge's infrastructure. Your server sends request context, gets back allow/deny. No crypto libraries, no database, no storage to manage.
-
-## Trust Score
+The device key never leaves the client. The TokenForge service holds the public key + session metadata. Your server passes request context, gets back an allow/step_up/block decision.
 
-7 signals scored 0-100 on every request:
+## Trust score signals
 
 | Signal | Weight | Detects |
 |--------|--------|---------|
-| Signature | 30 | Tampering, missing device key |
+| Signature | 30 | Tampering, missing/wrong device key |
 | IP Address | 15 | IP change since binding |
 | Geo Location | 15 | Country mismatch |
-| Fingerprint | 15 | Browser fingerprint drift |
+| Fingerprint | 15 | Browser/device fingerprint drift |
 | Velocity | 10 | Multiple IPs in short window |
-| Timing | 10 | Clock skew beyond tolerance |
+| Timing | 10 | Clock skew beyond ±60s |
 | Nonce | 5 | Replay attacks |
 
-Score >= 80: allow. Score 40-79: step-up auth. Score < 40: block.
+Score >= 80: `allow`. Score 40-79: `step_up`. Score < 40: `block`. Thresholds configurable per tenant.
 
-## Advanced: npm Client SDK
+## Drop-in for your existing IdP
 
-For React apps or when you need more control than the script tag:
+TokenForge runs *after* authentication — bring your own IdP:
+
+| IdP | Integration | Built-in support |
+|---|---|---|
+| **Microsoft Entra ID** | Custom Authentication Extension webhook | Roadmap M11 (Q3 2026) |
+| **Auth0** | Auth0 Action snippet | Roadmap M14 — Marketplace listing pending review |
+| **Okta** | Inline Hook + Custom Authenticator | Roadmap M15 — OIN listing pending review |
+| **Clerk** | `@tokenforge/clerk-middleware` shim | Roadmap M16 |
+| **Auth.js / NextAuth** | Works today via `@opensyber/tokenforge/nextjs` | ✅ |
+| **Firebase Auth** | Works today via `@opensyber/tokenforge/express` | ✅ |
+| **Supabase Auth** | Works today via `@opensyber/tokenforge/express` | ✅ |
+| **Custom JWT** | Works today | ✅ |
+
+## React integration
 
 ```tsx
 import { TokenForgeProvider, useTokenForge } from '@opensyber/tokenforge/react';
@@ -117,21 +230,66 @@ function App() {
     </TokenForgeProvider>
   );
 }
+
+function ProtectedPage() {
+  const { bound, trustScore, deviceId } = useTokenForge();
+  if (!bound) return <BindButton />;
+  return <Dashboard trustScore={trustScore} deviceId={deviceId} />;
+}
 ```
 
-## Works With Any Auth Provider
+## Self-hosted server
+
+The server adapters work against your own database / KV — no hosted service required:
+
+```ts
+import { createTokenForgeRoutes } from '@opensyber/tokenforge/server';
+import { D1Storage } from '@opensyber/tokenforge/server/storage';
+// or PostgresStorage, RedisStorage, or implement the StorageInterface
+
+const tf = createTokenForgeRoutes({
+  storage: new D1Storage(env.DB),
+  sessionMaxAge: 86400,
+});
+app.route('/api/tf', tf);
+```
 
-Microsoft Entra ID, Clerk, Auth.js, NextAuth, Firebase, Supabase, Okta, or custom JWT. TokenForge runs after authentication — no changes to your auth flow.
+Storage backends shipped: D1 (Cloudflare Workers), PostgreSQL, Redis. Bring your own via `StorageInterface`.
 
-## Pricing
+## Compatibility
+
+| Platform | Status |
+|---|---|
+| Chrome 146+ Windows | ✅ Native DBSC + polyfill fallback |
+| Chrome 146+ macOS / Linux | ⏳ DBSC pending Google rollout; polyfill works today |
+| Safari (macOS / iOS) | ✅ Polyfill via Web Crypto + IndexedDB |
+| Firefox | ✅ Polyfill |
+| Edge 146+ | ✅ Inherits Chromium DBSC |
+| Node.js 18+ (server) | ✅ |
+| Bun, Deno | ✅ |
+| Cloudflare Workers | ✅ |
+
+## Pricing (hosted service)
 
 | Plan | Price | Verifications/mo |
 |------|-------|-----------------|
 | Free | $0 | 1,000 |
 | Pro | $49/mo | 50,000 |
 | Team | $199/mo | 250,000 |
-| Enterprise | Custom | Unlimited |
+| Enterprise | Custom | Unlimited + SLA |
+
+The SDK code in this repository is MIT-licensed and runs against any storage backend — you can self-host without a TokenForge subscription.
+
+## Examples & docs
+
+- Full API reference: [tokenforge.opensyber.cloud/docs](https://tokenforge.opensyber.cloud/docs)
+- DBSC protocol explainer: [tokenforge.opensyber.cloud/dbsc](https://tokenforge.opensyber.cloud/dbsc)
+- Reference apps (Next.js, Express, Hono, Fastify): [github.com/opensyber/tokenforge-examples](https://github.com/opensyber/tokenforge-examples)
+
+## Security disclosure
+
+Security issues: `security@opensyber.cloud` (PGP key available). Coordinated disclosure within 90 days; CVE assignment for confirmed vulnerabilities.
 
 ## License
 
-Client SDK: MIT | Server verification requires a TokenForge API key from [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud).
+SDK: MIT (see [LICENSE.md](./LICENSE.md)). Hosted service requires API key — governed by [TokenForge Terms](https://tokenforge.opensyber.cloud/terms).

package/dist/adapters/astro.d.ts

@@ -0,0 +1,55 @@
+/** TokenForge context attached to context.locals.tf */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+/** Options for the Astro middleware. */
+export interface TokenForgeAstroOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+}
+/** Minimal Astro middleware context — avoids astro:middleware dep. */
+interface APIContext {
+    request: Request;
+    url: URL;
+    locals: {
+        tf?: TfContext;
+    };
+    clientAddress?: string;
+}
+type MiddlewareNext = () => Promise<Response>;
+type MiddlewareHandler = (context: APIContext, next: MiddlewareNext) => Promise<Response>;
+/**
+ * Astro middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/middleware.ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/astro';
+ * export const onRequest = tokenForgeMiddleware({
+ *   apiKey: import.meta.env.TOKENFORGE_API_KEY,
+ * });
+ * ```
+ *
+ * Reads `Astro.locals.tf` for downstream pages and endpoints.
+ */
+export declare function tokenForgeMiddleware(options: TokenForgeAstroOptions): MiddlewareHandler;
+/**
+ * Per-route step-up gate. Use inside page or endpoint code after the
+ * middleware has populated `Astro.locals.tf`.
+ *
+ * Returns a 403 `Response` when below threshold; the caller should
+ * `return` it. Returns `null` on pass.
+ */
+export declare function requireFreshSig(locals: {
+    tf?: TfContext;
+}, opts?: {
+    minTrustScore?: number;
+}): Response | null;
+export {};
+//# sourceMappingURL=astro.d.ts.map

package/dist/adapters/astro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astro.d.ts","sourceRoot":"","sources":["../../src/adapters/astro.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,sEAAsE;AACtE,UAAU,UAAU;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,KAAK,iBAAiB,GAAG,CACvB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CAoEnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,EAC1B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,QAAQ,GAAG,IAAI,CAcjB"}

package/dist/adapters/astro.js

@@ -0,0 +1,91 @@
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * Astro middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/middleware.ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/astro';
+ * export const onRequest = tokenForgeMiddleware({
+ *   apiKey: import.meta.env.TOKENFORGE_API_KEY,
+ * });
+ * ```
+ *
+ * Reads `Astro.locals.tf` for downstream pages and endpoints.
+ */
+export function tokenForgeMiddleware(options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    return async (context, next) => {
+        const path = context.url.pathname;
+        if (shouldSkip(path, options.skipPaths)) {
+            context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return next();
+        }
+        const header = (name) => context.request.headers.get(name);
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path,
+                    method: context.request.method,
+                    headers: {
+                        signature: header('x-tf-signature'),
+                        nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'),
+                        deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: context.clientAddress ?? header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok) {
+                context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+                return next();
+            }
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            }
+            context.locals.tf = {
+                bound: data.bound,
+                trustScore: data.trustScore,
+                deviceId: data.deviceId,
+            };
+            return next();
+        }
+        catch {
+            context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return next();
+        }
+    };
+}
+/**
+ * Per-route step-up gate. Use inside page or endpoint code after the
+ * middleware has populated `Astro.locals.tf`.
+ *
+ * Returns a 403 `Response` when below threshold; the caller should
+ * `return` it. Returns `null` on pass.
+ */
+export function requireFreshSig(locals, opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    const score = locals.tf?.trustScore ?? 0;
+    if (score < min) {
+        return new Response(JSON.stringify({
+            error: 'elevated_trust_required',
+            action: 'step_up_required',
+            trustScore: score,
+        }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+    }
+    return null;
+}
+function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
+}
+//# sourceMappingURL=astro.js.map

package/dist/adapters/astro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astro.js","sourceRoot":"","sources":["../../src/adapters/astro.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAiClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACnE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/adapters/express.d.ts

@@ -44,5 +44,20 @@ export interface TokenForgeExpressOptions {
  * - `deviceId: string | null` — device identifier
  */
 export declare function tokenForgeMiddleware(options: TokenForgeExpressOptions): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => Promise<void>;
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
+ * mounted on the routes that need elevated trust.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `req.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export declare function requireFreshSig(opts?: {
+    minTrustScore?: number;
+}): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => void;
 export {};
 //# sourceMappingURL=express.d.ts.map

package/dist/adapters/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAE3D,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,IAAI,CAY7E"}

package/dist/adapters/express.js

@@ -70,4 +70,31 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
+ * mounted on the routes that need elevated trust.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `req.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export function requireFreshSig(opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    return (req, res, next) => {
+        const score = req.tf?.trustScore ?? 0;
+        if (score < min) {
+            res.status(403).json({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: score,
+            });
+            return;
+        }
+        next();
+    };
+}
 //# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/fastify.d.ts

@@ -40,5 +40,22 @@ interface FastifyInstance {
  * ```
  */
 export declare function tokenForgePlugin(fastify: FastifyInstance, options: TokenForgeFastifyOptions, done: (err?: Error) => void): void;
+/**
+ * Per-route step-up gate. Register after `tokenForgePlugin` ran globally,
+ * scoped to a route that needs elevated trust.
+ *
+ * ```ts
+ * fastify.register(tokenForgePlugin, { apiKey });
+ * fastify.addHook('preHandler', async (req, reply) => {
+ *   if (req.url.startsWith('/admin')) await requireFreshSig()(req, reply);
+ * });
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `request.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export declare function requireFreshSig(opts?: {
+    minTrustScore?: number;
+}): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
 export {};
 //# sourceMappingURL=fastify.d.ts.map

package/dist/adapters/fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAEA,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN"}
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAEA,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAErD,KAAK,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAUvE"}