@opensyber/tokenforge 0.1.2 → 1.1.0

package/LICENSE.md

@@ -0,0 +1,32 @@
+MIT License
+
+Copyright (c) 2026 OpenSyber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+## Note on the hosted verification service
+
+The TokenForge SDK code in this repository is MIT-licensed. The TokenForge
+verification service hosted at `tokenforge.opensyber.cloud` requires a
+TokenForge API key and is governed by the OpenSyber Terms of Service at
+https://tokenforge.opensyber.cloud/terms. You are free to self-host the
+server adapters using your own database / KV storage backend (see
+`@opensyber/tokenforge/server/storage`) under MIT terms.

package/README.md

@@ -1,108 +1,340 @@
 # @opensyber/tokenforge
 
-Device-bound session security. Add one script tag — every request is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
+[![npm](https://img.shields.io/npm/v/@opensyber/tokenforge.svg)](https://www.npmjs.com/package/@opensyber/tokenforge)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
+
+## TokenForge Cloud v2 integration kit
+
+The `1.1.0` Cloud path keeps the TokenForge bearer credential on the
+application server. The browser creates a non-extractable P-256 key, binds only
+through an authenticated application endpoint, and signs the exact v2 request
+contract.
+
+```ts
+import { TokenForgeDevice } from '@opensyber/tokenforge/client';
+
+const device = await TokenForgeDevice.open({
+  bindEndpoint: '/api/v1/auth/device/bind',
+  fetch: authenticatedFetch,
+});
+await device.bindAuthenticatedSession();
+export const secureFetch = device.wrapFetch(authenticatedFetch);
+```
+
+The server adapter is responsible for session resolution, the server-only
+credential, local/cloud decision composition, circuit breaking, and telemetry.
+Set `TOKENFORGE_CLOUD_MODE` to `off`, `monitor`, or `enforce`; default/unknown
+values are `off`. In `monitor`, a locally valid request stays available while
+cloud failures and would-block outcomes are reported. In `enforce`, definitive
+cloud rejection or cloud unavailability rejects the request.
+
+See `@opensyber/tokenforge-protocol@2.0.0-rc.1` for the normative binary
+contract, schemas, migration guide, and cross-language vectors.
+
+### Cloud v2 server boundary
+
+Cloud v2 intentionally separates application authentication from TokenForge
+device proof. The application owns the authenticated bind route and resolves
+the current session on the server. Only that route may add a
+`TokenForgeIdentity` envelope before delegating to the generic bind handler.
+The browser never supplies trusted profile or subject fields.
+
+```ts
+import {
+  createTokenForgeCloudBindHandler,
+  createTokenForgeCloudMiddleware,
+} from '@opensyber/tokenforge/server';
+import type { TokenForgeIdentity } from '@opensyber/tokenforge/identity';
+
+// Configure these once in server-only application code. The generated types
+// describe the required session resolver, replay store, cloud client, mode,
+// telemetry, and circuit-breaker dependencies.
+export const bindDevice = createTokenForgeCloudBindHandler(bindOptions);
+export const protectRequest = createTokenForgeCloudMiddleware(verifyOptions);
+
+// Your authenticated route resolves identity from its own session or IdP,
+// then passes the standard Request to bindDevice. Never forward identity data
+// accepted from the browser.
+const identity: TokenForgeIdentity = await resolveIdentityFromSession(request);
+```
+
+Framework adapters expose the same verification contract without duplicating
+cryptography or authorization logic:
+
+| Framework | Cloud v2 entry point | Request bridge |
+|---|---|---|
+| Next.js | `withTokenForgeCloudV2` / `tokenForgeCloudV2Check` | Native `Request` |
+| Hono | `tokenForgeCloudV2Middleware` | `context.req.raw` |
+| SvelteKit | `tokenForgeCloudV2Handle` | `event.request` |
+| Astro | `tokenForgeCloudV2Middleware` | `context.request` |
+| Express | `tokenForgeCloudV2Middleware` | Explicit `toRequest` required |
+| Fastify | `tokenForgeCloudV2Plugin` | Explicit `toRequest` required |
+
+Express and Fastify require an application-owned `toRequest` converter because
+the SDK must not guess the external origin, proxy trust, or request-body
+semantics. Conversion failure is rejected rather than silently bypassing
+TokenForge.
+
+The same named bind adapter is available from every framework entry point:
+
+```ts
+import { createTokenForgeCloudBindHandler } from '@opensyber/tokenforge/server';
+import { tokenForgeCloudV2BindRoute } from '@opensyber/tokenforge/nextjs';
+
+const bindDevice = createTokenForgeCloudBindHandler(bindOptions);
+export const POST = tokenForgeCloudV2BindRoute(bindDevice);
+```
+
+For Hono, SvelteKit, and Astro, pass the same generic handler to
+`tokenForgeCloudV2BindRoute`. Express and Fastify take a second argument with
+the same explicit `toRequest` converter used by their verification adapter:
+
+```ts
+app.post(
+  '/api/v1/auth/device/bind',
+  tokenForgeCloudV2BindRoute(bindDevice, { toRequest }),
+);
+```
+
+Mount this route only after the application's authentication middleware. The
+generic bind handler must resolve the session and identity from trusted
+server-side state; never copy subject or profile fields from the request body.
+
+Recommended adoption order:
+
+1. Mount the authenticated bind route and verify identity correlation in
+   `off` mode.
+2. Enable `monitor` and inspect local denials, cloud would-block decisions,
+   outages, and replay telemetry without changing application availability.
+3. Resolve all unexplained monitor findings and switch selected protected paths
+   to `enforce`.
+4. Keep public health, callback, and webhook paths in the exact `skipPaths`
+   allowlist; do not use substring matching.
+
+The older `tokenForgeMiddleware`, `tokenForgePlugin`, `withTokenForge`, and
+`tokenForgeHandle` examples below use the legacy v1 fail-open cloud behavior.
+They remain exported for staged migration but should not be selected for a new
+Cloud v2 integration.
+
+**Device-bound session security for the post-AiTM era.** W3C [DBSC](https://w3c.github.io/webappsec-dbsc/)–aligned, ECDSA P-256 + WebAuthn, drop-in for Auth0 / Okta / Clerk / Microsoft Entra ID. Every request after login is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
+
+## Why this matters in 2026
+
+- **Session hijacking attacks grew 127% YoY** ([Microsoft, May 2026](https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/))
+- Adversary-in-the-Middle (AiTM) toolkits — EvilProxy, Tycoon — bypass MFA in real time
+- Chrome 146 (April 2026) shipped browser-native DBSC for Windows; macOS/Linux pending
+- Auth0 and Okta's "session protection" features rely on IP/ASN/UA fingerprinting — defeated by VPN-equipped attackers. **TokenForge uses cryptographic device binding — defeats them.**
 
 ## Quick Start
 
-### 1. Add the script tag (client — zero code)
+### 1. Initialize after authenticated login
 
-```html
-<script
-  src="https://tokenforge-api.opensyber.cloud/sdk.js"
-  data-api-key="tf_your_api_key"
-></script>
+```ts
+import { TokenForgeDevice } from '@opensyber/tokenforge/client';
+
+const device = await TokenForgeDevice.open({
+  bindEndpoint: '/api/v1/auth/device/bind',
+  fetch: authenticatedFetch,
+});
+await device.bindAuthenticatedSession();
+const secureFetch = device.wrapFetch(authenticatedFetch);
 ```
 
-That's it. The script auto-generates ECDSA P-256 device keys, binds the session, and signs every `fetch()` request with `X-TF-*` headers.
+The browser receives no TokenForge API key. It generates a non-extractable
+ECDSA P-256 device key, sends only the public JWK through the authenticated
+application bind endpoint, and signs the exact request-bound v2 contract.
 
-### 2. Add server middleware (one line)
+### 2. Add server middleware
 
 ```bash
 npm install @opensyber/tokenforge
 ```
 
-**Express**
 ```ts
+// Legacy v1 Express migration path
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
 app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
 // req.tf.bound, req.tf.trustScore, req.tf.deviceId
-```
 
-**Next.js**
-```ts
+// Legacy v1 Next.js migration path
 import { withTokenForge } from '@opensyber/tokenforge/nextjs';
 export const GET = withTokenForge(handler, { apiKey: process.env.TOKENFORGE_API_KEY! });
-```
 
-**Fastify**
-```ts
+// Legacy v1 Fastify migration path
 import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
 fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });
-```
 
-**Hono**
-```ts
+// Legacy v1 Hono migration path
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono';
 app.use('/api/*', tokenForgeMiddleware({ apiKey: env.TOKENFORGE_API_KEY }));
 ```
 
 ### 3. Get your API key
 
-Sign up free at [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud). Free tier: 1,000 verifications/month.
+Sign up at [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud) — free tier: 1,000 verifications/month, no credit card.
 
-## Why
+## What's new in v1.0.0 (May 2026)
 
-Authentication protects login. TokenForge protects everything **after** login:
+This release graduates the protocol surface from beta. Subsequent 1.x is backward-compatible additions only.
 
-- **Session hijacking** — stolen cookies are useless without the device's private key
-- **AiTM attacks** — relay proxies can't sign requests on behalf of the device
-- **Token theft** — XSS-exfiltrated tokens fail server-side signature verification
-- **Trust scoring** — 7 signals detect anomalies on every request in real time
+### W3C DBSC protocol (Sprint 37)
 
-## How It Works
+Aligned with the W3C draft + Chrome 146 native rollout:
+
+```
+POST /v1/dbsc/challenge        — issue one-shot challenge (register/refresh/step_up)
+POST /v1/dbsc/register         — bind device with JWS-signed challenge response
+POST /v1/dbsc/refresh          — rotate bound cookie, run risk policy
+POST /v1/dbsc/sessions/:id/revoke — admin soft-revoke
+GET  /.well-known/tokenforge/jwks — public verifier keys (5-min edge cache)
+GET  /.well-known/tokenforge/dbsc — service descriptor for SDK auto-discovery
+```
+
+### Workforce SSO replaces Cisco Duo Premier (Sprint 36)
+
+Five OIDC IdPs + SAML 2.0:
+
+```ts
+import { exchangeSso } from '@opensyber/tokenforge/server/internal';
+
+// After Okta / Entra / Google Workspace / Auth0 / generic OIDC login
+const result = await exchangeSso(db, store, {
+  tenantId, workforceAppId,
+  idToken: req.body.idToken,  // from your IdP
+  jwks,                        // cached via getJwks()
+});
+// result: { ok: true, subjectId, externalSubject, email, challenge, challengeExpiresAt }
+```
+
+JWKS cache: 24-hour freshness with stale-fallback when IdP is unreachable. xmlsoap claim namespace for Microsoft AD FS / Azure AD compatibility built in.
+
+### AitM detection + per-route step-up (Sprint 39)
+
+```ts
+import { requireFreshSig } from '@opensyber/tokenforge/server';
+
+app.use('/admin/*', requireFreshSig({ minTrustScore: 90 }));
+app.use('/billing/*', requireFreshSig({
+  minTrustScore: 95,
+  requireWebAuthn: true,
+}));
+```
+
+Per-tenant policy via `tf_tenants.step_up_actions` JSON:
+
+```json
+[
+  { "path": "/admin/billing", "requireFreshSig": true, "freshSigMaxAgeSec": 30 },
+  { "path": "/admin/*", "requireFreshSig": true, "requireWebAuthn": true }
+]
+```
+
+Exact match wins over glob. Glob /admin/* matches /admin/users but not /admin (no segment past prefix).
+
+### Action signing for sensitive operations
+
+```ts
+// Client
+const sig = await tokenforge.signAction({
+  action: 'transfer',
+  body: { fromAccount, toAccount, amount },
+});
+fetch('/api/transfer', {
+  method: 'POST',
+  headers: { 'X-TF-Action-Signature': sig },
+  body: JSON.stringify({ fromAccount, toAccount, amount }),
+});
+```
+
+5-second freshness window. JWS claims include `actionHash` (SHA-256 over canonicalized body) so an attacker can't replay the signature with a different transfer amount.
+
+### Webhook event stream
+
+12 events, HMAC-SHA256 signed, retried with [1s, 4s, 15s] backoff, stable `X-TF-Delivery-Id` across retries:
+
+```
+session.bound          session.verified         session.revoked
+trust_score.degraded   trust_score.critical     session.hijack_attempt
+usage.cap_exceeded     dbsc.risk_signal         dbsc.policy_block
+dbsc.session_step_up   dbsc.session_revoked     webhook.test
+```
+
+```ts
+import { verifyWebhookSignature } from '@opensyber/tokenforge/webhooks';
+
+app.post('/webhooks/tokenforge', async (c) => {
+  const rawBody = await c.req.text();
+  const ok = await verifyWebhookSignature({
+    body: rawBody,
+    signatureHeader: c.req.header('X-TF-Signature') ?? '',
+    timestampHeader: c.req.header('X-TF-Timestamp') ?? '',
+    secret: c.env.TOKENFORGE_WEBHOOK_SECRET,
+  });
+  if (!ok) return c.json({ error: 'bad_signature' }, 401);
+  // handle event ...
+});
+```
+
+Secret rotation grace window: 24 hours. Send the new secret while the old one stays valid; receivers verify against either.
+
+## How it works
 
 ```
 Browser                        TokenForge API                Your Server
   │                                │                              │
-  │ 1. Script auto-generates       │                              │
-  │    ECDSA P-256 key pair        │                              │
+  │ 1. Generate ECDSA P-256        │                              │
+  │    keypair (non-extractable)   │                              │
+  │                                │                              │
+  │ 2. POST /v1/dbsc/challenge ───>│                              │
+  │ <─────── { challenge } ────────│                              │
   │                                │                              │
-  │ 2. POST /v1/bind ─────────────>│ Store public key             │
-  │ <──────────────────────────────│ Return deviceId              │
+  │ 3. POST /v1/dbsc/register ────>│ Store public key             │
+  │    + JWS over challenge        │                              │
+  │ <─── { sessionId, deviceId } ──│                              │
   │                                │                              │
-  │ 3. fetch('/api/data')          │                              │
-  │    + X-TF-Signature header ────────────────────────────────>  │
+  │ 4. fetch('/api/data')          │                              │
+  │    + X-TF-Signature ──────────────────────────────────────>   │
   │                                │                              │
   │                                │ <── POST /v1/edge/verify ──  │
   │                                │     Verify signature         │
-  │                                │     Check nonce replay       │
+  │                                │     Run AitM heuristics      │
   │                                │     Compute trust score      │
-  │                                │ ── { allow, score: 92 } ──> │
-  │                                │                              │
-  │ <──────────────────────────────────── 200 OK ─────────────── │
+  │                                │ ──> { allow, score: 92 }     │
+  │ <──────────────────────────────────── 200 OK ───────────────  │
 ```
 
-All verification runs on TokenForge's infrastructure. Your server sends request context, gets back allow/deny. No crypto libraries, no database, no storage to manage.
+The device key never leaves the client. The TokenForge service holds the public key + session metadata. Your server passes request context, gets back an allow/step_up/block decision.
 
-## Trust Score
-
-7 signals scored 0-100 on every request:
+## Trust score signals
 
 | Signal | Weight | Detects |
 |--------|--------|---------|
-| Signature | 30 | Tampering, missing device key |
+| Signature | 30 | Tampering, missing/wrong device key |
 | IP Address | 15 | IP change since binding |
 | Geo Location | 15 | Country mismatch |
-| Fingerprint | 15 | Browser fingerprint drift |
+| Fingerprint | 15 | Browser/device fingerprint drift |
 | Velocity | 10 | Multiple IPs in short window |
-| Timing | 10 | Clock skew beyond tolerance |
+| Timing | 10 | Clock skew beyond ±60s |
 | Nonce | 5 | Replay attacks |
 
-Score >= 80: allow. Score 40-79: step-up auth. Score < 40: block.
+Score >= 80: `allow`. Score 40-79: `step_up`. Score < 40: `block`. Thresholds configurable per tenant.
+
+## Drop-in for your existing IdP
+
+TokenForge runs *after* authentication — bring your own IdP:
 
-## Advanced: npm Client SDK
+| IdP | Integration | Built-in support |
+|---|---|---|
+| **Microsoft Entra ID** | Custom Authentication Extension webhook | Roadmap M11 (Q3 2026) |
+| **Auth0** | Auth0 Action snippet | Roadmap M14 — Marketplace listing pending review |
+| **Okta** | Inline Hook + Custom Authenticator | Roadmap M15 — OIN listing pending review |
+| **Clerk** | `@tokenforge/clerk-middleware` shim | Roadmap M16 |
+| **Auth.js / NextAuth** | Works today via `@opensyber/tokenforge/nextjs` | ✅ |
+| **Firebase Auth** | Works today via `@opensyber/tokenforge/express` | ✅ |
+| **Supabase Auth** | Works today via `@opensyber/tokenforge/express` | ✅ |
+| **Custom JWT** | Works today | ✅ |
 
-For React apps or when you need more control than the script tag:
+## React integration
 
 ```tsx
 import { TokenForgeProvider, useTokenForge } from '@opensyber/tokenforge/react';
@@ -117,21 +349,66 @@ function App() {
     </TokenForgeProvider>
   );
 }
+
+function ProtectedPage() {
+  const { bound, trustScore, deviceId } = useTokenForge();
+  if (!bound) return <BindButton />;
+  return <Dashboard trustScore={trustScore} deviceId={deviceId} />;
+}
 ```
 
-## Works With Any Auth Provider
+## Self-hosted server
 
-Microsoft Entra ID, Clerk, Auth.js, NextAuth, Firebase, Supabase, Okta, or custom JWT. TokenForge runs after authentication — no changes to your auth flow.
+The server adapters work against your own database / KV — no hosted service required:
 
-## Pricing
+```ts
+import { createTokenForgeRoutes } from '@opensyber/tokenforge/server';
+import { D1Storage } from '@opensyber/tokenforge/server/storage';
+// or PostgresStorage, RedisStorage, or implement the StorageInterface
+
+const tf = createTokenForgeRoutes({
+  storage: new D1Storage(env.DB),
+  sessionMaxAge: 86400,
+});
+app.route('/api/tf', tf);
+```
+
+Storage backends shipped: D1 (Cloudflare Workers), PostgreSQL, Redis. Bring your own via `StorageInterface`.
+
+## Compatibility
+
+| Platform | Status |
+|---|---|
+| Chrome 146+ Windows | ✅ Native DBSC + polyfill fallback |
+| Chrome 146+ macOS / Linux | ⏳ DBSC pending Google rollout; polyfill works today |
+| Safari (macOS / iOS) | ✅ Polyfill via Web Crypto + IndexedDB |
+| Firefox | ✅ Polyfill |
+| Edge 146+ | ✅ Inherits Chromium DBSC |
+| Node.js 18+ (server) | ✅ |
+| Bun, Deno | ✅ |
+| Cloudflare Workers | ✅ |
+
+## Pricing (hosted service)
 
 | Plan | Price | Verifications/mo |
 |------|-------|-----------------|
 | Free | $0 | 1,000 |
 | Pro | $49/mo | 50,000 |
 | Team | $199/mo | 250,000 |
-| Enterprise | Custom | Unlimited |
+| Enterprise | Custom | Unlimited + SLA |
+
+The SDK code in this repository is MIT-licensed and runs against any storage backend — you can self-host without a TokenForge subscription.
+
+## Examples & docs
+
+- Full API reference: [tokenforge.opensyber.cloud/docs](https://tokenforge.opensyber.cloud/docs)
+- DBSC protocol explainer: [tokenforge.opensyber.cloud/dbsc](https://tokenforge.opensyber.cloud/dbsc)
+- Reference apps (Next.js, Express, Hono, Fastify): [github.com/opensyber/tokenforge-examples](https://github.com/opensyber/tokenforge-examples)
+
+## Security disclosure
+
+Security issues: `security@opensyber.cloud` (PGP key available). Coordinated disclosure within 90 days; CVE assignment for confirmed vulnerabilities.
 
 ## License
 
-Client SDK: MIT | Server verification requires a TokenForge API key from [tokenforge.opensyber.cloud](https://tokenforge.opensyber.cloud).
+SDK: MIT (see [LICENSE.md](./LICENSE.md)). Hosted service requires API key — governed by [TokenForge Terms](https://tokenforge.opensyber.cloud/terms).

package/dist/adapters/astro.d.ts

@@ -0,0 +1,64 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
+/** TokenForge context attached to context.locals.tf */
+export interface TfContext {
+    bound: boolean;
+    trustScore: number;
+    deviceId: string | null;
+}
+/** Options for the Astro middleware. */
+export interface TokenForgeAstroOptions {
+    /** Your TokenForge API key (starts with `tf_`). */
+    apiKey: string;
+    /** API base URL (defaults to TokenForge cloud). */
+    apiBase?: string;
+    /** Paths to skip verification. */
+    skipPaths?: string[];
+}
+/** Minimal Astro middleware context — avoids astro:middleware dep. */
+interface APIContext {
+    request: Request;
+    url: URL;
+    locals: {
+        tf?: TfContext;
+    };
+    clientAddress?: string;
+}
+type MiddlewareNext = () => Promise<Response>;
+type MiddlewareHandler = (context: APIContext, next: MiddlewareNext) => Promise<Response>;
+/**
+ * Astro middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/middleware.ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/astro';
+ * export const onRequest = tokenForgeMiddleware({
+ *   apiKey: import.meta.env.TOKENFORGE_API_KEY,
+ * });
+ * ```
+ *
+ * Reads `Astro.locals.tf` for downstream pages and endpoints.
+ */
+export declare function tokenForgeMiddleware(options: TokenForgeAstroOptions): MiddlewareHandler;
+/**
+ * Per-route step-up gate. Use inside page or endpoint code after the
+ * middleware has populated `Astro.locals.tf`.
+ *
+ * Returns a 403 `Response` when below threshold; the caller should
+ * `return` it. Returns `null` on pass.
+ */
+export declare function requireFreshSig(locals: {
+    tf?: TfContext;
+}, opts?: {
+    minTrustScore?: number;
+}): Response | null;
+export type TokenForgeAstroCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Astro middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeAstroCloudV2Options): MiddlewareHandler;
+export interface TokenForgeAstroCloudV2RouteContext {
+    request: Request;
+}
+/** Adapt the generic Cloud v2 bind handler to an Astro API route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (context: TokenForgeAstroCloudV2RouteContext) => Promise<Response>;
+export {};
+//# sourceMappingURL=astro.d.ts.map

package/dist/adapters/astro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astro.d.ts","sourceRoot":"../src/","sources":["adapters/astro.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,sEAAsE;AACtE,UAAU,UAAU;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,KAAK,iBAAiB,GAAG,CACvB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CAoEnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,EAC1B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,QAAQ,GAAG,IAAI,CAcjB;AASD,MAAM,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE5E,2EAA2E;AAC3E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CAOnB;AAED,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAGtC,SAAS,kCAAkC,KAC1C,OAAO,CAAC,QAAQ,CAAC,CACrB"}

package/dist/adapters/astro.js

@@ -0,0 +1,104 @@
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
+const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
+/**
+ * Astro middleware for TokenForge verification via the cloud API.
+ *
+ * Usage:
+ * ```ts
+ * // src/middleware.ts
+ * import { tokenForgeMiddleware } from '@opensyber/tokenforge/astro';
+ * export const onRequest = tokenForgeMiddleware({
+ *   apiKey: import.meta.env.TOKENFORGE_API_KEY,
+ * });
+ * ```
+ *
+ * Reads `Astro.locals.tf` for downstream pages and endpoints.
+ */
+export function tokenForgeMiddleware(options) {
+    const apiBase = options.apiBase ?? DEFAULT_API_BASE;
+    return async (context, next) => {
+        const path = context.url.pathname;
+        if (shouldSkip(path, options.skipPaths)) {
+            context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return next();
+        }
+        const header = (name) => context.request.headers.get(name);
+        try {
+            const apiRes = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path,
+                    method: context.request.method,
+                    headers: {
+                        signature: header('x-tf-signature'),
+                        nonce: header('x-tf-nonce'),
+                        timestamp: header('x-tf-timestamp'),
+                        deviceId: header('x-tf-device-id'),
+                    },
+                    ipAddress: context.clientAddress ?? header('x-forwarded-for') ?? '',
+                    countryCode: header('cf-ipcountry') ?? '',
+                    userAgent: header('user-agent') ?? '',
+                }),
+            });
+            if (!apiRes.ok) {
+                context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+                return next();
+            }
+            const { data } = (await apiRes.json());
+            if (data.status === 'block') {
+                return new Response(JSON.stringify({ error: 'session_blocked', reason: data.reason }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            }
+            context.locals.tf = {
+                bound: data.bound,
+                trustScore: data.trustScore,
+                deviceId: data.deviceId,
+            };
+            return next();
+        }
+        catch {
+            context.locals.tf = { bound: false, trustScore: 0, deviceId: null };
+            return next();
+        }
+    };
+}
+/**
+ * Per-route step-up gate. Use inside page or endpoint code after the
+ * middleware has populated `Astro.locals.tf`.
+ *
+ * Returns a 403 `Response` when below threshold; the caller should
+ * `return` it. Returns `null` on pass.
+ */
+export function requireFreshSig(locals, opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    const score = locals.tf?.trustScore ?? 0;
+    if (score < min) {
+        return new Response(JSON.stringify({
+            error: 'elevated_trust_required',
+            action: 'step_up_required',
+            trustScore: score,
+        }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+    }
+    return null;
+}
+function shouldSkip(path, skipPaths) {
+    if (!skipPaths)
+        return false;
+    return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
+}
+/** Astro middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (context, next) => {
+        const rejection = await gate(context.request);
+        return rejection ?? next();
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an Astro API route. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return async (context) => handler(context.request);
+}
+//# sourceMappingURL=astro.js.map