@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/adapters/astro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astro.js","sourceRoot":"../src/","sources":["adapters/astro.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAiClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACnE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC;AAID,2EAA2E;AAC3E,MAAM,UAAU,2BAA2B,CACzC,OAAsC;IAEtC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,SAAS,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAMD,qEAAqE;AACrE,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,KAAK,EACV,OAA2C,EACxB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/adapters/cloud-v2-bridge.d.ts

@@ -0,0 +1,8 @@
+import { type TokenForgeCloudMiddlewareOptions } from '../server/cloud-middleware.js';
+export type TokenForgeCloudV2AdapterOptions = TokenForgeCloudMiddlewareOptions;
+export type TokenForgeCloudV2RequestHandler = (request: Request) => Response | Promise<Response>;
+/** Convert the shared Fetch middleware into a framework-friendly allow/deny gate. */
+export declare function createTokenForgeCloudV2Gate(options: TokenForgeCloudMiddlewareOptions): (request: Request) => Promise<Response | null>;
+/** Preserve structured Cloud v2 denials when adapting Fetch responses. */
+export declare function tokenForgeCloudV2ResponseBody(response: Response): Promise<unknown>;
+//# sourceMappingURL=cloud-v2-bridge.d.ts.map

package/dist/adapters/cloud-v2-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-v2-bridge.d.ts","sourceRoot":"../src/","sources":["adapters/cloud-v2-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,CAC5C,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,qFAAqF;AACrF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,gCAAgC,GACxC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQhD;AAED,0EAA0E;AAC1E,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC,CAUlB"}

package/dist/adapters/cloud-v2-bridge.js

@@ -0,0 +1,24 @@
+import { createTokenForgeCloudMiddleware, } from '../server/cloud-middleware.js';
+/** Convert the shared Fetch middleware into a framework-friendly allow/deny gate. */
+export function createTokenForgeCloudV2Gate(options) {
+    const middleware = createTokenForgeCloudMiddleware(options);
+    return async (request) => {
+        const allowed = new Response(null, { status: 204 });
+        const result = await middleware(() => allowed)(request);
+        return result === allowed ? null : result;
+    };
+}
+/** Preserve structured Cloud v2 denials when adapting Fetch responses. */
+export async function tokenForgeCloudV2ResponseBody(response) {
+    try {
+        if (response.headers.get('content-type')?.includes('application/json')) {
+            return await response.json();
+        }
+        const body = await response.text();
+        return body || null;
+    }
+    catch {
+        return { error: 'tokenforge_request_rejected' };
+    }
+}
+//# sourceMappingURL=cloud-v2-bridge.js.map

package/dist/adapters/cloud-v2-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-v2-bridge.js","sourceRoot":"../src/","sources":["adapters/cloud-v2-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAEhC,MAAM,+BAA+B,CAAC;AAOvC,qFAAqF;AACrF,MAAM,UAAU,2BAA2B,CACzC,OAAyC;IAEzC,MAAM,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAgB,EAA4B,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAkB;IAElB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvE,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/adapters/express.d.ts

@@ -1,5 +1,6 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 /** Express request (minimal interface). */
-interface ExpressRequest {
+export interface ExpressRequest {
     path: string;
     method: string;
     headers: Record<string, string | string[] | undefined>;
@@ -7,7 +8,7 @@ interface ExpressRequest {
     tf?: TfContext;
     [key: string]: unknown;
 }
-interface ExpressResponse {
+export interface ExpressResponse {
     status(code: number): ExpressResponse;
     json(body: unknown): void;
 }
@@ -44,5 +45,32 @@ export interface TokenForgeExpressOptions {
  * - `deviceId: string | null` — device identifier
  */
 export declare function tokenForgeMiddleware(options: TokenForgeExpressOptions): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => Promise<void>;
+export interface TokenForgeExpressCloudV2Options extends TokenForgeCloudV2AdapterOptions {
+    /** Convert the framework request without guessing its origin or body semantics. */
+    toRequest(request: ExpressRequest): Request;
+}
+/** Express middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeExpressCloudV2Options): (request: ExpressRequest, response: ExpressResponse & {
+    setHeader?: (name: string, value: string) => void;
+}, next: NextFunction) => Promise<void>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Express route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler, options: Pick<TokenForgeExpressCloudV2Options, 'toRequest'>): (request: ExpressRequest, response: ExpressResponse & {
+    setHeader?: (name: string, value: string) => void;
+}) => Promise<void>;
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
+ * mounted on the routes that need elevated trust.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `req.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export declare function requireFreshSig(opts?: {
+    minTrustScore?: number;
+}): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => void;
 export {};
 //# sourceMappingURL=express.d.ts.map

package/dist/adapters/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F"}
+{"version":3,"file":"express.d.ts","sourceRoot":"../src/","sources":["adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F;AAOD,MAAM,WAAW,+BACf,SAAQ,+BAA+B;IACvC,mFAAmF;IACnF,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;CAC7C;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,+BAA+B,IAKtC,SAAS,cAAc,EACvB,UAAU,eAAe,GAAG;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnD,EACD,MAAM,YAAY,KACjB,OAAO,CAAC,IAAI,CAAC,CAoBjB;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,EACxC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,WAAW,CAAC,IAGzD,SAAS,cAAc,EACvB,UAAU,eAAe,GAAG;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnD,KACA,OAAO,CAAC,IAAI,CAAC,CAejB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAE3D,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,IAAI,CAY7E"}

package/dist/adapters/express.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, tokenForgeCloudV2ResponseBody, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Express middleware for TokenForge verification via the cloud API.
@@ -70,4 +71,68 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/** Express middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (request, response, next) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            response.status(500).json({ error: 'tokenforge_adapter_invalid_request' });
+            return;
+        }
+        const rejection = await gate(fetchRequest);
+        if (!rejection) {
+            next();
+            return;
+        }
+        rejection.headers.forEach((value, name) => response.setHeader?.(name, value));
+        response.status(rejection.status).json(await tokenForgeCloudV2ResponseBody(rejection));
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Express route. */
+export function tokenForgeCloudV2BindRoute(handler, options) {
+    return async (request, response) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            response.status(500).json({ error: 'tokenforge_adapter_invalid_request' });
+            return;
+        }
+        const result = await handler(fetchRequest);
+        result.headers.forEach((value, name) => response.setHeader?.(name, value));
+        response.status(result.status).json(await tokenForgeCloudV2ResponseBody(result));
+    };
+}
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
+ * mounted on the routes that need elevated trust.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `req.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export function requireFreshSig(opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    return (req, res, next) => {
+        const score = req.tf?.trustScore ?? 0;
+        if (score < min) {
+            res.status(403).json({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: score,
+            });
+            return;
+        }
+        next();
+    };
+}
 //# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"../src/","sources":["adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,OAAwC;IAExC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EACV,OAAuB,EACvB,QAEC,EACD,IAAkB,EACH,EAAE;QACjB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpC,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAwC,EACxC,OAA2D;IAE3D,OAAO,KAAK,EACV,OAAuB,EACvB,QAEC,EACc,EAAE;QACjB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjC,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/fastify.d.ts

@@ -1,3 +1,4 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 /** TokenForge context attached to request.tf */
 export interface TfContext {
     bound: boolean;
@@ -13,19 +14,20 @@ export interface TokenForgeFastifyOptions {
     /** Paths to skip verification. */
     skipPaths?: string[];
 }
-interface FastifyRequest {
+export interface FastifyRequest {
     url: string;
     method: string;
     headers: Record<string, string | string[] | undefined>;
     ip?: string;
     tf?: TfContext;
 }
-interface FastifyReply {
+export interface FastifyReply {
     code(statusCode: number): FastifyReply;
-    send(payload: unknown): void;
+    header?(name: string, value: string): FastifyReply;
+    send(payload: unknown): FastifyReply;
 }
-interface FastifyInstance {
-    addHook(name: 'preHandler', handler: (req: FastifyRequest, reply: FastifyReply) => Promise<void>): void;
+export interface FastifyInstance {
+    addHook(name: 'preHandler', handler: (req: FastifyRequest, reply: FastifyReply) => Promise<void | FastifyReply>): void;
     decorateRequest(name: string, value: unknown): void;
 }
 /**
@@ -40,5 +42,29 @@ interface FastifyInstance {
  * ```
  */
 export declare function tokenForgePlugin(fastify: FastifyInstance, options: TokenForgeFastifyOptions, done: (err?: Error) => void): void;
-export {};
+export interface TokenForgeFastifyCloudV2Options extends TokenForgeCloudV2AdapterOptions {
+    /** Convert the framework request without guessing its origin or body semantics. */
+    toRequest(request: FastifyRequest): Request;
+}
+/** Register fail-closed Cloud v2 verification as a Fastify pre-handler. */
+export declare function tokenForgeCloudV2Plugin(fastify: FastifyInstance, options: TokenForgeFastifyCloudV2Options): Promise<void>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Fastify route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler, options: Pick<TokenForgeFastifyCloudV2Options, 'toRequest'>): (request: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
+/**
+ * Per-route step-up gate. Register after `tokenForgePlugin` ran globally,
+ * scoped to a route that needs elevated trust.
+ *
+ * ```ts
+ * fastify.register(tokenForgePlugin, { apiKey });
+ * fastify.addHook('preHandler', async (req, reply) => {
+ *   if (req.url.startsWith('/admin')) await requireFreshSig()(req, reply);
+ * });
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `request.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export declare function requireFreshSig(opts?: {
+    minTrustScore?: number;
+}): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
 //# sourceMappingURL=fastify.d.ts.map

package/dist/adapters/fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAEA,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN"}
+{"version":3,"file":"fastify.d.ts","sourceRoot":"../src/","sources":["adapters/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CACP,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,GAChC,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN;AAOD,MAAM,WAAW,+BACf,SAAQ,+BAA+B;IACvC,mFAAmF;IACnF,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;CAC7C;AAED,2EAA2E;AAC3E,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,EACxC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,WAAW,CAAC,IAGzD,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,YAAY,CAAC,CAgBzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAErD,KAAK,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAUvE"}

package/dist/adapters/fastify.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, tokenForgeCloudV2ResponseBody, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Fastify plugin for TokenForge verification via the cloud API.
@@ -66,4 +67,68 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/** Register fail-closed Cloud v2 verification as a Fastify pre-handler. */
+export async function tokenForgeCloudV2Plugin(fastify, options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    fastify.addHook('preHandler', async (request, reply) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            return reply.code(500).send({
+                error: 'tokenforge_adapter_invalid_request',
+            });
+        }
+        const rejection = await gate(fetchRequest);
+        if (!rejection)
+            return;
+        rejection.headers.forEach((value, name) => reply.header?.(name, value));
+        return reply.code(rejection.status).send(await tokenForgeCloudV2ResponseBody(rejection));
+    });
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Fastify route. */
+export function tokenForgeCloudV2BindRoute(handler, options) {
+    return async (request, reply) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            return reply.code(500).send({
+                error: 'tokenforge_adapter_invalid_request',
+            });
+        }
+        const result = await handler(fetchRequest);
+        result.headers.forEach((value, name) => reply.header?.(name, value));
+        return reply.code(result.status).send(await tokenForgeCloudV2ResponseBody(result));
+    };
+}
+/**
+ * Per-route step-up gate. Register after `tokenForgePlugin` ran globally,
+ * scoped to a route that needs elevated trust.
+ *
+ * ```ts
+ * fastify.register(tokenForgePlugin, { apiKey });
+ * fastify.addHook('preHandler', async (req, reply) => {
+ *   if (req.url.startsWith('/admin')) await requireFreshSig()(req, reply);
+ * });
+ * ```
+ *
+ * Responds 403 `elevated_trust_required` when `request.tf` is missing or
+ * `trustScore` is below the threshold.
+ */
+export function requireFreshSig(opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    return async (req, reply) => {
+        const score = req.tf?.trustScore ?? 0;
+        if (score < min) {
+            reply.code(403).send({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: score,
+            });
+        }
+    };
+}
 //# sourceMappingURL=fastify.js.map

package/dist/adapters/fastify.js.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAwClE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwB,EACxB,OAAiC,EACjC,IAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"fastify.js","sourceRoot":"../src/","sources":["adapters/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AA4ClE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwB,EACxB,OAAiC,EACjC,IAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAQD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB,EACxB,OAAwC;IAExC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,oCAAoC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACtC,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAwC,EACxC,OAA2D;IAE3D,OAAO,KAAK,EACV,OAAuB,EACvB,KAAmB,EACI,EAAE;QACzB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,oCAAoC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACnC,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAiB,EAAE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/hono.d.ts

@@ -7,6 +7,18 @@
  * published tarball. Self-hosting customers should use the source repo
  * directly instead of the npm package.
  */
-export { tokenForgeMiddleware } from '../server/middleware.js';
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
+export { tokenForgeMiddleware, requireFreshSig } from '../server/middleware.js';
 export type { TokenForgeOptions } from '../server/middleware.js';
+export interface HonoCloudV2Context {
+    req: {
+        raw: Request;
+    };
+}
+type HonoCloudV2Next = () => Promise<void | Response>;
+export type TokenForgeHonoCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Hono middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeHonoCloudV2Options): (context: HonoCloudV2Context, next: HonoCloudV2Next) => Promise<void | Response>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Hono route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (context: HonoCloudV2Context) => Response | Promise<Response>;
 //# sourceMappingURL=hono.d.ts.map

package/dist/adapters/hono.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"hono.d.ts","sourceRoot":"../src/","sources":["adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;CACvB;AAED,KAAK,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;AAEtD,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE3E,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,IAKnC,SAAS,kBAAkB,EAC3B,MAAM,eAAe,KACpB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAI5B;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAEhC,SAAS,kBAAkB,KAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEnE"}

package/dist/adapters/hono.js

@@ -7,5 +7,18 @@
  * published tarball. Self-hosting customers should use the source repo
  * directly instead of the npm package.
  */
-export { tokenForgeMiddleware } from '../server/middleware.js';
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
+export { tokenForgeMiddleware, requireFreshSig } from '../server/middleware.js';
+/** Hono middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (context, next) => {
+        const rejection = await gate(context.req.raw);
+        return rejection ?? next();
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Hono route. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return (context) => handler(context.req.raw);
+}
 //# sourceMappingURL=hono.js.map

package/dist/adapters/hono.js.map

@@ -1 +1 @@
-{"version":3,"file":"hono.js","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"hono.js","sourceRoot":"../src/","sources":["adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAWhF,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EACV,OAA2B,EAC3B,IAAqB,EACK,EAAE;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,SAAS,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,CAAC,OAA2B,EAAgC,EAAE,CACnE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/adapters/index.d.ts

@@ -1,5 +1,7 @@
-export { tokenForgeMiddleware as honoMiddleware } from './hono.js';
-export { tokenForgeMiddleware as expressMiddleware } from './express.js';
+export { tokenForgeMiddleware as honoMiddleware, requireFreshSig as honoRequireFreshSig } from './hono.js';
+export { tokenForgeMiddleware as expressMiddleware, requireFreshSig as expressRequireFreshSig } from './express.js';
 export { withTokenForge, tokenForgeCheck } from './nextjs.js';
-export { tokenForgePlugin } from './fastify.js';
+export { tokenForgePlugin, requireFreshSig as fastifyRequireFreshSig } from './fastify.js';
+export { tokenForgeHandle, requireFreshSig as svelteKitRequireFreshSig } from './sveltekit.js';
+export { tokenForgeMiddleware as astroMiddleware, requireFreshSig as astroRequireFreshSig } from './astro.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../src/","sources":["adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapters/index.js

@@ -1,5 +1,7 @@
-export { tokenForgeMiddleware as honoMiddleware } from './hono.js';
-export { tokenForgeMiddleware as expressMiddleware } from './express.js';
+export { tokenForgeMiddleware as honoMiddleware, requireFreshSig as honoRequireFreshSig } from './hono.js';
+export { tokenForgeMiddleware as expressMiddleware, requireFreshSig as expressRequireFreshSig } from './express.js';
 export { withTokenForge, tokenForgeCheck } from './nextjs.js';
-export { tokenForgePlugin } from './fastify.js';
+export { tokenForgePlugin, requireFreshSig as fastifyRequireFreshSig } from './fastify.js';
+export { tokenForgeHandle, requireFreshSig as svelteKitRequireFreshSig } from './sveltekit.js';
+export { tokenForgeMiddleware as astroMiddleware, requireFreshSig as astroRequireFreshSig } from './astro.js';
 //# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"../src/","sources":["adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapters/nextjs.d.ts

@@ -1,3 +1,4 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 type NextRequest = Request & {
     nextUrl?: {
         pathname: string;
@@ -47,5 +48,35 @@ export declare function tokenForgeCheck(req: NextRequest, options: TokenForgeNex
     proceed: false;
     response: Response;
 }>;
+/**
+ * Per-route step-up gate. Wrap an inner handler that already received a
+ * `TfContext` (typically via `withTokenForge`). Returns 403 with
+ * `elevated_trust_required` when the device's `trustScore` is below the
+ * threshold (default 90).
+ *
+ * ```ts
+ * export const POST = withTokenForge(
+ *   withFreshSig(adminHandler, { minTrustScore: 90 }),
+ *   { apiKey: process.env.TOKENFORGE_API_KEY! },
+ * );
+ * ```
+ */
+export declare function withFreshSig(handler: (req: NextRequest, tf: TfContext) => Promise<Response>, opts?: {
+    minTrustScore?: number;
+}): (req: NextRequest, tf: TfContext) => Promise<Response>;
+/**
+ * Cross-adapter alias for {@link withFreshSig}. The 5 non-Next.js adapters
+ * (astro / express / fastify / hono / sveltekit) all export `requireFreshSig`;
+ * exposing the same name here keeps the per-adapter docs uniform so the
+ * Sprint 39 step-up snippet doesn't fork by framework.
+ */
+export declare const requireFreshSig: typeof withFreshSig;
+export type TokenForgeNextCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Wrap a Next.js route handler with the Cloud v2 local and remote gates. */
+export declare function withTokenForgeCloudV2<TRequest extends Request = NextRequest>(handler: (request: TRequest) => Response | Promise<Response>, options: TokenForgeNextCloudV2Options): (request: TRequest) => Promise<Response>;
+/** Run only the Cloud v2 authorization decision for middleware composition. */
+export declare function tokenForgeCloudV2Check(options: TokenForgeNextCloudV2Options): (request: Request) => Promise<Response | null>;
+/** Expose the generic Cloud v2 bind handler as a Next.js route handler. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): TokenForgeCloudV2RequestHandler;
 export {};
 //# sourceMappingURL=nextjs.d.ts.map

package/dist/adapters/nextjs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["../../src/adapters/nextjs.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG,OAAO,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhE,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,OAAO,EAAE,qBAAqB,IAIhB,KAAK,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA8CnD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAgDpF"}
+{"version":3,"file":"nextjs.d.ts","sourceRoot":"../src/","sources":["adapters/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,KAAK,WAAW,GAAG,OAAO,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhE,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,OAAO,EAAE,qBAAqB,IAIhB,KAAK,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqCnD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAmDpF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC/D,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAexD;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,qBAAe,CAAC;AAM5C,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE3E,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,QAAQ,SAAS,OAAO,GAAG,WAAW,EAC1E,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC5D,OAAO,EAAE,4BAA4B,GACpC,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAO1C;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,4BAA4B,GACpC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAEhD;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,GACvC,+BAA+B,CAEjC"}