@opensyber/tokenforge 1.0.0 → 1.1.0

package/README.md

@@ -3,6 +3,119 @@
 [![npm](https://img.shields.io/npm/v/@opensyber/tokenforge.svg)](https://www.npmjs.com/package/@opensyber/tokenforge)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
 
+## TokenForge Cloud v2 integration kit
+
+The `1.1.0` Cloud path keeps the TokenForge bearer credential on the
+application server. The browser creates a non-extractable P-256 key, binds only
+through an authenticated application endpoint, and signs the exact v2 request
+contract.
+
+```ts
+import { TokenForgeDevice } from '@opensyber/tokenforge/client';
+
+const device = await TokenForgeDevice.open({
+  bindEndpoint: '/api/v1/auth/device/bind',
+  fetch: authenticatedFetch,
+});
+await device.bindAuthenticatedSession();
+export const secureFetch = device.wrapFetch(authenticatedFetch);
+```
+
+The server adapter is responsible for session resolution, the server-only
+credential, local/cloud decision composition, circuit breaking, and telemetry.
+Set `TOKENFORGE_CLOUD_MODE` to `off`, `monitor`, or `enforce`; default/unknown
+values are `off`. In `monitor`, a locally valid request stays available while
+cloud failures and would-block outcomes are reported. In `enforce`, definitive
+cloud rejection or cloud unavailability rejects the request.
+
+See `@opensyber/tokenforge-protocol@2.0.0-rc.1` for the normative binary
+contract, schemas, migration guide, and cross-language vectors.
+
+### Cloud v2 server boundary
+
+Cloud v2 intentionally separates application authentication from TokenForge
+device proof. The application owns the authenticated bind route and resolves
+the current session on the server. Only that route may add a
+`TokenForgeIdentity` envelope before delegating to the generic bind handler.
+The browser never supplies trusted profile or subject fields.
+
+```ts
+import {
+  createTokenForgeCloudBindHandler,
+  createTokenForgeCloudMiddleware,
+} from '@opensyber/tokenforge/server';
+import type { TokenForgeIdentity } from '@opensyber/tokenforge/identity';
+
+// Configure these once in server-only application code. The generated types
+// describe the required session resolver, replay store, cloud client, mode,
+// telemetry, and circuit-breaker dependencies.
+export const bindDevice = createTokenForgeCloudBindHandler(bindOptions);
+export const protectRequest = createTokenForgeCloudMiddleware(verifyOptions);
+
+// Your authenticated route resolves identity from its own session or IdP,
+// then passes the standard Request to bindDevice. Never forward identity data
+// accepted from the browser.
+const identity: TokenForgeIdentity = await resolveIdentityFromSession(request);
+```
+
+Framework adapters expose the same verification contract without duplicating
+cryptography or authorization logic:
+
+| Framework | Cloud v2 entry point | Request bridge |
+|---|---|---|
+| Next.js | `withTokenForgeCloudV2` / `tokenForgeCloudV2Check` | Native `Request` |
+| Hono | `tokenForgeCloudV2Middleware` | `context.req.raw` |
+| SvelteKit | `tokenForgeCloudV2Handle` | `event.request` |
+| Astro | `tokenForgeCloudV2Middleware` | `context.request` |
+| Express | `tokenForgeCloudV2Middleware` | Explicit `toRequest` required |
+| Fastify | `tokenForgeCloudV2Plugin` | Explicit `toRequest` required |
+
+Express and Fastify require an application-owned `toRequest` converter because
+the SDK must not guess the external origin, proxy trust, or request-body
+semantics. Conversion failure is rejected rather than silently bypassing
+TokenForge.
+
+The same named bind adapter is available from every framework entry point:
+
+```ts
+import { createTokenForgeCloudBindHandler } from '@opensyber/tokenforge/server';
+import { tokenForgeCloudV2BindRoute } from '@opensyber/tokenforge/nextjs';
+
+const bindDevice = createTokenForgeCloudBindHandler(bindOptions);
+export const POST = tokenForgeCloudV2BindRoute(bindDevice);
+```
+
+For Hono, SvelteKit, and Astro, pass the same generic handler to
+`tokenForgeCloudV2BindRoute`. Express and Fastify take a second argument with
+the same explicit `toRequest` converter used by their verification adapter:
+
+```ts
+app.post(
+  '/api/v1/auth/device/bind',
+  tokenForgeCloudV2BindRoute(bindDevice, { toRequest }),
+);
+```
+
+Mount this route only after the application's authentication middleware. The
+generic bind handler must resolve the session and identity from trusted
+server-side state; never copy subject or profile fields from the request body.
+
+Recommended adoption order:
+
+1. Mount the authenticated bind route and verify identity correlation in
+   `off` mode.
+2. Enable `monitor` and inspect local denials, cloud would-block decisions,
+   outages, and replay telemetry without changing application availability.
+3. Resolve all unexplained monitor findings and switch selected protected paths
+   to `enforce`.
+4. Keep public health, callback, and webhook paths in the exact `skipPaths`
+   allowlist; do not use substring matching.
+
+The older `tokenForgeMiddleware`, `tokenForgePlugin`, `withTokenForge`, and
+`tokenForgeHandle` examples below use the legacy v1 fail-open cloud behavior.
+They remain exported for staged migration but should not be selected for a new
+Cloud v2 integration.
+
 **Device-bound session security for the post-AiTM era.** W3C [DBSC](https://w3c.github.io/webappsec-dbsc/)–aligned, ECDSA P-256 + WebAuthn, drop-in for Auth0 / Okta / Clerk / Microsoft Entra ID. Every request after login is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.
 
 ## Why this matters in 2026
@@ -14,16 +127,22 @@
 
 ## Quick Start
 
-### 1. Add the script tag (zero-code path)
+### 1. Initialize after authenticated login
+
+```ts
+import { TokenForgeDevice } from '@opensyber/tokenforge/client';
 
-```html
-<script
-  src="https://tokenforge-api.opensyber.cloud/sdk.js"
-  data-api-key="tf_your_api_key"
-></script>
+const device = await TokenForgeDevice.open({
+  bindEndpoint: '/api/v1/auth/device/bind',
+  fetch: authenticatedFetch,
+});
+await device.bindAuthenticatedSession();
+const secureFetch = device.wrapFetch(authenticatedFetch);
 ```
 
-The script auto-generates ECDSA P-256 device keys (non-extractable, IndexedDB-stored), binds the session, and signs every `fetch()` request with `X-TF-Signature`, `X-TF-Nonce`, `X-TF-Timestamp` headers. On Chrome 146+ Windows it transparently uses the browser's native DBSC; on other browsers it polyfills via Web Crypto.
+The browser receives no TokenForge API key. It generates a non-extractable
+ECDSA P-256 device key, sends only the public JWK through the authenticated
+application bind endpoint, and signs the exact request-bound v2 contract.
 
 ### 2. Add server middleware
 
@@ -32,20 +151,20 @@ npm install @opensyber/tokenforge
 ```
 
 ```ts
-// Express
+// Legacy v1 Express migration path
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
 app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
 // req.tf.bound, req.tf.trustScore, req.tf.deviceId
 
-// Next.js (App Router)
+// Legacy v1 Next.js migration path
 import { withTokenForge } from '@opensyber/tokenforge/nextjs';
 export const GET = withTokenForge(handler, { apiKey: process.env.TOKENFORGE_API_KEY! });
 
-// Fastify
+// Legacy v1 Fastify migration path
 import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
 fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });
 
-// Hono
+// Legacy v1 Hono migration path
 import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono';
 app.use('/api/*', tokenForgeMiddleware({ apiKey: env.TOKENFORGE_API_KEY }));
 ```

package/dist/adapters/astro.d.ts

@@ -1,3 +1,4 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 /** TokenForge context attached to context.locals.tf */
 export interface TfContext {
     bound: boolean;
@@ -51,5 +52,13 @@ export declare function requireFreshSig(locals: {
 }, opts?: {
     minTrustScore?: number;
 }): Response | null;
+export type TokenForgeAstroCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Astro middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeAstroCloudV2Options): MiddlewareHandler;
+export interface TokenForgeAstroCloudV2RouteContext {
+    request: Request;
+}
+/** Adapt the generic Cloud v2 bind handler to an Astro API route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (context: TokenForgeAstroCloudV2RouteContext) => Promise<Response>;
 export {};
 //# sourceMappingURL=astro.d.ts.map

package/dist/adapters/astro.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"astro.d.ts","sourceRoot":"","sources":["../../src/adapters/astro.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,sEAAsE;AACtE,UAAU,UAAU;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,KAAK,iBAAiB,GAAG,CACvB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CAoEnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,EAC1B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,QAAQ,GAAG,IAAI,CAcjB"}
+{"version":3,"file":"astro.d.ts","sourceRoot":"../src/","sources":["adapters/astro.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,sEAAsE;AACtE,UAAU,UAAU;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,KAAK,iBAAiB,GAAG,CACvB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CAoEnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,EAC1B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,QAAQ,GAAG,IAAI,CAcjB;AASD,MAAM,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE5E,2EAA2E;AAC3E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CAOnB;AAED,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAGtC,SAAS,kCAAkC,KAC1C,OAAO,CAAC,QAAQ,CAAC,CACrB"}

package/dist/adapters/astro.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Astro middleware for TokenForge verification via the cloud API.
@@ -88,4 +89,16 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/** Astro middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (context, next) => {
+        const rejection = await gate(context.request);
+        return rejection ?? next();
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an Astro API route. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return async (context) => handler(context.request);
+}
 //# sourceMappingURL=astro.js.map

package/dist/adapters/astro.js.map

@@ -1 +1 @@
-{"version":3,"file":"astro.js","sourceRoot":"","sources":["../../src/adapters/astro.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAiClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACnE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"astro.js","sourceRoot":"../src/","sources":["adapters/astro.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAiClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACnE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAQpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,KAAK;SAClB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC/D,CAAC;AACJ,CAAC;AAID,2EAA2E;AAC3E,MAAM,UAAU,2BAA2B,CACzC,OAAsC;IAEtC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,SAAS,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAMD,qEAAqE;AACrE,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,KAAK,EACV,OAA2C,EACxB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/adapters/cloud-v2-bridge.d.ts

@@ -0,0 +1,8 @@
+import { type TokenForgeCloudMiddlewareOptions } from '../server/cloud-middleware.js';
+export type TokenForgeCloudV2AdapterOptions = TokenForgeCloudMiddlewareOptions;
+export type TokenForgeCloudV2RequestHandler = (request: Request) => Response | Promise<Response>;
+/** Convert the shared Fetch middleware into a framework-friendly allow/deny gate. */
+export declare function createTokenForgeCloudV2Gate(options: TokenForgeCloudMiddlewareOptions): (request: Request) => Promise<Response | null>;
+/** Preserve structured Cloud v2 denials when adapting Fetch responses. */
+export declare function tokenForgeCloudV2ResponseBody(response: Response): Promise<unknown>;
+//# sourceMappingURL=cloud-v2-bridge.d.ts.map

package/dist/adapters/cloud-v2-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-v2-bridge.d.ts","sourceRoot":"../src/","sources":["adapters/cloud-v2-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,CAC5C,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,qFAAqF;AACrF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,gCAAgC,GACxC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQhD;AAED,0EAA0E;AAC1E,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC,CAUlB"}

package/dist/adapters/cloud-v2-bridge.js

@@ -0,0 +1,24 @@
+import { createTokenForgeCloudMiddleware, } from '../server/cloud-middleware.js';
+/** Convert the shared Fetch middleware into a framework-friendly allow/deny gate. */
+export function createTokenForgeCloudV2Gate(options) {
+    const middleware = createTokenForgeCloudMiddleware(options);
+    return async (request) => {
+        const allowed = new Response(null, { status: 204 });
+        const result = await middleware(() => allowed)(request);
+        return result === allowed ? null : result;
+    };
+}
+/** Preserve structured Cloud v2 denials when adapting Fetch responses. */
+export async function tokenForgeCloudV2ResponseBody(response) {
+    try {
+        if (response.headers.get('content-type')?.includes('application/json')) {
+            return await response.json();
+        }
+        const body = await response.text();
+        return body || null;
+    }
+    catch {
+        return { error: 'tokenforge_request_rejected' };
+    }
+}
+//# sourceMappingURL=cloud-v2-bridge.js.map

package/dist/adapters/cloud-v2-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-v2-bridge.js","sourceRoot":"../src/","sources":["adapters/cloud-v2-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAEhC,MAAM,+BAA+B,CAAC;AAOvC,qFAAqF;AACrF,MAAM,UAAU,2BAA2B,CACzC,OAAyC;IAEzC,MAAM,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAgB,EAA4B,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAkB;IAElB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvE,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/adapters/express.d.ts

@@ -1,5 +1,6 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 /** Express request (minimal interface). */
-interface ExpressRequest {
+export interface ExpressRequest {
     path: string;
     method: string;
     headers: Record<string, string | string[] | undefined>;
@@ -7,7 +8,7 @@ interface ExpressRequest {
     tf?: TfContext;
     [key: string]: unknown;
 }
-interface ExpressResponse {
+export interface ExpressResponse {
     status(code: number): ExpressResponse;
     json(body: unknown): void;
 }
@@ -44,6 +45,18 @@ export interface TokenForgeExpressOptions {
  * - `deviceId: string | null` — device identifier
  */
 export declare function tokenForgeMiddleware(options: TokenForgeExpressOptions): (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => Promise<void>;
+export interface TokenForgeExpressCloudV2Options extends TokenForgeCloudV2AdapterOptions {
+    /** Convert the framework request without guessing its origin or body semantics. */
+    toRequest(request: ExpressRequest): Request;
+}
+/** Express middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeExpressCloudV2Options): (request: ExpressRequest, response: ExpressResponse & {
+    setHeader?: (name: string, value: string) => void;
+}, next: NextFunction) => Promise<void>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Express route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler, options: Pick<TokenForgeExpressCloudV2Options, 'toRequest'>): (request: ExpressRequest, response: ExpressResponse & {
+    setHeader?: (name: string, value: string) => void;
+}) => Promise<void>;
 /**
  * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
  * mounted on the routes that need elevated trust.

package/dist/adapters/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAC3C,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAE3D,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,IAAI,CAY7E"}
+{"version":3,"file":"express.d.ts","sourceRoot":"../src/","sources":["adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,IAGtD,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwD5F;AAOD,MAAM,WAAW,+BACf,SAAQ,+BAA+B;IACvC,mFAAmF;IACnF,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;CAC7C;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,+BAA+B,IAKtC,SAAS,cAAc,EACvB,UAAU,eAAe,GAAG;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnD,EACD,MAAM,YAAY,KACjB,OAAO,CAAC,IAAI,CAAC,CAoBjB;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,EACxC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,WAAW,CAAC,IAGzD,SAAS,cAAc,EACvB,UAAU,eAAe,GAAG;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnD,KACA,OAAO,CAAC,IAAI,CAAC,CAejB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAE3D,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,KAAG,IAAI,CAY7E"}

package/dist/adapters/express.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, tokenForgeCloudV2ResponseBody, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Express middleware for TokenForge verification via the cloud API.
@@ -70,6 +71,43 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/** Express middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (request, response, next) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            response.status(500).json({ error: 'tokenforge_adapter_invalid_request' });
+            return;
+        }
+        const rejection = await gate(fetchRequest);
+        if (!rejection) {
+            next();
+            return;
+        }
+        rejection.headers.forEach((value, name) => response.setHeader?.(name, value));
+        response.status(rejection.status).json(await tokenForgeCloudV2ResponseBody(rejection));
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Express route. */
+export function tokenForgeCloudV2BindRoute(handler, options) {
+    return async (request, response) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            response.status(500).json({ error: 'tokenforge_adapter_invalid_request' });
+            return;
+        }
+        const result = await handler(fetchRequest);
+        result.headers.forEach((value, name) => response.setHeader?.(name, value));
+        response.status(result.status).json(await tokenForgeCloudV2ResponseBody(result));
+    };
+}
 /**
  * Per-route step-up gate. Use after `tokenForgeMiddleware` ran globally,
  * mounted on the routes that need elevated trust.

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"../src/","sources":["adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsClE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,OAAwC;IAExC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EACV,OAAuB,EACvB,QAEC,EACD,IAAkB,EACH,EAAE;QACjB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpC,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAwC,EACxC,OAA2D;IAE3D,OAAO,KAAK,EACV,OAAuB,EACvB,QAEC,EACc,EAAE;QACjB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjC,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/fastify.d.ts

@@ -1,3 +1,4 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 /** TokenForge context attached to request.tf */
 export interface TfContext {
     bound: boolean;
@@ -13,19 +14,20 @@ export interface TokenForgeFastifyOptions {
     /** Paths to skip verification. */
     skipPaths?: string[];
 }
-interface FastifyRequest {
+export interface FastifyRequest {
     url: string;
     method: string;
     headers: Record<string, string | string[] | undefined>;
     ip?: string;
     tf?: TfContext;
 }
-interface FastifyReply {
+export interface FastifyReply {
     code(statusCode: number): FastifyReply;
-    send(payload: unknown): void;
+    header?(name: string, value: string): FastifyReply;
+    send(payload: unknown): FastifyReply;
 }
-interface FastifyInstance {
-    addHook(name: 'preHandler', handler: (req: FastifyRequest, reply: FastifyReply) => Promise<void>): void;
+export interface FastifyInstance {
+    addHook(name: 'preHandler', handler: (req: FastifyRequest, reply: FastifyReply) => Promise<void | FastifyReply>): void;
     decorateRequest(name: string, value: unknown): void;
 }
 /**
@@ -40,6 +42,14 @@ interface FastifyInstance {
  * ```
  */
 export declare function tokenForgePlugin(fastify: FastifyInstance, options: TokenForgeFastifyOptions, done: (err?: Error) => void): void;
+export interface TokenForgeFastifyCloudV2Options extends TokenForgeCloudV2AdapterOptions {
+    /** Convert the framework request without guessing its origin or body semantics. */
+    toRequest(request: FastifyRequest): Request;
+}
+/** Register fail-closed Cloud v2 verification as a Fastify pre-handler. */
+export declare function tokenForgeCloudV2Plugin(fastify: FastifyInstance, options: TokenForgeFastifyCloudV2Options): Promise<void>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Fastify route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler, options: Pick<TokenForgeFastifyCloudV2Options, 'toRequest'>): (request: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
 /**
  * Per-route step-up gate. Register after `tokenForgePlugin` ran globally,
  * scoped to a route that needs elevated trust.
@@ -57,5 +67,4 @@ export declare function tokenForgePlugin(fastify: FastifyInstance, options: Toke
 export declare function requireFreshSig(opts?: {
     minTrustScore?: number;
 }): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-export {};
 //# sourceMappingURL=fastify.d.ts.map

package/dist/adapters/fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAEA,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,eAAe;IACvB,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAErD,KAAK,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAUvE"}
+{"version":3,"file":"fastify.d.ts","sourceRoot":"../src/","sources":["adapters/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAI9B,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAAC;IACvC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CACP,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,GAChC,IAAI,CAAC;IACR,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAC1B,IAAI,CA6DN;AAOD,MAAM,WAAW,+BACf,SAAQ,+BAA+B;IACvC,mFAAmF;IACnF,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;CAC7C;AAED,2EAA2E;AAC3E,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,EACxC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,WAAW,CAAC,IAGzD,SAAS,cAAc,EACvB,OAAO,YAAY,KAClB,OAAO,CAAC,YAAY,CAAC,CAgBzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,IAErD,KAAK,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAUvE"}

package/dist/adapters/fastify.js

@@ -1,3 +1,4 @@
+import { createTokenForgeCloudV2Gate, tokenForgeCloudV2ResponseBody, } from './cloud-v2-bridge.js';
 const DEFAULT_API_BASE = 'https://tokenforge-api.opensyber.cloud';
 /**
  * Fastify plugin for TokenForge verification via the cloud API.
@@ -66,6 +67,43 @@ function shouldSkip(path, skipPaths) {
         return false;
     return skipPaths.some((p) => p.endsWith('*') ? path.startsWith(p.slice(0, -1)) : path === p);
 }
+/** Register fail-closed Cloud v2 verification as a Fastify pre-handler. */
+export async function tokenForgeCloudV2Plugin(fastify, options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    fastify.addHook('preHandler', async (request, reply) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            return reply.code(500).send({
+                error: 'tokenforge_adapter_invalid_request',
+            });
+        }
+        const rejection = await gate(fetchRequest);
+        if (!rejection)
+            return;
+        rejection.headers.forEach((value, name) => reply.header?.(name, value));
+        return reply.code(rejection.status).send(await tokenForgeCloudV2ResponseBody(rejection));
+    });
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Fastify route. */
+export function tokenForgeCloudV2BindRoute(handler, options) {
+    return async (request, reply) => {
+        let fetchRequest;
+        try {
+            fetchRequest = options.toRequest(request);
+        }
+        catch {
+            return reply.code(500).send({
+                error: 'tokenforge_adapter_invalid_request',
+            });
+        }
+        const result = await handler(fetchRequest);
+        result.headers.forEach((value, name) => reply.header?.(name, value));
+        return reply.code(result.status).send(await tokenForgeCloudV2ResponseBody(result));
+    };
+}
 /**
  * Per-route step-up gate. Register after `tokenForgePlugin` ran globally,
  * scoped to a route that needs elevated trust.

package/dist/adapters/fastify.js.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAwClE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwB,EACxB,OAAiC,EACjC,IAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAiB,EAAE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fastify.js","sourceRoot":"../src/","sources":["adapters/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AA4ClE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwB,EACxB,OAAiC,EACjC,IAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAEpD,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACP,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;wBAC3B,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBACnC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnC;oBACD,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBACzC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAEpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAoB;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAQD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB,EACxB,OAAwC;IAExC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,oCAAoC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACtC,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAwC,EACxC,OAA2D;IAE3D,OAAO,KAAK,EACV,OAAuB,EACvB,KAAmB,EACI,EAAE;QACzB,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,oCAAoC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACnC,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAiB,EAAE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/hono.d.ts

@@ -7,6 +7,18 @@
  * published tarball. Self-hosting customers should use the source repo
  * directly instead of the npm package.
  */
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 export { tokenForgeMiddleware, requireFreshSig } from '../server/middleware.js';
 export type { TokenForgeOptions } from '../server/middleware.js';
+export interface HonoCloudV2Context {
+    req: {
+        raw: Request;
+    };
+}
+type HonoCloudV2Next = () => Promise<void | Response>;
+export type TokenForgeHonoCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Hono middleware backed by the shared fail-closed Cloud v2 contract. */
+export declare function tokenForgeCloudV2Middleware(options: TokenForgeHonoCloudV2Options): (context: HonoCloudV2Context, next: HonoCloudV2Next) => Promise<void | Response>;
+/** Adapt the generic Cloud v2 bind handler to an authenticated Hono route. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): (context: HonoCloudV2Context) => Response | Promise<Response>;
 //# sourceMappingURL=hono.d.ts.map

package/dist/adapters/hono.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"hono.d.ts","sourceRoot":"../src/","sources":["adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;CACvB;AAED,KAAK,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;AAEtD,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE3E,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,IAKnC,SAAS,kBAAkB,EAC3B,MAAM,eAAe,KACpB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAI5B;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,+BAA+B,IAEhC,SAAS,kBAAkB,KAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEnE"}

package/dist/adapters/hono.js

@@ -7,5 +7,18 @@
  * published tarball. Self-hosting customers should use the source repo
  * directly instead of the npm package.
  */
+import { createTokenForgeCloudV2Gate, } from './cloud-v2-bridge.js';
 export { tokenForgeMiddleware, requireFreshSig } from '../server/middleware.js';
+/** Hono middleware backed by the shared fail-closed Cloud v2 contract. */
+export function tokenForgeCloudV2Middleware(options) {
+    const gate = createTokenForgeCloudV2Gate(options);
+    return async (context, next) => {
+        const rejection = await gate(context.req.raw);
+        return rejection ?? next();
+    };
+}
+/** Adapt the generic Cloud v2 bind handler to an authenticated Hono route. */
+export function tokenForgeCloudV2BindRoute(handler) {
+    return (context) => handler(context.req.raw);
+}
 //# sourceMappingURL=hono.js.map

package/dist/adapters/hono.js.map

@@ -1 +1 @@
-{"version":3,"file":"hono.js","sourceRoot":"","sources":["../../src/adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"hono.js","sourceRoot":"../src/","sources":["adapters/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAWhF,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAElD,OAAO,KAAK,EACV,OAA2B,EAC3B,IAAqB,EACK,EAAE;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,SAAS,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,CAAC,OAA2B,EAAgC,EAAE,CACnE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../src/","sources":["adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"../src/","sources":["adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC3G,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,oBAAoB,IAAI,eAAe,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapters/nextjs.d.ts

@@ -1,3 +1,4 @@
+import { type TokenForgeCloudV2AdapterOptions, type TokenForgeCloudV2RequestHandler } from './cloud-v2-bridge.js';
 type NextRequest = Request & {
     nextUrl?: {
         pathname: string;
@@ -63,5 +64,19 @@ export declare function tokenForgeCheck(req: NextRequest, options: TokenForgeNex
 export declare function withFreshSig(handler: (req: NextRequest, tf: TfContext) => Promise<Response>, opts?: {
     minTrustScore?: number;
 }): (req: NextRequest, tf: TfContext) => Promise<Response>;
+/**
+ * Cross-adapter alias for {@link withFreshSig}. The 5 non-Next.js adapters
+ * (astro / express / fastify / hono / sveltekit) all export `requireFreshSig`;
+ * exposing the same name here keeps the per-adapter docs uniform so the
+ * Sprint 39 step-up snippet doesn't fork by framework.
+ */
+export declare const requireFreshSig: typeof withFreshSig;
+export type TokenForgeNextCloudV2Options = TokenForgeCloudV2AdapterOptions;
+/** Wrap a Next.js route handler with the Cloud v2 local and remote gates. */
+export declare function withTokenForgeCloudV2<TRequest extends Request = NextRequest>(handler: (request: TRequest) => Response | Promise<Response>, options: TokenForgeNextCloudV2Options): (request: TRequest) => Promise<Response>;
+/** Run only the Cloud v2 authorization decision for middleware composition. */
+export declare function tokenForgeCloudV2Check(options: TokenForgeNextCloudV2Options): (request: Request) => Promise<Response | null>;
+/** Expose the generic Cloud v2 bind handler as a Next.js route handler. */
+export declare function tokenForgeCloudV2BindRoute(handler: TokenForgeCloudV2RequestHandler): TokenForgeCloudV2RequestHandler;
 export {};
 //# sourceMappingURL=nextjs.d.ts.map