@opensyber/tokenforge 1.0.0 → 1.1.0

package/dist/server/cloud-bind.js

@@ -0,0 +1,387 @@
+import { PROTOCOL_V2, sha256Base64Url, } from '../protocol/v2.js';
+import { validateTokenForgeIdentity, } from '../shared/identity.js';
+const DEFAULT_API_URL = 'https://tokenforge-api.opensyber.cloud';
+const DEFAULT_TIMEOUT_MS = 1_500;
+const DEFAULT_MAX_REQUEST_BYTES = 16 * 1024;
+const DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;
+const DEVICE_PATTERN = /^[A-Za-z0-9_.:-]{8,256}$/;
+const PROJECT_PATTERN = /^[A-Za-z0-9_-]{8,256}$/;
+const SESSION_PATTERN = /^[A-Za-z0-9_-]{16,256}$/;
+const IDEMPOTENCY_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const BIND_KEYS = new Set(['protocol', 'localDeviceId', 'publicKey']);
+const PUBLIC_JWK_KEYS = new Set(['kty', 'crv', 'x', 'y', 'ext', 'key_ops']);
+class CloudBindRejectedError extends Error {
+    status;
+    code;
+    constructor(status, code) {
+        super('TokenForge Cloud rejected the bind');
+        this.status = status;
+        this.code = code;
+    }
+}
+/**
+ * Framework-neutral Cloud v2 bind handler. Mount the returned function behind
+ * the application's normal authenticated session endpoint.
+ */
+export function createTokenForgeCloudBindHandler(options) {
+    const mode = normalizeMode(options.mode);
+    const apiUrl = normalizeApiUrl(options.apiUrl ?? DEFAULT_API_URL);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const timeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_TIMEOUT_MS);
+    const maxRequestBytes = positiveInteger(options.maxRequestBytes, DEFAULT_MAX_REQUEST_BYTES);
+    const maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
+    if (!options.bindingStore || typeof options.resolveSession !== 'function') {
+        throw new Error('TokenForge Cloud bind requires bindingStore and resolveSession');
+    }
+    if (typeof fetcher !== 'function') {
+        throw new Error('TokenForge Cloud bind requires fetch');
+    }
+    return async (request) => {
+        if (request.method !== 'POST')
+            return safeJson(405, { error: 'method_not_allowed' });
+        let session;
+        try {
+            session = await options.resolveSession(request);
+        }
+        catch {
+            return safeJson(401, { error: 'unauthorized' });
+        }
+        if (!validSession(session))
+            return safeJson(401, { error: 'unauthorized' });
+        let input;
+        try {
+            input = await parseBrowserBindRequest(request, maxRequestBytes);
+        }
+        catch {
+            return safeJson(400, { error: 'invalid_bind_request' });
+        }
+        if (session.localDeviceId && session.localDeviceId !== input.localDeviceId) {
+            return safeJson(400, { error: 'device_mismatch' });
+        }
+        let publicKey;
+        try {
+            publicKey = await validatePublicJwk(input.publicKey);
+        }
+        catch {
+            return safeJson(400, { error: 'invalid_public_key' });
+        }
+        if (mode === 'off') {
+            return safeJson(200, { data: { protocol: PROTOCOL_V2, mode, bound: false } });
+        }
+        const publicSessionId = await hashOpaque('session', session.sessionId);
+        const correlationId = await hashOpaque('correlation', session.correlationId || session.userId || 'anonymous');
+        let currentBinding = null;
+        try {
+            const existing = await options.bindingStore.getByLocalDeviceId(input.localDeviceId);
+            if (existing &&
+                existing.sessionId === publicSessionId &&
+                existing.publicKeyFingerprint === publicKey.fingerprint &&
+                Date.parse(existing.expiresAt) > Date.now()) {
+                currentBinding = existing;
+                if (!options.resolveIdentity)
+                    return boundResponse(mode, existing, true);
+            }
+        }
+        catch {
+            // Cloud bind remains available when a stale local lookup fails.
+        }
+        if (!options.apiKey?.trim()) {
+            return unavailableOrExisting(mode, currentBinding);
+        }
+        const idempotencyKey = request.headers.get('Idempotency-Key') ?? '';
+        if (idempotencyKey && !IDEMPOTENCY_PATTERN.test(idempotencyKey)) {
+            return safeJson(400, { error: 'invalid_idempotency_key' });
+        }
+        let identity;
+        if (options.resolveIdentity) {
+            try {
+                const resolved = await options.resolveIdentity(request, session);
+                if (resolved !== null) {
+                    try {
+                        identity = validateTokenForgeIdentity(resolved);
+                    }
+                    catch {
+                        return safeJson(500, { error: 'tokenforge_identity_invalid' });
+                    }
+                }
+            }
+            catch {
+                return unavailableOrExisting(mode, currentBinding);
+            }
+        }
+        let cloudResult;
+        try {
+            cloudResult = await postCloudBind(fetcher, apiUrl, options.apiKey, idempotencyKey, timeoutMs, maxResponseBytes, {
+                publicKey: publicKey.json,
+                // A canonical identity is already scoped by the host's project and
+                // tenant derivation. Do not add an account-global legacy join key.
+                userId: identity?.externalUserRef ?? await hashOpaque('user', session.userId),
+                sessionId: publicSessionId,
+                fingerprint: publicKey.fingerprint,
+                userIdSource: 'declared',
+                identity,
+            });
+        }
+        catch (error) {
+            if (error instanceof CloudBindRejectedError) {
+                return safeJson(error.status, {
+                    error: 'tokenforge_rejected',
+                    reason: error.code,
+                });
+            }
+            return unavailableOrExisting(mode, currentBinding);
+        }
+        const binding = {
+            localDeviceId: input.localDeviceId,
+            cloudDeviceId: cloudResult.deviceId,
+            projectId: cloudResult.projectId,
+            sessionId: cloudResult.sessionId,
+            correlationId,
+            publicKeyFingerprint: publicKey.fingerprint,
+            publicKeyJwk: publicKey.json,
+            expiresAt: cloudResult.expiresAt,
+        };
+        try {
+            await options.bindingStore.put(binding);
+        }
+        catch {
+            return unavailableOrExisting(mode, currentBinding);
+        }
+        return boundResponse(mode, binding, cloudResult.idempotent);
+    };
+}
+async function postCloudBind(fetcher, apiUrl, apiKey, idempotencyKey, timeoutMs, maxResponseBytes, body) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    let raw;
+    try {
+        response = await fetcher(`${apiUrl}/v1/bind`, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+                ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
+            },
+            body: JSON.stringify(body),
+        });
+        raw = await readBoundedResponse(response, maxResponseBytes);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!response.ok) {
+        const code = safeCloudErrorCode(raw);
+        const authenticationFailure = response.status === 401 && code === 'unauthorized';
+        if (response.status >= 400 && response.status < 500 && !authenticationFailure) {
+            throw new CloudBindRejectedError(response.status, code);
+        }
+        throw new Error('TokenForge Cloud bind is unavailable');
+    }
+    const envelope = requireRecord(JSON.parse(raw), 'TokenForge Cloud response');
+    const data = requireRecord(envelope.data, 'TokenForge Cloud response data');
+    if (typeof data.projectId !== 'string' || !PROJECT_PATTERN.test(data.projectId) ||
+        typeof data.deviceId !== 'string' || !DEVICE_PATTERN.test(data.deviceId) ||
+        typeof data.sessionId !== 'string' || !SESSION_PATTERN.test(data.sessionId) ||
+        typeof data.expiresAt !== 'string' || !Number.isFinite(Date.parse(data.expiresAt)) ||
+        typeof data.idempotent !== 'boolean') {
+        throw new Error('TokenForge Cloud bind response is invalid');
+    }
+    return {
+        projectId: data.projectId,
+        deviceId: data.deviceId,
+        sessionId: data.sessionId,
+        expiresAt: data.expiresAt,
+        idempotent: data.idempotent,
+    };
+}
+async function readBoundedResponse(response, maxBytes) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new Error('TokenForge Cloud bind response is too large');
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(output);
+}
+async function parseBrowserBindRequest(request, maxRequestBytes) {
+    const raw = await readBoundedRequestBody(request, maxRequestBytes);
+    const input = requireRecord(JSON.parse(raw), 'TokenForge bind request');
+    rejectUnknownKeys(input, BIND_KEYS);
+    if (input.protocol !== PROTOCOL_V2 ||
+        typeof input.localDeviceId !== 'string' ||
+        !DEVICE_PATTERN.test(input.localDeviceId)) {
+        throw new Error('invalid bind request');
+    }
+    return {
+        protocol: PROTOCOL_V2,
+        localDeviceId: input.localDeviceId,
+        publicKey: requireRecord(input.publicKey, 'TokenForge public key'),
+    };
+}
+async function readBoundedRequestBody(request, maxBytes) {
+    const declaredLength = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        throw new Error('request too large');
+    }
+    if (!request.body)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new Error('request too large');
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(output);
+}
+async function validatePublicJwk(input) {
+    rejectUnknownKeys(input, PUBLIC_JWK_KEYS);
+    if (input.kty !== 'EC' || input.crv !== 'P-256' ||
+        typeof input.x !== 'string' || typeof input.y !== 'string' ||
+        (input.key_ops && (input.key_ops.length !== 1 || input.key_ops[0] !== 'verify'))) {
+        throw new Error('invalid public key');
+    }
+    const x = decodeBase64Url(input.x);
+    const y = decodeBase64Url(input.y);
+    if (x.byteLength !== 32 || y.byteLength !== 32)
+        throw new Error('invalid public key');
+    const canonical = {
+        kty: 'EC',
+        crv: 'P-256',
+        x: input.x,
+        y: input.y,
+        ext: true,
+        key_ops: ['verify'],
+    };
+    await crypto.subtle.importKey('jwk', canonical, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    const coordinates = new Uint8Array(64);
+    coordinates.set(x, 0);
+    coordinates.set(y, 32);
+    return {
+        json: JSON.stringify(canonical),
+        fingerprint: await sha256Base64Url(coordinates),
+    };
+}
+async function hashOpaque(purpose, value) {
+    return sha256Base64Url(new TextEncoder().encode(`tokenforge-v2:${purpose}\0${value}`));
+}
+function unavailableOrExisting(mode, existing) {
+    if (mode === 'enforce')
+        return safeJson(503, { error: 'tokenforge_unavailable' });
+    if (existing)
+        return boundResponse(mode, existing, true);
+    return safeJson(200, {
+        data: { protocol: PROTOCOL_V2, mode: 'monitor', bound: false, status: 'unavailable' },
+    });
+}
+function boundResponse(mode, binding, idempotent) {
+    return safeJson(200, {
+        data: {
+            protocol: PROTOCOL_V2,
+            mode,
+            bound: true,
+            projectId: binding.projectId,
+            deviceId: binding.cloudDeviceId,
+            sessionId: binding.sessionId,
+            expiresAt: binding.expiresAt,
+            idempotent,
+        },
+    });
+}
+function safeJson(status, value) {
+    return new Response(JSON.stringify(value), {
+        status,
+        headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+    });
+}
+function validSession(session) {
+    return !!session &&
+        typeof session.sessionId === 'string' && session.sessionId.length > 0 &&
+        typeof session.userId === 'string' && session.userId.length > 0;
+}
+function normalizeMode(mode) {
+    return mode === 'monitor' || mode === 'enforce' ? mode : 'off';
+}
+function normalizeApiUrl(input) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:' || !url.hostname || url.username || url.password ||
+        url.search || url.hash) {
+        throw new Error('TokenForge Cloud API URL is invalid');
+    }
+    return url.toString().replace(/\/$/, '');
+}
+function positiveInteger(value, fallback) {
+    return Number.isSafeInteger(value) && (value ?? 0) > 0 ? value : fallback;
+}
+function requireRecord(input, label) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error(`${label} must be an object`);
+    }
+    return input;
+}
+function rejectUnknownKeys(input, allowed) {
+    for (const key of Object.keys(input)) {
+        if (!allowed.has(key))
+            throw new Error(`unsupported bind field: ${key}`);
+    }
+}
+function safeCloudErrorCode(raw) {
+    try {
+        const envelope = requireRecord(JSON.parse(raw), 'TokenForge Cloud error');
+        const code = envelope.error;
+        if (typeof code === 'string' && /^[A-Za-z0-9._:-]{1,96}$/.test(code))
+            return code;
+    }
+    catch {
+        // Return a bounded generic reason without exposing a remote response body.
+    }
+    return 'bind_rejected';
+}
+function decodeBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(value))
+        throw new Error('invalid base64url');
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '=';
+    const binary = atob(padded);
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+//# sourceMappingURL=cloud-bind.js.map

package/dist/server/cloud-bind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-bind.js","sourceRoot":"../src/","sources":["server/cloud-bind.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5E,MAAM,sBAAuB,SAAQ,KAAK;IAE7B;IACA;IAFX,YACW,MAAc,EACd,IAAY;QAErB,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAHnC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;IAGvB,CAAC;CACF;AAoDD;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAgC;IAEhC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC5F,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAE/F,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAErF,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE5E,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,SAAgD,CAAC;QACrD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,MAAM,UAAU,CACpC,aAAa,EACb,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW,CACvD,CAAC;QACF,IAAI,cAAc,GAAwB,IAAI,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpF,IACE,QAAQ;gBACR,QAAQ,CAAC,SAAS,KAAK,eAAe;gBACtC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,CAAC,WAAW;gBACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAC3C,CAAC;gBACD,cAAc,GAAG,QAAQ,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,eAAe;oBAAE,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5B,OAAO,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,cAAc,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAChE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,QAAwC,CAAC;QAC7C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;oBAClD,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,WAA4B,CAAC;QACjC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,aAAa,CAC/B,OAAO,EACP,MAAM,EACN,OAAO,CAAC,MAAM,EACd,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB;gBACE,SAAS,EAAE,SAAS,CAAC,IAAI;gBACzB,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,EAAE,QAAQ,EAAE,eAAe,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBAC7E,SAAS,EAAE,eAAe;gBAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,YAAY,EAAE,UAAU;gBACxB,QAAQ;aACT,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE;oBAC5B,KAAK,EAAE,qBAAqB;oBAC5B,MAAM,EAAE,KAAK,CAAC,IAAI;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,WAAW,CAAC,QAAQ;YACnC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,aAAa;YACb,oBAAoB,EAAE,SAAS,CAAC,WAAW;YAC3C,YAAY,EAAE,SAAS,CAAC,IAAI;YAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,aAAa,CAC1B,OAAqB,EACrB,MAAc,EACd,MAAc,EACd,cAAsB,EACtB,SAAiB,EACjB,gBAAwB,EACxB,IAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,QAAkB,CAAC;IACvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,UAAU,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9E,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IAC5E,IACE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACxE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,QAAgB;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAgB,EAChB,eAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACxE,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpC,IACE,KAAK,CAAC,QAAQ,KAAK,WAAW;QAC9B,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAe;KACjF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAAgB,EAAE,QAAgB;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,iBAAiB,CAAC,KAAgC,EAAE,eAAe,CAAC,CAAC;IACrE,IACE,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO;QAC3C,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ;QAC1D,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACtF,MAAM,SAAS,GAAe;QAC5B,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,OAAO;QACZ,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB,CAAC;IACF,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3B,KAAK,EACL,SAAS,EACT,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACvC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/B,WAAW,EAAE,MAAM,eAAe,CAAC,WAAW,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACtD,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAyB,EAAE,QAA6B;IACrF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClF,IAAI,QAAQ;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE;KACtF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,IAAyB,EACzB,OAAqB,EACrB,UAAmB;IAEnB,OAAO,QAAQ,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE;YACJ,QAAQ,EAAE,WAAW;YACrB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,aAAa;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAc;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB;IACzC,OAAO,CAAC,CAAC,OAAO;QACd,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACrE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,IAAyB;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAC1E,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B,EAAE,OAA4B;IACrF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/server/cloud-middleware.d.ts

@@ -0,0 +1,46 @@
+import { PROTOCOL_V2 } from '../protocol/v2.js';
+import type { TokenForgeCloudMode } from './cloud-bind.js';
+import { type CloudVerifyOptions } from './cloud-verify.js';
+export type CloudCircuitState = 'closed' | 'open' | 'half_open';
+export type TokenForgeRequestHandler = (request: Request) => Promise<Response> | Response;
+export interface CloudVerifyDecision {
+    status: 'allow' | 'step_up' | 'block';
+    bound: boolean;
+    trustScore: number;
+    deviceId: string;
+    reason: string;
+    protocol: typeof PROTOCOL_V2;
+}
+export interface CloudTelemetryEvent {
+    type: 'attempt' | 'success' | 'would_block' | 'error' | 'timeout' | 'circuit_open' | 'local_cloud_mismatch';
+    operation: '/v2/edge/verify';
+    mode: TokenForgeCloudMode;
+    outcome: string;
+    latencyMs: number;
+    circuit: CloudCircuitState;
+    correlationId?: string;
+}
+export type CloudTelemetryHook = (event: CloudTelemetryEvent) => void;
+export interface TokenForgeCloudMiddlewareOptions {
+    mode: TokenForgeCloudMode;
+    local: CloudVerifyOptions;
+    apiKey?: string;
+    apiUrl?: string;
+    fetch?: typeof fetch;
+    requestTimeoutMs?: number;
+    maxResponseBytes?: number;
+    failureThreshold?: number;
+    openIntervalMs?: number;
+    maxOpenIntervalMs?: number;
+    /** Exact URL paths that bypass TokenForge proof verification. */
+    skipPaths?: readonly string[];
+    telemetry?: CloudTelemetryHook;
+    now?: () => number;
+}
+/**
+ * Compose local verification with TokenForge Cloud verification.
+ * Local denial always wins. Monitor observes cloud decisions; enforce requires
+ * both local and cloud acceptance.
+ */
+export declare function createTokenForgeCloudMiddleware(options: TokenForgeCloudMiddlewareOptions): (next: TokenForgeRequestHandler) => TokenForgeRequestHandler;
+//# sourceMappingURL=cloud-middleware.d.ts.map

package/dist/server/cloud-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-middleware.d.ts","sourceRoot":"../src/","sources":["server/cloud-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAGL,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAU3B,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAChE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,WAAW,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,GAAG,sBAAsB,CAAC;IAC5G,SAAS,EAAE,iBAAiB,CAAC;IAC7B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAEtE,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAaD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,CAAC,IAAI,EAAE,wBAAwB,KAAK,wBAAwB,CA8H9D"}