@spfn/auth 0.2.0-beta.87 → 0.2.0-beta.89

package/dist/{authenticate-C7w-pLOR.d.ts → authenticate-DK-hLSOW.d.ts}

@@ -1,5 +1,5 @@
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, e as SocialProvider } from './types-1BMx0OX1.js';
+import { K as KeyAlgorithmType, d as KeyPlatformType, h as SocialProvider } from './types-CD95yudz.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import { Context } from 'hono';
@@ -101,6 +101,8 @@ interface RegisterParams {
     keyId: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
     metadata?: Record<string, unknown>;
 }
 interface RegisterResult {
@@ -118,6 +120,8 @@ interface LoginParams {
     fingerprint: string;
     oldKeyId?: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface LoginResult {
     userId: string;
@@ -155,6 +159,16 @@ declare function changePasswordService(params: ChangePasswordParams): Promise<vo
 
 declare const EmailSchema: _sinclair_typebox.TString;
 declare const PhoneSchema: _sinclair_typebox.TString;
+/**
+ * Optional device labels a client may send when registering a key.
+ *
+ * Display only: the key list uses them to tell one device from another, and
+ * nothing is authorized or refused by either value, so a client that lies about
+ * them gains nothing. Both are omitted by every key registered before they
+ * existed, hence optional rather than defaulted.
+ */
+declare const DeviceNameSchema: _sinclair_typebox.TString;
+declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
 declare const PasswordSchema: _sinclair_typebox.TString;
 declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
 type VerificationTargetType = Static<typeof TargetTypeSchema>;
@@ -212,6 +226,9 @@ interface RegisterPublicKeyParams {
     publicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Device label for the key list. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyParams {
     userId: number;
@@ -220,6 +237,9 @@ interface RotateKeyParams {
     newPublicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Omitted: the replaced key's label carries over, so rotation keeps its name. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyResult {
     success: boolean;
@@ -230,8 +250,61 @@ interface RevokeKeyParams {
     keyId: string;
     reason: string;
 }
+interface RevokeAllKeysParams {
+    userId: number;
+    /** The key the request itself is signed with — spared unless includeCurrent. */
+    currentKeyId: string;
+    /** true signs the caller out too. Default false: "my other devices". */
+    includeCurrent?: boolean;
+    reason: string;
+}
+interface RevokeAllKeysResult {
+    revokedCount: number;
+    currentKeyRevoked: boolean;
+}
+/** One registered device as the account surface shows it. */
+interface KeySummary {
+    keyId: string;
+    deviceName?: string;
+    platform?: string;
+    algorithm: KeyAlgorithmType;
+    /** First bytes of the fingerprint — enough to tell two entries apart. */
+    fingerprintPrefix: string;
+    /**
+     * Milliseconds since the Unix epoch, not an ISO string.
+     *
+     * One representation of a moment across the whole surface: a generated Swift
+     * or Kotlin client reads an integer with no date formatter, and
+     * `ISO8601DateFormatter` rejecting fractional seconds by default stops being
+     * a way for the two SDKs to disagree about the same value.
+     */
+    createdAtMillis: number;
+    lastUsedAtMillis?: number;
+    expiresAtMillis?: number;
+    /** The TTL has run out. The key still reads as active; authenticate refuses it. */
+    isExpired: boolean;
+    /** False once revoked. Only ever false when the caller asked for revoked keys. */
+    isActive: boolean;
+    /** When it was revoked, for the "what did I cut off, and when" reading. */
+    revokedAtMillis?: number;
+}
+interface ListKeysParams {
+    userId: number;
+    /** Also return keys already revoked. Default false: only what can still sign. */
+    includeRevoked?: boolean;
+}
+/** How much of the fingerprint the list returns. */
+declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 /**
  * Register a new public key for a user
+ *
+ * `keyId` is UNIQUE across all users, so the lookup must ignore `isActive` —
+ * filtering on it misses a revoked row and the insert then fails on the unique
+ * index, rolling the whole login transaction back into a 500. Reuse is refused
+ * with a domain error instead, telling the client to generate a fresh keyId.
+ *
+ * @throws KeyIdAlreadyRegisteredError keyId가 이미 쓰인 값일 때 (자기 폐기 키 재사용 · 남의 키)
+ * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  */
 declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
 /**
@@ -239,9 +312,36 @@ declare function registerPublicKeyService(params: RegisterPublicKeyParams): Prom
  */
 declare function rotateKeyService(params: RotateKeyParams): Promise<RotateKeyResult>;
 /**
- * Revoke a user's public key
+ * Revoke a user's public key.
+ *
+ * Returns false when the key does not belong to this user, so a caller acting
+ * on a key id from outside (the device list) can answer "not found" instead of
+ * reporting a revocation that never happened. The repository already scopes the
+ * update by userId, so someone else's key is never touched either way.
+ */
+declare function revokeKeyService(params: RevokeKeyParams): Promise<boolean>;
+/**
+ * List the caller's active keys — one entry per device that can sign for them.
+ *
+ * `isExpired` is computed rather than stored: an expired key keeps `isActive`
+ * true (nothing flips it), and `authenticate` refuses it at request time. A list
+ * that showed it as simply "active" would be telling the user something the
+ * server does not act on.
+ *
+ * The fingerprint is truncated. Its full value is what a native sign-in must
+ * send as its nonce (issue #63), and an account page has no use for it beyond
+ * telling two entries apart.
  */
-declare function revokeKeyService(params: RevokeKeyParams): Promise<void>;
+declare function listKeysService(params: ListKeysParams): Promise<KeySummary[]>;
+/**
+ * Revoke every active key the user has, optionally sparing the current one.
+ *
+ * The caller's own key is spared by default, so "sign out my other devices"
+ * does not also end the session making the request. Passing
+ * `includeCurrent: true` is the full sign-out, which until now was reachable
+ * only as a side effect of changing a password.
+ */
+declare function revokeAllKeysService(params: RevokeAllKeysParams): Promise<RevokeAllKeysResult>;
 
 /**
  * @spfn/auth - RBAC Type Definitions
@@ -392,6 +492,16 @@ interface OAuthTokens {
 interface NativeVerifyOptions {
     /** 클라이언트가 생성한 raw nonce. provider별 규약(raw 또는 SHA-256 해시)으로 대조된다. */
     nonce: string;
+    /**
+     * 같은 로그인에서 SDK가 함께 받은 provider access token (선택).
+     *
+     * id_token만으로는 알 수 없는 claim을 provider API로 보강하려는 provider가 쓴다
+     * (카카오: id_token에 email_verified가 없어 /v2/user/me의 이메일 유효·인증 플래그를 본다).
+     *
+     * ⚠️ 클라이언트가 보낸 검증되지 않은 값이다. 다른 사용자의 토큰일 수 있으므로,
+     * 이 값으로 조회한 신원은 반드시 id_token의 sub와 대조한 뒤에만 신뢰해야 한다.
+     */
+    accessToken?: string;
 }
 interface OAuthCodeExchangeOptions {
     /** Provider가 callback에 돌려준 원본 state. 일부 provider는 token 교환에도 요구한다. */
@@ -621,6 +731,16 @@ interface OAuthNativeParams {
     keyId: string;
     fingerprint: string;
     algorithm: KeyAlgorithmType;
+    /** 키 목록에 보일 기기 라벨 (선택). 표시용이라 권한 판정에 쓰이지 않는다. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /**
+     * SDK가 id_token과 함께 받은 provider access token (선택).
+     *
+     * provider가 id_token만으로 확인할 수 없는 claim을 보강할 때만 쓴다. 없으면 provider는
+     * id_token이 담은 정보만으로 신원을 정규화한다.
+     */
+    accessToken?: string;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -635,7 +755,7 @@ interface OAuthNativeResult {
 /**
  * native id_token 로그인 처리
  *
- * @throws ValidationError provider가 native sign-in을 지원하지 않을 때
+ * @throws NativeSignInUnsupportedError provider가 native sign-in을 지원하지 않을 때
  * @throws InvalidSocialTokenError id_token 검증 실패 시
  */
 declare function oauthNativeService(params: OAuthNativeParams): Promise<OAuthNativeResult>;
@@ -690,6 +810,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
@@ -705,6 +827,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
@@ -714,8 +838,30 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RotateKeyResult>;
+    listKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeRevoked: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        keys: KeySummary[];
+    }>;
+    revokeKey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            keyId: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        keyId: string;
+        selfRevoked: boolean;
+    }>;
+    revokeAllKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, RevokeAllKeysResult>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -847,10 +993,13 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         body: _sinclair_typebox.TObject<{
             idToken: _sinclair_typebox.TString;
             nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
             profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
                 name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             }>>;
@@ -1231,4 +1380,4 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { type OAuthCallbackResult as $, type AuthSession as A, rotateKeyService as B, type ChangePasswordParams as C, revokeKeyService as D, type RegisterPublicKeyParams as E, type RotateKeyParams as F, type RevokeKeyParams as G, issueOneTimeTokenService as H, type IssueOneTimeTokenResult as I, verifyOneTimeTokenService as J, oauthStartService as K, type LoginResult as L, oauthCallbackService as M, buildOAuthErrorUrl as N, type OAuthStartResult as O, type PermissionConfig as P, isOAuthProviderEnabled as Q, type RoleConfig as R, type SendVerificationCodeResult as S, requireEnabledProvider as T, type UserProfile as U, type VerificationTargetType as V, getEnabledOAuthProviders as W, getGoogleAccessToken as X, oauthUnlinkNotifyService as Y, type OAuthStartParams as Z, type OAuthCallbackParams as _, type RegisterResult as a, type UnlinkNotifyResult as a0, oauthNativeService as a1, type OAuthNativeParams as a2, selectAuthProfile as a3, resolveAuthenticatedUser as a4, type AuthProfileVerifier as a5, authenticate as a6, optionalAuth as a7, EmailSchema as a8, PhoneSchema as a9, PasswordSchema as aa, TargetTypeSchema as ab, VerificationPurposeSchema as ac, type NormalizedIdentity as ad, type OAuthTokens as ae, type NativeVerifyOptions as af, type OAuthCodeExchangeOptions as ag, type UnlinkNotifyRequest as ah, type UnlinkNotification as ai, UnlinkNotifyRejection as aj, registerOAuthProvider as ak, getOAuthProvider as al, getRegisteredProviders as am, type RotateKeyResult as b, type OAuthNativeResult as c, type ProfileInfo as d, type VerificationPurpose as e, VERIFICATION_TARGET_TYPES as f, VERIFICATION_PURPOSES as g, PERMISSION_CATEGORIES as h, type PermissionCategory as i, type AuthInitOptions as j, type OAuthProvider as k, type AuthContext as l, mainAuthRouter as m, loginService as n, logoutService as o, changePasswordService as p, type RegisterParams as q, registerService as r, type LoginParams as s, type LogoutParams as t, sendVerificationCodeService as u, verifyCodeService as v, type SendVerificationCodeParams as w, type VerifyCodeParams as x, type VerifyCodeResult as y, registerPublicKeyService as z };
+export { requireEnabledProvider as $, type AuthSession as A, registerPublicKeyService as B, type ChangePasswordParams as C, rotateKeyService as D, revokeKeyService as E, listKeysService as F, revokeAllKeysService as G, KEY_FINGERPRINT_PREFIX_LENGTH as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RotateKeyParams as M, type RevokeKeyParams as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeAllKeysParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, issueOneTimeTokenService as T, type UserProfile as U, type VerificationTargetType as V, verifyOneTimeTokenService as W, oauthStartService as X, oauthCallbackService as Y, buildOAuthErrorUrl as Z, isOAuthProviderEnabled as _, type RegisterResult as a, getEnabledOAuthProviders as a0, getGoogleAccessToken as a1, oauthUnlinkNotifyService as a2, type OAuthStartParams as a3, type OAuthCallbackParams as a4, type OAuthCallbackResult as a5, type UnlinkNotifyResult as a6, oauthNativeService as a7, type OAuthNativeParams as a8, selectAuthProfile as a9, resolveAuthenticatedUser as aa, type AuthProfileVerifier as ab, authenticate as ac, optionalAuth as ad, EmailSchema as ae, PhoneSchema as af, DeviceNameSchema as ag, PlatformSchema as ah, PasswordSchema as ai, TargetTypeSchema as aj, VerificationPurposeSchema as ak, type NormalizedIdentity as al, type OAuthTokens as am, type NativeVerifyOptions as an, type OAuthCodeExchangeOptions as ao, type UnlinkNotifyRequest as ap, type UnlinkNotification as aq, UnlinkNotifyRejection as ar, registerOAuthProvider as as, getOAuthProvider as at, getRegisteredProviders as au, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type VerificationPurpose as f, VERIFICATION_TARGET_TYPES as g, VERIFICATION_PURPOSES as h, PERMISSION_CATEGORIES as i, type PermissionCategory as j, type AuthInitOptions as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, loginService as o, logoutService as p, changePasswordService as q, registerService as r, type RegisterParams as s, type LoginParams as t, type LogoutParams as u, sendVerificationCodeService as v, verifyCodeService as w, type SendVerificationCodeParams as x, type VerifyCodeParams as y, type VerifyCodeResult as z };

package/dist/client-proof.d.ts

@@ -149,6 +149,14 @@ declare class ClientProofRefusal {
     static bodyNotTheDeclaredType(): ClientProofRefusal;
     static sessionHeaderMisplaced(): ClientProofRefusal;
     static unprocessable(): ClientProofRefusal;
+    /**
+     * A client that ships separately from the server said nothing about which
+     * contract it was built against. Without it the server cannot tell whether
+     * the two ends agree, and answering as though they do is what produces the
+     * undecodable body this check exists to replace.
+     */
+    static contractVersionMissing(): ClientProofRefusal;
+    static contractVersionUnsupported(): ClientProofRefusal;
     static profileRejected(): ClientProofRefusal;
     static sessionRevoked(): ClientProofRefusal;
     static proofExpired(): ClientProofRefusal;
@@ -430,7 +438,7 @@ declare function getClientProofReplayStore(): ClientProofReplayStore;
  */
 
 interface ContractOperation {
-    id: 'auth.clientProof.handshake' | 'echo.send' | 'items.list' | 'auth.enroll.register' | 'auth.enroll.login' | 'auth.enroll.oauthNative' | 'auth.keys.rotate';
+    id: 'auth.clientProof.handshake' | 'echo.send' | 'items.list' | 'auth.enroll.register' | 'auth.enroll.login' | 'auth.enroll.oauthNative' | 'auth.keys.rotate' | 'auth.keys.list' | 'auth.keys.revoke' | 'auth.keys.revokeAll';
     method: 'POST';
     path: string;
     /**
@@ -554,4 +562,116 @@ interface ClientProofGuardOptions {
  */
 declare function createClientProofGuard(state: ClientProofState, options?: ClientProofGuardOptions): MiddlewareHandler;
 
-export { ABSENT_BODY_SHA256, AUTH_SURFACE_OPERATIONS, type Admission, CLIENT_PROOF_CONTENT_TYPE, CLIENT_PROOF_HEADERS, CLIENT_PROOF_PROFILE, CONTRACT_OPERATIONS, CONTROL_PREFIX, CONTROL_TOKEN_HEADER, CanonicalJsonError, type CanonicalJsonErrorCode, type CanonicalObject, type CanonicalValue, type ClientProofClock, type ClientProofContext, type ClientProofCredentials, type ClientProofDevHandler, type ClientProofDevHandlerOptions, type ClientProofErrorCode, type ClientProofGuardOptions, type ClientProofInput, ClientProofRefusal, type ClientProofReplayStore, ClientProofState, type ClientProofStateOptions, type ClientProofStats, type ContractItem, type ContractOperation, ContractTypeError, DEFAULT_REPLAY_WINDOW_MILLIS, DEFAULT_SESSION_TTL_MILLIS, DEV_CATALOGUE, DEV_MAX_LIMIT, type EchoRequest, type HandshakeRequest, type ListItemsRequest, MemoryReplayLedger, MemoryReplayStore, PROOF_SIGNATURE_BYTES, PROOF_SIGNATURE_HEX_LENGTH, ProofInputError, RedisReplayStore, TestClock, admitClientProofRequest, canonicalProofInput, configureClientProofReplayStore, createClientProofDevHandler, createClientProofGuard, decodeEchoRequest, decodeHandshakeRequest, decodeListItemsRequest, encodeCanonicalJson, encodeEchoResponse, encodeHandshakeResponse, encodeListItemsResponse, getClientProofReplayStore, isCanonicalBytes, isRequestContentType, newHexId, parseCanonicalJson, parseClientProofPublicKey, readCredentials, replayLedgerKey, sha256Hex, signClientProof, systemClock, verifyClientProof };
+/**
+ * The header names each end announces itself under.
+ *
+ * Separated from the logic that reads them so the contract bundle can name them
+ * without importing the version comparison, which reads the bundle back. These
+ * are declarations and depend on nothing.
+ *
+ * @module server/client-proof/wire-headers
+ */
+/** What a client says about itself, one header each. */
+declare const CLIENT_IDENTITY_HEADERS: {
+    readonly kind: "x-spfn-client-kind";
+    readonly version: "x-spfn-client-version";
+    readonly contractVersion: "x-spfn-client-contract-version";
+};
+/**
+ * What the server says about itself, on every response.
+ *
+ * Distinct names from the request headers on purpose: a proxy that echoes a
+ * request header into the response would otherwise make the client's own
+ * version look like the server's.
+ */
+declare const SERVER_CONTRACT_HEADERS: {
+    readonly version: "x-spfn-server-contract-version";
+    readonly supportedRange: "x-spfn-supported-contract-range";
+};
+/**
+ * The client kinds the server distinguishes.
+ *
+ * `web` is separated from the two app kinds because it carries no contract
+ * version: a browser bundle is deployed with the server that serves it, so
+ * there is no second version to reconcile.
+ */
+declare const CLIENT_KINDS: readonly ["web", "ios", "android"];
+type ClientKind = typeof CLIENT_KINDS[number];
+/** A kind that ships independently of the server, so its contract version matters. */
+declare function isAppKind(kind: ClientKind): boolean;
+
+/** What one request announced about the client that sent it. */
+interface ClientIdentity {
+    kind: ClientKind;
+    /** The client's own release — a store version, or a bundle build. */
+    version: string | null;
+    /** The contract version the client was generated from. Never set for `web`. */
+    contractVersion: string | null;
+}
+/**
+ * Reads the identity headers, or null when the kind is absent or unrecognised.
+ *
+ * Null is not by itself a refusal — a request from something that predates
+ * these headers reaches here too. `judgeClientIdentity` decides.
+ */
+declare function readClientIdentity(headers: Headers): ClientIdentity | null;
+/**
+ * Whether the server serves what the client was generated against.
+ *
+ * Under 0.x the minor carries breaking changes, so a supported client agrees on
+ * major and minor. From 1.0.0 the major alone decides. This is the rule
+ * `CONTRACT_SUPPORTED_RANGE` spells out; keeping it as a comparison rather than
+ * parsing that string leaves one place to change when the line reaches 1.0.0.
+ */
+declare function isContractVersionSupported(clientVersion: string): boolean;
+/**
+ * The refusal a request's announced identity earns, or null to let it through.
+ *
+ * An app kind must state a contract version this server serves. A version it
+ * does not serve, and the absence of one, are the same answer: the two ends do
+ * not agree on what the contract is, which is what CONTRACT_UNSUPPORTED means.
+ * The response carries the server's version and range, so the client can say
+ * which way the gap runs.
+ *
+ * `web` is exempt from the contract check by construction, not by leniency.
+ *
+ * A request with no recognised kind passes. The check is on what a client says
+ * about itself, and a caller that says nothing — a curl, a health probe, a
+ * server-to-server call — is not a deployed client this rule is about.
+ */
+declare function judgeClientIdentity(identity: ClientIdentity | null): ClientProofRefusal | null;
+/** Writes the server's own announcement onto a response's headers. */
+declare function applyServerContractHeaders(headers: Headers): void;
+/** The same announcement as a plain object, for a response built from one. */
+declare function serverContractHeaders(): Record<string, string>;
+
+/**
+ * The version announcement, applied to every request rather than to the proven
+ * ones.
+ *
+ * Enrollment and login are the first calls a client makes and they carry no
+ * proof — there is no key to sign with yet. A check that lives inside proof
+ * admission therefore never sees the client it is meant to catch: an outdated
+ * app fails at login, before it reaches anything proven. This runs ahead of all
+ * of it.
+ *
+ * hono is imported as types only, so this module adds no runtime dependency.
+ *
+ * @module server/client-proof/version-middleware
+ */
+
+/** The context key the identity is left under, for a handler that wants it. */
+declare const CLIENT_IDENTITY_CONTEXT_KEY = "clientIdentity";
+/**
+ * Announces the server's contract version on every response and refuses a
+ * client whose own contract version this server does not serve.
+ *
+ * The announcement goes out either way. A refused client needs it most — the
+ * refusal says the two ends disagree, and the range is what says how.
+ *
+ * Mount this before authentication, not after: the point is to answer a stale
+ * client before anything else has a chance to fail confusingly.
+ */
+declare function createClientVersionMiddleware(): MiddlewareHandler;
+
+export { ABSENT_BODY_SHA256, AUTH_SURFACE_OPERATIONS, type Admission, CLIENT_IDENTITY_CONTEXT_KEY, CLIENT_IDENTITY_HEADERS, CLIENT_KINDS, CLIENT_PROOF_CONTENT_TYPE, CLIENT_PROOF_HEADERS, CLIENT_PROOF_PROFILE, CONTRACT_OPERATIONS, CONTROL_PREFIX, CONTROL_TOKEN_HEADER, CanonicalJsonError, type CanonicalJsonErrorCode, type CanonicalObject, type CanonicalValue, type ClientIdentity, type ClientKind, type ClientProofClock, type ClientProofContext, type ClientProofCredentials, type ClientProofDevHandler, type ClientProofDevHandlerOptions, type ClientProofErrorCode, type ClientProofGuardOptions, type ClientProofInput, ClientProofRefusal, type ClientProofReplayStore, ClientProofState, type ClientProofStateOptions, type ClientProofStats, type ContractItem, type ContractOperation, ContractTypeError, DEFAULT_REPLAY_WINDOW_MILLIS, DEFAULT_SESSION_TTL_MILLIS, DEV_CATALOGUE, DEV_MAX_LIMIT, type EchoRequest, type HandshakeRequest, type ListItemsRequest, MemoryReplayLedger, MemoryReplayStore, PROOF_SIGNATURE_BYTES, PROOF_SIGNATURE_HEX_LENGTH, ProofInputError, RedisReplayStore, SERVER_CONTRACT_HEADERS, TestClock, admitClientProofRequest, applyServerContractHeaders, canonicalProofInput, configureClientProofReplayStore, createClientProofDevHandler, createClientProofGuard, createClientVersionMiddleware, decodeEchoRequest, decodeHandshakeRequest, decodeListItemsRequest, encodeCanonicalJson, encodeEchoResponse, encodeHandshakeResponse, encodeListItemsResponse, getClientProofReplayStore, isAppKind, isCanonicalBytes, isContractVersionSupported, isRequestContentType, judgeClientIdentity, newHexId, parseCanonicalJson, parseClientProofPublicKey, readClientIdentity, readCredentials, replayLedgerKey, serverContractHeaders, sha256Hex, signClientProof, systemClock, verifyClientProof };