The BTX RPC client (constructed once at boot).
OptionalenforceEnforce that the redeemed challenge's binding.{resource,subject,purpose}
matches what this request resolves to (audit H-1). Default true.
Without it, a valid proof issued for one binding can be replayed to admit a
different route/tenant (btxd's redeem can't see the request). Resolvers must
be deterministic per request. Set false only for intentional cross-binding reuse.
OptionalisOverride the default "is the proof present?" check. By default it returns
true iff all of x-btx-challenge, x-btx-proof-nonce, x-btx-proof-digest
are set.
OptionalissueExtra issue params forwarded to client.issue() (target_solve_time_s, expires_in_s, etc.).
OptionalonOptional hook fired on successful admission. Receives req + the redeem result.
OptionalonOptional hook fired when client.issue() or client.redeem() throws.
Receives the original error + the request. Fires exactly once before
the preHandler re-throws to hand off to Fastify's error pipeline.
Use this for logging/observability — don't mutate the error or the
reply. Audit ref: D-1.
Logical purpose label, e.g. 'ai_inference_gate' or 'rate_limit'.
Resource identifier, e.g. (req) => \model:${req.body.model}|route:${req.url}``.
Subject identifier, e.g. (req) => \tenant:${req.user.id}``.
Options for btxAdmission.