@dupecom/botcha-cloudflare 0.19.0 → 0.20.1

package/dist/tap-attestation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-attestation-routes.d.ts","sourceRoot":"","sources":["../src/tap-attestation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA4CpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4GrD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiDnD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;kBA8DrD;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsEtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmFtD;;;;;;;;AAED,wBAME"}
+{"version":3,"file":"tap-attestation-routes.d.ts","sourceRoot":"","sources":["../src/tap-attestation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAgEpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4GrD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiDnD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;kBA8DrD;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsEtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmFtD;;;;;;;;AAED,wBAME"}

package/dist/tap-attestation-routes.js

@@ -11,25 +11,45 @@
  *   POST   /v1/attestations/:id/revoke   — Revoke attestation
  *   POST   /v1/verify/attestation        — Verify attestation + check capability
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { issueAttestation, getAttestation, revokeAttestation, verifyAttestationToken, verifyAndCheckCapability, isValidCapabilityPattern, } from './tap-attestation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for attestation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-delegation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-delegation-routes.d.ts","sourceRoot":"","sources":["../src/tap-delegation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA4CpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsGrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDlD;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAqEpD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsErD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkDrD;;;;;;;;AAED,wBAME"}
+{"version":3,"file":"tap-delegation-routes.d.ts","sourceRoot":"","sources":["../src/tap-delegation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAgEpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsGrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDlD;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAqEpD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsErD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkDrD;;;;;;;;AAED,wBAME"}

package/dist/tap-delegation-routes.js

@@ -11,26 +11,46 @@
  *   POST   /v1/delegations/:id/revoke   — Revoke delegation (cascades)
  *   POST   /v1/verify/delegation        — Verify delegation chain
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { TAP_VALID_ACTIONS } from './tap-agents.js';
 import { createDelegation, getDelegation, listDelegations, revokeDelegation, verifyDelegationChain, } from './tap-delegation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for delegation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-reputation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-reputation-routes.d.ts","sourceRoot":"","sources":["../src/tap-reputation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EASL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAkC7B;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA6DlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2H1D;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4EzD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;oEAyDpD;;;;;;;AAED,wBAKE"}
+{"version":3,"file":"tap-reputation-routes.d.ts","sourceRoot":"","sources":["../src/tap-reputation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EASL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAsD7B;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA6DlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2H1D;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4EzD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;oEAyDpD;;;;;;;AAED,wBAKE"}

package/dist/tap-reputation-routes.js

@@ -10,25 +10,45 @@
  *   GET    /v1/reputation/:agent_id/events   — List reputation events
  *   POST   /v1/reputation/:agent_id/reset    — Reset agent reputation (admin)
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { getReputationScore, recordReputationEvent, listReputationEvents, resetReputation, isValidCategory, isValidAction, isValidCategoryAction, } from './tap-reputation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for reputation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-routes.d.ts

@@ -309,13 +309,22 @@ export declare function verifyIOURoute(c: Context): Promise<(Response & import("
     error: string;
     message: string;
 }, 404, "json">) | (Response & import("hono").TypedResponse<{
+    success: false;
+    error: string;
+    message: string;
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
     success: false;
     verified: false;
     error: string | undefined;
 }, 400, "json">) | (Response & import("hono").TypedResponse<{
+    success: false;
+    verified: true;
+    error: string;
+    message: string;
+}, 502, "json">) | (Response & import("hono").TypedResponse<{
     success: true;
     verified: true;
-    access_token: string | undefined;
+    access_token: string;
     expires_at: string | undefined;
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">) | (Response & import("hono").TypedResponse<{
     success: false;

package/dist/tap-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-routes.d.ts","sourceRoot":"","sources":["../src/tap-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAsIpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwErD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwDhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAmDlD;AAID;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsFrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2ClD;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4D9C;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAwClD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/C;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;kBAwE9C;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCnD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsClD;;;;;;;;;;;;;;AAaD,wBAYE"}
+{"version":3,"file":"tap-routes.d.ts","sourceRoot":"","sources":["../src/tap-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAmKpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwErD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwDhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAmDlD;AAID;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsFrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2ClD;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4D9C;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAwClD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/C;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6E9C;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCnD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsClD;;;;;;;;;;;;;;AAaD,wBAYE"}

package/dist/tap-routes.js

@@ -4,35 +4,64 @@
  *
  * Provides backward-compatible endpoints with optional TAP functionality
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { registerTAPAgent, getTAPAgent, listTAPAgents, createTAPSession, getTAPSession, validateCapability, TAP_VALID_ACTIONS } from './tap-agents.js';
 import { parseTAPIntent } from './tap-verify.js';
 import { createInvoice, getInvoice, verifyPaymentContainer, verifyBrowsingIOU, fulfillInvoice, parsePaymentContainer } from './tap-payment.js';
 import { parseAgenticConsumer, verifyAgenticConsumer } from './tap-consumer.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for TAP verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
-    // Extract app_id from query param or JWT
     const queryAppId = c.req.query('app_id');
-    // Try to get from JWT Bearer token
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return {
+            valid: false,
+            error: 'UNAUTHORIZED',
+            status: 401
+        };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
         return {
             valid: false,
-            error: 'MISSING_APP_ID',
+            error: 'INVALID_TOKEN',
             status: 401
         };
     }
-    // TODO: Validate app exists (integrate with existing app validation)
-    return { valid: true, appId };
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return {
+            valid: false,
+            error: 'MISSING_APP_ID',
+            status: 403
+        };
+    }
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return {
+            valid: false,
+            error: 'APP_ID_MISMATCH',
+            status: 403
+        };
+    }
+    return { valid: true, appId: jwtAppId };
 }
 function validateTAPRegistration(body) {
     if (!body.name || typeof body.name !== 'string') {
@@ -515,33 +544,37 @@ export async function verifyIOURoute(c) {
         if (!agentKeyId) {
             return c.json({ success: false, error: 'MISSING_KEY_ID', message: 'browsingIOU must include kid' }, 400);
         }
-        // For now, try to find the key in our agent registry
-        // Future: also check federated sources
-        let publicKey = null;
-        const agentIndex = await c.env.AGENTS.get(`app_agents:${invoiceResult.invoice.app_id}`, 'text');
-        if (agentIndex) {
-            const agentIds = JSON.parse(agentIndex);
-            for (const agentId of agentIds) {
-                const agentData = await c.env.AGENTS.get(`agent:${agentId}`, 'text');
-                if (agentData) {
-                    const agent = JSON.parse(agentData);
-                    if (agent.public_key) {
-                        publicKey = agent.public_key;
-                        break;
-                    }
-                }
-            }
+        // Resolve key by kid (agent/key identifier) and enforce same-app ownership.
+        const agentData = await c.env.AGENTS.get(`agent:${agentKeyId}`, 'text');
+        if (!agentData) {
+            return c.json({ success: false, error: 'KEY_NOT_FOUND', message: `No TAP key found for kid: ${agentKeyId}` }, 404);
         }
-        if (!publicKey) {
+        const agent = JSON.parse(agentData);
+        if (agent.app_id !== invoiceResult.invoice.app_id) {
+            return c.json({
+                success: false,
+                error: 'KEY_APP_MISMATCH',
+                message: 'Key does not belong to the app that issued this invoice',
+            }, 403);
+        }
+        if (!agent.public_key) {
             return c.json({ success: false, error: 'KEY_NOT_FOUND', message: 'Could not resolve public key for verification' }, 404);
         }
         // Verify the IOU
-        const iouResult = await verifyBrowsingIOU(body.browsingIOU, invoiceResult.invoice, publicKey, body.browsingIOU.alg || 'ES256');
+        const iouResult = await verifyBrowsingIOU(body.browsingIOU, invoiceResult.invoice, agent.public_key, body.browsingIOU.alg || agent.signature_algorithm || 'ES256');
         if (!iouResult.valid) {
             return c.json({ success: false, verified: false, error: iouResult.error }, 400);
         }
         // Fulfill the invoice
         const fulfillResult = await fulfillInvoice(c.env.INVOICES, invoiceId, body.browsingIOU);
+        if (!fulfillResult.success || !fulfillResult.access_token) {
+            return c.json({
+                success: false,
+                verified: true,
+                error: 'INVOICE_FULFILLMENT_FAILED',
+                message: fulfillResult.error || 'Invoice could not be fulfilled',
+            }, 502);
+        }
         return c.json({
             success: true,
             verified: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dupecom/botcha-cloudflare",
-  "version": "0.19.0",
+  "version": "0.20.1",
   "description": "BOTCHA for Cloudflare Workers - Prove you're a bot. Humans need not apply.",
   "type": "module",
   "main": "dist/index.js",