@dupecom/botcha-cloudflare 0.20.0 → 0.20.2

package/dist/dashboard/auth.d.ts

@@ -113,7 +113,7 @@ export declare function handleDeviceCodeChallenge(c: Context<{
  * POST /v1/auth/device-code/verify
  *
  * Agent submits challenge solution. On success, returns a short-lived
- * device code (BOTCHA-XXXX) that a human can enter at /dashboard/code.
+ * device code (BOTCHA-XXXXXX) that a human can enter at /dashboard/code.
  */
 export declare function handleDeviceCodeVerify(c: Context<{
     Bindings: Bindings;

package/dist/dashboard/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAmChG,CAAC;AAIF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEA2CpF;AAgDD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEAwBjF;AAID;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEAEjF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEA4B9E;AAID;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBA2E5E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAqB9E;AAID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAyBnE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAGpE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFA2BxE;AA4BD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBAgFvE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAOvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAmChG,CAAC;AAIF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEA2CpF;AAgDD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEAwBjF;AAID;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEAEjF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEA4B9E;AAID;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBA2E5E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFA4B9E;AAID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAyBnE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAGpE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFA2BxE;AA4BD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBAgFvE"}

package/dist/dashboard/auth.js

@@ -4,6 +4,7 @@ import { SignJWT } from 'jose';
 import { verifyToken } from '../auth';
 import { validateAppSecret, getAppByEmail } from '../apps';
 import { sendEmail, recoveryEmail } from '../email';
+import { checkRateLimit, getClientIP } from '../rate-limit';
 import { generateDeviceCode, storeDeviceCode, redeemDeviceCode } from './device-code';
 import { LoginLayout, Card, Divider } from './layout';
 // ============ SESSION HELPERS ============
@@ -195,7 +196,7 @@ export async function handleDeviceCodeChallenge(c) {
  * POST /v1/auth/device-code/verify
  *
  * Agent submits challenge solution. On success, returns a short-lived
- * device code (BOTCHA-XXXX) that a human can enter at /dashboard/code.
+ * device code (BOTCHA-XXXXXX) that a human can enter at /dashboard/code.
  */
 export async function handleDeviceCodeVerify(c) {
     const body = await c.req.json().catch(() => ({}));
@@ -247,12 +248,12 @@ export async function renderDeviceCodePage(c) {
     };
     return c.html(_jsxs(LoginLayout, { title: "Enter Device Code - BOTCHA", children: [_jsxs("div", { style: "font-size: 0.875rem; font-weight: 700; letter-spacing: 0.15em; text-transform: uppercase; text-align: center; margin-bottom: 2rem;", children: ['>', "_\u00A0BOTCHA"] }), _jsx("form", { method: "post", action: "/dashboard/code", children: _jsxs(Card, { title: "Device Code", children: [emailSent && (_jsx("div", { class: "success-message", style: "background: #f0faf0; border: 1px solid #1a8a2a; color: #1a6a1a; padding: 0.75rem; font-size: 0.75rem; margin-bottom: 1rem;", children: "If an account with that email exists, a login code has been sent. Check your inbox." })), error && errorMap[error] && (_jsx("div", { class: "error-message", children: errorMap[error] })), _jsx("p", { class: "text-muted mb-2", style: "font-size: 0.75rem;", children: emailSent
                                 ? 'Enter the code from your email below.'
-                                : 'Your AI agent generated a login code for you. Enter it below to access the dashboard.' }), _jsxs("div", { class: "form-group", children: [_jsx("label", { for: "code", children: "Code" }), _jsxs("div", { style: "display: flex; align-items: stretch; gap: 0;", children: [_jsx("span", { style: "display: flex; align-items: center; font-size: 1.5rem; font-weight: 700; letter-spacing: 0.15em; padding: 0 0.25rem 0 1rem; border: 1px solid var(--border); border-right: none; background: var(--bg-raised); color: var(--text-muted);", children: "BOTCHA-" }), _jsx("input", { type: "text", id: "code", name: "code", placeholder: "XXXX", value: prefill, required: true, autocomplete: "off", maxlength: 11, style: "font-size: 1.5rem; font-weight: 700; text-align: center; letter-spacing: 0.15em; padding: 1rem; flex: 1; border-left: none;" })] })] }), _jsx("script", { dangerouslySetInnerHTML: { __html: `
+                                : 'Your AI agent generated a login code for you. Enter it below to access the dashboard.' }), _jsxs("div", { class: "form-group", children: [_jsx("label", { for: "code", children: "Code" }), _jsxs("div", { style: "display: flex; align-items: stretch; gap: 0;", children: [_jsx("span", { style: "display: flex; align-items: center; font-size: 1.5rem; font-weight: 700; letter-spacing: 0.15em; padding: 0 0.25rem 0 1rem; border: 1px solid var(--border); border-right: none; background: var(--bg-raised); color: var(--text-muted);", children: "BOTCHA-" }), _jsx("input", { type: "text", id: "code", name: "code", placeholder: "XXXXXX", value: prefill, required: true, autocomplete: "off", maxlength: 13, style: "font-size: 1.5rem; font-weight: 700; text-align: center; letter-spacing: 0.15em; padding: 1rem; flex: 1; border-left: none;" })] })] }), _jsx("script", { dangerouslySetInnerHTML: { __html: `
             document.getElementById('code').addEventListener('input', function(e) {
               var v = e.target.value.toUpperCase().replace(/[^A-Z0-9-]/g, '');
               if (v.startsWith('BOTCHA-')) v = v.slice(7);
               else if (v.startsWith('BOTCHA')) v = v.slice(6);
-              e.target.value = v.slice(0, 4);
+              e.target.value = v.slice(0, 6);
             });
           ` } }), _jsxs("button", { type: "submit", children: ["Verify Code ", '>'] })] }) }), _jsxs("div", { class: "hint", style: "text-align: center; line-height: 1.8; margin-top: 1.5rem;", children: ["Don't have a code? Ask your AI agent to run:", _jsx("br", {}), _jsx("code", { children: "POST /v1/auth/device-code" }), _jsx("br", {}), _jsx("br", {}), _jsx("a", { href: "/dashboard/login", children: "Back to login" })] })] }));
 }
@@ -262,12 +263,18 @@ export async function renderDeviceCodePage(c) {
  * Human submits device code. If valid, creates session and redirects to dashboard.
  */
 export async function handleDeviceCodeRedeem(c) {
+    // Brute-force guard for device code redemption attempts (20/hour/IP).
+    const clientIp = getClientIP(c.req.raw);
+    const redemptionRate = await checkRateLimit(c.env.RATE_LIMITS, `device-code:${clientIp}`, 20);
+    if (!redemptionRate.allowed) {
+        return c.redirect('/dashboard/code?error=invalid');
+    }
     const body = await c.req.parseBody();
     let code = (body.code || '').trim().toUpperCase();
     if (!code) {
         return c.redirect('/dashboard/code?error=missing');
     }
-    // Normalize: accept both "AR8C" and "BOTCHA-AR8C", always look up with prefix
+    // Normalize: accept both "AR8C2Q" and "BOTCHA-AR8C2Q", always look up with prefix.
     if (!code.startsWith('BOTCHA-')) {
         code = `BOTCHA-${code}`;
     }

package/dist/dashboard/device-code.d.ts

@@ -22,7 +22,7 @@ export interface DeviceCodeData {
 }
 /**
  * Generate a human-friendly device code.
- * Format: BOTCHA-XXXX (4 alphanumeric chars, no ambiguous chars)
+ * Format: BOTCHA-XXXXXX (6 alphanumeric chars, no ambiguous chars)
  *
  * Uses a restricted alphabet that avoids 0/O, 1/I/l confusion.
  */

package/dist/dashboard/device-code.js

@@ -15,13 +15,13 @@
 // ============ CODE GENERATION ============
 /**
  * Generate a human-friendly device code.
- * Format: BOTCHA-XXXX (4 alphanumeric chars, no ambiguous chars)
+ * Format: BOTCHA-XXXXXX (6 alphanumeric chars, no ambiguous chars)
  *
  * Uses a restricted alphabet that avoids 0/O, 1/I/l confusion.
  */
 export function generateDeviceCode() {
     const alphabet = '23456789ABCDEFGHJKMNPQRSTUVWXYZ'; // no 0,O,1,I,L
-    const bytes = new Uint8Array(4);
+    const bytes = new Uint8Array(6);
     crypto.getRandomValues(bytes);
     const chars = Array.from(bytes).map(b => alphabet[b % alphabet.length]).join('');
     return `BOTCHA-${chars}`;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAwDtB,OAAO,EACL,KAAK,sBAAsB,EAM5B,MAAM,aAAa,CAAC;AAGrB,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,YAAY,CAAC,EAAE;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF,QAAA,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AAowErE,eAAe,GAAG,CAAC;AAGnB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAwDtB,OAAO,EACL,KAAK,sBAAsB,EAM5B,MAAM,aAAa,CAAC;AAGrB,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,YAAY,CAAC,EAAE;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF,QAAA,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AAuzErE,eAAe,GAAG,CAAC;AAGnB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -40,7 +40,7 @@ app.route('/dashboard', dashboardRoutes);
 // BOTCHA discovery headers
 app.use('*', async (c, next) => {
     await next();
-    c.header('X-Botcha-Version', c.env.BOTCHA_VERSION || '0.20.0');
+    c.header('X-Botcha-Version', c.env.BOTCHA_VERSION || '0.20.2');
     c.header('X-Botcha-Enabled', 'true');
     c.header('X-Botcha-Methods', 'speed-challenge,reasoning-challenge,hybrid-challenge,standard-challenge,jwt-token');
     c.header('X-Botcha-Docs', 'https://botcha.ai/openapi.json');
@@ -76,7 +76,13 @@ async function validateAppId(appId, appsKV) {
     try {
         const app = await getApp(appsKV, appId);
         if (!app) {
-            return { valid: false, error: `App not found: ${appId}` };
+            return {
+                valid: false,
+                error: `App not found: ${appId}. ` +
+                    `app_id is OPTIONAL — remove it to get a token without an app. ` +
+                    `To register an app: POST https://botcha.ai/v1/apps with {"email": "you@example.com", "name": "My App"}. ` +
+                    `App IDs look like: app_a1b2c3d4e5f6a7b8`
+            };
         }
         return { valid: true };
     }
@@ -125,6 +131,61 @@ async function requireJWT(c, next) {
     c.set('tokenPayload', result.payload);
     await next();
 }
+// Resolve app_id from authenticated JWT and enforce optional query consistency.
+async function resolveAuthenticatedAppId(c) {
+    const authHeader = c.req.header('authorization');
+    const token = extractBearerToken(authHeader);
+    if (!token) {
+        return {
+            ok: false,
+            error: 'UNAUTHORIZED',
+            message: 'Missing Bearer token. Use POST /v1/token/verify to get a token.',
+            status: 401,
+        };
+    }
+    const publicKey = getPublicKey(c.env);
+    const verification = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!verification.valid || !verification.payload) {
+        return {
+            ok: false,
+            error: 'INVALID_TOKEN',
+            message: verification.error || 'Token is invalid or expired',
+            status: 401,
+        };
+    }
+    const jwtAppId = verification.payload.app_id;
+    if (!jwtAppId) {
+        return {
+            ok: false,
+            error: 'MISSING_APP_ID',
+            message: 'Token is missing app_id claim. Request a token scoped to your app.',
+            status: 403,
+        };
+    }
+    const queryAppId = c.req.query('app_id');
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return {
+            ok: false,
+            error: 'APP_ID_MISMATCH',
+            message: 'Query app_id does not match token app_id.',
+            status: 403,
+        };
+    }
+    const validation = await validateAppId(jwtAppId, c.env.APPS);
+    if (!validation.valid) {
+        return {
+            ok: false,
+            error: 'INVALID_APP_ID',
+            message: validation.error || 'Invalid app_id',
+            status: 400,
+        };
+    }
+    return {
+        ok: true,
+        appId: jwtAppId,
+        status: 200,
+    };
+}
 // ============ ROOT & INFO ============
 // Detect request preference: 'markdown' | 'json' | 'html'
 // Strategy: only return JSON/markdown when explicitly requested or from
@@ -192,10 +253,11 @@ app.get('/', async (c) => {
             status: 'unverified',
             message: 'Verify yourself to see the full API documentation.',
             verify: {
-                step1: `GET ${baseUrl}/v1/token — receive a speed challenge (5 SHA-256 hashes)`,
+                step1: `GET ${baseUrl}/v1/token — receive a speed challenge (5 SHA-256 hashes). No app_id needed.`,
                 step2: 'Solve: compute SHA-256 of each number, return first 8 hex chars',
                 step3: `POST ${baseUrl}/v1/token/verify {"id":"<challenge_id>","answers":["hash1","hash2",...]}`,
                 step4: `Revisit: GET ${baseUrl}/ with header Authorization: Bearer <access_token>`,
+                note: 'app_id is OPTIONAL. You can get tokens without registering an app. To register one for production use: POST /v1/apps {"email":"you@example.com","name":"My App"}',
             },
             human_handoff: {
                 note: 'After verifying, the response includes a human_link. Give it to your human to open in their browser.',
@@ -217,13 +279,16 @@ app.get('/', async (c) => {
 
 ## Verify Yourself
 
-1. \`GET ${baseUrl}/v1/token\` — receive a speed challenge (5 SHA-256 hashes)
+1. \`GET ${baseUrl}/v1/token\` — receive a speed challenge (5 SHA-256 hashes). **No app_id needed.**
 2. Solve: compute SHA-256 of each number, return first 8 hex chars
 3. \`POST ${baseUrl}/v1/token/verify {"id":"<challenge_id>","answers":["hash1","hash2",...]}\`
 4. Revisit: \`GET ${baseUrl}/\` with header \`Authorization: Bearer <access_token>\`
 
 You have 500ms. Only a bot can do this.
 
+> **Note:** \`app_id\` is optional. You can get tokens without registering an app.
+> To register for production: \`POST /v1/apps {"email":"you@example.com","name":"My App"}\`
+
 ## Human Handoff
 
 After verifying, the response includes a \`human_link\`. Give this URL to your human:
@@ -710,13 +775,30 @@ app.post('/v1/token/verify', async (c) => {
     }
     // Get client IP from request headers
     const clientIp = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown';
+    // Enforce challenge-bound app_id; never allow app_id override from request body.
+    const challengeAppId = result.app_id;
+    if (typeof app_id === 'string') {
+        if (!challengeAppId) {
+            return c.json({
+                success: false,
+                error: 'APP_ID_NOT_ALLOWED',
+                message: 'This challenge was issued without app_id. Request /v1/token?app_id=... first.',
+            }, 400);
+        }
+        if (app_id !== challengeAppId) {
+            return c.json({
+                success: false,
+                error: 'APP_ID_MISMATCH',
+                message: 'Provided app_id does not match the app_id bound to this challenge.',
+            }, 403);
+        }
+    }
     // Generate JWT tokens (access + refresh)
-    // Prefer app_id from request body, fall back to challenge's app_id (returned by verifySpeedChallenge)
     const signingKey = getSigningKey(c.env);
     const tokenResult = await generateToken(id, result.solveTimeMs || 0, c.env.JWT_SECRET, c.env, {
         aud: audience,
         clientIp: bind_ip ? clientIp : undefined,
-        app_id: app_id || result.app_id,
+        app_id: challengeAppId,
     }, signingKey);
     // Get badge information (for backward compatibility)
     const baseUrl = new URL(c.req.url).origin;
@@ -1401,7 +1483,6 @@ app.get('/v1/apps/:id', async (c) => {
             ...(app.name && { name: app.name }),
             created_at: new Date(app.created_at).toISOString(),
             rate_limit: app.rate_limit,
-            email: app.email,
             email_verified: app.email_verified,
         },
     });
@@ -1513,27 +1594,30 @@ app.post('/v1/apps/:id/rotate-secret', async (c) => {
             message: 'Authentication required. Use a dashboard session token (Bearer or cookie).',
         }, 401);
     }
-    // Verify the session token includes this app_id
-    const { jwtVerify, createLocalJWKSet } = await import('jose');
-    try {
-        const secret = new TextEncoder().encode(c.env.JWT_SECRET);
-        const { payload } = await jwtVerify(authToken, secret);
-        const tokenAppId = payload.app_id;
-        if (tokenAppId !== app_id) {
-            return c.json({
-                success: false,
-                error: 'FORBIDDEN',
-                message: 'Session token does not match the requested app_id',
-            }, 403);
-        }
-    }
-    catch {
+    // Verify dashboard session token includes this app_id.
+    const publicKey = getPublicKey(c.env);
+    const verification = await verifyToken(authToken, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!verification.valid || !verification.payload) {
         return c.json({
             success: false,
             error: 'INVALID_TOKEN',
             message: 'Invalid or expired session token',
         }, 401);
     }
+    if (verification.payload.sub !== 'dashboard-session') {
+        return c.json({
+            success: false,
+            error: 'FORBIDDEN',
+            message: 'Dashboard session token required for secret rotation.',
+        }, 403);
+    }
+    if (verification.payload.app_id !== app_id) {
+        return c.json({
+            success: false,
+            error: 'FORBIDDEN',
+            message: 'Session token does not match the requested app_id',
+        }, 403);
+    }
     const appData = await getApp(c.env.APPS, app_id);
     if (!appData) {
         return c.json({ success: false, error: 'App not found' }, 404);
@@ -1601,36 +1685,15 @@ app.post('/v1/verify/attestation', verifyAttestationRoute);
 // Register a new agent
 app.post('/v1/agents/register', async (c) => {
     try {
-        // Extract app_id from query param or JWT
-        const queryAppId = c.req.query('app_id');
-        // Try to get from JWT Bearer token
-        let jwtAppId;
-        const authHeader = c.req.header('authorization');
-        const token = extractBearerToken(authHeader);
-        if (token) {
-            const regPublicKey = getPublicKey(c.env);
-            const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, regPublicKey);
-            if (result.valid && result.payload) {
-                jwtAppId = result.payload.app_id;
-            }
-        }
-        const app_id = queryAppId || jwtAppId;
-        if (!app_id) {
-            return c.json({
-                success: false,
-                error: 'MISSING_APP_ID',
-                message: 'app_id is required. Provide it as a query parameter (?app_id=...) or in the JWT token.',
-            }, 401);
-        }
-        // Validate app_id exists
-        const validation = await validateAppId(app_id, c.env.APPS);
-        if (!validation.valid) {
+        const appAccess = await resolveAuthenticatedAppId(c);
+        if (!appAccess.ok) {
             return c.json({
                 success: false,
-                error: 'INVALID_APP_ID',
-                message: validation.error || 'Invalid app_id',
-            }, 400);
+                error: appAccess.error,
+                message: appAccess.message,
+            }, appAccess.status);
         }
+        const app_id = appAccess.appId;
         // Parse request body
         const body = await c.req.json().catch(() => ({}));
         const { name, operator, version } = body;
@@ -1708,36 +1771,15 @@ app.get('/v1/agents/:id', async (c) => {
 // List all agents for an app
 app.get('/v1/agents', async (c) => {
     try {
-        // Extract app_id from query param or JWT
-        const queryAppId = c.req.query('app_id');
-        // Try to get from JWT Bearer token
-        let jwtAppId;
-        const authHeader = c.req.header('authorization');
-        const token = extractBearerToken(authHeader);
-        if (token) {
-            const listPublicKey = getPublicKey(c.env);
-            const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, listPublicKey);
-            if (result.valid && result.payload) {
-                jwtAppId = result.payload.app_id;
-            }
-        }
-        const app_id = queryAppId || jwtAppId;
-        if (!app_id) {
+        const appAccess = await resolveAuthenticatedAppId(c);
+        if (!appAccess.ok) {
             return c.json({
                 success: false,
-                error: 'MISSING_APP_ID',
-                message: 'app_id is required. Provide it as a query parameter (?app_id=...) or in the JWT token.',
-            }, 401);
-        }
-        // Validate app_id exists
-        const validation = await validateAppId(app_id, c.env.APPS);
-        if (!validation.valid) {
-            return c.json({
-                success: false,
-                error: 'INVALID_APP_ID',
-                message: validation.error || 'Invalid app_id',
-            }, 400);
+                error: appAccess.error,
+                message: appAccess.message,
+            }, appAccess.status);
         }
+        const app_id = appAccess.appId;
         // Get all agents for this app
         const agents = await listAgents(c.env.AGENTS, app_id);
         return c.json({

package/dist/tap-attestation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-attestation-routes.d.ts","sourceRoot":"","sources":["../src/tap-attestation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA4CpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4GrD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiDnD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;kBA8DrD;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsEtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmFtD;;;;;;;;AAED,wBAME"}
+{"version":3,"file":"tap-attestation-routes.d.ts","sourceRoot":"","sources":["../src/tap-attestation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAgEpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4GrD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiDnD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;kBA8DrD;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsEtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmFtD;;;;;;;;AAED,wBAME"}

package/dist/tap-attestation-routes.js

@@ -11,25 +11,45 @@
  *   POST   /v1/attestations/:id/revoke   — Revoke attestation
  *   POST   /v1/verify/attestation        — Verify attestation + check capability
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { issueAttestation, getAttestation, revokeAttestation, verifyAttestationToken, verifyAndCheckCapability, isValidCapabilityPattern, } from './tap-attestation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for attestation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-delegation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-delegation-routes.d.ts","sourceRoot":"","sources":["../src/tap-delegation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA4CpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsGrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDlD;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAqEpD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsErD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkDrD;;;;;;;;AAED,wBAME"}
+{"version":3,"file":"tap-delegation-routes.d.ts","sourceRoot":"","sources":["../src/tap-delegation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAgEpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsGrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDlD;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAqEpD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAsErD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkDrD;;;;;;;;AAED,wBAME"}

package/dist/tap-delegation-routes.js

@@ -11,26 +11,46 @@
  *   POST   /v1/delegations/:id/revoke   — Revoke delegation (cascades)
  *   POST   /v1/verify/delegation        — Verify delegation chain
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { TAP_VALID_ACTIONS } from './tap-agents.js';
 import { createDelegation, getDelegation, listDelegations, revokeDelegation, verifyDelegationChain, } from './tap-delegation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for delegation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-reputation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-reputation-routes.d.ts","sourceRoot":"","sources":["../src/tap-reputation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EASL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAkC7B;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA6DlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2H1D;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4EzD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;oEAyDpD;;;;;;;AAED,wBAKE"}
+{"version":3,"file":"tap-reputation-routes.d.ts","sourceRoot":"","sources":["../src/tap-reputation-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EASL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAsD7B;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA6DlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2H1D;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4EzD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;oEAyDpD;;;;;;;AAED,wBAKE"}

package/dist/tap-reputation-routes.js

@@ -10,25 +10,45 @@
  *   GET    /v1/reputation/:agent_id/events   — List reputation events
  *   POST   /v1/reputation/:agent_id/reset    — Reset agent reputation (admin)
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { getReputationScore, recordReputationEvent, listReputationEvents, resetReputation, isValidCategory, isValidAction, isValidCategoryAction, } from './tap-reputation.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for reputation route verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
     const queryAppId = c.req.query('app_id');
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return { valid: false, error: 'UNAUTHORIZED', status: 401 };
+    }
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
+        return { valid: false, error: 'INVALID_TOKEN', status: 401 };
+    }
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return { valid: false, error: 'MISSING_APP_ID', status: 403 };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
-        return { valid: false, error: 'MISSING_APP_ID', status: 401 };
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return { valid: false, error: 'APP_ID_MISMATCH', status: 403 };
     }
-    return { valid: true, appId };
+    return { valid: true, appId: jwtAppId };
 }
 // ============ ROUTE HANDLERS ============
 /**

package/dist/tap-routes.d.ts

@@ -309,13 +309,22 @@ export declare function verifyIOURoute(c: Context): Promise<(Response & import("
     error: string;
     message: string;
 }, 404, "json">) | (Response & import("hono").TypedResponse<{
+    success: false;
+    error: string;
+    message: string;
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
     success: false;
     verified: false;
     error: string | undefined;
 }, 400, "json">) | (Response & import("hono").TypedResponse<{
+    success: false;
+    verified: true;
+    error: string;
+    message: string;
+}, 502, "json">) | (Response & import("hono").TypedResponse<{
     success: true;
     verified: true;
-    access_token: string | undefined;
+    access_token: string;
     expires_at: string | undefined;
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">) | (Response & import("hono").TypedResponse<{
     success: false;

package/dist/tap-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tap-routes.d.ts","sourceRoot":"","sources":["../src/tap-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAsIpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwErD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwDhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAmDlD;AAID;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsFrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2ClD;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4D9C;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAwClD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/C;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;kBAwE9C;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCnD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsClD;;;;;;;;;;;;;;AAaD,wBAYE"}
+{"version":3,"file":"tap-routes.d.ts","sourceRoot":"","sources":["../src/tap-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAmKpC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwErD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwDhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAmDlD;AAID;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsFrD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2ClD;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4D9C;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAwClD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;kBAuB/C;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6E9C;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCnD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsClD;;;;;;;;;;;;;;AAaD,wBAYE"}

package/dist/tap-routes.js

@@ -4,35 +4,64 @@
  *
  * Provides backward-compatible endpoints with optional TAP functionality
  */
-import { extractBearerToken, verifyToken } from './auth.js';
+import { extractBearerToken, verifyToken, getSigningPublicKeyJWK } from './auth.js';
 import { registerTAPAgent, getTAPAgent, listTAPAgents, createTAPSession, getTAPSession, validateCapability, TAP_VALID_ACTIONS } from './tap-agents.js';
 import { parseTAPIntent } from './tap-verify.js';
 import { createInvoice, getInvoice, verifyPaymentContainer, verifyBrowsingIOU, fulfillInvoice, parsePaymentContainer } from './tap-payment.js';
 import { parseAgenticConsumer, verifyAgenticConsumer } from './tap-consumer.js';
 // ============ VALIDATION HELPERS ============
+function getVerificationPublicKey(env) {
+    const rawSigningKey = env?.JWT_SIGNING_KEY;
+    if (!rawSigningKey)
+        return undefined;
+    try {
+        const signingKey = JSON.parse(rawSigningKey);
+        return getSigningPublicKeyJWK(signingKey);
+    }
+    catch {
+        console.error('Failed to parse JWT_SIGNING_KEY for TAP verification');
+        return undefined;
+    }
+}
 async function validateAppAccess(c, requireAuth = true) {
-    // Extract app_id from query param or JWT
     const queryAppId = c.req.query('app_id');
-    // Try to get from JWT Bearer token
-    let jwtAppId;
     const authHeader = c.req.header('authorization');
     const token = extractBearerToken(authHeader);
-    if (token) {
-        const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-        if (result.valid && result.payload) {
-            jwtAppId = result.payload.app_id;
+    if (!token) {
+        if (!requireAuth) {
+            return { valid: true, appId: queryAppId };
         }
+        return {
+            valid: false,
+            error: 'UNAUTHORIZED',
+            status: 401
+        };
     }
-    const appId = queryAppId || jwtAppId;
-    if (requireAuth && !appId) {
+    const publicKey = getVerificationPublicKey(c.env);
+    const result = await verifyToken(token, c.env.JWT_SECRET, c.env, undefined, publicKey);
+    if (!result.valid || !result.payload) {
         return {
             valid: false,
-            error: 'MISSING_APP_ID',
+            error: 'INVALID_TOKEN',
             status: 401
         };
     }
-    // TODO: Validate app exists (integrate with existing app validation)
-    return { valid: true, appId };
+    const jwtAppId = result.payload.app_id;
+    if (!jwtAppId) {
+        return {
+            valid: false,
+            error: 'MISSING_APP_ID',
+            status: 403
+        };
+    }
+    if (queryAppId && queryAppId !== jwtAppId) {
+        return {
+            valid: false,
+            error: 'APP_ID_MISMATCH',
+            status: 403
+        };
+    }
+    return { valid: true, appId: jwtAppId };
 }
 function validateTAPRegistration(body) {
     if (!body.name || typeof body.name !== 'string') {
@@ -515,33 +544,37 @@ export async function verifyIOURoute(c) {
         if (!agentKeyId) {
             return c.json({ success: false, error: 'MISSING_KEY_ID', message: 'browsingIOU must include kid' }, 400);
         }
-        // For now, try to find the key in our agent registry
-        // Future: also check federated sources
-        let publicKey = null;
-        const agentIndex = await c.env.AGENTS.get(`app_agents:${invoiceResult.invoice.app_id}`, 'text');
-        if (agentIndex) {
-            const agentIds = JSON.parse(agentIndex);
-            for (const agentId of agentIds) {
-                const agentData = await c.env.AGENTS.get(`agent:${agentId}`, 'text');
-                if (agentData) {
-                    const agent = JSON.parse(agentData);
-                    if (agent.public_key) {
-                        publicKey = agent.public_key;
-                        break;
-                    }
-                }
-            }
+        // Resolve key by kid (agent/key identifier) and enforce same-app ownership.
+        const agentData = await c.env.AGENTS.get(`agent:${agentKeyId}`, 'text');
+        if (!agentData) {
+            return c.json({ success: false, error: 'KEY_NOT_FOUND', message: `No TAP key found for kid: ${agentKeyId}` }, 404);
         }
-        if (!publicKey) {
+        const agent = JSON.parse(agentData);
+        if (agent.app_id !== invoiceResult.invoice.app_id) {
+            return c.json({
+                success: false,
+                error: 'KEY_APP_MISMATCH',
+                message: 'Key does not belong to the app that issued this invoice',
+            }, 403);
+        }
+        if (!agent.public_key) {
             return c.json({ success: false, error: 'KEY_NOT_FOUND', message: 'Could not resolve public key for verification' }, 404);
         }
         // Verify the IOU
-        const iouResult = await verifyBrowsingIOU(body.browsingIOU, invoiceResult.invoice, publicKey, body.browsingIOU.alg || 'ES256');
+        const iouResult = await verifyBrowsingIOU(body.browsingIOU, invoiceResult.invoice, agent.public_key, body.browsingIOU.alg || agent.signature_algorithm || 'ES256');
         if (!iouResult.valid) {
             return c.json({ success: false, verified: false, error: iouResult.error }, 400);
         }
         // Fulfill the invoice
         const fulfillResult = await fulfillInvoice(c.env.INVOICES, invoiceId, body.browsingIOU);
+        if (!fulfillResult.success || !fulfillResult.access_token) {
+            return c.json({
+                success: false,
+                verified: true,
+                error: 'INVOICE_FULFILLMENT_FAILED',
+                message: fulfillResult.error || 'Invoice could not be fulfilled',
+            }, 502);
+        }
         return c.json({
             success: true,
             verified: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dupecom/botcha-cloudflare",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "BOTCHA for Cloudflare Workers - Prove you're a bot. Humans need not apply.",
   "type": "module",
   "main": "dist/index.js",