@every-app/sdk 0.1.13 → 0.2.0

package/dist/internal/identity.d.ts

@@ -0,0 +1,73 @@
+import { APP_ID_ENV, DEV_ENV, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
+export declare class IdentityError extends Error {
+    readonly status = 401;
+    constructor(message: string);
+}
+export declare class ConfigurationError extends Error {
+    readonly status = 500;
+    constructor(message: string);
+}
+/**
+ * Parse the public key set from an env var value. Accepts a JSON array of PEM
+ * strings, or a single PEM string. Returns at least one key or throws.
+ */
+export declare function parsePublicKeys(envValue: string | undefined | null): string[];
+export interface VerifyOptions {
+    /** SPKI PEM public keys (current + next). */
+    publicKeys: string[];
+    /** Expected `aud` — this app's id. */
+    audience: string;
+    /** Expected issuer (the gateway URL). Required for user identities. */
+    issuer?: string;
+    /**
+     * Accept the dev identity kid ({@link IDENTITY_DEV_KEY_ID}). Set ONLY in
+     * local dev (driven by the {@link DEV_ENV} worker env var). Never true in
+     * production.
+     */
+    allowDevIdentities?: boolean;
+    /** Override for tests. */
+    now?: number;
+}
+/**
+ * Verify an identity JWT fail-closed. Throws {@link IdentityError} on any
+ * problem (bad alg/kid, `none`, wrong key, expired, wrong audience, missing
+ * claims).
+ */
+export declare function verifyIdentityJwt(token: string, options: VerifyOptions): Promise<EveryAppUser>;
+/**
+ * Verify a public-route marker (the value of `x-everyapp-public`). The marker
+ * is a gateway-signed, app-scoped JWT with `pub: true` and `typ: "public"` —
+ * a bare header is NEVER a trust source, so a re-exposed app worker cannot be
+ * flipped into public mode by anyone who can type a header. Throws on any
+ * problem.
+ */
+export declare function verifyPublicMarkerJwt(token: string, options: VerifyOptions): Promise<void>;
+export interface IdentityResult {
+    /** The verified user, or null for a declared public route. */
+    user: EveryAppUser | null;
+    /** True when the gateway marked this request as a public route. */
+    isPublic: boolean;
+}
+export interface RequestIdentityOptions {
+    audience: string;
+    /** Provide keys directly, or let {@link getIdentityFromRequest} read env. */
+    publicKeys?: string[];
+    /** Env bag to read {@link PUBLIC_KEYS_ENV} / {@link DEV_ENV} from. */
+    env?: Record<string, unknown>;
+    keysEnvVar?: string;
+    issuer?: string;
+    /** Force dev-kid acceptance. Defaults to reading {@link DEV_ENV} from env. */
+    allowDevIdentities?: boolean;
+    now?: number;
+}
+/**
+ * Resolve identity for an incoming proxied request. Public routes carry a
+ * gateway-SIGNED marker in `x-everyapp-public` and resolve to
+ * `{ user: null, isPublic: true }` only after the marker verifies. Everything
+ * else requires a valid identity JWT. Throws {@link IdentityError} on any
+ * problem — including a bare/forged public header — so a re-exposed worker
+ * fails closed.
+ */
+export declare function getIdentityFromRequest(request: Request, options: RequestIdentityOptions): Promise<IdentityResult>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/internal/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAIjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAmED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAqCzB"}

package/dist/internal/identity.js

@@ -0,0 +1,192 @@
+/**
+ * Every App identity JWT verification (the app side of the trust boundary).
+ *
+ * The gateway injects a short-lived RS256 JWT as `x-everyapp-identity`. This
+ * module verifies it **fail-closed**: the algorithm and key id are pinned,
+ * `none` is rejected, the audience must equal this app, and the verification
+ * key set arrives from an env var (current + next public keys) — never a
+ * runtime JWKS fetch. A bare header is never a trust source; only a token that
+ * survives verification produces a user.
+ */
+import { importSPKI, jwtVerify, decodeProtectedHeader, } from "jose";
+import { APP_ID_ENV, DEV_ENV, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, assertPublicMarkerClaims, identityClaimsToEveryAppUser, ProtocolClaimsError, } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, };
+export class IdentityError extends Error {
+    status = 401;
+    constructor(message) {
+        super(message);
+        this.name = "IdentityError";
+    }
+}
+export class ConfigurationError extends Error {
+    status = 500;
+    constructor(message) {
+        super(message);
+        this.name = "ConfigurationError";
+    }
+}
+/**
+ * Parse the public key set from an env var value. Accepts a JSON array of PEM
+ * strings, or a single PEM string. Returns at least one key or throws.
+ */
+export function parsePublicKeys(envValue) {
+    if (!envValue || envValue.trim().length === 0) {
+        throw new ConfigurationError(`${PUBLIC_KEYS_ENV} is not set — the gateway must inject the identity public key set.`);
+    }
+    const trimmed = envValue.trim();
+    let keys;
+    if (trimmed.startsWith("[")) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (error) {
+            throw new ConfigurationError(`${PUBLIC_KEYS_ENV} must be a JSON array of PEM strings: ${error.message}`);
+        }
+        if (!Array.isArray(parsed) || parsed.some((k) => typeof k !== "string")) {
+            throw new ConfigurationError(`${PUBLIC_KEYS_ENV} must be a JSON array of PEM strings.`);
+        }
+        keys = parsed.map((k) => k.replace(/\\n/g, "\n"));
+    }
+    else {
+        keys = [trimmed.replace(/\\n/g, "\n")];
+    }
+    if (keys.length === 0) {
+        throw new ConfigurationError(`${PUBLIC_KEYS_ENV} contained no keys.`);
+    }
+    return keys;
+}
+const keyCache = new Map();
+function importKey(pem) {
+    let cached = keyCache.get(pem);
+    if (!cached) {
+        cached = importSPKI(pem, IDENTITY_ALG);
+        keyCache.set(pem, cached);
+    }
+    return cached;
+}
+/**
+ * Verify an identity JWT fail-closed. Throws {@link IdentityError} on any
+ * problem (bad alg/kid, `none`, wrong key, expired, wrong audience, missing
+ * claims).
+ */
+export async function verifyIdentityJwt(token, options) {
+    const payload = await verifyPinnedJwt(token, options, "user");
+    try {
+        return identityClaimsToEveryAppUser(payload);
+    }
+    catch (error) {
+        if (error instanceof ProtocolClaimsError) {
+            throw new IdentityError(error.message);
+        }
+        throw error;
+    }
+}
+/**
+ * The shared fail-closed verification core: pinned alg/kid, `none` rejected,
+ * `aud` checked, multi-key (current + next). Returns the verified payload.
+ */
+async function verifyPinnedJwt(token, options, expectedTyp) {
+    if (!token)
+        throw new IdentityError("no identity token");
+    // Pin the header BEFORE attempting any signature work. This is what defeats
+    // `alg: none` and algorithm-confusion (e.g. an HS256 token forged with the
+    // public key as the HMAC secret).
+    let header;
+    try {
+        header = decodeProtectedHeader(token);
+    }
+    catch {
+        throw new IdentityError("malformed identity token");
+    }
+    if (header.alg !== IDENTITY_ALG) {
+        throw new IdentityError(`unexpected alg "${header.alg}" (expected ${IDENTITY_ALG})`);
+    }
+    const allowedKids = options.allowDevIdentities
+        ? [IDENTITY_KEY_ID, IDENTITY_DEV_KEY_ID]
+        : [IDENTITY_KEY_ID];
+    if (!header.kid || !allowedKids.includes(header.kid)) {
+        throw new IdentityError(`unexpected kid "${header.kid}"`);
+    }
+    if (expectedTyp === "user" && !options.issuer) {
+        throw new IdentityError(`${ISSUER_ENV} not configured — deploy with the Every App CLI or provide an explicit issuer.`);
+    }
+    const verifyOpts = {
+        algorithms: [IDENTITY_ALG],
+        audience: options.audience,
+        requiredClaims: ["exp"],
+        ...(options.issuer ? { issuer: options.issuer } : {}),
+        ...(options.now ? { currentDate: new Date(options.now) } : {}),
+    };
+    let lastErr;
+    for (const pem of options.publicKeys) {
+        try {
+            const key = await importKey(pem);
+            const { payload } = await jwtVerify(token, key, verifyOpts);
+            if (payload.typ !== expectedTyp) {
+                throw new IdentityError(`unexpected token typ "${payload.typ}" (expected ${expectedTyp})`);
+            }
+            return payload;
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw new IdentityError(`identity verification failed: ${lastErr?.message ?? "no matching key"}`);
+}
+/**
+ * Verify a public-route marker (the value of `x-everyapp-public`). The marker
+ * is a gateway-signed, app-scoped JWT with `pub: true` and `typ: "public"` —
+ * a bare header is NEVER a trust source, so a re-exposed app worker cannot be
+ * flipped into public mode by anyone who can type a header. Throws on any
+ * problem.
+ */
+export async function verifyPublicMarkerJwt(token, options) {
+    const payload = await verifyPinnedJwt(token, options, "public");
+    try {
+        assertPublicMarkerClaims(payload);
+    }
+    catch (error) {
+        if (error instanceof ProtocolClaimsError) {
+            throw new IdentityError(error.message);
+        }
+        throw error;
+    }
+}
+/**
+ * Resolve identity for an incoming proxied request. Public routes carry a
+ * gateway-SIGNED marker in `x-everyapp-public` and resolve to
+ * `{ user: null, isPublic: true }` only after the marker verifies. Everything
+ * else requires a valid identity JWT. Throws {@link IdentityError} on any
+ * problem — including a bare/forged public header — so a re-exposed worker
+ * fails closed.
+ */
+export async function getIdentityFromRequest(request, options) {
+    const publicKeys = options.publicKeys ??
+        parsePublicKeys(options.env?.[options.keysEnvVar ?? PUBLIC_KEYS_ENV] ?? null);
+    // Dev identities are accepted only when the worker env opts in (everyapp dev
+    // sets EVERYAPP_DEV in .dev.vars). Production never sets it.
+    const devEnv = options.env?.[DEV_ENV];
+    const allowDevIdentities = options.allowDevIdentities ??
+        (typeof devEnv === "string" &&
+            (devEnv === "1" || devEnv.toLowerCase() === "true"));
+    const verifyOptions = {
+        publicKeys,
+        audience: options.audience,
+        issuer: options.issuer ??
+            (options.env?.[ISSUER_ENV] || undefined),
+        allowDevIdentities,
+        now: options.now,
+    };
+    const publicMarker = request.headers.get(PUBLIC_HEADER);
+    if (publicMarker) {
+        await verifyPublicMarkerJwt(publicMarker, verifyOptions);
+        return { user: null, isPublic: true };
+    }
+    const token = request.headers.get(IDENTITY_HEADER);
+    if (!token) {
+        throw new IdentityError("request reached the app without an identity token (not proxied through the gateway?)");
+    }
+    const user = await verifyIdentityJwt(token, verifyOptions);
+    return { user, isPublic: false };
+}

package/dist/internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./protocol.js";
+export { ConfigurationError, IdentityError, getIdentityFromRequest, parsePublicKeys, verifyIdentityJwt, verifyPublicMarkerJwt, type IdentityResult, type RequestIdentityOptions, type VerifyOptions, } from "./identity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/internal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}

package/dist/internal/index.js

@@ -0,0 +1,2 @@
+export * from "./protocol.js";
+export { ConfigurationError, IdentityError, getIdentityFromRequest, parsePublicKeys, verifyIdentityJwt, verifyPublicMarkerJwt, } from "./identity.js";

package/dist/internal/protocol.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @every-app/sdk/internal — Every App platform protocol internals.
+ *
+ * This subpath is for the Every App platform itself (gateway, perimeter, CLI),
+ * not for app authors. It owns the wire constants, claim shapes, claim codecs,
+ * and gateway-side JWT minters shared by the platform packages.
+ */
+import { type JWTPayload } from "jose";
+export declare const IDENTITY_ALG = "RS256";
+export declare const IDENTITY_KEY_ID = "everyapp-identity";
+export declare const IDENTITY_DEV_KEY_ID = "everyapp-identity-dev";
+export declare const IDENTITY_HEADER = "x-everyapp-identity";
+export declare const PUBLIC_HEADER = "x-everyapp-public";
+/** 120-second lifetime — caps revocation staleness while surviving clock skew. */
+export declare const IDENTITY_TTL_SECONDS = 120;
+/** Env var carrying the app id used as the expected identity audience. */
+export declare const APP_ID_ENV = "EVERYAPP_APP_ID";
+/** Default env var carrying a JSON array of SPKI PEM public keys. */
+export declare const PUBLIC_KEYS_ENV = "EVERYAPP_IDENTITY_PUBLIC_KEYS";
+/** Env var carrying the expected gateway issuer for user identity verification. */
+export declare const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
+/** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
+export declare const DEV_ENV = "EVERYAPP_DEV";
+/** `sub` claim the gateway mints public-route markers with. */
+export declare const PUBLIC_MARKER_SUB = "public";
+export type IdentityChannel = "web" | "api" | "mcp" | "agent";
+export type IdentityTokenType = "user" | "public";
+/** The actor on whose behalf the request is made (user, MCP client, agent). */
+export interface IdentityActor {
+    sub: string;
+}
+export interface IdentitySubject {
+    sub: string;
+    email: string;
+    orgId: string;
+    orgRole: string;
+}
+export interface EveryAppUser {
+    /** User id (the `sub` claim). */
+    id: string;
+    email: string;
+    orgId: string;
+    orgRole: string;
+    channel: IdentityChannel;
+    /** The acting principal (user, or `mcp:<client>` / agent). */
+    actor: IdentityActor;
+    scopes: string[];
+    jti: string;
+}
+export interface IdentityClaims extends JWTPayload {
+    typ: "user";
+    email: string;
+    org_id: string;
+    org_role: string;
+    chan: IdentityChannel;
+    act: IdentityActor;
+    scopes: string[];
+    jti: string;
+}
+export interface PublicMarkerClaims extends JWTPayload {
+    typ: "public";
+    pub: true;
+    jti: string;
+}
+export declare class ProtocolClaimsError extends Error {
+    constructor(message: string);
+}
+export declare function identitySubjectToClaims(subject: IdentitySubject, opts: {
+    channel?: IdentityChannel;
+    actor?: IdentityActor;
+    scopes?: string[];
+    jti: string;
+}): IdentityClaims;
+export declare function identityClaimsToEveryAppUser(payload: JWTPayload): EveryAppUser;
+export declare function publicMarkerClaims(jti: string): PublicMarkerClaims;
+export declare function assertPublicMarkerClaims(payload: JWTPayload): void;
+export interface MintIdentityOptions {
+    subject: IdentitySubject;
+    /** The app id this token is scoped to — becomes the `aud` claim. */
+    audience: string;
+    issuer: string;
+    channel?: IdentityChannel;
+    actor?: IdentityActor;
+    scopes?: string[];
+    ttlSeconds?: number;
+    now?: number;
+    /** Header kid. Defaults to the production kid; dev mints with the dev kid. */
+    keyId?: string;
+}
+/**
+ * Mint an identity JWT. Returns the compact JWS string to inject as
+ * `x-everyapp-identity`.
+ */
+export declare function mintIdentityJwt(privateKeyPem: string, opts: MintIdentityOptions): Promise<string>;
+export interface MintPublicMarkerOptions {
+    /** The app id this marker is scoped to — becomes the `aud` claim. */
+    audience: string;
+    issuer: string;
+    ttlSeconds?: number;
+    now?: number;
+    /** Header kid. Defaults to the production kid; dev mints with the dev kid. */
+    keyId?: string;
+}
+/**
+ * Mint the public-route marker for `x-everyapp-public`. A bare header value
+ * is never a trust source, so the marker is a signed, short-lived, app-scoped
+ * JWT with `pub: true` and `typ: "public"` that the SDK verifies exactly like
+ * an identity token.
+ */
+export declare function mintPublicMarkerJwt(privateKeyPem: string, opts: MintPublicMarkerOptions): Promise<string>;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/internal/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAE7D,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,0EAA0E;AAC1E,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAWhB;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CA4Bd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/dist/internal/protocol.js

@@ -0,0 +1,139 @@
+/**
+ * @every-app/sdk/internal — Every App platform protocol internals.
+ *
+ * This subpath is for the Every App platform itself (gateway, perimeter, CLI),
+ * not for app authors. It owns the wire constants, claim shapes, claim codecs,
+ * and gateway-side JWT minters shared by the platform packages.
+ */
+import { SignJWT, importPKCS8 } from "jose";
+export const IDENTITY_ALG = "RS256";
+export const IDENTITY_KEY_ID = "everyapp-identity";
+export const IDENTITY_DEV_KEY_ID = "everyapp-identity-dev";
+export const IDENTITY_HEADER = "x-everyapp-identity";
+export const PUBLIC_HEADER = "x-everyapp-public";
+/** 120-second lifetime — caps revocation staleness while surviving clock skew. */
+export const IDENTITY_TTL_SECONDS = 120;
+/** Env var carrying the app id used as the expected identity audience. */
+export const APP_ID_ENV = "EVERYAPP_APP_ID";
+/** Default env var carrying a JSON array of SPKI PEM public keys. */
+export const PUBLIC_KEYS_ENV = "EVERYAPP_IDENTITY_PUBLIC_KEYS";
+/** Env var carrying the expected gateway issuer for user identity verification. */
+export const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
+/** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
+export const DEV_ENV = "EVERYAPP_DEV";
+/** `sub` claim the gateway mints public-route markers with. */
+export const PUBLIC_MARKER_SUB = "public";
+export class ProtocolClaimsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProtocolClaimsError";
+    }
+}
+export function identitySubjectToClaims(subject, opts) {
+    return {
+        typ: "user",
+        email: subject.email,
+        org_id: subject.orgId,
+        org_role: subject.orgRole,
+        chan: opts.channel ?? "web",
+        act: opts.actor ?? { sub: subject.sub },
+        scopes: opts.scopes ?? ["*"],
+        jti: opts.jti,
+    };
+}
+export function identityClaimsToEveryAppUser(payload) {
+    if (payload.typ !== "user") {
+        throw new ProtocolClaimsError("identity token has wrong typ");
+    }
+    const sub = payload.sub;
+    const email = payload.email;
+    const orgId = payload.org_id;
+    const orgRole = payload.org_role;
+    if (!sub || !email || !orgId || !orgRole) {
+        throw new ProtocolClaimsError("identity token missing required claims");
+    }
+    const chan = payload.chan ?? "web";
+    const act = payload.act ?? { sub };
+    const scopes = Array.isArray(payload.scopes)
+        ? payload.scopes.filter((scope) => typeof scope === "string")
+        : ["*"];
+    return {
+        id: sub,
+        email,
+        orgId,
+        orgRole,
+        channel: chan,
+        actor: { sub: act.sub ?? sub },
+        scopes,
+        jti: payload.jti ?? "",
+    };
+}
+export function publicMarkerClaims(jti) {
+    return { typ: "public", pub: true, jti };
+}
+export function assertPublicMarkerClaims(payload) {
+    if (payload.typ !== "public") {
+        throw new ProtocolClaimsError("public marker has wrong typ");
+    }
+    if (payload.pub !== true || payload.sub !== PUBLIC_MARKER_SUB) {
+        throw new ProtocolClaimsError("token is not a public-route marker");
+    }
+}
+let cachedPrivateKey = null;
+async function loadPrivateKey(privateKeyPem) {
+    const pem = privateKeyPem.replace(/\\n/g, "\n");
+    if (cachedPrivateKey && cachedPrivateKey.pem === pem) {
+        return cachedPrivateKey.key;
+    }
+    const key = await importPKCS8(pem, IDENTITY_ALG);
+    cachedPrivateKey = { pem, key };
+    return key;
+}
+/**
+ * Mint an identity JWT. Returns the compact JWS string to inject as
+ * `x-everyapp-identity`.
+ */
+export async function mintIdentityJwt(privateKeyPem, opts) {
+    const key = await loadPrivateKey(privateKeyPem);
+    const nowSec = Math.floor((opts.now ?? Date.now()) / 1000);
+    const ttl = opts.ttlSeconds ?? IDENTITY_TTL_SECONDS;
+    const jti = crypto.randomUUID();
+    return new SignJWT(identitySubjectToClaims(opts.subject, {
+        channel: opts.channel,
+        actor: opts.actor,
+        scopes: opts.scopes,
+        jti,
+    }))
+        .setProtectedHeader({
+        alg: IDENTITY_ALG,
+        kid: opts.keyId ?? IDENTITY_KEY_ID,
+    })
+        .setIssuer(opts.issuer)
+        .setSubject(opts.subject.sub)
+        .setAudience(opts.audience)
+        .setIssuedAt(nowSec)
+        .setExpirationTime(nowSec + ttl)
+        .sign(key);
+}
+/**
+ * Mint the public-route marker for `x-everyapp-public`. A bare header value
+ * is never a trust source, so the marker is a signed, short-lived, app-scoped
+ * JWT with `pub: true` and `typ: "public"` that the SDK verifies exactly like
+ * an identity token.
+ */
+export async function mintPublicMarkerJwt(privateKeyPem, opts) {
+    const key = await loadPrivateKey(privateKeyPem);
+    const nowSec = Math.floor((opts.now ?? Date.now()) / 1000);
+    const ttl = opts.ttlSeconds ?? IDENTITY_TTL_SECONDS;
+    return new SignJWT(publicMarkerClaims(crypto.randomUUID()))
+        .setProtectedHeader({
+        alg: IDENTITY_ALG,
+        kid: opts.keyId ?? IDENTITY_KEY_ID,
+    })
+        .setIssuer(opts.issuer)
+        .setSubject(PUBLIC_MARKER_SUB)
+        .setAudience(opts.audience)
+        .setIssuedAt(nowSec)
+        .setExpirationTime(nowSec + ttl)
+        .sign(key);
+}

package/dist/server/everyApp.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `everyApp()` — the app-side identity boundary.
+ *
+ *   import manifest from "../everyapp.config.js";
+ *   export default everyApp(handler, manifest);
+ *
+ * The wrapper verifies the gateway-injected identity before app code runs,
+ * stores the result on the original Request, and then delegates to the
+ * worker-style handler.
+ */
+import { ConfigurationError, IdentityError, type EveryAppUser, type IdentityResult } from "../internal/index.js";
+export { ConfigurationError, IdentityError };
+export type { EveryAppUser, IdentityResult };
+export interface ExecutionContextLike {
+    waitUntil(promise: Promise<unknown>): void;
+    passThroughOnException?(): void;
+}
+export interface EveryAppManifestLike {
+    id: string;
+    [key: string]: unknown;
+}
+export interface EveryAppOptions {
+    /** Optional expected issuer (gateway URL). Defaults to env.EVERYAPP_IDENTITY_ISSUER when set. */
+    issuer?: string;
+    /** Env var holding the public key set. Defaults to EVERYAPP_IDENTITY_PUBLIC_KEYS. */
+    keysEnvVar?: string;
+    /** Provide keys directly (tests / non-standard delivery). */
+    publicKeys?: string[];
+    /**
+     * Accept dev identity tokens. Defaults to reading EVERYAPP_DEV from env.
+     * Never enable this in production.
+     */
+    allowDevIdentities?: boolean;
+    /** Override for tests. */
+    now?: number;
+}
+/** The handler accepted by everyApp, with the verified user as a 4th argument. */
+export type EveryAppHandler<TEnv = Record<string, unknown>> = (request: Request, env: TEnv, ctx: ExecutionContextLike, user: EveryAppUser | null) => Response | Promise<Response>;
+interface EveryAppExport<TEnv> {
+    fetch(request: Request, env: TEnv, ctx: ExecutionContextLike): Promise<Response>;
+}
+/**
+ * Return the verified Every App user for this request, or null for a declared
+ * public request. Uses the request cache first, then verifies the identity
+ * headers from the app id and public keys configured in env.
+ */
+export declare function getEveryAppUser(request: Request, env: object): Promise<EveryAppUser | null>;
+/**
+ * Return the verified user, or throw the same 401 JSON Response shape as
+ * everyApp() when the request is public or unauthenticated.
+ */
+export declare function requireEveryAppUser(request: Request, env: object): Promise<EveryAppUser>;
+export declare function hasScope(user: EveryAppUser, scope: string): boolean;
+export declare function everyApp<TEnv = Record<string, unknown>>(handler: EveryAppHandler<TEnv>, manifest: EveryAppManifestLike, options?: EveryAppOptions): EveryAppExport<TEnv>;
+//# sourceMappingURL=everyApp.d.ts.map

package/dist/server/everyApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"everyApp.d.ts","sourceRoot":"","sources":["../../src/server/everyApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAEL,kBAAkB,EAElB,aAAa,EAIb,KAAK,YAAY,EACjB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAE7C,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,sBAAsB,CAAC,IAAI,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,MAAM,MAAM,eAAe,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAC5D,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,YAAY,GAAG,IAAI,KACtB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,UAAU,cAAc,CAAC,IAAI;IAC3B,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAiFD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW9B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,CAevB;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAAC,IAAI,CAAC,CAqBtB"}