@fabrika/proxy-core 0.8.2 → 0.9.0-cloudflare.2

package/types/src/oauth-resource.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/** Configuration, not caller-supplied URLs. Resource and metadata stay on the protected app origin. */
+export interface OAuthProtectedResource {
+    resource: string;
+    resourceMetadata: string;
+    authorizationServers: string[];
+    scopesSupported: string[];
+}
+/** RFC 9728 metadata response; metadata publication does not admit requests to the resource. */
+export interface OAuthProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: ['header'];
+}
+/** RFC 6750 challenge parameters with RFC 9728 resource metadata discovery. */
+export interface OAuthBearerChallenge {
+    resource_metadata: string;
+    error?: 'invalid_token' | 'insufficient_scope';
+    scope?: string;
+}
+export declare const oauthScopesSchema: z.ZodEffects<z.ZodUnknown, string[], unknown>;
+export declare const oauthProtectedResourceSchema: z.ZodEffects<z.ZodObject<{
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    resourceMetadata: z.ZodEffects<z.ZodString, string, string>;
+    authorizationServers: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+    scopesSupported: z.ZodEffects<z.ZodUnknown, string[], unknown>;
+}, "strip", z.ZodTypeAny, {
+    resource: string;
+    resourceMetadata: string;
+    authorizationServers: string[];
+    scopesSupported: string[];
+}, {
+    resource: string;
+    resourceMetadata: string;
+    authorizationServers: string[];
+    scopesSupported?: unknown;
+}>, {
+    resource: string;
+    resourceMetadata: string;
+    authorizationServers: string[];
+    scopesSupported: string[];
+}, {
+    resource: string;
+    resourceMetadata: string;
+    authorizationServers: string[];
+    scopesSupported?: unknown;
+}>;
+export declare function parseOAuthProtectedResource(value: unknown): OAuthProtectedResource | null;
+export declare function oauthProtectedResourceMetadata(config: OAuthProtectedResource): OAuthProtectedResourceMetadata;
+export declare function parseOAuthBearerChallenge(value: unknown): OAuthBearerChallenge | null;
+export declare function formatOAuthBearerChallenge(value: OAuthBearerChallenge): string;

package/types/src/oauth.d.ts

@@ -0,0 +1,12 @@
+import { type OAuthProtectedResource, type ProxyApp } from './manifest';
+/**
+ * The auth service's RFC 9728 metadata endpoint. Separate from `/verify` because a 2xx from `/verify`
+ * admits the request to the app, while metadata is answered by the proxy itself and never forwarded.
+ */
+export declare const OAUTH_METADATA_VERIFY_PATH = "/oauth-metadata";
+/**
+ * The entry's protected resource whose metadata URL is this request's host and exact raw pathname. Only an
+ * installation entry has one.
+ */
+export declare function findOAuthMetadata(app: ProxyApp, url: URL): OAuthProtectedResource | null;
+export declare function oauthMetadataResponse(resource: OAuthProtectedResource, method: string): Response;

package/types/src/page-style.d.ts

@@ -0,0 +1,40 @@
+import type { InstallationBrand } from './brand';
+/**
+ * The one stylesheet of every page fabrika renders outside the console and an application's own interface: IAM's
+ * sign-in, account, invitation and consent pages, Control's GitHub handoff, and the proxy's error pages (`./pages`).
+ * Each page is the console's welcome (`packages/dashboard/src/styles.css`, `.welcome`) set for a page that stands alone:
+ * one panel in the middle of the window, the page's own words at the left, the fabrika mark drawn large on the
+ * blueprint grid at the right, and fabrika named once, quietly, in a footer under it. Unlike the console's welcome the
+ * panel follows the scheme: a plate on the floor in light, the welcome's dark panel in dark. Buttons are the console's:
+ * outlined, and the brand blue fills only the page's one constructive step, the first button of a form.
+ * `pageBody` writes the frame, so every page has the same one. `page-style.test.ts` fails when a token here drifts from
+ * the console's.
+ *
+ * It imports nothing at runtime and loads nothing: every page that carries it admits only its own inline style, so the
+ * console's IBM Plex is used where the machine has it and a system face otherwise. The values the console mixes with
+ * `color-mix()` are written out here, and `light-dark()` is a media query, because these pages reach every browser
+ * that follows a sign-in link, not only the console's.
+ *
+ * The proxy's Caddy configuration serves it inside a `static_response` body, where Caddy expands `{name}`
+ * placeholders. Every block therefore opens with `{` and a newline, never `{` and a name.
+ */
+export declare const PAGE_STYLE = "\n:root {\n\tcolor-scheme: light dark;\n\t--floor: #f6f7f9;\n\t--panel: #ffffff;\n\t--panel-rule: rgba(14, 20, 32, 0.1);\n\t--art-rule: rgba(14, 20, 32, 0.08);\n\t--logo: #2544c2;\n\t--recess: #f1f3f6;\n\t--rule: rgba(14, 20, 32, 0.1);\n\t--rule-strong: rgba(14, 20, 32, 0.18);\n\t--control: #ffffff;\n\t--control-rule: rgba(14, 20, 32, 0.16);\n\t--control-hover: #f2f4f7;\n\t--ink: #0e1117;\n\t--ink-2: #343d4a;\n\t--ink-3: #4b5563;\n\t--ink-4: #596372;\n\t--brand: #2544c2;\n\t--brand-hover: #1e389f;\n\t--brand-on: #ffffff;\n\t--blueprint: #2544c2;\n\t--blueprint-hover: #1e369b;\n\t--blueprint-wash: rgba(37, 68, 194, 0.07);\n\t--rule-focus: rgba(37, 68, 194, 0.28);\n\t--lamp-stop: #bf2f2f;\n\t--wash-stop: rgba(191, 47, 47, 0.09);\n\t--r-1: 4px;\n\t--r-2: 6px;\n\t--font-ui: 'IBM Plex Sans Variable', 'IBM Plex Sans', ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif;\n\t--font-mono: 'IBM Plex Mono', ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n}\n\n@media (prefers-color-scheme: dark) {\n\t:root {\n\t\t--floor: #080a0d;\n\t\t--panel: #080a0d;\n\t\t--panel-rule: rgba(255, 255, 255, 0.08);\n\t\t--art-rule: rgba(255, 255, 255, 0.08);\n\t\t--logo: #e6e9ee;\n\t\t--recess: #0a0d11;\n\t\t--rule: rgba(255, 255, 255, 0.1);\n\t\t--rule-strong: rgba(255, 255, 255, 0.18);\n\t\t--control: #11151a;\n\t\t--control-rule: rgba(255, 255, 255, 0.15);\n\t\t--control-hover: #1b2027;\n\t\t--ink: #f1f3f6;\n\t\t--ink-2: #b0b2b8;\n\t\t--ink-3: #85878e;\n\t\t--ink-4: #5c5e64;\n\t\t--blueprint: #9dabe4;\n\t\t--blueprint-hover: #bec7ed;\n\t\t--blueprint-wash: rgba(37, 68, 194, 0.16);\n\t\t--rule-focus: rgba(37, 68, 194, 0.45);\n\t\t--lamp-stop: #f4736f;\n\t\t--wash-stop: rgba(244, 115, 111, 0.14);\n\t}\n}\n\n*, *::before, *::after {\n\tbox-sizing: border-box;\n}\n\n[hidden] {\n\tdisplay: none !important;\n}\n\nhtml {\n\t-webkit-text-size-adjust: 100%;\n\ttext-size-adjust: 100%;\n}\n\n/* The panel and its footer, together in the middle of the window; a page taller than the window grows down. */\nbody {\n\tdisplay: grid;\n\talign-content: center;\n\tmin-height: 100vh;\n\tmin-height: 100dvh;\n\tmargin: 0;\n\tpadding: 3rem 1rem;\n\tbackground: var(--floor);\n\tcolor: var(--ink);\n\tfont: 400 0.875rem/1.5 var(--font-ui);\n\tfont-variant-numeric: tabular-nums;\n\t-webkit-font-smoothing: antialiased;\n\t-moz-osx-font-smoothing: grayscale;\n}\n\n::selection {\n\tbackground: var(--blueprint-wash);\n}\n\nmain {\n\tdisplay: grid;\n\tgrid-template-columns: minmax(0, 1.35fr) minmax(0, 1fr);\n\tgap: 2.5rem;\n\twidth: 100%;\n\tmax-width: 60rem;\n\tmargin: 0 auto;\n\tpadding: 2.75rem;\n\tbackground: var(--panel);\n\tborder: 1px solid var(--panel-rule);\n\tborder-radius: var(--r-2);\n\tcolor: var(--ink-2);\n\toverflow-wrap: anywhere;\n}\n\n.copy {\n\tmin-width: 0;\n\talign-self: center;\n}\n\n.copy > :last-child {\n\tmargin-bottom: 0;\n}\n\n/* The mark on the grid of the console's welcome, in the brand blue on both panels. */\n.art {\n\tdisplay: grid;\n\tplace-items: center;\n\tmin-height: 15rem;\n\tcolor: var(--brand);\n\tbackground-image:\n\t\tlinear-gradient(var(--art-rule) 1px, transparent 1px),\n\t\tlinear-gradient(90deg, var(--art-rule) 1px, transparent 1px);\n\tbackground-size: 24px 24px;\n\tbackground-position: center;\n\tborder-radius: var(--r-1);\n}\n\n.art svg {\n\tdisplay: block;\n\twidth: min(70%, 10rem);\n\theight: auto;\n}\n\n/* The client's logo (ADR-0066), fitted inside the grid whatever its proportions: a wordmark runs wide, a symbol tall. */\n.art img {\n\tdisplay: block;\n\tmax-width: 80%;\n\tmax-height: 8rem;\n\twidth: auto;\n\theight: auto;\n}\n\n.made-with {\n\tdisplay: flex;\n\talign-items: center;\n\tjustify-content: space-between;\n\tgap: 1rem;\n\twidth: 100%;\n\tmax-width: 60rem;\n\tmargin: 1rem auto 0;\n\tpadding-inline: 0.25rem;\n\tcolor: var(--ink-3);\n\tfont-size: 0.75rem;\n}\n\n.runs-on {\n\tdisplay: inline-flex;\n\talign-items: center;\n\tgap: 0.3125rem;\n}\n\n.runs-on svg {\n\tdisplay: block;\n}\n\n.eyebrow {\n\tmargin: 0 0 0.75rem;\n\tcolor: var(--ink-3);\n\tfont-size: 0.8125rem;\n\tfont-weight: 500;\n}\n\nh1 {\n\tmargin: 0 0 1rem;\n\tfont-size: clamp(1.75rem, 4vw, 2.5rem);\n\tfont-weight: 700;\n\tline-height: 1.05;\n\tletter-spacing: -0.04em;\n\tcolor: var(--ink);\n\ttext-wrap: balance;\n}\n\np {\n\tmax-width: 34rem;\n\tmargin: 0 0 0.75rem;\n\tcolor: var(--ink-2);\n\tfont-size: 0.9375rem;\n\tline-height: 1.6;\n\ttext-wrap: pretty;\n}\n\nstrong {\n\tcolor: var(--ink);\n\tfont-weight: 600;\n}\n\na {\n\tcolor: var(--blueprint);\n\ttext-decoration: none;\n\tborder-radius: 2px;\n}\n\na:hover {\n\tcolor: var(--blueprint-hover);\n\ttext-decoration: underline;\n\ttext-underline-offset: 2px;\n\ttext-decoration-thickness: 1px;\n}\n\n:focus-visible {\n\toutline: 2px solid var(--blueprint);\n\toutline-offset: 2px;\n}\n\ncode {\n\tpadding: 0.1em 0.35em;\n\tfont-family: var(--font-mono);\n\tfont-size: 0.92em;\n\tbackground: var(--recess);\n\tborder-radius: var(--r-1);\n}\n\nul {\n\tmargin: 0 0 0.75rem;\n\tpadding: 0;\n\tlist-style: none;\n\tborder: 1px solid var(--rule);\n\tborder-radius: var(--r-2);\n\tfont-size: 0.875rem;\n}\n\nli {\n\tpadding: 0.5rem 0.75rem;\n\tcolor: var(--ink-2);\n}\n\nli + li {\n\tborder-top: 1px solid var(--rule);\n}\n\nhr {\n\tmargin: 1.25rem 0;\n\tborder: 0;\n\tborder-top: 1px solid var(--rule);\n}\n\nform {\n\tdisplay: grid;\n\tgap: 1rem;\n\tmargin: 1rem 0 0;\n}\n\nform + p {\n\tmargin: 1rem 0 0;\n}\n\nlabel {\n\tdisplay: grid;\n\tgap: 0.375rem;\n\tcolor: var(--ink-2);\n\tfont-size: 0.8125rem;\n\tfont-weight: 600;\n}\n\ninput {\n\twidth: 100%;\n\tmin-width: 0;\n\tmin-height: 2.25rem;\n\tmargin: 0;\n\tpadding: 0.375rem 0.625rem;\n\tfont: inherit;\n\tfont-size: 0.875rem;\n\tfont-weight: 400;\n\tcolor: var(--ink);\n\tbackground: var(--control);\n\tborder: 1px solid var(--control-rule);\n\tborder-radius: var(--r-1);\n\ttransition: border-color 0.12s ease, box-shadow 0.12s ease;\n}\n\ninput::placeholder {\n\tcolor: var(--ink-4);\n}\n\ninput:hover {\n\tborder-color: var(--rule-strong);\n}\n\ninput:focus {\n\toutline: none;\n\tborder-color: var(--blueprint);\n\tbox-shadow: 0 0 0 3px var(--rule-focus);\n}\n\nbutton,\n.button {\n\tdisplay: inline-flex;\n\talign-items: center;\n\tjustify-content: center;\n\tjustify-self: start;\n\tgap: 0.375rem;\n\tmin-height: 2.25rem;\n\tmargin: 0;\n\tpadding: 0.375rem 0.875rem;\n\tfont: inherit;\n\tfont-size: 0.8125rem;\n\tfont-weight: 500;\n\twhite-space: nowrap;\n\ttext-decoration: none;\n\tcolor: var(--ink);\n\tbackground: var(--control);\n\tborder: 1px solid var(--control-rule);\n\tborder-radius: var(--r-1);\n\tcursor: pointer;\n\ttransition: background 0.12s ease, border-color 0.12s ease, color 0.12s ease;\n}\n\nbutton:hover,\n.button:hover {\n\tcolor: var(--ink);\n\ttext-decoration: none;\n\tbackground: var(--control-hover);\n\tborder-color: var(--rule-strong);\n}\n\nform > button:first-of-type {\n\tcolor: var(--brand-on);\n\tbackground: var(--brand);\n\tborder-color: var(--brand);\n\tfont-weight: 600;\n}\n\nform > button:first-of-type:hover {\n\tcolor: var(--brand-on);\n\tbackground: var(--brand-hover);\n\tborder-color: var(--brand-hover);\n}\n\n.password {\n\tdisplay: flex;\n\tbackground: var(--control);\n\tborder: 1px solid var(--control-rule);\n\tborder-radius: var(--r-1);\n\ttransition: border-color 0.12s ease, box-shadow 0.12s ease;\n}\n\n.password:hover {\n\tborder-color: var(--rule-strong);\n}\n\n.password:focus-within {\n\tborder-color: var(--blueprint);\n\tbox-shadow: 0 0 0 3px var(--rule-focus);\n}\n\n.password input {\n\tflex: 1;\n\tmin-height: calc(2.25rem - 2px);\n\tbackground: transparent;\n\tborder: 0;\n\tbox-shadow: none;\n}\n\n.password button {\n\tflex: none;\n\tmin-height: 0;\n\tmargin: 0.25rem;\n\tpadding: 0 0.625rem;\n\tfont-size: 0.75rem;\n\tcolor: var(--blueprint);\n\tbackground: transparent;\n\tborder: 0;\n}\n\n.password button:hover {\n\tcolor: var(--blueprint);\n\tbackground: var(--blueprint-wash);\n}\n\n.error {\n\tdisplay: flex;\n\tgap: 0.625rem;\n\tpadding: 0.75rem 1rem;\n\tcolor: var(--ink);\n\tbackground: var(--wash-stop);\n\tborder-radius: var(--r-2);\n}\n\n.error::before {\n\tcontent: '';\n\tflex: none;\n\twidth: 0.5rem;\n\theight: 0.5rem;\n\tmargin-top: 0.55em;\n\tborder-radius: 50%;\n\tbackground: var(--lamp-stop);\n\tbox-shadow: 0 0 0 3px var(--wash-stop);\n}\n\n/* On a phone the art becomes a band above the copy. */\n@media (max-width: 40rem) {\n\tbody {\n\t\tpadding: 1.5rem 1rem;\n\t}\n\n\tmain {\n\t\tgrid-template-columns: minmax(0, 1fr);\n\t\tgap: 1.5rem;\n\t\tpadding: 1.5rem;\n\t}\n\n\t.art {\n\t\torder: -1;\n\t\tmin-height: 7rem;\n\t}\n\n\t.art svg {\n\t\twidth: 4.5rem;\n\t}\n\n\t.art img {\n\t\tmax-height: 4.5rem;\n\t}\n\n\t/* A smaller input makes a phone zoom the page in when it is focused. */\n\tinput {\n\t\tfont-size: 1rem;\n\t}\n}\n\n@media (prefers-reduced-motion: reduce) {\n\t* {\n\t\ttransition: none !important;\n\t}\n}\n";
+/**
+ * What the grid shows: the installation's client logo where it has one (ADR-0066), the designer's mark otherwise. The
+ * dark variant takes over on a dark page; without one, the light logo stands on the dark panel as it is.
+ */
+export declare function pageArt(brand: InstallationBrand | null): string;
+/** The designer's mark, as the console's `BrandMark` draws it: `height` tall and a hair narrower. */
+export declare function brandMark(height: number): string;
+/** What the footer under the panel says: who runs the page, and the status the page answers with, if it has one. */
+export interface PageFooter {
+    /** The words before the mark and the name: "Runs on" in English. */
+    readonly runsOn: string;
+    readonly status?: string;
+}
+/**
+ * The body every page in this stylesheet has: the panel with the page's `content` at the left and the art on the grid
+ * at the right (`pageArt`), and the footer under it, which names fabrika whatever the art shows. Every value is markup
+ * the caller has already escaped; the brand is checked where it was written and again where it was read.
+ */
+export declare function pageBody(content: string, footer: PageFooter, brand?: InstallationBrand | null): string;

package/types/src/pages.d.ts

@@ -0,0 +1,62 @@
+import type { InstallationBrand } from './brand';
+/**
+ * The pages a person reads when the proxy, not the application, answers their browser: a refusal, an unknown host, an
+ * application that does not answer. Every enforcement point renders them from here, the auth service, the generated
+ * Caddy configuration and the Cloudflare proxy Worker, so a refusal looks the same on both providers.
+ *
+ * A page is only for a top-level navigation (`isPageNavigation`). An XHR, a `fetch`, a key-carrying program or a client
+ * that sends no `Sec-Fetch-Mode` gets the short text it always got, which is what each of them parses. The text of a
+ * page is fixed per status and names no deny reason: the reasons stay coarse and stay in the log.
+ *
+ * They look like IAM's pages because they carry the same stylesheet and frame (`./page-style`). No script and no external
+ * reference: a page is served on the application's own origin under its header policy, whose CSP admits inline styles
+ * and nothing else that a page could load from elsewhere. A download endpoint's answers never get a page, because the
+ * file treatment makes every one of them an attachment.
+ */
+/**
+ * The browser's own description of what issued the request, written by the browser and not by the page: `Sec-` is a
+ * forbidden header prefix, so a page's `fetch` cannot set it. Read from the FORWARDED headers like everything else a
+ * decision depends on; caddy 2.10.2's `forward_auth` subrequest carries the original `Sec-Fetch-*` verbatim.
+ */
+export declare const FETCH_MODE_HEADER = "Sec-Fetch-Mode";
+/** The statuses the proxy answers on its own. */
+export type ErrorPageStatus = 400 | 401 | 403 | 404 | 502 | 503 | 504;
+/** A same-origin link under a page's text, drawn as the console's outlined button; an empty `href` reloads the page. */
+export interface PageAction {
+    readonly href: string;
+    readonly label: string;
+    /** Draws the console's refresh glyph before the label, as its Retry does. */
+    readonly retry?: boolean;
+}
+export interface PageContent {
+    readonly title: string;
+    readonly detail: string;
+    readonly action?: PageAction;
+}
+/**
+ * Only an explicit `navigate`. Unlike the login bounce, an absent header is not read as a browser here: a client that
+ * sends none (curl, a script, an old SDK) has always read the text, and a page instead of it helps nobody.
+ */
+export declare function isPageNavigation(headers: Headers): boolean;
+export interface ErrorPageOptions {
+    /**
+     * The code printed on the page, the status itself by default; the Caddy configuration passes
+     * `{http.error.status_code}`, a placeholder Caddy fills in for the status it answers with.
+     */
+    readonly shownStatus?: string;
+    /** The installation's client logo (ADR-0066), from the manifest; the fabrika mark without one. */
+    readonly brand?: InstallationBrand | null;
+}
+/** The page of a status. */
+export declare function errorPage(status: ErrorPageStatus, options?: ErrorPageOptions): string;
+/** The answer of a status: its page when `asPage`, `text` as plain text otherwise. The caller applies the header policy. */
+export declare function errorAnswer(status: ErrorPageStatus, text: string, asPage: boolean, brand?: InstallationBrand | null): Response;
+/** A rendered page as an answer; the caller applies the header policy. */
+export declare function pageResponse(status: number, body: string): Response;
+export declare const PAGE_CONTENT_TYPE = "text/html; charset=utf-8";
+/**
+ * The page in the shared stylesheet and frame (`./page-style`): a heading, one sentence and an outlined button in the
+ * panel, the status in the footer for whoever reports it. Every string that reaches the markup is a constant of this
+ * module or a status code; nothing of the request is printed, so nothing is escaped.
+ */
+export declare function renderPage(content: PageContent, shownStatus: string, brand?: InstallationBrand | null): string;

package/types/src/service.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The `forward_auth` endpoint — a fetch-style `Request → Response` service, written the way
+ * `@fabrika/iam` is so the same code runs on Bun, Node and Workers.
+ *
+ * Caddy's contract (verified against `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go`):
+ *   - the subrequest is rewritten to `GET /verify` with the ORIGINAL headers, plus
+ *     `X-Forwarded-Method` / `X-Forwarded-Uri`, plus reverse_proxy's `X-Forwarded-{For,Proto,Host}`;
+ *   - a **2xx** response lets the request continue, and each `copy_headers` field is copied onto the
+ *     UPSTREAM request — but ONLY when non-empty (Caddy guards each copy with a `not vars ""` matcher);
+ *   - **any other status** is returned to the client verbatim — status, headers AND body, verified
+ *     against caddy 2.10.2 — so both a 302 to `/auth/login` and a 401 carrying a JSON login envelope
+ *     reach the caller and neither reaches the app.
+ *
+ * The two consequences that shape this file:
+ *   1. the request being authorized is described ENTIRELY by the forwarded headers. Never look at
+ *      this request's own method or path — a missing `X-Forwarded-Uri` must deny, not fall back;
+ *   2. because an empty copy header is a no-op rather than a delete, the generated Caddy config
+ *      strips the token header AND the request id from the inbound request BEFORE `forward_auth`
+ *      runs. Otherwise a client could present its own token header on a `public` path and have it
+ *      reach the app, or choose the correlation id that lands in IAM's audit trail. Both are handed
+ *      back on a 2xx, so the edge is the only thing that mints either.
+ */
+import type { TokenCache } from './cache';
+import type { DelegationIssuer, IamGateway } from './iam';
+import { type ProxyLogger } from './log';
+import { type ProxyManifest } from './manifest';
+export interface VerifyServiceConfig {
+    manifest: ProxyManifest;
+    iam: IamGateway;
+    /** IAM's origin — token `iss` and the base of the login bounce. */
+    issuer: string;
+    /** `null`/omitted disables the token cache. Same decisions, more IAM calls. */
+    cache?: TokenCache | null;
+    logger?: ProxyLogger;
+    /** Liveness probe path on the auth service's own port. Default `/healthz`. */
+    healthPath?: string;
+    /** Unix seconds. Injectable for tests. */
+    now?: () => number;
+    /** Issues delegation grants for membership and scope-creating endpoints; see `AuthorizerOptions.delegations`. */
+    delegations?: DelegationIssuer | null;
+}
+export type VerifyService = (request: Request) => Promise<Response>;
+/**
+ * Build the `/verify` service. Endpoint tables are compiled once here, not per request — the planner is
+ * on the hot path of every request to every app.
+ */
+export declare function createVerifyService(config: VerifyServiceConfig): VerifyService;

package/types/src/verifier.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Local token verification — the warm path. Fetch the JWKS once, then verify every token with no
+ * network call on the warm path.
+ *
+ * The verification itself is `@fabrika/jwks`, shared byte-for-byte with the app SDK. What this file
+ * owns is the proxy's construction shape: one long-lived process holding one verifier, so the key set
+ * is cached per instance, and the audience is the app the forwarded request resolved to — per call,
+ * not per verifier.
+ */
+import type { Jwks, TokenAudienceProfile } from '@fabrika/auth-core';
+import { type VerifyResult } from '@fabrika/jwks';
+export type { VerifyResult };
+export declare class TokenVerifier {
+    private readonly inner;
+    constructor(getJwks: () => Promise<Jwks>, issuer: string, now: () => number, ttlSeconds?: number, refetchCooldownSeconds?: number);
+    /**
+     * Verify `token` for `audience` (a bare string is an app id). An unknown `kid` forces one JWKS refetch (a key rotated in), then a
+     * retry — but at most once per cooldown, because otherwise any caller can turn every request into an
+     * IAM round trip just by inventing a `kid`.
+     */
+    verify(token: string, audience: string | TokenAudienceProfile): Promise<VerifyResult>;
+}