@farthershore/backend 0.10.0 → 0.12.0

package/README.md

@@ -12,7 +12,7 @@ graceful lifecycle (health + shutdown). Everything else — your product, backen
 and environment ids, the verification keys, and the metering endpoint — is
 fetched automatically from the token at startup.
 
-> **Status: `0.10.0`.** Pre-1.0: minor releases may include breaking changes, so
+> **Status: `0.12.0`.** Pre-1.0: minor releases may include breaking changes, so
 > pin this package to an exact version (or a patch-only range) and upgrade
 > deliberately.
 

package/dist/generated/runtime-contract.js

@@ -160,7 +160,8 @@ var RUNTIME_ERROR_CODES = {
   bodyTooLarge: "body_too_large",
   environmentMismatch: "environment_mismatch",
   missingToken: "missing_token",
-  invalidToken: "invalid_token"
+  invalidToken: "invalid_token",
+  contextUnverified: "context_unverified"
 };
 var RUNTIME_METERING_CONTRACT = {
   endpoint: "/v1/metering/events",

package/dist/index.js

@@ -214,7 +214,8 @@ var RUNTIME_ERROR_CODES = {
   bodyTooLarge: "body_too_large",
   environmentMismatch: "environment_mismatch",
   missingToken: "missing_token",
-  invalidToken: "invalid_token"
+  invalidToken: "invalid_token",
+  contextUnverified: "context_unverified"
 };
 var RUNTIME_RESPONSE_METERING_CONTRACT = {
   headers: {
@@ -259,6 +260,8 @@ var RUNTIME_ERROR_CODE_TO_ERROR_CODE = {
   // Credential / token presentation faults → UNAUTHORIZED (401).
   [RUNTIME_ERROR_CODES.missingToken]: "UNAUTHORIZED",
   [RUNTIME_ERROR_CODES.invalidToken]: "UNAUTHORIZED",
+  // UA-6 — fail-closed signed-context requirement (mirrors contracts).
+  [RUNTIME_ERROR_CODES.contextUnverified]: "UNAUTHORIZED",
   // Signature / key faults → UNAUTHORIZED (401, fail-closed verification).
   [RUNTIME_ERROR_CODES.missingSignature]: "UNAUTHORIZED",
   [RUNTIME_ERROR_CODES.malformedSignature]: "UNAUTHORIZED",
@@ -1299,8 +1302,22 @@ function permissionGrants(permissions, key2) {
   if (permissions.includes(WILDCARD)) return true;
   return permissions.includes(key2);
 }
+function permissionSatisfies(required, granted) {
+  if (granted === void 0) return true;
+  if (granted.includes(WILDCARD)) return true;
+  if (granted.includes(required)) return true;
+  const idx = required.indexOf(":");
+  if (idx > 0 && idx < required.length - 1) {
+    const subject = required.slice(0, idx);
+    if (granted.includes(`${subject}:${WILDCARD}`)) return true;
+  }
+  return false;
+}
 function hasPermission(ctx, key2) {
-  return permissionGrants(ctx.permissions, key2);
+  if (ctx.permissions === void 0) {
+    return ctx.signedContext !== void 0;
+  }
+  return permissionSatisfies(key2, ctx.permissions);
 }
 function requirePermission(ctx, key2) {
   if (!hasPermission(ctx, key2)) {
@@ -1309,6 +1326,78 @@ function requirePermission(ctx, key2) {
 }
 var IDENTITY_HEADER_NAMES = RUNTIME_IDENTITY_HEADER_NAMES;
 
+// src/core/verifyContext.ts
+var EXPECTED_JWT_ALG = "HS256";
+function base64urlDecode(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function importHmacKey(secret) {
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+}
+async function verifyContext(token, secrets) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [header, payload, signature] = parts;
+  let headerJson = null;
+  try {
+    headerJson = JSON.parse(
+      new TextDecoder().decode(base64urlDecode(header))
+    );
+  } catch {
+    return null;
+  }
+  if (headerJson?.alg !== EXPECTED_JWT_ALG) return null;
+  const signingInput = new TextEncoder().encode(`${header}.${payload}`);
+  let signatureBytes;
+  try {
+    signatureBytes = base64urlDecode(signature);
+  } catch {
+    return null;
+  }
+  let verified = false;
+  for (const secret of secrets) {
+    try {
+      const key2 = await importHmacKey(secret);
+      if (await crypto.subtle.verify(
+        "HMAC",
+        key2,
+        signatureBytes,
+        signingInput
+      )) {
+        verified = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!verified) return null;
+  try {
+    const parsed = JSON.parse(
+      new TextDecoder().decode(base64urlDecode(payload))
+    );
+    if (typeof parsed !== "object" || parsed === null) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function contextRequiredError(reason) {
+  return new FartherShoreError(
+    "context_unverified",
+    `X-Fs-Context ${reason} (contextVerification is "required")`
+  );
+}
+
 // src/core/verifyRequest.ts
 async function verifyRequest(input, deps) {
   const h = headerGetter(input.headers);
@@ -1416,10 +1505,39 @@ async function verifyRequest(input, deps) {
       "x-fs-request-id has already been seen (replay)"
     );
   }
-  const permissions = parsePermissionHeader(
-    h(RUNTIME_IDENTITY_HEADER_NAMES.permissions)
-  );
-  const roles = parsePermissionHeader(h(RUNTIME_IDENTITY_HEADER_NAMES.roles));
+  let permissions;
+  let roles;
+  let signedContext = null;
+  const contextSecrets = deps.contextSecrets ?? [];
+  const hasContextKeyring = contextSecrets.length > 0;
+  if (hasContextKeyring) {
+    const token = h("x-fs-context");
+    if (token) {
+      signedContext = await verifyContext(token, contextSecrets);
+      if (signedContext === null && deps.contextVerification === "required") {
+        throw contextRequiredError("failed verification");
+      }
+      if (signedContext && signedContext.productId !== signedProductId) {
+        throw new FartherShoreError(
+          "context_unverified",
+          "X-Fs-Context was minted for a different product than the signed request"
+        );
+      }
+    } else if (deps.contextVerification === "required") {
+      throw contextRequiredError("header is missing");
+    }
+  } else if (deps.contextVerification === "required") {
+    throw contextRequiredError("keyring is empty");
+  }
+  if (signedContext) {
+    permissions = signedContext.permissions;
+    roles = signedContext.roles;
+  } else {
+    permissions = parsePermissionHeader(
+      h(RUNTIME_IDENTITY_HEADER_NAMES.permissions)
+    );
+    roles = parsePermissionHeader(h(RUNTIME_IDENTITY_HEADER_NAMES.roles));
+  }
   return {
     requestId,
     productId: signedProductId,
@@ -1429,7 +1547,8 @@ async function verifyRequest(input, deps) {
     timestamp,
     bodyHash: computedBodyHash,
     ...permissions !== void 0 ? { permissions } : {},
-    ...roles !== void 0 ? { roles } : {}
+    ...roles !== void 0 ? { roles } : {},
+    ...signedContext ? { signedContext } : {}
   };
 }
 async function computeBodyHash(input) {
@@ -1464,8 +1583,8 @@ function headerGetter(headers) {
 
 // src/core/runtime.ts
 var DEFAULT_CORE_URL = "https://core.farthershore.com";
-var SDK_VERSION = "0.10.0".length > 0 ? "0.10.0" : "0.0.0-dev";
-var CONTRACTS_FP = "5ac9937372d11da5".length > 0 ? "5ac9937372d11da5" : "0000000000000000";
+var SDK_VERSION = "0.12.0".length > 0 ? "0.12.0" : "0.0.0-dev";
+var CONTRACTS_FP = "220bea90107ed396".length > 0 ? "220bea90107ed396" : "0000000000000000";
 var FartherShore = class {
   bootstrapClient;
   fetchImpl;
@@ -1475,6 +1594,10 @@ var FartherShore = class {
   coreUrl;
   instanceId;
   tunnelOptions;
+  /** FAR-723 — HS256 secret(s) for verifying the signed X-Fs-Context claim. */
+  contextSecrets;
+  /** FAR-723 — "preferred" (fallback to unsigned) | "required" (fail-closed). */
+  contextVerification;
   nonceCache = new NonceCache();
   shutdownManager = new ShutdownManager();
   jwks = null;
@@ -1492,6 +1615,8 @@ var FartherShore = class {
     this.meteringEnabledOverride = options.metering?.enabled ?? true;
     this.tunnelOptions = options.tunnel ?? {};
     this.instanceId = options.instanceId;
+    this.contextSecrets = options.contextSecrets ?? parseContextSecrets(env.FS_CONTEXT_SECRETS);
+    this.contextVerification = options.contextVerification ?? (env.FS_CONTEXT_VERIFICATION === "required" ? "required" : "preferred");
     this.bootstrapClient = new BootstrapClient({
       runtimeToken,
       coreUrl,
@@ -1610,7 +1735,13 @@ var FartherShore = class {
       backendId: config.backend.id,
       knownRouteIds,
       clockSkewSeconds: config.verification.clockSkewSeconds,
-      replayWindowSeconds: config.verification.replayWindowSeconds
+      replayWindowSeconds: config.verification.replayWindowSeconds,
+      // FAR-723 — a VERIFIED signed X-Fs-Context is the preferred (or
+      // required) identity source. Required mode must also fail closed when the
+      // keyring is empty; preferred mode preserves the transitional unsigned
+      // fallback until the backend-v* publish gate removes it.
+      contextSecrets: this.contextSecrets,
+      contextVerification: this.contextVerification
     });
   }
   /** Whether verification is required (bootstrap × opt-out). */
@@ -1701,6 +1832,10 @@ function readProcessEnv() {
   const maybeProcess = globalThis.process;
   return maybeProcess?.env ?? {};
 }
+function parseContextSecrets(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
 
 // src/adapters/express.ts
 var STREAMING_CONTENT_TYPES = new Set(
@@ -1967,6 +2102,7 @@ export {
   nodeSpawn,
   parsePermissionHeader,
   permissionGrants,
+  permissionSatisfies,
   reportHealth,
   requirePermission,
   runtimeErrorToErrorCode,
@@ -1974,6 +2110,7 @@ export {
   signCanonicalString2 as signCanonicalString,
   statusForCode,
   verifyCanonicalSignature2 as verifyCanonicalSignature,
+  verifyContext,
   verifyRequest,
   withUsage
 };

package/dist/types/core/permissions.d.ts

@@ -1,3 +1,4 @@
+import type { FartherShoreSignedContext } from "./verifyContext.js";
 /**
  * Thrown by {@link requirePermission} when the acting user lacks a permission.
  * Distinct from {@link FartherShoreError} (which models signing/verification
@@ -13,36 +14,68 @@ export declare class FartherShorePermissionError extends Error {
 }
 /**
  * Parse the comma-joined `x-fs-permissions` header into a permission list.
- * Returns `undefined` when the header is absent (full-access grace) and `[]`
- * for a present-but-empty header (deny-all — an authenticated user with no
- * grants). Whitespace-trimmed; empty segments dropped.
+ * Returns `undefined` when the header is absent (no permission source ⇒
+ * carrier-level DENY under FAR-723) and `[]` for a present-but-empty header
+ * (deny-all — an authenticated user with no grants). Whitespace-trimmed; empty
+ * segments dropped.
  */
 export declare function parsePermissionHeader(raw: string | null | undefined): string[] | undefined;
 /**
- * Pure grant check. `undefined` permissions (no header) grant everything —
- * this backend SDK's LOCAL policy, parity with the edge treating an absent
- * claim as `["*"]`. Over a DEFINED array the rule is the shared core primitive:
- * a `"*"` entry grants everything, otherwise the key must be an exact member.
+ * Pure grant check — a FAITHFUL COPY of the canonical `permissionGrants` in
+ * `@farthershore/contracts` (`rbac.ts`). Over a DEFINED array: a `"*"` entry
+ * grants everything, otherwise the key must be an exact member. Its
+ * `undefined → true` codomain is the PRIMITIVE's contract (kept byte-identical
+ * to contracts for parity); it is NOT the SDK's carrier policy. Under FAR-723
+ * the carrier gate {@link hasPermission} DENIES an absent permission set before
+ * this primitive is consulted, so absence never grants at the boundary.
  *
- * The defined-array branch is a FAITHFUL COPY of the canonical
- * `permissionGrants` in `@farthershore/contracts` (`rbac.ts`) — the published
- * SDK surface must stay contracts-free, so it can't import it. A TEST-ONLY
- * parity guard (`permissions-parity.test.ts`, which CAN import contracts as a
- * devDependency) asserts this copy agrees with the canonical primitive across a
- * shared golden vector table, so the copy can't silently drift. The
- * `undefined → grant-all` grace is documented here as the SDK's own policy; the
- * shared primitive only covers the defined-array rule.
+ * The published SDK surface must stay contracts-free, so it can't import the
+ * canonical primitive. A TEST-ONLY parity guard (`permissions-parity.test.ts`,
+ * which CAN import contracts as a devDependency) asserts this copy agrees with
+ * the canonical primitive across a shared golden vector table, so the copy
+ * can't silently drift.
  */
 export declare function permissionGrants(permissions: readonly string[] | undefined, key: string): boolean;
+/**
+ * Whether the granted `permissions` satisfy the required `key` under the
+ * unified grammar: `"*"` (global), `"<subject>:*"` (subject wildcard), or the
+ * EXACT key. NO verb-class widening (class forms are expanded to concrete verbs
+ * server-side at save time). Superset of {@link permissionGrants} — it adds the
+ * `<subject>:*` rung. NOTE: the `granted === undefined → true` codomain here is
+ * the PRIMITIVE's contract (kept byte-identical to contracts for parity); it is
+ * NOT the SDK's carrier policy. Callers gate through {@link hasPermission},
+ * which under FAR-723 DENIES an absent permission set before ever reaching this
+ * primitive — so absence never grants at the carrier level.
+ *
+ * FAITHFUL COPY of the canonical `permissionSatisfies` in
+ * `@farthershore/contracts` (`authz/verbs.ts`); the published bundle is
+ * contracts-free, so `permissions-parity.test.ts` asserts agreement over a
+ * shared golden table (with the backend's grace rule tested separately).
+ */
+export declare function permissionSatisfies(required: string, granted: readonly string[] | undefined): boolean;
 /** The subset of a verified context these helpers read. */
 export interface PermissionCarrier {
     permissions?: readonly string[];
+    /** The verified X-Fs-Context claims, when the request carried a valid token. */
+    signedContext?: FartherShoreSignedContext;
 }
 /**
  * True when the acting user holds `key`. Call only with a verified request
  * context ({@link parsePermissionHeader} output lives on `context.permissions`).
  * NOTE: this is a convenience for in-handler gating; the edge `permission`
  * constraint is the security boundary for route-level access.
+ *
+ * FAR-723 FAIL-CLOSED: an ABSENT permission set (`ctx.permissions === undefined`)
+ * DENIES — the reverse of the former grant-all grace — UNLESS the request
+ * carried a cryptographically VERIFIED context token that simply omits the
+ * `perms` claim. Core deliberately mints ORG-actor (and unidentified-user-actor)
+ * `fsc_` tokens with no `perms` claim — RBAC never applies to them, and the edge
+ * `permission` constraint treats a verified claimless token as full access. The
+ * carrier mirrors the edge: verified-but-claimless ⇒ grant; no verified context
+ * AND no permission set ⇒ no trusted permission source ⇒ deny. A DEFINED array
+ * uses the unified {@link permissionSatisfies} rule (`*` / `<subject>:*` /
+ * exact), so an explicit `["*"]` (org OWNER / RBAC-disabled) still grants
+ * everything and `[]` denies.
  */
 export declare function hasPermission(ctx: PermissionCarrier, key: string): boolean;
 /**

package/dist/types/core/runtime.d.ts

@@ -39,6 +39,38 @@ export type FartherShoreInitOptions = {
     tunnel?: FartherShoreTunnelOptions;
     /** SDK metadata forwarded to bootstrap. */
     instanceId?: string;
+    /**
+     * FAR-723 / UA-6 — HS256 secret(s) for verifying the gateway's SIGNED
+     * `X-Fs-Context` claim. These are the GATEWAY CONTEXT-SIGNING keyring values
+     * (`CONTEXT_SIGNING_KEYS_JSON` — the keys `forward-upstream` stamps the
+     * header with; supply every live key during rotation — try-all). They are
+     * NOT the product's `contextTokenSecret`, which signs `fsc_` INGRESS tokens
+     * verified BY the gateway — setting that here would reject every valid
+     * gateway request in `"required"` mode. When present, a VERIFIED context's
+     * `permissions`/`roles` claims are the AUTHORITATIVE identity source
+     * (preferred over the transitional unsigned `x-fs-permissions`/`x-fs-roles`
+     * headers). Defaults to `FS_CONTEXT_SECRETS` (comma-separated) from the env.
+     *
+     * NOTE (core-side dependency, FAR-723 publish gate): no bootstrap field
+     * carries these keys yet, and handing the raw platform keyring to builder
+     * backends is NOT the end-state (it would allow cross-product context
+     * forgery). The distribution mechanism — per-product derived keys or an
+     * asymmetric context signature verified via JWKS like the request
+     * signature — is decided at the FAR-723 gate before the headers retire;
+     * until then this option (or `FS_CONTEXT_SECRETS`) is the manual wiring for
+     * platform-operated deployments.
+     */
+    contextSecrets?: readonly string[];
+    /**
+     * FAR-723 / UA-6 — `"preferred"` (default): a missing/unverifiable signed
+     * context falls back to the transitional unsigned headers.
+     * `"required"`: a missing or invalid signed context REJECTS the request
+     * (fail-closed), including when the context-secret keyring is empty or
+     * unconfigured. Defaults to `FS_CONTEXT_VERIFICATION` from the env, else
+     * `"preferred"`. The unsigned fallback is transitional and is removed after
+     * the backend-v* publish gate.
+     */
+    contextVerification?: "preferred" | "required";
 };
 export declare const SDK_VERSION: string;
 export declare const CONTRACTS_FP: string;
@@ -55,6 +87,10 @@ export declare class FartherShore {
     private readonly coreUrl;
     private readonly instanceId?;
     private readonly tunnelOptions;
+    /** FAR-723 — HS256 secret(s) for verifying the signed X-Fs-Context claim. */
+    private readonly contextSecrets;
+    /** FAR-723 — "preferred" (fallback to unsigned) | "required" (fail-closed). */
+    private readonly contextVerification;
     private readonly nonceCache;
     private readonly shutdownManager;
     private jwks;

package/dist/types/core/verifyContext.d.ts

@@ -0,0 +1,33 @@
+import { FartherShoreError } from "./errors.js";
+/** The signed context payload (claim-format cv=1). */
+export type FartherShoreSignedContext = {
+    /** Claim-format version. This SDK understands cv 1 (and legacy tokens
+     *  without cv, which predate UA-6 and carry no permissions). */
+    cv?: number;
+    orgId: string;
+    actor: {
+        type: string;
+        id: string | null;
+    };
+    productId: string;
+    compiledPlanId: string;
+    subscriptionId: string;
+    subscriberId: string;
+    environmentId: string | null;
+    subjectKey: string;
+    /** UA-6 — the unified-authz permission claim (absent when unminted). */
+    permissions?: string[];
+    /** UA-6 — the bound role keys (absent when unminted). */
+    roles?: string[];
+};
+/**
+ * Verify an `X-Fs-Context` token against one or more HS256 secrets (try-all
+ * for keyring rotation). Returns the typed payload on success, `null` on any
+ * failure (malformed, wrong alg, bad signature, unparseable payload) — the
+ * caller decides whether absence/invalidity is fatal (`required`) or falls
+ * back to the transitional unsigned headers (`preferred`).
+ */
+export declare function verifyContext(token: string, secrets: readonly string[]): Promise<FartherShoreSignedContext | null>;
+/** Thrown by verifyRequest when `contextVerification: "required"` and the
+ *  signed context is missing or fails verification. */
+export declare function contextRequiredError(reason: string): FartherShoreError;

package/dist/types/core/verifyRequest.d.ts

@@ -1,3 +1,4 @@
+import { type FartherShoreSignedContext } from "./verifyContext.js";
 import type { JwksClient } from "./jwks.js";
 import type { NonceCache } from "./nonceCache.js";
 /** Per-request input. `headers` keys are matched case-insensitively. */
@@ -33,13 +34,18 @@ export type FartherShoreRequestContext = {
     meters?: string[];
     features?: Record<string, unknown>;
     /**
-     * Managed-RBAC permissions the gateway resolved for the acting user, from
-     * the UNSIGNED `x-fs-permissions` identity header (trusted transitively on a
-     * verified request — see permissions.ts). `undefined` when the header is
-     * absent (full-access grace); `[]` for an authenticated user with no grants.
-     * Read via {@link hasPermission} / {@link requirePermission}.
+     * Managed-RBAC permissions the gateway resolved for the acting user —
+     * preferred from the VERIFIED signed `X-Fs-Context` claim, else the UNSIGNED
+     * `x-fs-permissions` identity header (both trusted transitively on a verified
+     * request — see permissions.ts). `undefined` when NO permission source was
+     * present ⇒ FAR-723 carrier-level DENY; `[]` for an authenticated user with
+     * no grants. Read via {@link hasPermission} / {@link requirePermission}.
      */
     permissions?: string[];
+    /** UA-6 — the VERIFIED signed context payload, when context secrets are
+     *  configured and the X-Fs-Context token verified. Its permissions/roles
+     *  populated the fields above (signed-preferred). */
+    signedContext?: FartherShoreSignedContext;
     /** Managed-RBAC role keys the acting user holds (display/audit only). */
     roles?: string[];
 };
@@ -60,5 +66,19 @@ export type VerifyRequestDeps = {
     replayWindowSeconds?: number;
     /** Injectable clock (seconds since epoch). */
     nowSeconds?: () => number;
+    /**
+     * UA-6 — HS256 secret(s) for verifying the gateway's SIGNED `X-Fs-Context`
+     * claim (multiple = keyring rotation, try-all). When provided, a VERIFIED
+     * context's `permissions`/`roles` claims are preferred over the
+     * transitional unsigned identity headers.
+     */
+    contextSecrets?: readonly string[];
+    /**
+     * UA-6 — `"preferred"` (default): a missing/unverifiable signed context
+     * falls back to the unsigned headers. `"required"`: missing or invalid
+     * signed context REJECTS the request (fail-closed) — set this once your
+     * gateway config has context signing enabled.
+     */
+    contextVerification?: "preferred" | "required";
 };
 export declare function verifyRequest(input: VerifyRequestInput, deps: VerifyRequestDeps): Promise<FartherShoreRequestContext>;

package/dist/types/generated/runtime-contract.d.ts

@@ -136,6 +136,7 @@ export declare const RUNTIME_ERROR_CODES: {
     readonly environmentMismatch: "environment_mismatch";
     readonly missingToken: "missing_token";
     readonly invalidToken: "invalid_token";
+    readonly contextUnverified: "context_unverified";
 };
 export type RuntimeErrorCode = (typeof RUNTIME_ERROR_CODES)[keyof typeof RUNTIME_ERROR_CODES];
 export declare const RUNTIME_METERING_CONTRACT: {

package/dist/types/index.d.ts

@@ -4,7 +4,9 @@ export { FartherShore } from "./core/runtime.js";
 export type { FartherShoreInitOptions } from "./core/runtime.js";
 export { FartherShoreError, statusForCode } from "./core/errors.js";
 export { verifyRequest, type VerifyRequestInput, type VerifyRequestDeps, type FartherShoreRequestContext, type HeadersLike, } from "./core/verifyRequest.js";
-export { hasPermission, requirePermission, permissionGrants, parsePermissionHeader, FartherShorePermissionError, IDENTITY_HEADER_NAMES, type PermissionCarrier, } from "./core/permissions.js";
+export { verifyContext } from "./core/verifyContext.js";
+export type { FartherShoreSignedContext } from "./core/verifyContext.js";
+export { hasPermission, requirePermission, permissionGrants, permissionSatisfies, parsePermissionHeader, FartherShorePermissionError, IDENTITY_HEADER_NAMES, type PermissionCarrier, } from "./core/permissions.js";
 export { JwksClient, type Jwk, type JwksClientOptions } from "./core/jwks.js";
 export { NonceCache, type NonceCacheOptions } from "./core/nonceCache.js";
 export { BootstrapClient, type BootstrapClientOptions, } from "./core/bootstrap.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farthershore/backend",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Farther Shore backend SDK for builder upstreams: signed response usage, fail-closed gateway request verification, health, and lifecycle from FS_RUNTIME_TOKEN",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,9 +33,9 @@
   },
   "optionalDependencies": {
     "@farthershore/cloudflared-linux-x64": "0.0.0",
+    "@farthershore/cloudflared-linux-arm64": "0.0.0",
     "@farthershore/cloudflared-darwin-arm64": "0.0.0",
-    "@farthershore/cloudflared-darwin-x64": "0.0.0",
-    "@farthershore/cloudflared-linux-arm64": "0.0.0"
+    "@farthershore/cloudflared-darwin-x64": "0.0.0"
   },
   "peerDependencies": {
     "express": "^4.0.0 || ^5.0.0"
@@ -53,7 +53,7 @@
     "typescript": "^6.0.2",
     "typescript-eslint": "^8.59.0",
     "vitest": "^4.1.6",
-    "@farthershore/contracts": "0.61.1"
+    "@farthershore/contracts": "0.62.0"
   },
   "engines": {
     "node": ">=22"