@keystrokehq/platform 0.0.120 → 0.0.121

package/dist/run.cjs

@@ -1,5 +1,5 @@
 const require_config = require("./config.cjs");
-const require_start = require("./start-DTky6Eom.cjs");
+const require_start = require("./start-CP-3N24R.cjs");
 //#region src/run.ts
 async function main() {
 	await require_start.startPlatformServer(require_config.definePlatformConfig());

package/dist/run.mjs

@@ -1,5 +1,5 @@
 import { definePlatformConfig } from "./config.mjs";
-import { t as startPlatformServer } from "./start-3-EHSg3p.mjs";
+import { t as startPlatformServer } from "./start-CGgykWD2.mjs";
 //#region src/run.ts
 async function main() {
 	await startPlatformServer(definePlatformConfig());

package/dist/{start-3-EHSg3p.mjs → start-CGgykWD2.mjs}

@@ -1170,7 +1170,7 @@ function createRemoteJWKSet(url, options) {
 	return remoteJWKSet;
 }
 //#endregion
-//#region ../../packages/auth/dist/jwt-jroYvvqz.mjs
+//#region ../../packages/auth/dist/jwt-BVJ7dVm9.mjs
 /** OAuth device-flow client id for `keystroke auth login`. */
 const CLI_CLIENT_ID = "keystroke-cli";
 const jwksCache = /* @__PURE__ */ new Map();
@@ -1250,6 +1250,13 @@ async function resolveRequestAuth(jwtVerifier, headers) {
 		session: sessionFromJwt(jwtUser, bearerToken)
 	};
 }
+/** Auth API origin for JWT verification — platform URL when auth is mounted there. */
+function resolveAuthApiBaseUrl() {
+	return (process.env.PUBLIC_PLATFORM_URL ?? process.env.PUBLIC_WEB_URL ?? "").replace(/\/+$/, "");
+}
+function createDefaultAuthJwtVerifier() {
+	return createAuthJwtVerifier(resolveAuthApiBaseUrl());
+}
 function createAuthJwtVerifier(authBaseUrl) {
 	const normalizedBaseUrl = authBaseUrl.replace(/\/+$/, "");
 	if (!normalizedBaseUrl) return;
@@ -1438,8 +1445,8 @@ function createAuthInstance(options) {
 function createAuth(options = {}) {
 	const secret = options.secret ?? process.env.BETTER_AUTH_SECRET;
 	if (!secret) return;
-	const baseURL = options.baseURL ?? process.env.PUBLIC_WEB_URL;
-	if (!baseURL) throw new Error("PUBLIC_WEB_URL is required when auth is enabled");
+	const baseURL = options.baseURL ?? process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "") ?? process.env.PUBLIC_WEB_URL;
+	if (!baseURL) throw new Error("PUBLIC_PLATFORM_URL or PUBLIC_WEB_URL is required when auth is enabled");
 	return createAuthInstance({
 		...options,
 		secret,
@@ -1683,7 +1690,7 @@ function routeProject(project) {
 //#endregion
 //#region src/auth/require-session.ts
 function requireSession(jwtVerifier) {
-	const verifier = jwtVerifier ?? createAuthJwtVerifier(process.env.PUBLIC_WEB_URL ?? "");
+	const verifier = jwtVerifier ?? createDefaultAuthJwtVerifier();
 	return async (c, next) => {
 		const result = await resolveRequestAuth(verifier, c.req.raw.headers);
 		if (!result) return c.json({ error: "Unauthorized" }, 401);
@@ -2277,7 +2284,7 @@ function mountAccountRoutes(options) {
 	const account = new Hono();
 	const orgScoped = new Hono();
 	const projectScoped = new Hono();
-	const protect = requireSession(createAuthJwtVerifier(process.env.PUBLIC_WEB_URL ?? ""));
+	const protect = requireSession(createDefaultAuthJwtVerifier());
 	account.use("/*", protect);
 	orgScoped.use("/*", protect);
 	orgScoped.use("/*", requireOrganization());
@@ -2616,11 +2623,11 @@ function manifestTriggerEntries(manifest) {
 	}
 	return entries;
 }
-function createIntegrationServices(platformOrigin, webOrigin) {
+function createIntegrationServices(platformOrigin) {
 	const tokenRefresh = createOAuthTokenRefreshRegistry();
 	const oauthAdapter = createOAuthTokenAdapterFromBackend(createLocalCredentialBackend({ tokenRefresh }));
 	const oauthRedirectOrigin = platformApiOrigin(platformOrigin);
-	const jwtVerifier = webOrigin ? createAuthJwtVerifier(webOrigin) : void 0;
+	const jwtVerifier = createDefaultAuthJwtVerifier();
 	return {
 		tokenRefresh,
 		oauthAdapter,
@@ -2659,8 +2666,7 @@ function createIntegrationServices(platformOrigin, webOrigin) {
 */
 async function mountOAuthCallbacks() {
 	const platformOrigin = process.env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "");
-	const webOrigin = process.env.PUBLIC_WEB_URL?.replace(/\/$/, "");
-	const { tokenRefresh, services: baseServices } = createIntegrationServices(platformOrigin, webOrigin);
+	const { tokenRefresh, services: baseServices } = createIntegrationServices(platformOrigin);
 	const callbacks = new Hono();
 	await mountProjectIntegrations({
 		app: callbacks,
@@ -2690,8 +2696,7 @@ async function mountOAuthCallbacks() {
 async function mountRuntimeRoutes() {
 	const api = new Hono();
 	const platformOrigin = process.env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "");
-	const webOrigin = process.env.PUBLIC_WEB_URL?.replace(/\/$/, "");
-	const { tokenRefresh, jwtVerifier, services: baseServices } = createIntegrationServices(platformOrigin, webOrigin);
+	const { tokenRefresh, jwtVerifier, services: baseServices } = createIntegrationServices(platformOrigin);
 	const protect = requireSession(jwtVerifier);
 	api.use("/*", protect);
 	api.use("/*", requireOrganization());
@@ -3244,8 +3249,10 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 	} });
 	const webUrl = process.env.PUBLIC_WEB_URL;
 	if (!webUrl) throw new Error("PUBLIC_WEB_URL is required for the platform server");
+	const platformUrl = process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "");
+	if (!platformUrl) throw new Error("PUBLIC_PLATFORM_URL is required for the platform server");
 	const auth = createAuth({
-		baseURL: webUrl,
+		baseURL: platformUrl,
 		verificationUri: `${webUrl.replace(/\/+$/, "")}/device`,
 		trustedOrigins: [webUrl]
 	});
@@ -3268,4 +3275,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { startPlatformServer as t };
 
-//# sourceMappingURL=start-3-EHSg3p.mjs.map
+//# sourceMappingURL=start-CGgykWD2.mjs.map