@keystrokehq/platform 0.0.120 → 0.0.122

package/dist/run.cjs

@@ -1,5 +1,5 @@
 const require_config = require("./config.cjs");
-const require_start = require("./start-DTky6Eom.cjs");
+const require_start = require("./start-B7tYhvDm.cjs");
 //#region src/run.ts
 async function main() {
 	await require_start.startPlatformServer(require_config.definePlatformConfig());

package/dist/run.mjs

@@ -1,5 +1,5 @@
 import { definePlatformConfig } from "./config.mjs";
-import { t as startPlatformServer } from "./start-3-EHSg3p.mjs";
+import { t as startPlatformServer } from "./start-DfVTA4cX.mjs";
 //#region src/run.ts
 async function main() {
 	await startPlatformServer(definePlatformConfig());

package/dist/{start-DTky6Eom.cjs → start-B7tYhvDm.cjs}

@@ -1170,7 +1170,7 @@ function createRemoteJWKSet(url, options) {
 	return remoteJWKSet;
 }
 //#endregion
-//#region ../../packages/auth/dist/jwt-jroYvvqz.mjs
+//#region ../../packages/auth/dist/jwt-BVJ7dVm9.mjs
 /** OAuth device-flow client id for `keystroke auth login`. */
 const CLI_CLIENT_ID = "keystroke-cli";
 const jwksCache = /* @__PURE__ */ new Map();
@@ -1250,6 +1250,13 @@ async function resolveRequestAuth(jwtVerifier, headers) {
 		session: sessionFromJwt(jwtUser, bearerToken)
 	};
 }
+/** Auth API origin for JWT verification — platform URL when auth is mounted there. */
+function resolveAuthApiBaseUrl() {
+	return (process.env.PUBLIC_PLATFORM_URL ?? process.env.PUBLIC_WEB_URL ?? "").replace(/\/+$/, "");
+}
+function createDefaultAuthJwtVerifier() {
+	return createAuthJwtVerifier(resolveAuthApiBaseUrl());
+}
 function createAuthJwtVerifier(authBaseUrl) {
 	const normalizedBaseUrl = authBaseUrl.replace(/\/+$/, "");
 	if (!normalizedBaseUrl) return;
@@ -1438,8 +1445,8 @@ function createAuthInstance(options) {
 function createAuth(options = {}) {
 	const secret = options.secret ?? process.env.BETTER_AUTH_SECRET;
 	if (!secret) return;
-	const baseURL = options.baseURL ?? process.env.PUBLIC_WEB_URL;
-	if (!baseURL) throw new Error("PUBLIC_WEB_URL is required when auth is enabled");
+	const baseURL = options.baseURL ?? process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "") ?? process.env.PUBLIC_WEB_URL;
+	if (!baseURL) throw new Error("PUBLIC_PLATFORM_URL or PUBLIC_WEB_URL is required when auth is enabled");
 	return createAuthInstance({
 		...options,
 		secret,
@@ -1683,7 +1690,7 @@ function routeProject(project) {
 //#endregion
 //#region src/auth/require-session.ts
 function requireSession(jwtVerifier) {
-	const verifier = jwtVerifier ?? createAuthJwtVerifier(process.env.PUBLIC_WEB_URL ?? "");
+	const verifier = jwtVerifier ?? createDefaultAuthJwtVerifier();
 	return async (c, next) => {
 		const result = await resolveRequestAuth(verifier, c.req.raw.headers);
 		if (!result) return c.json({ error: "Unauthorized" }, 401);
@@ -2277,7 +2284,7 @@ function mountAccountRoutes(options) {
 	const account = new hono.Hono();
 	const orgScoped = new hono.Hono();
 	const projectScoped = new hono.Hono();
-	const protect = requireSession(createAuthJwtVerifier(process.env.PUBLIC_WEB_URL ?? ""));
+	const protect = requireSession(createDefaultAuthJwtVerifier());
 	account.use("/*", protect);
 	orgScoped.use("/*", protect);
 	orgScoped.use("/*", requireOrganization());
@@ -2616,11 +2623,11 @@ function manifestTriggerEntries(manifest) {
 	}
 	return entries;
 }
-function createIntegrationServices(platformOrigin, webOrigin) {
+function createIntegrationServices(platformOrigin) {
 	const tokenRefresh = require_dist$2.createOAuthTokenRefreshRegistry();
 	const oauthAdapter = require_dist$2.createOAuthTokenAdapterFromBackend(require_dist$2.createLocalCredentialBackend({ tokenRefresh }));
 	const oauthRedirectOrigin = platformApiOrigin(platformOrigin);
-	const jwtVerifier = webOrigin ? createAuthJwtVerifier(webOrigin) : void 0;
+	const jwtVerifier = createDefaultAuthJwtVerifier();
 	return {
 		tokenRefresh,
 		oauthAdapter,
@@ -2659,8 +2666,7 @@ function createIntegrationServices(platformOrigin, webOrigin) {
 */
 async function mountOAuthCallbacks() {
 	const platformOrigin = process.env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "");
-	const webOrigin = process.env.PUBLIC_WEB_URL?.replace(/\/$/, "");
-	const { tokenRefresh, services: baseServices } = createIntegrationServices(platformOrigin, webOrigin);
+	const { tokenRefresh, services: baseServices } = createIntegrationServices(platformOrigin);
 	const callbacks = new hono.Hono();
 	await require_dist$2.mountProjectIntegrations({
 		app: callbacks,
@@ -2690,8 +2696,7 @@ async function mountOAuthCallbacks() {
 async function mountRuntimeRoutes() {
 	const api = new hono.Hono();
 	const platformOrigin = process.env.PUBLIC_PLATFORM_URL?.replace(/\/$/, "");
-	const webOrigin = process.env.PUBLIC_WEB_URL?.replace(/\/$/, "");
-	const { tokenRefresh, jwtVerifier, services: baseServices } = createIntegrationServices(platformOrigin, webOrigin);
+	const { tokenRefresh, jwtVerifier, services: baseServices } = createIntegrationServices(platformOrigin);
 	const protect = requireSession(jwtVerifier);
 	api.use("/*", protect);
 	api.use("/*", requireOrganization());
@@ -3179,7 +3184,8 @@ async function createApp(auth, options) {
 			"Content-Type",
 			"Authorization",
 			require_dist.ACTIVE_ORG_HEADER
-		]
+		],
+		maxAge: 86400
 	}));
 	mountAuth(app, auth);
 	app.route("/api/projects", mountWebhookRoutes());
@@ -3244,8 +3250,10 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 	} });
 	const webUrl = process.env.PUBLIC_WEB_URL;
 	if (!webUrl) throw new Error("PUBLIC_WEB_URL is required for the platform server");
+	const platformUrl = process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "");
+	if (!platformUrl) throw new Error("PUBLIC_PLATFORM_URL is required for the platform server");
 	const auth = createAuth({
-		baseURL: webUrl,
+		baseURL: platformUrl,
 		verificationUri: `${webUrl.replace(/\/+$/, "")}/device`,
 		trustedOrigins: [webUrl]
 	});
@@ -3273,4 +3281,4 @@ Object.defineProperty(exports, "startPlatformServer", {
 	}
 });
 
-//# sourceMappingURL=start-DTky6Eom.cjs.map
+//# sourceMappingURL=start-B7tYhvDm.cjs.map