@oxy.so/core 7.16.0 → 7.17.0

package/dist/esm/server/callerAccess.js

@@ -0,0 +1,145 @@
+/**
+ * The person behind a request, in an Oxy account and over an Oxy application:
+ * `OxyServer.accountAccessFor` and `OxyServer.applicationAccessFor`.
+ *
+ * Both read Oxy with the request's OWN verified bearer (an `OxyUserClient`),
+ * so Oxy resolves the HUMAN operator from the session — a person acting as
+ * their organization is answered for themselves — with inheritance, per-member
+ * grants and revokes applied. Nothing else the client sends is consulted.
+ *
+ * ```ts
+ * // Can the caller update this store (an Oxy account) in my app?
+ * const access = await oxy.accountAccessFor(req, storeAccountId, { fresh: true });
+ * if (!access.has('account:update')) throw new OxyAccessError('ACCESS_DENIED', '…');
+ *
+ * // Can the caller manage webhooks of application A (developer RBAC)?
+ * const app = await oxy.applicationAccessFor(req, applicationId);
+ * if (!app.has('webhooks:update')) …
+ * ```
+ *
+ * Which reader answers which question is in `./callerAuthority`; the short
+ * version: `appPermissionsFor` is about THIS backend's own declared operator
+ * keys, `applicationAccessFor` about any application through the account that
+ * owns it, `accountAccessFor` about an account. For work with no person
+ * present (a background import), `oxy.accounts.accessFor(accountId, userId)`
+ * asks with the service's own token instead.
+ *
+ * Node only; reachable solely from `@oxy.so/core/server`.
+ */
+import { accountAccessGrantSchema, } from '@oxy.so/contracts';
+import { accessFailure, CallerAuthorityCache, OxyAccessError, permissionSet, readCallerSession, } from './callerAuthority.js';
+function callerSession(req) {
+    const caller = readCallerSession(req);
+    if (caller.ok)
+        return caller.session;
+    throw new OxyAccessError('ACCESS_SESSION_REQUIRED', caller.reason === 'service'
+        ? 'This request is authenticated by a service token; account and application access belong to a person in a session'
+        : 'No verified user session on this request; mount middleware.auth() first');
+}
+function requireId(id, what) {
+    if (typeof id !== 'string' || id.trim() === '') {
+        throw new TypeError(`${what} must be a non-empty string`);
+    }
+    return id;
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string')
+        ? value
+        : null;
+}
+const RELATIONSHIPS = ['self', 'owner', 'member'];
+/** `GET /accounts/:id` → the caller's effective access, or `null` for a malformed answer. */
+export function parseAccountAccess(accountId, answer) {
+    const node = record(answer);
+    if (!node || node.accountId !== accountId)
+        return null;
+    const relationship = node.relationship;
+    if (!RELATIONSHIPS.includes(relationship) || typeof node.kind !== 'string')
+        return null;
+    const grant = accountAccessGrantSchema.safeParse(node.callerAccess);
+    if (!grant.success)
+        return null;
+    return Object.freeze({
+        accountId,
+        kind: node.kind,
+        relationship,
+        role: grant.data.role,
+        source: grant.data.source,
+        ...permissionSet(grant.data.permissions),
+    });
+}
+/** `GET /applications/:id` → the caller's access over it, or `null` for a malformed answer. */
+export function parseApplicationAccess(applicationId, answer) {
+    const application = record(answer);
+    if (!application || application._id !== applicationId)
+        return null;
+    const ownerAccountId = application.ownerAccountId;
+    const membership = record(application.callerMembership);
+    const permissions = stringArray(membership?.permissions);
+    if (typeof ownerAccountId !== 'string' ||
+        ownerAccountId === '' ||
+        typeof application.isOfficial !== 'boolean' ||
+        !membership ||
+        typeof membership.role !== 'string' ||
+        membership.role === '' ||
+        membership.ownerAccountId !== ownerAccountId ||
+        !permissions) {
+        return null;
+    }
+    return Object.freeze({
+        applicationId,
+        ownerAccountId,
+        official: application.isOfficial,
+        role: membership.role,
+        ...permissionSet(permissions),
+    });
+}
+/** The caches and lookups behind `accountAccessFor` / `applicationAccessFor`. One per server. */
+export class OxyCallerAccessResolver {
+    constructor(host) {
+        this.host = host;
+        this.accounts = new CallerAuthorityCache(host.ttlMs);
+        this.applications = new CallerAuthorityCache(host.ttlMs);
+    }
+    async account(req, accountId, options = {}) {
+        const id = requireId(accountId, 'accountId');
+        const session = callerSession(req);
+        return this.accounts.read([id], session, options.fresh === true, async () => {
+            const answer = await this.host
+                .readAccount(id, session.accessToken)
+                .catch((error) => {
+                throw accessFailure(error, `account ${id}`);
+            });
+            const access = parseAccountAccess(id, answer);
+            if (!access) {
+                throw new OxyAccessError('ACCESS_UNAVAILABLE', `Oxy answered account ${id} without the caller's access`);
+            }
+            return access;
+        });
+    }
+    async application(req, applicationId, options = {}) {
+        const id = requireId(applicationId, 'applicationId');
+        const session = callerSession(req);
+        return this.applications.read([id], session, options.fresh === true, async () => {
+            const answer = await this.host
+                .readApplication(id, session.accessToken)
+                .catch((error) => {
+                throw accessFailure(error, `application ${id}`);
+            });
+            const access = parseApplicationAccess(id, answer);
+            if (!access) {
+                throw new OxyAccessError('ACCESS_UNAVAILABLE', `Oxy answered application ${id} without the caller's access`);
+            }
+            return access;
+        });
+    }
+    invalidate(filter = {}) {
+        this.accounts.invalidate(filter);
+        this.applications.invalidate(filter);
+    }
+}

package/dist/esm/server/callerAuthority.js

@@ -0,0 +1,194 @@
+/**
+ * What every "may the person behind this request …?" read on `OxyServer`
+ * shares: which requests carry a person at all, the one failure type and its
+ * status mapping, the response envelope, and the positive-only answer cache.
+ *
+ * The readers built on it answer different questions — keep them apart:
+ *
+ * | Question | Reader |
+ * |---|---|
+ * | Does this person hold one of MY application's declared operator keys (`payments.operate`)? | `appPermissionsFor` (`./appPermissions`) |
+ * | What may this person do in Oxy account X (an organization, store, channel)? | `accountAccessFor` (`./callerAccess`) |
+ * | What may this person do to application A, through the account that owns it (`app:read`, `app:update`)? | `applicationAccessFor` (`./callerAccess`) |
+ *
+ * ## The outcome mapping, and why an outage is never a "no"
+ *
+ * Every reader asks Oxy with the request's OWN verified bearer and maps the
+ * answer the same way: a 401 means the session is gone (sign in again); a 403
+ * or 404 is Oxy's definitive refusal; anything else — a 5xx, a timeout, a
+ * malformed body — is UNAVAILABLE, answered 503. Only a positive answer is
+ * cached, so a blip can never be remembered as a refusal, and a refusal is
+ * never remembered at all (the next request asks again).
+ *
+ * Node only; reachable solely from `@oxy.so/core/server`.
+ */
+/** Entries kept per reader; the oldest goes first. */
+const CALLER_AUTHORITY_CACHE_MAX = 1000;
+/**
+ * The person behind `req`, or why there is none: `service` for a request
+ * authenticated by a service token (delegated or not — its bearer is the
+ * service's, never the person's), `missing` when `middleware.auth()` resolved
+ * no user session.
+ */
+export function readCallerSession(req) {
+    if (req.serviceApp)
+        return { ok: false, reason: 'service' };
+    const { userId, sessionId, accessToken } = req;
+    if (typeof userId !== 'string' ||
+        userId.length === 0 ||
+        typeof sessionId !== 'string' ||
+        sessionId.length === 0 ||
+        typeof accessToken !== 'string' ||
+        !isBearerToken(accessToken)) {
+        return { ok: false, reason: 'missing' };
+    }
+    return { ok: true, session: { userId, sessionId, accessToken } };
+}
+/** A bearer that can be put in an `Authorization` header unchanged. */
+export function isBearerToken(token) {
+    return token.length > 0 && !/\s/.test(token);
+}
+/** The typed failure of `asUser`, `accountAccessFor`, `applicationAccessFor` and their middleware. */
+export class OxyAccessError extends Error {
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'OxyAccessError';
+        this.code = code;
+        this.permission = options.permission;
+        this.cause = options.cause;
+    }
+}
+/**
+ * The status for an {@link OxyAccessError}: `deny` (default `403`) for a
+ * refusal; `401` for no session (`404` when `deny` is `404`, so a hidden
+ * surface stays hidden from the signed-out too); `503` when Oxy could not say.
+ */
+export function accessErrorStatus(error, deny = 403) {
+    switch (error.code) {
+        case 'ACCESS_DENIED':
+            return deny;
+        case 'ACCESS_SESSION_REQUIRED':
+            return deny === 404 ? 404 : 401;
+        case 'ACCESS_UNAVAILABLE':
+            return 503;
+    }
+}
+/** The response body for a status: the API error envelope (`docs/api-conventions.md`). */
+export function authorityErrorBody(status) {
+    switch (status) {
+        case 401:
+            return { error: { code: 'unauthorized', message: 'Authentication required' } };
+        case 403:
+            return { error: { code: 'forbidden', message: 'Not permitted' } };
+        case 404:
+            return { error: { code: 'not_found', message: 'Not found' } };
+        case 503:
+            return { error: { code: 'service_unavailable', message: 'Temporarily unavailable' } };
+        default:
+            return { error: { code: 'internal_error', message: 'Internal error' } };
+    }
+}
+/** The HTTP status an `OxyApiError` (or anything shaped like one) carries. */
+export function errorStatus(error) {
+    const status = error?.status;
+    return typeof status === 'number' ? status : undefined;
+}
+/**
+ * Map a failed caller-bearer read of Oxy to its outcome: 401 → session
+ * required, 403/404 → denied, everything else → unavailable.
+ */
+export function accessFailure(error, what) {
+    const status = errorStatus(error);
+    if (status === 401) {
+        return new OxyAccessError('ACCESS_SESSION_REQUIRED', `Oxy refused the session reading ${what}`, {
+            cause: error,
+        });
+    }
+    if (status === 403 || status === 404) {
+        return new OxyAccessError('ACCESS_DENIED', `Oxy refused ${what} to this session`, {
+            cause: error,
+        });
+    }
+    return new OxyAccessError('ACCESS_UNAVAILABLE', `Could not read ${what} from Oxy`, {
+        cause: error,
+    });
+}
+/**
+ * The positive-only answer cache one caller-authority reader keeps, keyed by
+ * (resource, session, person). Concurrent identical reads share one lookup; a
+ * `fresh` read skips the cache and refreshes it; a slower, OLDER answer never
+ * overwrites a newer one (the newer may be the fresh read that saw a
+ * revocation); a failure is never stored.
+ */
+export class CallerAuthorityCache {
+    /**
+     * @param ttlMs How long an answer is reused; `0` disables the cache.
+     * @param isAbout Whether a cached answer concerns `userId` beyond the
+     *   session's own user (an application-permissions answer names the
+     *   resolved operator), for {@link invalidate}.
+     */
+    constructor(ttlMs, isAbout = () => false) {
+        this.ttlMs = ttlMs;
+        this.isAbout = isAbout;
+        this.entries = new Map();
+        this.pending = new Map();
+    }
+    async read(resourceKey, session, fresh, lookup) {
+        const key = JSON.stringify([...resourceKey, session.sessionId, session.userId]);
+        const ttl = this.ttlMs;
+        if (!fresh && ttl > 0) {
+            const cached = this.entries.get(key);
+            if (cached && cached.expiresAt > Date.now())
+                return cached.value;
+            const inFlight = this.pending.get(key);
+            if (inFlight)
+                return inFlight;
+        }
+        const startedAt = Date.now();
+        const answer = lookup().then((value) => {
+            if (ttl > 0)
+                this.remember(key, session.userId, value, startedAt, ttl);
+            return value;
+        });
+        if (fresh || ttl <= 0)
+            return answer;
+        this.pending.set(key, answer);
+        try {
+            return await answer;
+        }
+        finally {
+            if (this.pending.get(key) === answer)
+                this.pending.delete(key);
+        }
+    }
+    /** Forget every answer, or those about one person. */
+    invalidate(filter = {}) {
+        const { userId } = filter;
+        if (!userId) {
+            this.entries.clear();
+            return;
+        }
+        for (const [key, entry] of this.entries) {
+            if (entry.userId === userId || this.isAbout(entry.value, userId))
+                this.entries.delete(key);
+        }
+    }
+    remember(key, userId, value, startedAt, ttl) {
+        const existing = this.entries.get(key);
+        if (existing && existing.startedAt > startedAt)
+            return;
+        this.entries.delete(key);
+        this.entries.set(key, { value, userId, startedAt, expiresAt: startedAt + ttl });
+        if (this.entries.size > CALLER_AUTHORITY_CACHE_MAX) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest !== undefined)
+                this.entries.delete(oldest);
+        }
+    }
+}
+/** A frozen, sorted permission set with `has`. */
+export function permissionSet(permissions) {
+    const sorted = Object.freeze([...new Set(permissions)].sort());
+    const held = new Set(sorted);
+    return { permissions: sorted, has: (permission) => held.has(permission) };
+}

package/dist/esm/server/capabilityTicket.js

@@ -41,7 +41,7 @@ export function issueCapabilityTicket(claims, options) {
     const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`;
     return `${signingInput}.${base64UrlEncode(signBytes(null, Buffer.from(signingInput), options.privateKey))}`;
 }
-export function verifyCapabilityTicket(token, options) {
+function parseCapabilityTicket(token) {
     const segments = token.split('.');
     if (segments.length !== 3) {
         throw new CapabilityTicketError('malformed', 'Capability ticket must have three segments');
@@ -62,21 +62,29 @@ export function verifyCapabilityTicket(token, options) {
         headerRecord.kid.length === 0) {
         throw new CapabilityTicketError('malformed', 'Capability ticket header is not supported');
     }
-    const publicKey = options.resolvePublicKey(headerRecord.kid);
+    return {
+        keyId: headerRecord.kid,
+        signingInput: `${encodedHeader}.${encodedPayload}`,
+        encodedPayload,
+        encodedSignature,
+    };
+}
+/** Signature and claims of a parsed ticket against the key its `kid` resolved to. */
+function checkCapabilityTicket(ticket, publicKey, options) {
     if (!publicKey || publicKey.asymmetricKeyType !== 'ed25519') {
         throw new CapabilityTicketError('unknown_key', 'Capability ticket signing key is not trusted');
     }
     let providedSignature;
     try {
-        providedSignature = Buffer.from(encodedSignature, 'base64url');
+        providedSignature = Buffer.from(ticket.encodedSignature, 'base64url');
     }
     catch {
         throw new CapabilityTicketError('malformed', 'Capability ticket signature is malformed');
     }
-    if (!verifyBytes(null, Buffer.from(`${encodedHeader}.${encodedPayload}`), publicKey, providedSignature)) {
+    if (!verifyBytes(null, Buffer.from(ticket.signingInput), publicKey, providedSignature)) {
         throw new CapabilityTicketError('invalid_signature', 'Capability ticket signature is invalid');
     }
-    const parsed = capabilityTicketClaimsSchema.safeParse(decodeJsonSegment(encodedPayload));
+    const parsed = capabilityTicketClaimsSchema.safeParse(decodeJsonSegment(ticket.encodedPayload));
     if (!parsed.success) {
         throw new CapabilityTicketError('invalid_claims', 'Capability ticket claims are invalid');
     }
@@ -99,6 +107,30 @@ export function verifyCapabilityTicket(token, options) {
     }
     return claims;
 }
+export function verifyCapabilityTicket(token, options) {
+    const ticket = parseCapabilityTicket(token);
+    return checkCapabilityTicket(ticket, options.resolvePublicKey(ticket.keyId), options);
+}
+/**
+ * A verifier for one ticket whose key lookup may be asynchronous: the key is
+ * resolved once, and the returned `check` re-verifies signature and claims
+ * against it (the live verifier checks again after introspection, so a slow
+ * authority answer cannot outlive the ticket).
+ *
+ * @internal Shared by the middleware and `createLiveCapabilityTicketVerifier`.
+ */
+export async function resolveCapabilityTicketKey(token, options) {
+    const ticket = parseCapabilityTicket(token);
+    let publicKey;
+    try {
+        publicKey = await options.resolvePublicKey(ticket.keyId);
+    }
+    catch {
+        // A key set that cannot be read trusts no key; never a different error class.
+        publicKey = undefined;
+    }
+    return { check: () => checkCapabilityTicket(ticket, publicKey, options) };
+}
 export function readCapabilityAuthorization(authorization) {
     if (!authorization)
         return null;
@@ -121,7 +153,7 @@ export function createCapabilityTicketMiddleware(options) {
         }
         let claims;
         try {
-            claims = verifyCapabilityTicket(token, options);
+            claims = (await resolveCapabilityTicketKey(token, options)).check();
         }
         catch (error) {
             const code = error instanceof CapabilityTicketError ? error.code : 'invalid_claims';

package/dist/esm/server/cors.js

@@ -158,6 +158,43 @@ export function matchesAllowedOrigin(explicit, origin) {
         return true;
     return isOxyFamilyOrigin(normalized);
 }
+/**
+ * The origin predicate `createOxyCors` applies, for any other transport that
+ * must admit the same browsers: the built-in HTTPS Oxy apex family plus the
+ * exact `appOrigins`, never an opaque origin (`exp://`, `file:`, …).
+ *
+ * ```ts
+ * const allowed = createOxyOriginCheck(['https://app.example.com']);
+ * allowed('https://mention.oxy.so'); // true
+ * ```
+ */
+export function createOxyOriginCheck(appOrigins = []) {
+    const explicit = normalizeAppOrigins(appOrigins);
+    return (origin) => matchesAllowedOrigin(explicit, origin);
+}
+/**
+ * The Socket.IO server options that admit exactly the origins `createOxyCors`
+ * admits — spread them into `new Server(httpServer, { ...createOxySocketCors(…) })`.
+ *
+ * Two halves, because Socket.IO has two transports: `cors` answers the
+ * long-polling requests (which browsers check), and `allowRequest` refuses a
+ * handshake from any other browser origin, which is the only check a WebSocket
+ * upgrade gets — browsers apply no CORS to it. A request with no `Origin`
+ * header (a native app, a server) is not a browser cross-origin request and is
+ * admitted; authenticate it with `oxy.middleware.socket()` as every socket.
+ */
+export function createOxySocketCors(options = {}) {
+    const allowed = createOxyOriginCheck(options.appOrigins);
+    const admits = (origin) => origin === undefined || (typeof origin === 'string' && (origin === '' || allowed(origin)));
+    return {
+        cors: {
+            origin: (origin, callback) => callback(null, admits(origin)),
+            credentials: options.allowCredentials ?? true,
+            methods: ['GET', 'POST'],
+        },
+        allowRequest: (req, callback) => callback(null, admits(req.headers.origin)),
+    };
+}
 /**
  * Create a strict Oxy CORS middleware. See module docs.
  *
@@ -168,7 +205,7 @@ export function matchesAllowedOrigin(explicit, origin) {
  */
 export function createOxyCors(options = {}) {
     const { appOrigins = [], allowCredentials = true, methods = DEFAULT_ALLOWED_METHODS, allowedHeaders = DEFAULT_ALLOWED_HEADERS, exposedHeaders = [], maxAgeSeconds = DEFAULT_MAX_AGE_SECONDS, } = options;
-    const explicitOrigins = normalizeAppOrigins(appOrigins);
+    const allowed = createOxyOriginCheck(appOrigins);
     const methodsHeader = methods.join(', ');
     const allowedHeadersHeader = allowedHeaders.join(', ');
     const exposedHeadersHeader = exposedHeaders.join(', ');
@@ -186,7 +223,7 @@ export function createOxyCors(options = {}) {
         }
         // Origin is present. Caching correctness: this response varies by Origin.
         res.setHeader('Vary', 'Origin');
-        if (!matchesAllowedOrigin(explicitOrigins, origin)) {
+        if (!allowed(origin)) {
             // DENY: do NOT reflect the origin, do NOT emit a wildcard. The browser
             // will block the cross-origin read. Preflights for denied origins get a
             // 204 with no CORS headers (the actual request then fails CORS).

package/dist/esm/server/index.js

@@ -4,19 +4,42 @@
  * This subpath export provides Express middleware and Node.js-specific
  * utilities that are not available in React Native or browser environments.
  *
+ * One `OxyServer` per process, authenticated as the backend's own workload
+ * (ADR 0026/0049 — no api key, no client secret):
+ *
  * @example
  * ```ts
- * import { OxyServer, createOxyAuthMiddleware, createOxyRateLimit } from '@oxy.so/core/server';
+ * import {
+ *   OxyServer,
+ *   createOxyAuthMiddleware,
+ *   createOxyCors,
+ *   createOxyRateLimit,
+ *   createOxySecurityHeaders,
+ *   oxyTrustProxy,
+ * } from '@oxy.so/core/server';
  *
- * const oxy = new OxyServer({ baseURL: 'https://api.oxy.so', serviceAuth: { apiKey, apiSecret } });
+ * export const oxy = new OxyServer({
+ *   baseURL: process.env.OXY_API_URL ?? 'https://api.oxy.so',
+ *   applicationId: process.env.OXY_APPLICATION_ID,
+ *   serviceIdentity: 'when-anonymous',
+ * });
  *
+ * app.set('trust proxy', oxyTrustProxy);
+ * app.use(createOxySecurityHeaders(), createOxyCors({ appOrigins }));
  * app.use(createOxyRateLimit(oxy, { store: redisStore }));
  * app.use('/api', createOxyAuthMiddleware(oxy));
+ *
+ * // As the person behind the request, never on the shared client:
+ * const node = await oxy.withUser(req, (user) => user.accounts.get(accountId));
  * ```
  */
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
 export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, DEFAULT_SERVICE_TOKEN_AUDIENCE, } from './OxyServer.js';
+// The requesting person: an isolated client bound to their bearer, and what
+// they may do in an account or over an application (with typed outcomes).
+export { OxyUserClient } from './userClient.js';
+export { OxyAccessError, accessErrorStatus } from './callerAuthority.js';
 export { ServerAccountsApi, ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
 export { ServerSafetyApi } from './safety.js';
 export { ServerSessionApi } from './session.js';
@@ -41,7 +64,7 @@ export { FILE_EVENT_DEFAULT_TOLERANCE_SECONDS, FILE_EVENT_SIGNATURE_HEADER, FILE
 export { STREAM_KEY_AUTHORIZATION_EVENT_TYPE, StreamKeyAuthorizationVerificationError, verifyStreamKeyAuthorization, } from './streamKeyAuthorization.js';
 export { LargeUploadFailedError } from './largeUpload.js';
 // Strict CORS allowlist (Oxy apex family + explicit app origins).
-export { createOxyCors } from './cors.js';
+export { createOxyCors, createOxyOriginCheck, createOxySocketCors } from './cors.js';
 // Shared Helmet + Content-Security-Policy baseline (Cloudflare Insights beacon,
 // Oxy API/CDN origins) with additive, per-app extensions.
 //

package/dist/esm/server/liveCapabilityTicket.js

@@ -1,5 +1,5 @@
 import { canonicalCapabilityJson, capabilityTicketClaimsSchema, } from '@oxy.so/contracts';
-import { verifyCapabilityTicket, } from './capabilityTicket.js';
+import { resolveCapabilityTicketKey, } from './capabilityTicket.js';
 /** Local signature + live receiving-service introspection; no cache or retry. */
 export function createLiveCapabilityTicketVerifier(options) {
     if (typeof options.issuer !== 'string' || options.issuer.trim() === '')
@@ -10,7 +10,9 @@ export function createLiveCapabilityTicketVerifier(options) {
     }
     return async (ticket, input = {}) => {
         input.signal?.throwIfAborted();
-        const signed = verifyCapabilityTicket(ticket, options);
+        const verifier = await resolveCapabilityTicketKey(ticket, options);
+        input.signal?.throwIfAborted();
+        const signed = verifier.check();
         if (!signed.catalog)
             throw new Error('Internal MCP requires a signed catalogue binding');
         const controller = new AbortController();
@@ -36,7 +38,7 @@ export function createLiveCapabilityTicketVerifier(options) {
             if (canonicalCapabilityJson(live) !== canonicalCapabilityJson(signed))
                 throw new Error('Capability introspection claims mismatch');
             // An authority response delayed past expiry cannot extend the signed grant.
-            return verifyCapabilityTicket(ticket, options);
+            return verifier.check();
         }
         finally {
             clearTimeout(timer);