@run402/functions 4.0.0 → 4.2.0

package/dist/lib/project-jwt-keys.d.ts

@@ -17,22 +17,14 @@
  * pattern for the actor-context key — same lazy single-flight fetch, same
  * service-key auth, same "failures are non-fatal, the next request retries".
  *
- * FETCH-ONLY. There was a transition fallback here: while `RUN402_JWT_SECRET`
- * was still injected, it was kept as a second, kid-less verification key tried
- * after the fetched keyset. It was load-bearing for exactly one window — after
- * the fleet carried this runtime but BEFORE the gateway's signing key became
- * asymmetric, the gateway was still minting HS256 tokens that an
- * asymmetric-only keyset cannot verify.
- *
- * That window closed. The gateway signs ES256 (`kid=p1-2026-08`), and §8 both
- * stopped injecting the env key and swept it out of the fleet, so the fallback
- * had already stopped firing in production before this removed it — it read an
- * env var that is no longer set on any live function.
+ * FETCH-ONLY, with no local fallback key. `RUN402_JWT_SECRET` is not injected
+ * into any live function and is not read here. The gateway signs project
+ * tokens with an asymmetric key (`kid`-stamped); this runtime verifies only
+ * against the fetched keyset.
  *
  * The consequence is deliberate and is the whole point: with no fallback, a
  * failed keyset fetch leaves NO keys, and `getUser()` fails closed rather than
  * silently falling back to material the tenant's own environment could supply.
- * See `openspec/changes/functions-runtime-key-decoupling/design.md`.
  */
 import type { VerificationKey } from "./jwt.js";
 /**
@@ -46,12 +38,42 @@ export declare function projectJwtVerificationKeys(): VerificationKey[];
 /**
  * Ensure the keyset is loaded before a synchronous verify.
  *
- * Single-flight: concurrent invocations in the same execution environment
- * share one fetch. Cached for the life of the environment, so a warm Lambda
- * pays nothing. Never throws — a failed fetch leaves whatever keys are
- * available (possibly none at all) and the next request retries.
+ * Single-flight: concurrent invocations in the same execution environment share
+ * one fetch. Never throws — a failed fetch leaves whatever keys are available
+ * (possibly none at all) and the next request retries.
+ *
+ * AWAITS ONLY WHEN THERE IS NOTHING TO SERVE. With no keys we must block; with
+ * a merely STALE keyset we refresh in the background and verify against what we
+ * have, because the old keys are still perfectly valid — a rotation adds a key
+ * before it promotes one. Blocking on the refresh instead would put a network
+ * round trip on one unlucky request every TTL for no correctness gain.
  */
 export declare function ensureProjectJwtKeysLoaded(): Promise<void>;
+/**
+ * Refetch once when a token names a `kid` this environment has never seen, so a
+ * freshly promoted signing key is picked up NOW rather than at the next TTL.
+ *
+ * Returns true only when the refetch actually produced that `kid` — i.e. when
+ * retrying the verification is worth doing. Deliberately narrow:
+ *
+ *   - a kid-less token returns false. Those select the legacy key, and a
+ *     missing legacy key is not something a refetch fixes.
+ *   - a KNOWN kid returns false. If the kid is present and verification still
+ *     failed, the signature is bad; refetching the same public keys cannot
+ *     change that, and doing so would let a forged-signature flood drive the
+ *     same amplification the interval floor exists to prevent.
+ *   - inside the cooldown returns false, without fetching.
+ */
+export declare function refreshForUnknownKid(kid: string | undefined): Promise<boolean>;
+/**
+ * The `kid` a token claims, read WITHOUT verifying it.
+ *
+ * Untrusted by construction and used for exactly one decision: whether to
+ * refresh a PUBLIC keyset. It never selects a key, never influences which key
+ * verifies, and nothing it returns is trusted — `verifyWithKey` still does the
+ * real `kid` selection against material the gateway served.
+ */
+export declare function unverifiedKidFromToken(token: string): string | undefined;
 /** True when verification has no key at all — the caller must fail CLOSED
  *  rather than treat the request as anonymous-but-fine. */
 export declare function projectJwtKeysUnavailable(): boolean;

package/dist/lib/project-jwt-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-jwt-keys.d.ts","sourceRoot":"","sources":["../../src/lib/project-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAchD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,eAAe,EAAE,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAehE;AAED;2DAC2D;AAC3D,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAsCD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,IAAI,GAAG,IAAI,CAG9E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAQpE,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGhF"}
+{"version":3,"file":"project-jwt-keys.d.ts","sourceRoot":"","sources":["../../src/lib/project-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AA2EhD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,eAAe,EAAE,CAE9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQhE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAOpF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASxE;AAED;2DAC2D;AAC3D,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAsCD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,IAAI,GAAG,IAAI,CAK9E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAQpE,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGhF"}

package/dist/lib/project-jwt-keys.js

@@ -17,52 +17,59 @@
  * pattern for the actor-context key — same lazy single-flight fetch, same
  * service-key auth, same "failures are non-fatal, the next request retries".
  *
- * FETCH-ONLY. There was a transition fallback here: while `RUN402_JWT_SECRET`
- * was still injected, it was kept as a second, kid-less verification key tried
- * after the fetched keyset. It was load-bearing for exactly one window — after
- * the fleet carried this runtime but BEFORE the gateway's signing key became
- * asymmetric, the gateway was still minting HS256 tokens that an
- * asymmetric-only keyset cannot verify.
- *
- * That window closed. The gateway signs ES256 (`kid=p1-2026-08`), and §8 both
- * stopped injecting the env key and swept it out of the fleet, so the fallback
- * had already stopped firing in production before this removed it — it read an
- * env var that is no longer set on any live function.
+ * FETCH-ONLY, with no local fallback key. `RUN402_JWT_SECRET` is not injected
+ * into any live function and is not read here. The gateway signs project
+ * tokens with an asymmetric key (`kid`-stamped); this runtime verifies only
+ * against the fetched keyset.
  *
  * The consequence is deliberate and is the whole point: with no fallback, a
  * failed keyset fetch leaves NO keys, and `getUser()` fails closed rather than
  * silently falling back to material the tenant's own environment could supply.
- * See `openspec/changes/functions-runtime-key-decoupling/design.md`.
  */
 import { createPublicKey } from "node:crypto";
 let cached = null;
 let fetchInFlight = null;
+let cachedAt = 0;
+let lastUnknownKidRefetchAt = 0;
 /**
- * The keys `getUser()` should verify against.
+ * How stale a keyset may get before it is refreshed in the background.
  *
- * The fetched public keyset, and nothing else. An empty array is a legitimate
- * result — it means the fetch has not succeeded yet — and callers must treat it
- * as "cannot verify", never as "no verification needed".
+ * This is what makes a key rotation self-healing. Before it existed the cache
+ * had no TTL at all: a warm execution environment fetched once and NEVER
+ * refetched, so promoting a new signing key meant every warm function rejected
+ * the new tokens until its environment happened to recycle — with nothing in
+ * the system forcing that. The operator's only lever was a fleet-wide config
+ * touch to retire the environments.
  */
-export function projectJwtVerificationKeys() {
-    return cached ? [...cached] : [];
-}
+const KEYSET_MAX_AGE_MS = 5 * 60_000;
 /**
- * Ensure the keyset is loaded before a synchronous verify.
+ * Floor on how often an unknown `kid` may force an immediate refetch.
+ *
+ * THE REASON THIS NUMBER EXISTS, and why the unknown-kid path is not simply
+ * "refetch whenever we see one": a `kid` is attacker-controlled. Without a
+ * floor, a flood of tokens carrying random kids would make every warm Lambda in
+ * the fleet fetch the keyset once per request — turning an unauthenticated
+ * request into amplified load on the gateway. With it, an attacker gets one
+ * fetch per environment per interval no matter what they send, which is the
+ * same rate the TTL already permits.
  *
- * Single-flight: concurrent invocations in the same execution environment
- * share one fetch. Cached for the life of the environment, so a warm Lambda
- * pays nothing. Never throws — a failed fetch leaves whatever keys are
- * available (possibly none at all) and the next request retries.
+ * It is its OWN budget, not "time since the last fetch of any kind". Sharing
+ * the routine-fetch timestamp would starve the legitimate case it exists to
+ * serve: an environment that cold-started moments before a promotion would sit
+ * out the cooldown and reject valid tokens, which is the exact failure this
+ * whole mechanism was added to remove.
  */
-export async function ensureProjectJwtKeysLoaded() {
-    if (cached && cached.length > 0)
-        return;
+const MIN_REFETCH_INTERVAL_MS = 30_000;
+function startFetch() {
     if (!fetchInFlight) {
         fetchInFlight = fetchKeysFromGateway()
             .then((fetched) => {
-            if (fetched.length > 0)
+            // Only REPLACE on a non-empty result. A gateway blip must not empty a
+            // working keyset and fail every request until it recovers.
+            if (fetched.length > 0) {
                 cached = fetched;
+                cachedAt = Date.now();
+            }
         })
             .catch(() => {
             /* keep whatever we have; the next request retries */
@@ -71,7 +78,93 @@ export async function ensureProjectJwtKeysLoaded() {
             fetchInFlight = null;
         });
     }
-    await fetchInFlight;
+    return fetchInFlight;
+}
+/** The `kid`s currently verifiable, for the unknown-kid check. */
+function knownKids() {
+    const out = new Set();
+    for (const k of cached ?? [])
+        if (k.kid)
+            out.add(k.kid);
+    return out;
+}
+/**
+ * The keys `getUser()` should verify against.
+ *
+ * The fetched public keyset, and nothing else. An empty array is a legitimate
+ * result — it means the fetch has not succeeded yet — and callers must treat it
+ * as "cannot verify", never as "no verification needed".
+ */
+export function projectJwtVerificationKeys() {
+    return cached ? [...cached] : [];
+}
+/**
+ * Ensure the keyset is loaded before a synchronous verify.
+ *
+ * Single-flight: concurrent invocations in the same execution environment share
+ * one fetch. Never throws — a failed fetch leaves whatever keys are available
+ * (possibly none at all) and the next request retries.
+ *
+ * AWAITS ONLY WHEN THERE IS NOTHING TO SERVE. With no keys we must block; with
+ * a merely STALE keyset we refresh in the background and verify against what we
+ * have, because the old keys are still perfectly valid — a rotation adds a key
+ * before it promotes one. Blocking on the refresh instead would put a network
+ * round trip on one unlucky request every TTL for no correctness gain.
+ */
+export async function ensureProjectJwtKeysLoaded() {
+    if (!cached || cached.length === 0) {
+        await startFetch();
+        return;
+    }
+    if (Date.now() - cachedAt > KEYSET_MAX_AGE_MS) {
+        void startFetch();
+    }
+}
+/**
+ * Refetch once when a token names a `kid` this environment has never seen, so a
+ * freshly promoted signing key is picked up NOW rather than at the next TTL.
+ *
+ * Returns true only when the refetch actually produced that `kid` — i.e. when
+ * retrying the verification is worth doing. Deliberately narrow:
+ *
+ *   - a kid-less token returns false. Those select the legacy key, and a
+ *     missing legacy key is not something a refetch fixes.
+ *   - a KNOWN kid returns false. If the kid is present and verification still
+ *     failed, the signature is bad; refetching the same public keys cannot
+ *     change that, and doing so would let a forged-signature flood drive the
+ *     same amplification the interval floor exists to prevent.
+ *   - inside the cooldown returns false, without fetching.
+ */
+export async function refreshForUnknownKid(kid) {
+    if (!kid)
+        return false;
+    if (knownKids().has(kid))
+        return false;
+    if (Date.now() - lastUnknownKidRefetchAt < MIN_REFETCH_INTERVAL_MS)
+        return false;
+    lastUnknownKidRefetchAt = Date.now();
+    await startFetch();
+    return knownKids().has(kid);
+}
+/**
+ * The `kid` a token claims, read WITHOUT verifying it.
+ *
+ * Untrusted by construction and used for exactly one decision: whether to
+ * refresh a PUBLIC keyset. It never selects a key, never influences which key
+ * verifies, and nothing it returns is trusted — `verifyWithKey` still does the
+ * real `kid` selection against material the gateway served.
+ */
+export function unverifiedKidFromToken(token) {
+    try {
+        const [header] = token.split(".");
+        if (!header)
+            return undefined;
+        const parsed = JSON.parse(Buffer.from(header, "base64url").toString("utf8"));
+        return typeof parsed.kid === "string" && parsed.kid.length > 0 ? parsed.kid : undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 /** True when verification has no key at all — the caller must fail CLOSED
  *  rather than treat the request as anonymous-but-fine. */
@@ -122,6 +215,8 @@ async function fetchKeysFromGateway() {
 export function _setProjectJwtKeysForTest(keys) {
     cached = keys;
     fetchInFlight = null;
+    cachedAt = keys ? Date.now() : 0;
+    lastUnknownKidRefetchAt = 0;
 }
 /**
  * The header carrying the gateway-minted actor token.

package/dist/lib/project-jwt-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-jwt-keys.js","sourceRoot":"","sources":["../../src/lib/project-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,IAAI,MAAM,GAA6B,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,oBAAoB,EAAE;aACnC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,GAAG,OAAO,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,qDAAqD;QACvD,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,aAAa,CAAC;AACtB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,yBAAyB;IACvC,OAAO,0BAA0B,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC1D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAClC,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;YAAE,SAAS;QACtD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,SAAS;QACrE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAW;gBAC7D,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBACtD,GAAG,EAAE,OAAO;gBACZ,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,IAA8B;IACtE,MAAM,GAAG,IAAI,CAAC;IACd,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AAQpE,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,IAAY;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,CAAC,GAAG,OAAsB,CAAC;IACjC,IAAI,OAAQ,CAAuB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACvD,OAAQ,CAAuC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,CAAkD,CAAC;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"project-jwt-keys.js","sourceRoot":"","sources":["../../src/lib/project-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,IAAI,MAAM,GAA6B,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,IAAI,uBAAuB,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,SAAS,UAAU;IACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,oBAAoB,EAAE;aACnC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,GAAG,OAAO,CAAC;gBACjB,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,qDAAqD;QACvD,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE;QAAE,IAAI,CAAC,CAAC,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,UAAU,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QAC9C,KAAK,UAAU,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAuB;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,SAAS,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACjF,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,UAAU,EAAE,CAAC;IACnB,OAAO,SAAS,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAClG,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,yBAAyB;IACvC,OAAO,0BAA0B,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC1D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAClC,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;YAAE,SAAS;QACtD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,SAAS;QACrE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAW;gBAC7D,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBACtD,GAAG,EAAE,OAAO;gBACZ,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,IAA8B;IACtE,MAAM,GAAG,IAAI,CAAC;IACd,aAAa,GAAG,IAAI,CAAC;IACrB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,uBAAuB,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AAQpE,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,IAAY;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,CAAC,GAAG,OAAsB,CAAC;IACjC,IAAI,OAAQ,CAAuB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACvD,OAAQ,CAAuC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,CAAkD,CAAC;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@run402/functions",
-  "version": "4.0.0",
+  "version": "4.2.0",
   "description": "In-function helper library for Run402 serverless functions - db, adminDb, getUser, email, ai, assets, verifyWebhook. Auto-bundled into deployed functions; also installable for local TypeScript autocomplete.",
   "type": "module",
   "main": "dist/index.js",