@shelbyb/daywalker-sdk 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shelby Brayton
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,210 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="./assets/logo-512.png" alt="Daywalker" width="160" />
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @shelbyb/daywalker-sdk
+
+Zero-dependency, runtime-agnostic client library for [Daywalker Auth](https://auth.daywalker.dev). Supports **RFC 9421 (HTTP Message Signatures)**, **RFC 9530 (Digest Fields)**, **Web Crypto standards**, **Push Architecture key registration**, and **hardened web & Next.js middleware**.
+
+Runs seamlessly across **Node.js 18+**, **Bun**, **Deno**, **Cloudflare Workers**, **Next.js Edge**, and standard browser runtimes.
+
+- **Zero-Dependency Web Standards Core**: 100% standard `crypto.subtle`, `Uint8Array`, `fetch`, `Request`, and `Response`.
+- **RFC 9421 (HTTP Message Signatures)**: Cryptographically binds `@method`, `@path`, `@authority`, and `content-digest` using Ed25519 signatures (`Signature-Input`, `Signature`).
+- **RFC 9530 (Digest Fields)**: Computes standard `Content-Digest: sha-256=:<base64>:` headers for payload integrity.
+- **Class-Based Client Architecture**: Instantiable `Daywalker` client supporting dependency injection, with a lazy default singleton for plug-and-play simplicity.
+- **Resilience & Rate Limiting**: Automatic exponential backoff with jitter and `Retry-After` header parsing directly inside client fetch requests.
+- **Deterministic Type-Safe Results**: Discriminated union returns (`Result<T, E>`) for clean handling without try/catch boilerplate.
+- **Security-Hardened Next.js Middleware**: Built-in Server Action probe mitigation (CVE-2025-55182 defense), health check bypass, and self-healing diagnostic error routing.
+- **Zero-Egress Inbound Verification**: In-memory caching (60–300s TTL) and offline JWT token lease validation using Daywalker's asymmetric public key.
+- **Decoupled Push Architecture CLI**: `npx daywalker init --json` registers keys directly via `POST /api/v1/keys/register` with zero runtime reverse-HTTP calls.
+
+---
+
+## Installation
+
+```bash
+npm install @shelbyb/daywalker-sdk
+```
+
+---
+
+## Setup (once per service)
+
+```bash
+# Generate Ed25519 keypair and write .env.local
+npx daywalker init --service my-service-slug
+
+# Or register the public key immediately with Daywalker Auth:
+npx daywalker init --service my-service-slug --api-key srv_live_...
+
+# Pipe JSON secrets directly into Vercel, Fly.io, DigitalOcean, or AWS SSM:
+npx daywalker init --service my-service-slug --api-key srv_live_... --json
+```
+
+`daywalker init`:
+- Generates an Ed25519 keypair locally using WebCrypto (`crypto.subtle`)
+- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register`
+- Writes `DAYWALKER_SERVICE_SLUG`, `DAYWALKER_KEY_ID`, `DAYWALKER_SIGNING_KEY`, and `DAYWALKER_AUTH_URL` to `.env.local`
+- No route injectors or public `/.well-known/` endpoints needed
+
+The private key is never printed unless you pass `--print-key`.
+
+---
+
+## Environment
+
+| Variable | Required | Purpose |
+|---|---|---|
+| `DAYWALKER_API_KEY` | ✅ | The service's Daywalker API token (`srv_live_…`) or JWT lease |
+| `DAYWALKER_SERVICE_SLUG` | ✅ | The service slug to validate against (e.g. `sonalyze`) |
+| `DAYWALKER_SIGNING_KEY` | for signed requests | Ed25519 private key from `daywalker init` (PKCS#8 Base64 DER or PEM) |
+| `DAYWALKER_KEY_ID` | optional | RFC 7638 JWK thumbprint derived during key generation |
+| `DAYWALKER_SIGNING_KEY_PREVIOUS` | during rotation | Previous private key, maintained during deployment transitions |
+| `DAYWALKER_DOMAIN` | optional | Optional caller identifier or host domain name |
+| `DAYWALKER_PUBLIC_KEY` | optional | Daywalker Auth public key for zero-egress offline JWT lease verification |
+| `DAYWALKER_AUTH_URL` | optional | Defaults to `https://auth.daywalker.dev` |
+
+---
+
+## Usage
+
+### Client Class & Instantiation
+
+```ts
+import { Daywalker, daywalker } from "@shelbyb/daywalker-sdk";
+
+// Option 1: Instantiable client with custom options / dependency injection
+const client = new Daywalker({
+  apiKey: process.env.DAYWALKER_API_KEY,
+  serviceSlug: "sonalyze",
+  maxRetries: 3,
+});
+
+// Option 2: Default lazy singleton (reads process.env automatically)
+const result = await daywalker.validateToken();
+
+if (result.ok) {
+  console.log("Validated tenant:", result.data.tenantId);
+  console.log("Rate limit remaining:", result.data.rateLimit.remaining);
+} else {
+  console.error(`Validation failed (${result.status} ${result.error}): ${result.message}`);
+}
+```
+
+### Type-Safe Verification & Error Handling
+
+```ts
+// requireValidToken returns data or throws DaywalkerAuthError / DaywalkerRateLimitError
+try {
+  const auth = await client.requireValidToken(req.headers.get("x-api-token"));
+  console.log("Authenticated service:", auth.serviceSlug);
+} catch (err) {
+  if (err instanceof DaywalkerRateLimitError) {
+    console.warn(`Rate limited. Retry after ${err.retryAfter}s`);
+  }
+}
+```
+
+### RFC 9421 Signed Requests with Automatic Backoff
+
+```ts
+// Outbound request automatically computes Content-Digest (RFC 9530)
+// and attaches RFC 9421 signature headers. Retries 429 rate limits automatically.
+const res = await client.fetch("/api/v1/tokens/validate", {
+  method: "POST",
+  body: { token: "user_token", serviceSlug: "other-service" },
+});
+```
+
+---
+
+## Hardened Next.js Middleware (`@shelbyb/daywalker-sdk/next`)
+
+```ts
+// middleware.ts
+import { createDaywalkerMiddleware } from "@shelbyb/daywalker-sdk/next";
+
+export const middleware = createDaywalkerMiddleware({
+  serviceSlug: "sonalyze",
+  errorPath: "/service-error", // redirect unauthorized web visitors
+  validateServerActions: true, // drops malformed CVE-2025-55182 scanner probes
+});
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+```
+
+### Route Handler Wrapper
+
+```ts
+// app/api/protected/route.ts
+import { withDaywalkerAuth } from "@shelbyb/daywalker-sdk/next";
+
+export const POST = withDaywalkerAuth(async (req, { auth }) => {
+  return Response.json({ message: "Hello " + auth.serviceSlug, auth });
+});
+```
+
+---
+
+## Web Standard & Hono Middleware (`@shelbyb/daywalker-sdk/middleware`)
+
+```ts
+import { Hono } from "hono";
+import { daywalkerAuth } from "@shelbyb/daywalker-sdk/middleware";
+
+const app = new Hono();
+app.use("/api/*", daywalkerAuth());
+
+app.get("/api/me", (c) => {
+  const auth = c.get("auth");
+  return c.json({ auth });
+});
+```
+
+---
+
+## Zero-Egress Offline Verification
+
+When high-throughput internal microservices need zero latency and zero external egress, Daywalker Auth can issue asymmetric JWT leases. Configure `DAYWALKER_PUBLIC_KEY` (PEM or standard JWK) and token validation runs entirely in memory without network calls:
+
+```ts
+import { Daywalker } from "@shelbyb/daywalker-sdk";
+
+const client = new Daywalker({
+  serviceSlug: "myservice",
+  daywalkerPublicKey: process.env.DAYWALKER_PUBLIC_KEY,
+});
+
+// Verifies JWT signature, expiration, and service claims locally
+const result = await client.validateToken(incomingJwt);
+```
+
+---
+
+## CLI Reference
+
+| Command | Description |
+|---|---|
+| `npx daywalker init --service <slug> [--api-key <key>] [--json]` | Generate Ed25519 key, register with Daywalker Auth, and write `.env.local` or output JSON |
+| `npx daywalker check` | Validate configuration, signature readiness, and connection |
+| `npx daywalker rotate [--api-key <key>] [--json]` | Generate and register a new key while preserving the previous key in `.env.local` |
+
+---
+
+## Request Signing Specification (RFC 9421 & RFC 9530)
+
+Each outbound request signed by `@shelbyb/daywalker-sdk` includes:
+- `Content-Digest: sha-256=:<base64-encoded-hash>:`
+- `Signature-Input: sig1=("@method" "@path" "@authority" "content-digest");created=<unix_seconds>;keyid="<kid>";alg="ed25519"`
+- `Signature: sig1=:<base64-encoded-signature>:`
+- `Authorization: Bearer <DAYWALKER_API_KEY>`
+
+The exact signature base and test cases are verified against [`test-vectors/signing-rfc9421.json`](./test-vectors/signing-rfc9421.json).
+
+---
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { createDaywalker } from "./client.js";
+import { publicHostname } from "./config.js";
+import { generateSigningKey, loadSigningKey, registerPublicKey, redactSecrets } from "./crypto/index.js";
+const HELP = `daywalker: connect a service to Daywalker Auth (RFC 9421 / Push Architecture)
+
+Usage:
+  daywalker init   --service <slug> [--api-key <key>] [--domain <host>] [--auth-url <url>] [--json|--export] [--print-key]
+  daywalker rotate [--service <slug>] [--api-key <key>] [--auth-url <url>] [--json|--export] [--print-key]
+  daywalker check
+
+init     Generates an Ed25519 keypair, registers the public key directly with Daywalker Auth
+         (POST /api/v1/keys/register), and writes DAYWALKER_* settings to .env.local (or outputs JSON with --json).
+         No public ingress or /.well-known route handlers are required.
+rotate   Generates a new Ed25519 key, registers it with Daywalker Auth, and keeps the old one
+         in .env.local as DAYWALKER_SIGNING_KEY_PREVIOUS during deployment transition.
+check    Validates configuration and confirms Daywalker Auth connection and signature readiness.
+
+Options:
+  --json, --export  Output configuration as JSON for piping into Vercel, DigitalOcean, Fly.io, AWS SSM, etc.
+  --print-key       Print the private key to stdout (disabled by default for security).
+`;
+function args(argv) {
+    const out = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (!a.startsWith("--"))
+            continue;
+        const next = argv[i + 1];
+        if (next && !next.startsWith("--")) {
+            out[a.slice(2)] = next;
+            i++;
+        }
+        else
+            out[a.slice(2)] = true;
+    }
+    return out;
+}
+function fail(message) {
+    console.error(redactSecrets(`✖ ${message}`));
+    process.exit(1);
+}
+function readEnvFile(file) {
+    const map = new Map();
+    if (!fs.existsSync(file))
+        return map;
+    for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+        const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*)$/);
+        if (m)
+            map.set(m[1], m[2].replace(/^"(.*)"$/, "$1"));
+    }
+    return map;
+}
+function writeEnvFile(file, values) {
+    const lines = fs.existsSync(file) ? fs.readFileSync(file, "utf8").split("\n") : [];
+    const seen = new Set();
+    const out = [];
+    for (const line of lines) {
+        const key = line.match(/^\s*([A-Z0-9_]+)\s*=/)?.[1];
+        if (key && key in values) {
+            seen.add(key);
+            if (values[key] !== null)
+                out.push(`${key}="${values[key]}"`);
+            continue;
+        }
+        out.push(line);
+    }
+    while (out.length && out[out.length - 1] === "")
+        out.pop();
+    const added = Object.entries(values).filter(([k, v]) => !seen.has(k) && v !== null);
+    if (added.length) {
+        if (out.length)
+            out.push("");
+        out.push("# Daywalker Auth (managed by `daywalker init`)", ...added.map(([k, v]) => `${k}="${v}"`));
+    }
+    fs.writeFileSync(file, out.join("\n") + "\n", { mode: 0o600 });
+}
+function ensureGitignored(dir, entry) {
+    const file = path.join(dir, ".gitignore");
+    const content = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+    const covered = content.split("\n").some((l) => [entry, ".env*", ".env.*", ".env*.local", "*.local"].includes(l.trim()));
+    if (!covered)
+        fs.appendFileSync(file, `${content.endsWith("\n") || !content ? "" : "\n"}${entry}\n`);
+}
+async function init(opts) {
+    const isJson = Boolean(opts.json || opts.export);
+    const dir = process.cwd();
+    const envFile = path.join(dir, ".env.local");
+    const existing = readEnvFile(envFile);
+    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "")
+        .trim()
+        .toLowerCase();
+    if (!slug || !/^[a-z0-9_-]+$/.test(slug)) {
+        fail("--service must be this service's Daywalker slug (e.g. --service sonalyze)");
+    }
+    const rawDomain = opts.domain ? String(opts.domain) : existing.get("DAYWALKER_DOMAIN") ?? process.env.DAYWALKER_DOMAIN ?? "";
+    let domain = null;
+    if (rawDomain) {
+        domain = publicHostname(rawDomain);
+        if (!domain)
+            fail(`--domain (${rawDomain}) is not a valid public hostname`);
+    }
+    const apiKey = String(opts["api-key"] ?? existing.get("DAYWALKER_API_KEY") ?? process.env.DAYWALKER_API_KEY ?? "").trim() || null;
+    const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    const keyExists = Boolean(existing.get("DAYWALKER_SIGNING_KEY")) && !opts.force;
+    const key = keyExists ? null : await generateSigningKey();
+    const activeKey = key ?? (existing.get("DAYWALKER_SIGNING_KEY") ? await loadSigningKey(existing.get("DAYWALKER_SIGNING_KEY")) : null);
+    const kid = activeKey?.publicJwk.kid ?? String(opts["key-id"] ?? "");
+    // Register public key directly with Daywalker Auth if API key is provided
+    let registered = false;
+    if (apiKey && activeKey && !opts["skip-register"]) {
+        if (!isJson)
+            console.log(`• Registering public key (${activeKey.publicJwk.kid}) with Daywalker Auth...`);
+        const regResult = await registerPublicKey({
+            authUrl,
+            apiKey,
+            serviceSlug: slug,
+            domain,
+            publicJwk: activeKey.publicJwk,
+        });
+        if (regResult.ok) {
+            registered = true;
+            if (!isJson)
+                console.log(`✔ Public key registered with Daywalker Auth (Push Architecture)`);
+        }
+        else {
+            if (!isJson) {
+                console.warn(redactSecrets(`! Key registration warning (${regResult.status}): ${regResult.error}`));
+                console.warn(`  You can register the key later by re-running init with your DAYWALKER_API_KEY.`);
+            }
+        }
+    }
+    else if (!apiKey && !opts["skip-register"] && !isJson) {
+        console.log(`• Note: Set DAYWALKER_API_KEY in .env.local to automatically register public keys.`);
+    }
+    const signingKeyStr = key?.privateKeyPkcs8Base64 ?? existing.get("DAYWALKER_SIGNING_KEY") ?? "";
+    const envValues = {
+        DAYWALKER_SERVICE_SLUG: slug,
+        DAYWALKER_KEY_ID: kid,
+        DAYWALKER_AUTH_URL: authUrl,
+        ...(domain ? { DAYWALKER_DOMAIN: domain } : {}),
+        ...(apiKey ? { DAYWALKER_API_KEY: apiKey } : {}),
+        ...(signingKeyStr ? { DAYWALKER_SIGNING_KEY: signingKeyStr } : {}),
+    };
+    if (isJson) {
+        console.log(JSON.stringify(envValues, null, 2));
+        return;
+    }
+    writeEnvFile(envFile, envValues);
+    ensureGitignored(dir, ".env.local");
+    console.log(`✔ Daywalker configured for service "${slug}"${domain ? ` (${domain})` : ""}`);
+    console.log(`  • RFC 9421 / RFC 9530 HTTP Message Signing active`);
+    console.log(`  • .env.local: DAYWALKER_SERVICE_SLUG, DAYWALKER_KEY_ID, DAYWALKER_AUTH_URL${domain ? ", DAYWALKER_DOMAIN" : ""}${apiKey ? ", DAYWALKER_API_KEY" : ""}${signingKeyStr ? ", DAYWALKER_SIGNING_KEY" : ""}`);
+    if (kid)
+        console.log(`  • Key ID (RFC 7638 thumbprint): ${kid}`);
+    if (registered)
+        console.log(`  • Zero-ingress push architecture: public key registered directly`);
+    if (opts["print-key"] && signingKeyStr)
+        console.log(`\nDAYWALKER_SIGNING_KEY=${signingKeyStr}`);
+}
+async function rotate(opts) {
+    const isJson = Boolean(opts.json || opts.export);
+    const dir = process.cwd();
+    const envFile = path.join(dir, ".env.local");
+    const existing = readEnvFile(envFile);
+    const current = existing.get("DAYWALKER_SIGNING_KEY") ?? process.env.DAYWALKER_SIGNING_KEY;
+    if (!current)
+        fail("No DAYWALKER_SIGNING_KEY found; run `daywalker init` first");
+    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "").trim().toLowerCase();
+    const apiKey = String(opts["api-key"] ?? existing.get("DAYWALKER_API_KEY") ?? process.env.DAYWALKER_API_KEY ?? "").trim() || null;
+    const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    const key = await generateSigningKey();
+    if (apiKey && slug) {
+        if (!isJson)
+            console.log(`• Registering new public key (${key.publicJwk.kid}) with Daywalker Auth...`);
+        const regResult = await registerPublicKey({
+            authUrl,
+            apiKey,
+            serviceSlug: slug,
+            publicJwk: key.publicJwk,
+        });
+        if (regResult.ok) {
+            if (!isJson)
+                console.log(`✔ New public key registered with Daywalker Auth`);
+        }
+        else {
+            if (!isJson)
+                console.warn(redactSecrets(`! Key registration warning: ${regResult.error}`));
+        }
+    }
+    const envValues = {
+        DAYWALKER_KEY_ID: key.publicJwk.kid,
+        DAYWALKER_SIGNING_KEY: key.privateKeyPkcs8Base64 ?? "",
+        DAYWALKER_SIGNING_KEY_PREVIOUS: current,
+    };
+    if (isJson) {
+        console.log(JSON.stringify(envValues, null, 2));
+        return;
+    }
+    writeEnvFile(envFile, envValues);
+    console.log(`✔ New key ${key.publicJwk.kid} written; previous key preserved as DAYWALKER_SIGNING_KEY_PREVIOUS.`);
+    console.log(`  After deployment rollout is complete, you may remove DAYWALKER_SIGNING_KEY_PREVIOUS.`);
+    if (opts["print-key"])
+        console.log(`\nDAYWALKER_SIGNING_KEY=${key.privateKeyPkcs8Base64}`);
+}
+async function check() {
+    const env = { ...process.env, ...Object.fromEntries(readEnvFile(path.join(process.cwd(), ".env.local"))) };
+    const client = createDaywalker({ env });
+    const result = await client.selfCheck();
+    if (result.ok) {
+        console.log(`✔ Daywalker configuration looks good`);
+        if (result.serviceSlug)
+            console.log(`  • Service slug: ${result.serviceSlug}`);
+        if (result.domain)
+            console.log(`  • Caller domain: ${result.domain}`);
+        if (result.keyId)
+            console.log(`  • Key ID: ${result.keyId}`);
+        if (result.signing)
+            console.log(`  • RFC 9421 signature signing: ready`);
+        if (result.offlineVerificationReady)
+            console.log(`  • Zero-egress offline JWT lease verification: ready`);
+        return;
+    }
+    console.error(`✖ Daywalker self-check found problems:`);
+    for (const p of result.problems)
+        console.error(redactSecrets(`  - ${p}`));
+    process.exit(1);
+}
+async function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    const parsedArgs = args(rest);
+    if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
+        console.log(HELP);
+        return;
+    }
+    if (cmd === "init") {
+        await init(parsedArgs);
+    }
+    else if (cmd === "rotate") {
+        await rotate(parsedArgs);
+    }
+    else if (cmd === "check") {
+        await check();
+    }
+    else {
+        fail(`Unknown command "${cmd}". Run \`daywalker --help\` for usage.`);
+    }
+}
+main().catch((err) => {
+    console.error(redactSecrets(String(err?.stack || err)));
+    process.exit(1);
+});

package/dist/client.d.ts

@@ -0,0 +1,60 @@
+import { type ResolvedConfig } from "./config.js";
+import { type DaywalkerConfig, type PublicJwk, type RetryOptions, type SelfCheckResult, type TokenPayload, type ValidateResult } from "./types.js";
+export type DaywalkerFetchInit = Omit<RequestInit, "body"> & {
+    body?: BodyInit | object | null;
+    retry?: RetryOptions;
+};
+export declare class Daywalker {
+    private readonly _config;
+    private readonly _rawConfig;
+    private _signingKeyPromise?;
+    private readonly _cache;
+    constructor(config?: DaywalkerConfig);
+    get config(): ResolvedConfig;
+    toJSON(): Record<string, unknown>;
+    private getLoadedSigningKey;
+    /**
+     * Signs and executes requests with automatic retry and exponential backoff on 429 responses.
+     */
+    fetch(path: string, init?: DaywalkerFetchInit): Promise<Response>;
+    /**
+     * Validates incoming bearer tokens with memory caching and discriminated union return.
+     * Supports zero-egress offline verification for JWT token leases when Daywalker's public key is configured.
+     */
+    validateToken(tokenOrOptions?: string | {
+        token?: string;
+        serviceSlug?: string;
+        forceRefresh?: boolean;
+        offlineOnly?: boolean;
+    }, options?: {
+        serviceSlug?: string;
+        forceRefresh?: boolean;
+        offlineOnly?: boolean;
+    }): Promise<ValidateResult>;
+    /**
+     * Throws DaywalkerAuthError or DaywalkerRateLimitError if token is invalid or rate limited.
+     */
+    requireValidToken(tokenOrOptions?: string | {
+        token?: string;
+        serviceSlug?: string;
+        offlineOnly?: boolean;
+    }, options?: {
+        serviceSlug?: string;
+        offlineOnly?: boolean;
+    }): Promise<TokenPayload>;
+    /**
+     * The public JWK(s) configured for this service.
+     */
+    keys(): Promise<{
+        keys: PublicJwk[];
+    }>;
+    /**
+     * Check configuration and verify signature readiness.
+     */
+    selfCheck(): Promise<SelfCheckResult>;
+}
+/**
+ * Factory function for creating instantiable Daywalker client instances.
+ */
+export declare function createDaywalker(config?: DaywalkerConfig): Daywalker;
+export declare const daywalker: Daywalker & (() => Daywalker);