@shelbyb/daywalker-sdk 0.0.0-stage → 0.1.1

package/dist/crypto/signatures.js

@@ -0,0 +1,331 @@
+import { base64ToBytes, base64UrlToBytes, bytesToBase64, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
+import { computeContentDigest } from "./digest.js";
+import { loadPublicKey, loadSigningKey } from "./keys.js";
+export const SIGNATURE_VERSION = "rfc9421";
+export const SIGNATURE_LABEL = "sig1";
+export const SIGNATURE_ALG = "ed25519";
+export const MAX_CLOCK_SKEW_SECONDS = 300;
+export const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z0-9_\-\.]{1,128}$/;
+/**
+ * Normalizes HTTP request path per RFC 3986 to prevent path traversal & signature confusion.
+ */
+export function normalizePath(rawPath) {
+    if (!rawPath || !rawPath.trim())
+        return "/";
+    let p = rawPath.trim();
+    p = p.replace(/\/+/g, "/");
+    try {
+        const parsed = new URL(p, "http://localhost");
+        return parsed.pathname + parsed.search;
+    }
+    catch {
+        return p.startsWith("/") ? p : `/${p}`;
+    }
+}
+/**
+ * Validates that an identifier (keyId, serviceSlug, etc.) contains only safe alphanumeric/hyphen characters.
+ */
+export function assertSafeIdentifier(name, value) {
+    if (!value || typeof value !== "string" || value.length > 128 || !SAFE_IDENTIFIER_PATTERN.test(value)) {
+        throw new Error(`Invalid ${name}: must be 1-128 safe characters (alphanumeric, '_', '-', '.')`);
+    }
+}
+/**
+ * In-memory LRU / sliding cache for nonces / signature replay protection.
+ */
+class SignatureReplayCache {
+    seen = new Map();
+    ttlMs;
+    constructor(ttlSeconds = 360) {
+        this.ttlMs = ttlSeconds * 1000;
+    }
+    checkAndRecord(signatureId) {
+        const now = Date.now();
+        if (this.seen.size > 5000) {
+            for (const [k, exp] of this.seen.entries()) {
+                if (exp <= now)
+                    this.seen.delete(k);
+            }
+        }
+        const expiresAt = this.seen.get(signatureId);
+        if (expiresAt && expiresAt > now) {
+            return false; // Replay detected
+        }
+        this.seen.set(signatureId, now + this.ttlMs);
+        return true;
+    }
+}
+export const globalReplayCache = new SignatureReplayCache();
+/**
+ * Format the RFC 9421 Signature-Input parameters string.
+ * Example: `("@method" "@path" "@authority" "content-digest");created=1791561600;keyid="...";alg="ed25519";nonce="..."`
+ */
+export function formatSignatureParams(params) {
+    const components = params.components ?? ["@method", "@path", "@authority", "content-digest"];
+    const componentsStr = components.map((c) => `"${c}"`).join(" ");
+    let out = `(${componentsStr});created=${params.created};keyid="${params.keyid}";alg="${params.alg ?? SIGNATURE_ALG}"`;
+    if (params.nonce) {
+        out += `;nonce="${params.nonce}"`;
+    }
+    return out;
+}
+/**
+ * Construct canonical RFC 9421 signature base string.
+ */
+export function createSignatureBase(params) {
+    const method = params.method.toUpperCase();
+    const path = normalizePath(params.path);
+    const authority = params.authority.toLowerCase();
+    const lines = [
+        `"@method": ${method}`,
+        `"@path": ${path}`,
+        `"@authority": ${authority}`,
+    ];
+    if (params.contentDigest !== undefined && params.contentDigest !== null) {
+        lines.push(`"content-digest": ${params.contentDigest}`);
+    }
+    if (params.additionalComponents) {
+        for (const [k, v] of Object.entries(params.additionalComponents)) {
+            lines.push(`"${k.toLowerCase()}": ${v}`);
+        }
+    }
+    lines.push(`"@signature-params": ${params.signatureParams}`);
+    return lines.join("\n");
+}
+/**
+ * Sign an outgoing HTTP request according to RFC 9421 + RFC 9530.
+ */
+export async function signRequest(params) {
+    const signingKey = await loadSigningKey(params.key);
+    const created = params.created ?? Math.floor(Date.now() / 1000);
+    const keyid = params.keyid ?? signingKey.publicJwk.kid;
+    const alg = params.alg ?? SIGNATURE_ALG;
+    if (keyid) {
+        assertSafeIdentifier("keyid", keyid);
+    }
+    const hasBody = params.body !== undefined && params.body !== null;
+    const contentDigest = hasBody ? await computeContentDigest(params.body) : null;
+    const components = ["@method", "@path", "@authority"];
+    if (contentDigest !== null) {
+        components.push("content-digest");
+    }
+    const signatureParams = formatSignatureParams({
+        components,
+        created,
+        keyid,
+        alg,
+        nonce: params.nonce,
+    });
+    const signatureBase = createSignatureBase({
+        method: params.method,
+        path: params.path,
+        authority: params.authority,
+        contentDigest,
+        signatureParams,
+    });
+    const signatureBuffer = await globalThis.crypto.subtle.sign("Ed25519", signingKey.privateKey, stringToUtf8(signatureBase));
+    const signatureBase64 = bytesToBase64(new Uint8Array(signatureBuffer));
+    const headers = {
+        "Signature-Input": `${SIGNATURE_LABEL}=${signatureParams}`,
+        Signature: `${SIGNATURE_LABEL}=:${signatureBase64}:`,
+    };
+    if (contentDigest !== null) {
+        headers["Content-Digest"] = contentDigest;
+    }
+    if (params.apiKey) {
+        headers["Authorization"] = `Bearer ${params.apiKey}`;
+    }
+    return headers;
+}
+/**
+ * Verify an incoming RFC 9421 HTTP Message Signature.
+ */
+export async function verifyRequestSignature(params) {
+    const getHeader = (name) => {
+        if (params.headers instanceof Headers) {
+            return params.headers.get(name) ?? undefined;
+        }
+        const lower = name.toLowerCase();
+        for (const [k, v] of Object.entries(params.headers)) {
+            if (k.toLowerCase() === lower && v !== undefined)
+                return v;
+        }
+        return undefined;
+    };
+    const sigInputHeader = getHeader("Signature-Input");
+    const signatureHeader = getHeader("Signature");
+    const contentDigestHeader = getHeader("Content-Digest");
+    if (!sigInputHeader || !signatureHeader) {
+        return { valid: false, error: "Missing Signature-Input or Signature header" };
+    }
+    const sigInputMatch = sigInputHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=([^,]+)`));
+    if (!sigInputMatch) {
+        return { valid: false, error: `Signature-Input header does not contain ${SIGNATURE_LABEL}` };
+    }
+    const signatureParams = sigInputMatch[1].trim();
+    // Validate parameters and check for component duplicates
+    const coveredComponentsMatch = signatureParams.match(/^\(([^)]*)\)/);
+    if (!coveredComponentsMatch) {
+        return { valid: false, error: "Signature-Input missing covered components list" };
+    }
+    const rawComponents = coveredComponentsMatch[1].trim().split(/\s+/).filter(Boolean);
+    const seenComponents = new Set();
+    for (const c of rawComponents) {
+        if (seenComponents.has(c)) {
+            return { valid: false, error: `Duplicate covered component in Signature-Input: ${c}` };
+        }
+        seenComponents.add(c);
+    }
+    const sigMatch = signatureHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=:([A-Za-z0-9+/=_-]+):`));
+    if (!sigMatch) {
+        return { valid: false, error: `Signature header does not contain valid ${SIGNATURE_LABEL} byte sequence` };
+    }
+    const signatureBase64 = sigMatch[1].trim();
+    const createdMatch = signatureParams.match(/created=(\d+)/);
+    if (!createdMatch) {
+        return { valid: false, error: "Signature-Input missing created timestamp" };
+    }
+    const created = parseInt(createdMatch[1], 10);
+    const now = params.currentTime ?? Math.floor(Date.now() / 1000);
+    const maxSkew = params.maxClockSkewSeconds ?? MAX_CLOCK_SKEW_SECONDS;
+    if (Math.abs(now - created) > maxSkew) {
+        return { valid: false, error: `Signature timestamp expired or clock skew too large (created=${created}, now=${now})` };
+    }
+    if (params.replayCheck !== false) {
+        const replayKey = `${signatureBase64}:${created}`;
+        if (!globalReplayCache.checkAndRecord(replayKey)) {
+            return { valid: false, error: "Replay detected: request signature was already presented" };
+        }
+    }
+    const keyidMatch = signatureParams.match(/keyid="([^"]+)"/);
+    const keyid = keyidMatch ? keyidMatch[1] : undefined;
+    if (keyid) {
+        try {
+            assertSafeIdentifier("keyid", keyid);
+        }
+        catch (e) {
+            return { valid: false, error: e.message };
+        }
+    }
+    const algMatch = signatureParams.match(/alg="([^"]+)"/);
+    const alg = algMatch ? algMatch[1] : undefined;
+    if (alg && alg.toLowerCase() !== "ed25519" && alg.toLowerCase() !== "eddsa") {
+        return { valid: false, error: `Unsupported signature algorithm: ${alg}` };
+    }
+    if (signatureParams.includes('"content-digest"')) {
+        if (!contentDigestHeader) {
+            return { valid: false, error: "Signature covers content-digest but Content-Digest header is missing" };
+        }
+        const computedDigest = await computeContentDigest(params.body ?? "");
+        if (!computedDigest || !timingSafeEqualString(contentDigestHeader.trim(), computedDigest)) {
+            return { valid: false, error: `Content-Digest mismatch: expected ${computedDigest}, got ${contentDigestHeader}` };
+        }
+    }
+    const signatureBase = createSignatureBase({
+        method: params.method,
+        path: params.path,
+        authority: params.authority,
+        contentDigest: signatureParams.includes('"content-digest"') ? contentDigestHeader?.trim() : null,
+        signatureParams,
+    });
+    try {
+        const { publicKey } = await loadPublicKey(params.publicKey);
+        const signatureBytes = signatureBase64.includes("-") || signatureBase64.includes("_")
+            ? base64UrlToBytes(signatureBase64)
+            : base64ToBytes(signatureBase64);
+        const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, stringToUtf8(signatureBase));
+        if (!isValid) {
+            return { valid: false, error: "Cryptographic signature verification failed" };
+        }
+        return { valid: true, keyid };
+    }
+    catch (err) {
+        return { valid: false, error: `Verification error: ${err.message}` };
+    }
+}
+/**
+ * Zero-egress offline verification for asymmetric JWT token leases.
+ */
+export async function verifyJwtLease(params) {
+    try {
+        const parts = params.token.trim().split(".");
+        if (parts.length !== 3) {
+            return { valid: false, error: "Token is not a valid 3-part JWT" };
+        }
+        const [headerB64, payloadB64, signatureB64] = parts;
+        const headerJson = utf8ToString(base64UrlToBytes(headerB64));
+        const payloadJson = utf8ToString(base64UrlToBytes(payloadB64));
+        const header = JSON.parse(headerJson);
+        const payload = JSON.parse(payloadJson);
+        if (header.alg !== "EdDSA" && header.alg !== "ed25519") {
+            return { valid: false, error: `Unsupported JWT alg: ${header.alg}` };
+        }
+        const { publicKey } = await loadPublicKey(params.publicKey);
+        const signedData = stringToUtf8(`${headerB64}.${payloadB64}`);
+        const signatureBytes = base64UrlToBytes(signatureB64);
+        const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, signedData);
+        if (!isValid) {
+            return { valid: false, error: "JWT signature verification failed" };
+        }
+        const now = params.currentTime ?? Math.floor(Date.now() / 1000);
+        if (payload.exp && typeof payload.exp === "number" && payload.exp < now) {
+            return { valid: false, error: "JWT token lease has expired" };
+        }
+        if (payload.nbf && typeof payload.nbf === "number" && payload.nbf > now + 60) {
+            return { valid: false, error: "JWT token lease not active yet" };
+        }
+        if (params.expectedServiceSlug) {
+            const tokenSlug = (payload.serviceSlug || payload.aud || "").toLowerCase();
+            if (tokenSlug && tokenSlug !== params.expectedServiceSlug.toLowerCase()) {
+                return {
+                    valid: false,
+                    error: `JWT audience mismatch: expected ${params.expectedServiceSlug}, got ${tokenSlug}`,
+                };
+            }
+        }
+        return { valid: true, payload };
+    }
+    catch (err) {
+        return { valid: false, error: `Failed to verify JWT lease: ${err.message}` };
+    }
+}
+/**
+ * Register public key directly with Daywalker Auth via POST /api/v1/keys/register (Push Architecture).
+ */
+export async function registerPublicKey(params) {
+    const authUrl = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    const registerUrl = `${authUrl}/api/v1/keys/register`;
+    const doFetch = params.fetchFn ?? globalThis.fetch;
+    try {
+        const res = await doFetch(registerUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+                Authorization: `Bearer ${params.apiKey}`,
+            },
+            body: JSON.stringify({
+                keyId: params.publicJwk.kid,
+                domain: params.domain ?? undefined,
+                serviceSlug: params.serviceSlug ?? undefined,
+                publicKey: params.publicJwk,
+            }),
+        });
+        if (res.ok) {
+            return { ok: true, status: res.status };
+        }
+        const data = (await res.json().catch(() => ({})));
+        return {
+            ok: false,
+            status: res.status,
+            error: data.message || data.error || `HTTP ${res.status}`,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 0,
+            error: err.message,
+        };
+    }
+}

package/dist/express.d.ts

@@ -0,0 +1,25 @@
+import { Daywalker } from "./client.js";
+import type { TokenPayload } from "./types.js";
+interface Req {
+    method?: string;
+    path?: string;
+    url?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    get?: (name: string) => string | undefined;
+    auth?: TokenPayload;
+}
+interface Res {
+    setHeader(name: string, value: string): unknown;
+    status(code: number): Res;
+    json(body: unknown): unknown;
+    statusCode?: number;
+    end(body?: string): unknown;
+}
+/**
+ * Express / Connect / Node http middleware that validates incoming Daywalker tokens.
+ */
+export declare function daywalkerAuth(options?: {
+    client?: Daywalker;
+}): (req: Req, res: Res, next?: (err?: unknown) => void) => Promise<void>;
+export declare function daywalkerKeys(client?: Daywalker): (req: Req, res: Res, next?: () => void) => Promise<void>;
+export {};

package/dist/express.js

@@ -0,0 +1,68 @@
+import { daywalker } from "./client.js";
+/**
+ * Express / Connect / Node http middleware that validates incoming Daywalker tokens.
+ */
+export function daywalkerAuth(options = {}) {
+    const client = options.client ?? daywalker;
+    return async (req, res, next) => {
+        const getHeader = (name) => {
+            if (typeof req.get === "function")
+                return req.get(name);
+            if (req.headers) {
+                const val = req.headers[name.toLowerCase()] ?? req.headers[name];
+                return Array.isArray(val) ? val[0] : val;
+            }
+            return undefined;
+        };
+        const authHeader = getHeader("authorization");
+        const apiTokenHeader = getHeader("x-api-token");
+        let token = null;
+        if (authHeader && authHeader.toLowerCase().startsWith("bearer ")) {
+            token = authHeader.slice(7).trim();
+        }
+        else if (apiTokenHeader) {
+            token = apiTokenHeader.trim();
+        }
+        if (!token) {
+            if (typeof res.status === "function" && typeof res.json === "function") {
+                res.status(401).json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" });
+                return;
+            }
+            res.statusCode = 401;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }));
+            return;
+        }
+        const result = await client.validateToken(token);
+        if (!result.ok) {
+            const status = result.status === 429 ? 429 : 401;
+            if (result.retryAfter) {
+                res.setHeader("Retry-After", String(result.retryAfter));
+            }
+            if (typeof res.status === "function" && typeof res.json === "function") {
+                res.status(status).json({ error: result.error, message: result.message, retryAfter: result.retryAfter });
+                return;
+            }
+            res.statusCode = status;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: result.error, message: result.message, retryAfter: result.retryAfter }));
+            return;
+        }
+        req.auth = result.data;
+        next?.();
+    };
+}
+export function daywalkerKeys(client = daywalker) {
+    return async (req, res, next) => {
+        const path = req.path ?? (req.url ?? "").split("?")[0];
+        if ((req.method ?? "GET") === "GET" && path === "/.well-known/daywalker-keys.json") {
+            const keysDoc = await client.keys();
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("Cache-Control", "public, max-age=300");
+            res.end(JSON.stringify(keysDoc));
+            return;
+        }
+        next?.();
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { Daywalker, createDaywalker, daywalker, } from "./client.js";
+export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, } from "./types.js";
+export type { DaywalkerConfig, RateLimitWindow, TokenPayload, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, PublicJwk, SigningKey, } from "./types.js";
+export { resolveConfig, publicHostname, } from "./config.js";
+export type { ResolvedConfig, } from "./config.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
+export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, } from "./crypto/index.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { Daywalker, createDaywalker, daywalker, } from "./client.js";
+export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, } from "./types.js";
+export { resolveConfig, publicHostname, } from "./config.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";

package/dist/middleware.d.ts

@@ -0,0 +1,20 @@
+import { Daywalker } from "./client.js";
+export interface DaywalkerMiddlewareOptions {
+    client?: Daywalker;
+    serviceSlug?: string;
+    headerName?: string;
+}
+/**
+ * Standard Web / Hono compatible middleware.
+ * Works with Hono, standard Web Request/Response routers, and middleware pipelines.
+ *
+ * Example in Hono:
+ *   import { Hono } from "hono";
+ *   import { daywalkerAuth } from "@shelbyb/daywalker-sdk/middleware";
+ *
+ *   const app = new Hono();
+ *   app.use("/api/*", daywalkerAuth());
+ *   app.get("/api/me", (c) => c.json({ auth: c.get("auth") }));
+ */
+export declare function daywalkerAuth(options?: DaywalkerMiddlewareOptions): (c: any, next: () => Promise<Response | void | undefined>) => Promise<Response | void>;
+export { daywalkerAuth as daywalkerMiddleware };

package/dist/middleware.js

@@ -0,0 +1,72 @@
+import { daywalker } from "./client.js";
+/**
+ * Standard Web / Hono compatible middleware.
+ * Works with Hono, standard Web Request/Response routers, and middleware pipelines.
+ *
+ * Example in Hono:
+ *   import { Hono } from "hono";
+ *   import { daywalkerAuth } from "@shelbyb/daywalker-sdk/middleware";
+ *
+ *   const app = new Hono();
+ *   app.use("/api/*", daywalkerAuth());
+ *   app.get("/api/me", (c) => c.json({ auth: c.get("auth") }));
+ */
+export function daywalkerAuth(options = {}) {
+    const client = options.client ?? daywalker;
+    const serviceSlug = options.serviceSlug;
+    return async function daywalkerMiddleware(c, next) {
+        let authHeader;
+        let apiTokenHeader;
+        if (typeof c?.req?.header === "function") {
+            authHeader = c.req.header("authorization");
+            apiTokenHeader = c.req.header("x-api-token");
+        }
+        else if (c?.req?.headers instanceof Headers || c?.headers instanceof Headers) {
+            const headers = (c.req?.headers ?? c.headers);
+            authHeader = headers.get("authorization") ?? undefined;
+            apiTokenHeader = headers.get("x-api-token") ?? undefined;
+        }
+        else if (typeof c?.req?.headers === "object" || typeof c?.headers === "object") {
+            const headers = c.req?.headers ?? c.headers;
+            authHeader = headers["authorization"] || headers["Authorization"];
+            apiTokenHeader = headers["x-api-token"] || headers["X-Api-Token"];
+        }
+        let token = null;
+        if (authHeader && authHeader.toLowerCase().startsWith("bearer ")) {
+            token = authHeader.slice(7).trim();
+        }
+        else if (apiTokenHeader) {
+            token = apiTokenHeader.trim();
+        }
+        if (!token) {
+            if (typeof c?.json === "function") {
+                return c.json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }, 401);
+            }
+            return Response.json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }, { status: 401 });
+        }
+        const result = await client.validateToken(token, { serviceSlug });
+        if (!result.ok) {
+            const status = result.status === 429 ? 429 : 401;
+            const body = {
+                error: result.error,
+                message: result.message,
+                retryAfter: result.retryAfter,
+            };
+            const headers = result.retryAfter ? { "Retry-After": String(result.retryAfter) } : undefined;
+            if (typeof c?.json === "function") {
+                return c.json(body, status, headers);
+            }
+            return Response.json(body, { status, headers });
+        }
+        // Attach to context if available
+        if (typeof c?.set === "function") {
+            c.set("auth", result.data);
+            c.set("daywalkerAuth", result.data);
+        }
+        else if (c) {
+            c.auth = result.data;
+        }
+        return next();
+    };
+}
+export { daywalkerAuth as daywalkerMiddleware };

package/dist/next.d.ts

@@ -0,0 +1,63 @@
+import { Daywalker } from "./client.js";
+import type { TokenPayload } from "./types.js";
+/**
+ * Real Server Action IDs are hex hashes. Scanners probing for CVE-2025-55182 (React2Shell)
+ * send junk like `Next-Action: x`, which Next.js rejects with an internal error.
+ * Dropping them up front protects application logs and server resources.
+ */
+export declare const SERVER_ACTION_ID_PATTERN: RegExp;
+export declare const DEFAULT_BYPASS_PATHS: string[];
+export interface NextMiddlewareOptions {
+    client?: Daywalker;
+    serviceSlug?: string;
+    bypassPaths?: string[];
+    errorPath?: string;
+    homePath?: string;
+    protectApiOnly?: boolean;
+    validateServerActions?: boolean;
+    allowedHosts?: string[];
+}
+/**
+ * Sanitizes open redirect path parameter (`from`).
+ * Prevents protocol-relative URLs (`//evil.com`), backslashes (`/\evil.com`), and control characters.
+ */
+export declare function sanitizeRedirectPath(path: string): string | null;
+/**
+ * Hardened Next.js Middleware for root `middleware.ts`.
+ *
+ * Implements:
+ * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
+ * 2. Static asset and health check bypass
+ * 3. Self-healing service error page routing with `from` back-redirect
+ * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect)
+ *
+ * Example:
+ *   // middleware.ts
+ *   import { createDaywalkerMiddleware } from "@shelbyb/daywalker-sdk/next";
+ *
+ *   export const middleware = createDaywalkerMiddleware();
+ *
+ *   export const config = {
+ *     matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+ *   };
+ */
+export declare function createDaywalkerMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;
+/**
+ * Next.js App Router route handler wrapper with Daywalker token validation.
+ * Extracts `Authorization: Bearer <token>` or `x-api-token`, validates via client,
+ * returns 401/429 JSON response on error, or passes validated `auth` payload in context.
+ *
+ * Example:
+ *   // app/api/protected/route.ts
+ *   import { withDaywalkerAuth } from "@shelbyb/daywalker-sdk/next";
+ *
+ *   export const POST = withDaywalkerAuth(async (req, { auth }) => {
+ *     return Response.json({ message: "Hello " + auth.serviceSlug, auth });
+ *   });
+ */
+export declare function withDaywalkerAuth<Context extends Record<string, unknown> = Record<string, unknown>>(handler: (req: Request, context: Context & {
+    auth: TokenPayload;
+}) => Promise<Response>, clientOrOptions?: Daywalker | {
+    client?: Daywalker;
+    serviceSlug?: string;
+}): (req: Request, context?: Context) => Promise<Response>;