@shelbyb/daywalker-sdk 0.1.0 → 0.1.1

package/README.md

@@ -1,90 +1,210 @@
+<p align="center">
+  <img src="./assets/logo-512.png" alt="Daywalker" width="160" />
+</p>
+
 # @shelbyb/daywalker-sdk
 
-Connect any service to [Daywalker Auth](https://auth.daywalker.dev): validate API tokens and make **domain-signed** API calls that pass token allowlists from any host, CDN, container, or serverless platform.
+Zero-dependency, runtime-agnostic client library for [Daywalker Auth](https://auth.daywalker.dev). Supports **RFC 9421 (HTTP Message Signatures)**, **RFC 9530 (Digest Fields)**, **Web Crypto standards**, **Push Architecture key registration**, and **hardened web & Next.js middleware**.
 
-## Setup (once per service)
+Runs seamlessly across **Node.js 18+**, **Bun**, **Deno**, **Cloudflare Workers**, **Next.js Edge**, and standard browser runtimes.
+
+- **Zero-Dependency Web Standards Core**: 100% standard `crypto.subtle`, `Uint8Array`, `fetch`, `Request`, and `Response`.
+- **RFC 9421 (HTTP Message Signatures)**: Cryptographically binds `@method`, `@path`, `@authority`, and `content-digest` using Ed25519 signatures (`Signature-Input`, `Signature`).
+- **RFC 9530 (Digest Fields)**: Computes standard `Content-Digest: sha-256=:<base64>:` headers for payload integrity.
+- **Class-Based Client Architecture**: Instantiable `Daywalker` client supporting dependency injection, with a lazy default singleton for plug-and-play simplicity.
+- **Resilience & Rate Limiting**: Automatic exponential backoff with jitter and `Retry-After` header parsing directly inside client fetch requests.
+- **Deterministic Type-Safe Results**: Discriminated union returns (`Result<T, E>`) for clean handling without try/catch boilerplate.
+- **Security-Hardened Next.js Middleware**: Built-in Server Action probe mitigation (CVE-2025-55182 defense), health check bypass, and self-healing diagnostic error routing.
+- **Zero-Egress Inbound Verification**: In-memory caching (60–300s TTL) and offline JWT token lease validation using Daywalker's asymmetric public key.
+- **Decoupled Push Architecture CLI**: `npx daywalker init --json` registers keys directly via `POST /api/v1/keys/register` with zero runtime reverse-HTTP calls.
+
+---
+
+## Installation
 
 ```bash
 npm install @shelbyb/daywalker-sdk
-npx daywalker init --domain myservice.daywalker.dev --service my-service-slug
-# On DigitalOcean App Platform, also set the env vars on the live app:
-npx daywalker init --domain myservice.daywalker.dev --service my-service-slug --do-app my-app
 ```
 
-`init`:
-- generates an Ed25519 signing key
-- adds the `/.well-known/daywalker-keys.json` route (Next.js; for Express it prints the one line to add)
-- writes `DAYWALKER_SERVICE_SLUG`, `DAYWALKER_DOMAIN`, and `DAYWALKER_SIGNING_KEY` to `.env.local` (git-ignored)
-- with `--do-app`, sets them on your DigitalOcean app through `doctl`, with the key as an encrypted secret
+---
+
+## Setup (once per service)
+
+```bash
+# Generate Ed25519 keypair and write .env.local
+npx daywalker init --service my-service-slug
+
+# Or register the public key immediately with Daywalker Auth:
+npx daywalker init --service my-service-slug --api-key srv_live_...
+
+# Pipe JSON secrets directly into Vercel, Fly.io, DigitalOcean, or AWS SSM:
+npx daywalker init --service my-service-slug --api-key srv_live_... --json
+```
+
+`daywalker init`:
+- Generates an Ed25519 keypair locally using WebCrypto (`crypto.subtle`)
+- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register`
+- Writes `DAYWALKER_SERVICE_SLUG`, `DAYWALKER_KEY_ID`, `DAYWALKER_SIGNING_KEY`, and `DAYWALKER_AUTH_URL` to `.env.local`
+- No route injectors or public `/.well-known/` endpoints needed
 
 The private key is never printed unless you pass `--print-key`.
 
-Then set `DAYWALKER_API_KEY` to the service's token, deploy, run `npx daywalker check`, and in the Daywalker dashboard click **Connect** on the token to add your domain to its allowed callers.
+---
 
 ## Environment
 
 | Variable | Required | Purpose |
 |---|---|---|
-| `DAYWALKER_API_KEY` | ✅ | The service's Daywalker API token (`srv_live_…`) |
-| `DAYWALKER_SERVICE_SLUG` | ✅ | The service slug to validate against. Each service sets its own |
-| `DAYWALKER_SIGNING_KEY` | for allowlisted tokens | Ed25519 private key from `daywalker init` (secret) |
-| `DAYWALKER_DOMAIN` | recommended | Public hostname that serves the key. Falls back to `APP_URL`, `NEXTAUTH_URL`, `NEXT_PUBLIC_APP_URL`, `BETTER_AUTH_URL`, `PUBLIC_URL`, `SITE_URL`, `URL`, `VERCEL_PROJECT_PRODUCTION_URL`, `RENDER_EXTERNAL_HOSTNAME`, `RAILWAY_PUBLIC_DOMAIN`, `VERCEL_URL` |
-| `DAYWALKER_SIGNING_KEY_PREVIOUS` | during rotation | Old key, still published so in-flight requests verify |
+| `DAYWALKER_API_KEY` | ✅ | The service's Daywalker API token (`srv_live_…`) or JWT lease |
+| `DAYWALKER_SERVICE_SLUG` | ✅ | The service slug to validate against (e.g. `sonalyze`) |
+| `DAYWALKER_SIGNING_KEY` | for signed requests | Ed25519 private key from `daywalker init` (PKCS#8 Base64 DER or PEM) |
+| `DAYWALKER_KEY_ID` | optional | RFC 7638 JWK thumbprint derived during key generation |
+| `DAYWALKER_SIGNING_KEY_PREVIOUS` | during rotation | Previous private key, maintained during deployment transitions |
+| `DAYWALKER_DOMAIN` | optional | Optional caller identifier or host domain name |
+| `DAYWALKER_PUBLIC_KEY` | optional | Daywalker Auth public key for zero-egress offline JWT lease verification |
 | `DAYWALKER_AUTH_URL` | optional | Defaults to `https://auth.daywalker.dev` |
 
-Internal addresses (`0.0.0.0`, `localhost`, IPs) are never used as the domain, so a container's bind address can't end up in a signature.
+---
 
 ## Usage
 
+### Client Class & Instantiation
+
 ```ts
-import { daywalker } from "@shelbyb/daywalker-sdk";
+import { Daywalker, daywalker } from "@shelbyb/daywalker-sdk";
+
+// Option 1: Instantiable client with custom options / dependency injection
+const client = new Daywalker({
+  apiKey: process.env.DAYWALKER_API_KEY,
+  serviceSlug: "sonalyze",
+  maxRetries: 3,
+});
+
+// Option 2: Default lazy singleton (reads process.env automatically)
+const result = await daywalker.validateToken();
+
+if (result.ok) {
+  console.log("Validated tenant:", result.data.tenantId);
+  console.log("Rate limit remaining:", result.data.rateLimit.remaining);
+} else {
+  console.error(`Validation failed (${result.status} ${result.error}): ${result.message}`);
+}
+```
+
+### Type-Safe Verification & Error Handling
 
-// Validate DAYWALKER_API_KEY for DAYWALKER_SERVICE_SLUG (successful results cached for 60s)
-const result = await daywalker().validateToken();
-if (!result.valid) console.error(result.status, result.data.message);
+```ts
+// requireValidToken returns data or throws DaywalkerAuthError / DaywalkerRateLimitError
+try {
+  const auth = await client.requireValidToken(req.headers.get("x-api-token"));
+  console.log("Authenticated service:", auth.serviceSlug);
+} catch (err) {
+  if (err instanceof DaywalkerRateLimitError) {
+    console.warn(`Rate limited. Retry after ${err.retryAfter}s`);
+  }
+}
+```
 
-// Or validate a token your own users send you
-await daywalker().requireValidToken({ token: req.headers["x-api-token"] }); // throws DaywalkerError
+### RFC 9421 Signed Requests with Automatic Backoff
 
-// Signed call to any Daywalker Auth API path
-const res = await daywalker().fetch("/api/v1/tokens/validate", { body: { token, serviceSlug: "other" } });
+```ts
+// Outbound request automatically computes Content-Digest (RFC 9530)
+// and attaches RFC 9421 signature headers. Retries 429 rate limits automatically.
+const res = await client.fetch("/api/v1/tokens/validate", {
+  method: "POST",
+  body: { token: "user_token", serviceSlug: "other-service" },
+});
 ```
 
-`result.data` includes `rateLimit` (per minute) and `rateLimitHourly` (per hour), each `{ limit, remaining, reset }`. On a `429`, `result.retryAfter` is the number of seconds to wait.
+---
 
-### Serving the public key
+## Hardened Next.js Middleware (`@shelbyb/daywalker-sdk/next`)
 
-Next.js (App Router), which `init` creates for you:
+```ts
+// middleware.ts
+import { createDaywalkerMiddleware } from "@shelbyb/daywalker-sdk/next";
+
+export const middleware = createDaywalkerMiddleware({
+  serviceSlug: "sonalyze",
+  errorPath: "/service-error", // redirect unauthorized web visitors
+  validateServerActions: true, // drops malformed CVE-2025-55182 scanner probes
+});
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+```
+
+### Route Handler Wrapper
 
 ```ts
-// app/.well-known/daywalker-keys.json/route.ts
-export { GET, dynamic } from "@shelbyb/daywalker-sdk/next";
+// app/api/protected/route.ts
+import { withDaywalkerAuth } from "@shelbyb/daywalker-sdk/next";
+
+export const POST = withDaywalkerAuth(async (req, { auth }) => {
+  return Response.json({ message: "Hello " + auth.serviceSlug, auth });
+});
 ```
 
-Express / Connect / Node http:
+---
+
+## Web Standard & Hono Middleware (`@shelbyb/daywalker-sdk/middleware`)
 
 ```ts
-import { daywalkerKeys } from "@shelbyb/daywalker-sdk/express";
-app.use(daywalkerKeys());
+import { Hono } from "hono";
+import { daywalkerAuth } from "@shelbyb/daywalker-sdk/middleware";
+
+const app = new Hono();
+app.use("/api/*", daywalkerAuth());
+
+app.get("/api/me", (c) => {
+  const auth = c.get("auth");
+  return c.json({ auth });
+});
 ```
 
-Anything else: serve `JSON.stringify(daywalker().keys())` at `GET /.well-known/daywalker-keys.json`. It must be on the domain itself over HTTPS, without redirects.
+---
+
+## Zero-Egress Offline Verification
 
-### Custom clients
+When high-throughput internal microservices need zero latency and zero external egress, Daywalker Auth can issue asymmetric JWT leases. Configure `DAYWALKER_PUBLIC_KEY` (PEM or standard JWK) and token validation runs entirely in memory without network calls:
 
 ```ts
-import { createDaywalker } from "@shelbyb/daywalker-sdk";
-const client = createDaywalker({ serviceSlug: "gigpulse", domain: "gigpulse.daywalker.dev", cacheTtlMs: 0 });
+import { Daywalker } from "@shelbyb/daywalker-sdk";
+
+const client = new Daywalker({
+  serviceSlug: "myservice",
+  daywalkerPublicKey: process.env.DAYWALKER_PUBLIC_KEY,
+});
+
+// Verifies JWT signature, expiration, and service claims locally
+const result = await client.validateToken(incomingJwt);
 ```
 
-## Commands
+---
 
-| Command | Does |
+## CLI Reference
+
+| Command | Description |
 |---|---|
-| `npx daywalker init --domain <host> --service <slug> [--do-app <app>]` | Generate a key, add the key route, write env (re-running keeps the existing key; `--force` replaces it) |
-| `npx daywalker check` | Validate config and confirm the domain publishes the current key |
-| `npx daywalker rotate [--do-app <app>]` | New key; the old one stays published as `DAYWALKER_SIGNING_KEY_PREVIOUS`. Remove that after the deploy is live |
+| `npx daywalker init --service <slug> [--api-key <key>] [--json]` | Generate Ed25519 key, register with Daywalker Auth, and write `.env.local` or output JSON |
+| `npx daywalker check` | Validate configuration, signature readiness, and connection |
+| `npx daywalker rotate [--api-key <key>] [--json]` | Generate and register a new key while preserving the previous key in `.env.local` |
+
+---
+
+## Request Signing Specification (RFC 9421 & RFC 9530)
+
+Each outbound request signed by `@shelbyb/daywalker-sdk` includes:
+- `Content-Digest: sha-256=:<base64-encoded-hash>:`
+- `Signature-Input: sig1=("@method" "@path" "@authority" "content-digest");created=<unix_seconds>;keyid="<kid>";alg="ed25519"`
+- `Signature: sig1=:<base64-encoded-signature>:`
+- `Authorization: Bearer <DAYWALKER_API_KEY>`
+
+The exact signature base and test cases are verified against [`test-vectors/signing-rfc9421.json`](./test-vectors/signing-rfc9421.json).
+
+---
 
-## How signing works
+## License
 
-Each request carries `X-Daywalker-Domain`, `-Key-Id`, `-Timestamp`, `-Nonce`, and `-Signature`, an Ed25519 signature over the method, path, domain, timestamp, nonce, and the body's SHA-256. Daywalker fetches the public key from your domain over HTTPS, so a valid signature proves the request comes from whoever controls the domain. Timestamps must be within 5 minutes and nonces are single-use. See the Daywalker README for the full protocol.
+MIT

package/dist/cli.js

@@ -1,26 +1,27 @@
 #!/usr/bin/env node
-import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { createDaywalker } from "./client.js";
 import { publicHostname } from "./config.js";
-import { generateSigningKey } from "./signing.js";
-const HELP = `daywalker: connect a service to Daywalker Auth
+import { generateSigningKey, loadSigningKey, registerPublicKey, redactSecrets } from "./crypto/index.js";
+const HELP = `daywalker: connect a service to Daywalker Auth (RFC 9421 / Push Architecture)
 
 Usage:
-  daywalker init   --domain <host> --service <slug> [--do-app <name|id>] [--framework next|express] [--print-key]
-  daywalker rotate [--do-app <name|id>] [--print-key]
+  daywalker init   --service <slug> [--api-key <key>] [--domain <host>] [--auth-url <url>] [--json|--export] [--print-key]
+  daywalker rotate [--service <slug>] [--api-key <key>] [--auth-url <url>] [--json|--export] [--print-key]
   daywalker check
 
-init     Generates a signing key, adds the /.well-known/daywalker-keys.json route for your
-         framework, and writes DAYWALKER_* settings to .env.local. With --do-app it also sets
-         them on your DigitalOcean App Platform app (as an encrypted secret, via doctl).
-rotate   Generates a new key and keeps the old one published as DAYWALKER_SIGNING_KEY_PREVIOUS,
-         so requests signed with either key verify during the switch. Remove the previous key
-         a few minutes after deploying.
-check    Validates config and confirms your domain serves the current public key.
+init     Generates an Ed25519 keypair, registers the public key directly with Daywalker Auth
+         (POST /api/v1/keys/register), and writes DAYWALKER_* settings to .env.local (or outputs JSON with --json).
+         No public ingress or /.well-known route handlers are required.
+rotate   Generates a new Ed25519 key, registers it with Daywalker Auth, and keeps the old one
+         in .env.local as DAYWALKER_SIGNING_KEY_PREVIOUS during deployment transition.
+check    Validates configuration and confirms Daywalker Auth connection and signature readiness.
 
-The private key is never printed unless you pass --print-key.`;
+Options:
+  --json, --export  Output configuration as JSON for piping into Vercel, DigitalOcean, Fly.io, AWS SSM, etc.
+  --print-key       Print the private key to stdout (disabled by default for security).
+`;
 function args(argv) {
     const out = {};
     for (let i = 0; i < argv.length; i++) {
@@ -38,10 +39,9 @@ function args(argv) {
     return out;
 }
 function fail(message) {
-    console.error(`✖ ${message}`);
+    console.error(redactSecrets(`✖ ${message}`));
     process.exit(1);
 }
-// --- .env.local ---------------------------------------------------------------
 function readEnvFile(file) {
     const map = new Map();
     if (!fs.existsSync(file))
@@ -84,149 +84,171 @@ function ensureGitignored(dir, entry) {
     if (!covered)
         fs.appendFileSync(file, `${content.endsWith("\n") || !content ? "" : "\n"}${entry}\n`);
 }
-// --- framework route ------------------------------------------------------------
-function detectFramework(dir) {
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
-        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-        if (deps.next)
-            return "next";
-        if (deps.express || deps.fastify || deps.koa || deps.hono)
-            return "express";
-    }
-    catch {
-        // no package.json
-    }
-    return null;
-}
-function addNextRoute(dir) {
-    const appDir = ["src/app", "app"].map((d) => path.join(dir, d)).find((d) => fs.existsSync(d)) ?? path.join(dir, "app");
-    const routeDir = path.join(appDir, ".well-known", "daywalker-keys.json");
-    const routeFile = path.join(routeDir, "route.ts");
-    const rel = path.relative(dir, routeFile);
-    if (fs.existsSync(routeFile))
-        return `${rel} already exists (left unchanged)`;
-    // A static file here would shadow the route and pin an old key
-    const staticFile = path.join(dir, "public", ".well-known", "daywalker-keys.json");
-    if (fs.existsSync(staticFile))
-        console.warn(`! Remove ${path.relative(dir, staticFile)}; the route serves keys from env now.`);
-    fs.mkdirSync(routeDir, { recursive: true });
-    fs.writeFileSync(routeFile, `// Serves this service's public signing key so Daywalker Auth can verify its requests.\nexport { GET, dynamic } from "@shelbyb/daywalker-sdk/next";\n`);
-    return `created ${rel}`;
-}
-// --- DigitalOcean ---------------------------------------------------------------
-function setDigitalOceanEnv(app, values) {
-    const doctl = (a, input) => execFileSync("doctl", a, { encoding: "utf8", input, stdio: [input ? "pipe" : "ignore", "pipe", "pipe"] });
-    let appId = app;
-    if (!/^[0-9a-f-]{36}$/.test(app)) {
-        const apps = JSON.parse(doctl(["apps", "list", "--output", "json"]));
-        appId = apps.find((a) => a.spec.name === app)?.id ?? fail(`No DigitalOcean app named "${app}"`);
-    }
-    const spec = JSON.parse(doctl(["apps", "spec", "get", appId, "--format", "json"]));
-    const components = [...(spec.services ?? []), ...(spec.workers ?? []), ...(spec.jobs ?? [])];
-    if (!components.length)
-        fail("The app spec has no services, workers, or jobs to configure");
-    for (const component of components) {
-        component.envs = (component.envs ?? []).filter((e) => !(e.key in values));
-        for (const [key, { value, secret }] of Object.entries(values)) {
-            if (value !== null)
-                component.envs.push({ key, value, scope: "RUN_TIME", ...(secret ? { type: "SECRET" } : {}) });
-        }
-    }
-    // Spec goes in via stdin so secrets never appear in process arguments
-    doctl(["apps", "update", appId, "--spec", "-", "--output", "json"], JSON.stringify(spec));
-    return appId;
-}
-// --- commands ---------------------------------------------------------------
 async function init(opts) {
+    const isJson = Boolean(opts.json || opts.export);
     const dir = process.cwd();
     const envFile = path.join(dir, ".env.local");
     const existing = readEnvFile(envFile);
-    const domain = publicHostname(String(opts.domain ?? existing.get("DAYWALKER_DOMAIN") ?? ""));
-    if (!domain)
-        fail("--domain must be the public hostname that serves this app, e.g. --domain sonalyze.daywalker.dev");
-    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? "").trim().toLowerCase();
-    if (!/^[a-z0-9_-]+$/.test(slug))
-        fail("--service must be this service's Daywalker slug, e.g. --service sonalyze");
+    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "")
+        .trim()
+        .toLowerCase();
+    if (!slug || !/^[a-z0-9_-]+$/.test(slug)) {
+        fail("--service must be this service's Daywalker slug (e.g. --service sonalyze)");
+    }
+    const rawDomain = opts.domain ? String(opts.domain) : existing.get("DAYWALKER_DOMAIN") ?? process.env.DAYWALKER_DOMAIN ?? "";
+    let domain = null;
+    if (rawDomain) {
+        domain = publicHostname(rawDomain);
+        if (!domain)
+            fail(`--domain (${rawDomain}) is not a valid public hostname`);
+    }
+    const apiKey = String(opts["api-key"] ?? existing.get("DAYWALKER_API_KEY") ?? process.env.DAYWALKER_API_KEY ?? "").trim() || null;
+    const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
     const keyExists = Boolean(existing.get("DAYWALKER_SIGNING_KEY")) && !opts.force;
-    const key = keyExists ? null : generateSigningKey();
-    const framework = opts.framework || detectFramework(dir);
-    let routeNote;
-    if (framework === "next")
-        routeNote = addNextRoute(dir);
-    else if (framework === "express")
-        routeNote = `add app.use(daywalkerKeys()) from "@shelbyb/daywalker-sdk/express" before your routes`;
-    else
-        routeNote = `serve GET /.well-known/daywalker-keys.json with daywalker().keys() (see the SDK README)`;
-    writeEnvFile(envFile, {
-        DAYWALKER_SERVICE_SLUG: slug,
-        DAYWALKER_DOMAIN: domain,
-        ...(key ? { DAYWALKER_SIGNING_KEY: key.privateKey } : {}),
-    });
-    ensureGitignored(dir, ".env.local");
-    console.log(`✔ Daywalker configured for ${domain} (service "${slug}")`);
-    console.log(`  • ${routeNote}`);
-    console.log(`  • .env.local: DAYWALKER_SERVICE_SLUG, DAYWALKER_DOMAIN${key ? ", DAYWALKER_SIGNING_KEY" : " (kept existing signing key)"}`);
-    if (key)
-        console.log(`  • key id ${key.publicJwk.kid}`);
-    if (opts["do-app"]) {
-        const signingKey = key?.privateKey ?? existing.get("DAYWALKER_SIGNING_KEY");
-        const appId = setDigitalOceanEnv(String(opts["do-app"]), {
-            DAYWALKER_SERVICE_SLUG: { value: slug, secret: false },
-            DAYWALKER_DOMAIN: { value: domain, secret: false },
-            DAYWALKER_SIGNING_KEY: { value: signingKey, secret: true },
+    const key = keyExists ? null : await generateSigningKey();
+    const activeKey = key ?? (existing.get("DAYWALKER_SIGNING_KEY") ? await loadSigningKey(existing.get("DAYWALKER_SIGNING_KEY")) : null);
+    const kid = activeKey?.publicJwk.kid ?? String(opts["key-id"] ?? "");
+    // Register public key directly with Daywalker Auth if API key is provided
+    let registered = false;
+    if (apiKey && activeKey && !opts["skip-register"]) {
+        if (!isJson)
+            console.log(`• Registering public key (${activeKey.publicJwk.kid}) with Daywalker Auth...`);
+        const regResult = await registerPublicKey({
+            authUrl,
+            apiKey,
+            serviceSlug: slug,
+            domain,
+            publicJwk: activeKey.publicJwk,
         });
-        console.log(`  • DigitalOcean app ${appId}: env vars set (signing key encrypted); a redeploy has started`);
-        console.log(`    Pull the updated spec into .do/app.yaml before your next spec deploy, or the key will be removed.`);
+        if (regResult.ok) {
+            registered = true;
+            if (!isJson)
+                console.log(`✔ Public key registered with Daywalker Auth (Push Architecture)`);
+        }
+        else {
+            if (!isJson) {
+                console.warn(redactSecrets(`! Key registration warning (${regResult.status}): ${regResult.error}`));
+                console.warn(`  You can register the key later by re-running init with your DAYWALKER_API_KEY.`);
+            }
+        }
     }
-    else {
-        console.log(`  • Production: set DAYWALKER_SERVICE_SLUG, DAYWALKER_DOMAIN, and DAYWALKER_SIGNING_KEY (as a secret)`);
-        console.log(`    on your host, or re-run with --do-app <name> for DigitalOcean App Platform.`);
+    else if (!apiKey && !opts["skip-register"] && !isJson) {
+        console.log(`• Note: Set DAYWALKER_API_KEY in .env.local to automatically register public keys.`);
     }
-    if (opts["print-key"] && key)
-        console.log(`\nDAYWALKER_SIGNING_KEY=${key.privateKey}`);
-    console.log(`\nNext: deploy, then run \`npx daywalker check\`, and add ${domain} (or *.${domain.split(".").slice(1).join(".")}) to your token's allowed callers.`);
+    const signingKeyStr = key?.privateKeyPkcs8Base64 ?? existing.get("DAYWALKER_SIGNING_KEY") ?? "";
+    const envValues = {
+        DAYWALKER_SERVICE_SLUG: slug,
+        DAYWALKER_KEY_ID: kid,
+        DAYWALKER_AUTH_URL: authUrl,
+        ...(domain ? { DAYWALKER_DOMAIN: domain } : {}),
+        ...(apiKey ? { DAYWALKER_API_KEY: apiKey } : {}),
+        ...(signingKeyStr ? { DAYWALKER_SIGNING_KEY: signingKeyStr } : {}),
+    };
+    if (isJson) {
+        console.log(JSON.stringify(envValues, null, 2));
+        return;
+    }
+    writeEnvFile(envFile, envValues);
+    ensureGitignored(dir, ".env.local");
+    console.log(`✔ Daywalker configured for service "${slug}"${domain ? ` (${domain})` : ""}`);
+    console.log(`  • RFC 9421 / RFC 9530 HTTP Message Signing active`);
+    console.log(`  • .env.local: DAYWALKER_SERVICE_SLUG, DAYWALKER_KEY_ID, DAYWALKER_AUTH_URL${domain ? ", DAYWALKER_DOMAIN" : ""}${apiKey ? ", DAYWALKER_API_KEY" : ""}${signingKeyStr ? ", DAYWALKER_SIGNING_KEY" : ""}`);
+    if (kid)
+        console.log(`  • Key ID (RFC 7638 thumbprint): ${kid}`);
+    if (registered)
+        console.log(`  • Zero-ingress push architecture: public key registered directly`);
+    if (opts["print-key"] && signingKeyStr)
+        console.log(`\nDAYWALKER_SIGNING_KEY=${signingKeyStr}`);
 }
 async function rotate(opts) {
-    const envFile = path.join(process.cwd(), ".env.local");
+    const isJson = Boolean(opts.json || opts.export);
+    const dir = process.cwd();
+    const envFile = path.join(dir, ".env.local");
     const existing = readEnvFile(envFile);
-    const current = existing.get("DAYWALKER_SIGNING_KEY");
+    const current = existing.get("DAYWALKER_SIGNING_KEY") ?? process.env.DAYWALKER_SIGNING_KEY;
     if (!current)
-        fail("No DAYWALKER_SIGNING_KEY in .env.local; run `daywalker init` first");
-    const key = generateSigningKey();
-    writeEnvFile(envFile, { DAYWALKER_SIGNING_KEY: key.privateKey, DAYWALKER_SIGNING_KEY_PREVIOUS: current });
-    console.log(`✔ New key ${key.publicJwk.kid} written; the old key stays published as DAYWALKER_SIGNING_KEY_PREVIOUS.`);
-    if (opts["do-app"]) {
-        const appId = setDigitalOceanEnv(String(opts["do-app"]), {
-            DAYWALKER_SIGNING_KEY: { value: key.privateKey, secret: true },
-            DAYWALKER_SIGNING_KEY_PREVIOUS: { value: current, secret: true },
+        fail("No DAYWALKER_SIGNING_KEY found; run `daywalker init` first");
+    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "").trim().toLowerCase();
+    const apiKey = String(opts["api-key"] ?? existing.get("DAYWALKER_API_KEY") ?? process.env.DAYWALKER_API_KEY ?? "").trim() || null;
+    const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    const key = await generateSigningKey();
+    if (apiKey && slug) {
+        if (!isJson)
+            console.log(`• Registering new public key (${key.publicJwk.kid}) with Daywalker Auth...`);
+        const regResult = await registerPublicKey({
+            authUrl,
+            apiKey,
+            serviceSlug: slug,
+            publicJwk: key.publicJwk,
         });
-        console.log(`  • DigitalOcean app ${appId} updated; a redeploy has started.`);
+        if (regResult.ok) {
+            if (!isJson)
+                console.log(`✔ New public key registered with Daywalker Auth`);
+        }
+        else {
+            if (!isJson)
+                console.warn(redactSecrets(`! Key registration warning: ${regResult.error}`));
+        }
     }
-    console.log(`  After the deploy is live, remove DAYWALKER_SIGNING_KEY_PREVIOUS to retire the old key.`);
+    const envValues = {
+        DAYWALKER_KEY_ID: key.publicJwk.kid,
+        DAYWALKER_SIGNING_KEY: key.privateKeyPkcs8Base64 ?? "",
+        DAYWALKER_SIGNING_KEY_PREVIOUS: current,
+    };
+    if (isJson) {
+        console.log(JSON.stringify(envValues, null, 2));
+        return;
+    }
+    writeEnvFile(envFile, envValues);
+    console.log(`✔ New key ${key.publicJwk.kid} written; previous key preserved as DAYWALKER_SIGNING_KEY_PREVIOUS.`);
+    console.log(`  After deployment rollout is complete, you may remove DAYWALKER_SIGNING_KEY_PREVIOUS.`);
     if (opts["print-key"])
-        console.log(`\nDAYWALKER_SIGNING_KEY=${key.privateKey}`);
+        console.log(`\nDAYWALKER_SIGNING_KEY=${key.privateKeyPkcs8Base64}`);
 }
 async function check() {
-    // Merge .env.local over the process env, like Next.js does in development
     const env = { ...process.env, ...Object.fromEntries(readEnvFile(path.join(process.cwd(), ".env.local"))) };
-    const result = await createDaywalker({ env }).selfCheck();
-    console.log(`domain:  ${result.domain ?? "(none)"}`);
-    console.log(`keys:    ${result.keysUrl ?? "(none)"}`);
-    console.log(`signing: ${result.signing ? "yes" : "no"}`);
-    if (result.ok)
-        console.log("✔ Ready: requests will be signed and your key is published.");
-    else {
-        for (const p of result.problems)
-            console.log(`✖ ${p}`);
-        process.exit(1);
+    const client = createDaywalker({ env });
+    const result = await client.selfCheck();
+    if (result.ok) {
+        console.log(`✔ Daywalker configuration looks good`);
+        if (result.serviceSlug)
+            console.log(`  • Service slug: ${result.serviceSlug}`);
+        if (result.domain)
+            console.log(`  • Caller domain: ${result.domain}`);
+        if (result.keyId)
+            console.log(`  • Key ID: ${result.keyId}`);
+        if (result.signing)
+            console.log(`  • RFC 9421 signature signing: ready`);
+        if (result.offlineVerificationReady)
+            console.log(`  • Zero-egress offline JWT lease verification: ready`);
+        return;
     }
+    console.error(`✖ Daywalker self-check found problems:`);
+    for (const p of result.problems)
+        console.error(redactSecrets(`  - ${p}`));
+    process.exit(1);
 }
-const [command, ...rest] = process.argv.slice(2);
-const opts = args(rest);
-const commands = { init, rotate, check };
-if (!command || !commands[command] || opts.help) {
-    console.log(HELP);
-    process.exit(command && !opts.help ? 1 : 0);
+async function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    const parsedArgs = args(rest);
+    if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
+        console.log(HELP);
+        return;
+    }
+    if (cmd === "init") {
+        await init(parsedArgs);
+    }
+    else if (cmd === "rotate") {
+        await rotate(parsedArgs);
+    }
+    else if (cmd === "check") {
+        await check();
+    }
+    else {
+        fail(`Unknown command "${cmd}". Run \`daywalker --help\` for usage.`);
+    }
 }
-commands[command](opts).catch((err) => fail(err.message));
+main().catch((err) => {
+    console.error(redactSecrets(String(err?.stack || err)));
+    process.exit(1);
+});