@shelbyb/daywalker-sdk 0.1.0 → 0.1.2

package/dist/next.d.ts

@@ -1,10 +1,63 @@
-import { type Daywalker } from "./client.js";
+import { Daywalker } from "./client.js";
+import type { TokenPayload } from "./types.js";
 /**
- * Next.js App Router route handler for /.well-known/daywalker-keys.json.
+ * Real Server Action IDs are hex hashes. Scanners probing for CVE-2025-55182 (React2Shell)
+ * send junk like `Next-Action: x`, which Next.js rejects with an internal error.
+ * Dropping them up front protects application logs and server resources.
+ */
+export declare const SERVER_ACTION_ID_PATTERN: RegExp;
+export declare const DEFAULT_BYPASS_PATHS: string[];
+export interface NextMiddlewareOptions {
+    client?: Daywalker;
+    serviceSlug?: string;
+    bypassPaths?: string[];
+    errorPath?: string;
+    homePath?: string;
+    protectApiOnly?: boolean;
+    validateServerActions?: boolean;
+    allowedHosts?: string[];
+}
+/**
+ * Sanitizes open redirect path parameter (`from`).
+ * Prevents protocol-relative URLs (`//evil.com`), backslashes (`/\evil.com`), and control characters.
+ */
+export declare function sanitizeRedirectPath(path: string): string | null;
+/**
+ * Hardened Next.js Middleware for root `middleware.ts`.
+ *
+ * Implements:
+ * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
+ * 2. Static asset and health check bypass
+ * 3. Self-healing service error page routing with `from` back-redirect
+ * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect)
+ *
+ * Example:
+ *   // middleware.ts
+ *   import { createDaywalkerMiddleware } from "@shelbyb/daywalker-sdk/next";
+ *
+ *   export const middleware = createDaywalkerMiddleware();
+ *
+ *   export const config = {
+ *     matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+ *   };
+ */
+export declare function createDaywalkerMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;
+/**
+ * Next.js App Router route handler wrapper with Daywalker token validation.
+ * Extracts `Authorization: Bearer <token>` or `x-api-token`, validates via client,
+ * returns 401/429 JSON response on error, or passes validated `auth` payload in context.
+ *
+ * Example:
+ *   // app/api/protected/route.ts
+ *   import { withDaywalkerAuth } from "@shelbyb/daywalker-sdk/next";
  *
- *   // app/.well-known/daywalker-keys.json/route.ts
- *   export { GET, dynamic } from "@shelbyb/daywalker-sdk/next";
+ *   export const POST = withDaywalkerAuth(async (req, { auth }) => {
+ *     return Response.json({ message: "Hello " + auth.serviceSlug, auth });
+ *   });
  */
-export declare const dynamic = "force-dynamic";
-export declare function keysRouteHandler(client?: Daywalker): () => Response;
-export declare const GET: () => Response;
+export declare function withDaywalkerAuth<Context extends Record<string, unknown> = Record<string, unknown>>(handler: (req: Request, context: Context & {
+    auth: TokenPayload;
+}) => Promise<Response>, clientOrOptions?: Daywalker | {
+    client?: Daywalker;
+    serviceSlug?: string;
+}): (req: Request, context?: Context) => Promise<Response>;

package/dist/next.js

@@ -1,14 +1,189 @@
-import { daywalker } from "./client.js";
+import { daywalker, Daywalker } from "./client.js";
 /**
- * Next.js App Router route handler for /.well-known/daywalker-keys.json.
+ * Real Server Action IDs are hex hashes. Scanners probing for CVE-2025-55182 (React2Shell)
+ * send junk like `Next-Action: x`, which Next.js rejects with an internal error.
+ * Dropping them up front protects application logs and server resources.
+ */
+export const SERVER_ACTION_ID_PATTERN = /^[0-9a-f]{40,}$/i;
+export const DEFAULT_BYPASS_PATHS = [
+    "/api/health",
+    "/healthz",
+    "/favicon.ico",
+    "/robots.txt",
+    "/sitemap.xml",
+];
+/**
+ * Sanitizes open redirect path parameter (`from`).
+ * Prevents protocol-relative URLs (`//evil.com`), backslashes (`/\evil.com`), and control characters.
+ */
+export function sanitizeRedirectPath(path) {
+    if (!path || typeof path !== "string")
+        return null;
+    const clean = path.trim().replace(/[\r\n\0]/g, "");
+    if (!clean.startsWith("/") || clean.startsWith("//") || clean.startsWith("/\\")) {
+        return null;
+    }
+    return clean;
+}
+function extractToken(req) {
+    const authHeader = req.headers.get("authorization");
+    if (authHeader && authHeader.toLowerCase().startsWith("bearer ")) {
+        return authHeader.slice(7).trim();
+    }
+    const apiTokenHeader = req.headers.get("x-api-token");
+    if (apiTokenHeader) {
+        return apiTokenHeader.trim();
+    }
+    return null;
+}
+/**
+ * Hardened Next.js Middleware for root `middleware.ts`.
+ *
+ * Implements:
+ * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
+ * 2. Static asset and health check bypass
+ * 3. Self-healing service error page routing with `from` back-redirect
+ * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect)
+ *
+ * Example:
+ *   // middleware.ts
+ *   import { createDaywalkerMiddleware } from "@shelbyb/daywalker-sdk/next";
+ *
+ *   export const middleware = createDaywalkerMiddleware();
+ *
+ *   export const config = {
+ *     matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+ *   };
+ */
+export function createDaywalkerMiddleware(options = {}) {
+    const client = options.client ?? daywalker;
+    const bypassPaths = options.bypassPaths ?? DEFAULT_BYPASS_PATHS;
+    const errorPath = options.errorPath ?? "/service-error";
+    const homePath = options.homePath ?? "/";
+    const validateServerActions = options.validateServerActions ?? true;
+    return async function middleware(request) {
+        const url = new URL(request.url);
+        const pathname = url.pathname;
+        const search = url.search;
+        // Host header validation if allowedHosts configured
+        if (options.allowedHosts && options.allowedHosts.length > 0) {
+            const host = request.headers.get("host")?.toLowerCase().replace(/:\d+$/, "");
+            if (host && !options.allowedHosts.some((h) => h.toLowerCase() === host)) {
+                return Response.json({ error: "Forbidden", message: "Invalid host header." }, { status: 403 });
+            }
+        }
+        // 0. Reject malformed Server Action requests before routing or auth checks
+        if (validateServerActions) {
+            const actionId = request.headers.get("next-action");
+            if (actionId !== null && (actionId.length > 256 || !SERVER_ACTION_ID_PATTERN.test(actionId.trim()))) {
+                return Response.json({ error: "Bad Request", message: "Invalid Server Action request." }, { status: 400 });
+            }
+        }
+        // 1. Bypass static files and health check probes
+        if (bypassPaths.some((path) => pathname === path || pathname.startsWith(`${path}/`)) ||
+            pathname.startsWith("/_next") ||
+            (pathname.includes(".") && !pathname.endsWith(".json"))) {
+            return globalThis.NextResponse?.next
+                ? globalThis.NextResponse.next()
+                : new Response(null, { headers: { "x-middleware-next": "1" } });
+        }
+        // 2. Validate token (from request header, or service's configured DAYWALKER_API_KEY)
+        const incomingToken = extractToken(request);
+        const authResult = await client.validateToken(incomingToken ? { token: incomingToken, serviceSlug: options.serviceSlug } : { serviceSlug: options.serviceSlug });
+        // 3. Handle service error page route
+        if (pathname === errorPath) {
+            if (authResult.ok) {
+                // If the service token is now valid, heal/redirect back to home or referer
+                const redirectUrl = new URL(homePath, request.url);
+                return globalThis.NextResponse?.redirect
+                    ? globalThis.NextResponse.redirect(redirectUrl)
+                    : Response.redirect(redirectUrl.toString(), 307);
+            }
+            // Allow rendering the error page
+            return globalThis.NextResponse?.next
+                ? globalThis.NextResponse.next()
+                : new Response(null, { headers: { "x-middleware-next": "1" } });
+        }
+        // 4. Handle invalid token for all other routes
+        if (!authResult.ok) {
+            // API routes: return JSON error response
+            if (pathname.startsWith("/api/")) {
+                return Response.json({
+                    error: authResult.error || "Unauthorized",
+                    message: authResult.message || "Service authorization check failed with Daywalker Auth.",
+                    retryAfter: authResult.retryAfter,
+                }, {
+                    status: authResult.status || 401,
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Access-Control-Allow-Origin": "*",
+                        "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+                        "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Api-Token",
+                        ...(authResult.retryAfter ? { "Retry-After": String(authResult.retryAfter) } : {}),
+                    },
+                });
+            }
+            // If user only wanted API protection, allow web routes through
+            if (options.protectApiOnly) {
+                return globalThis.NextResponse?.next
+                    ? globalThis.NextResponse.next()
+                    : new Response(null, { headers: { "x-middleware-next": "1" } });
+            }
+            // Web UI routes: redirect to diagnostic service error screen
+            const redirectUrl = new URL(errorPath, request.url);
+            redirectUrl.searchParams.set("error", authResult.error || "Unauthorized");
+            redirectUrl.searchParams.set("message", authResult.message || "Service authorization check failed.");
+            redirectUrl.searchParams.set("status", String(authResult.status || 401));
+            if (pathname !== "/" || search) {
+                const rawTarget = `${pathname}${search}`;
+                const sanitized = sanitizeRedirectPath(rawTarget);
+                if (sanitized) {
+                    redirectUrl.searchParams.set("from", sanitized);
+                }
+            }
+            return globalThis.NextResponse?.redirect
+                ? globalThis.NextResponse.redirect(redirectUrl)
+                : Response.redirect(redirectUrl.toString(), 307);
+        }
+        return globalThis.NextResponse?.next
+            ? globalThis.NextResponse.next()
+            : new Response(null, { headers: { "x-middleware-next": "1" } });
+    };
+}
+/**
+ * Next.js App Router route handler wrapper with Daywalker token validation.
+ * Extracts `Authorization: Bearer <token>` or `x-api-token`, validates via client,
+ * returns 401/429 JSON response on error, or passes validated `auth` payload in context.
+ *
+ * Example:
+ *   // app/api/protected/route.ts
+ *   import { withDaywalkerAuth } from "@shelbyb/daywalker-sdk/next";
  *
- *   // app/.well-known/daywalker-keys.json/route.ts
- *   export { GET, dynamic } from "@shelbyb/daywalker-sdk/next";
+ *   export const POST = withDaywalkerAuth(async (req, { auth }) => {
+ *     return Response.json({ message: "Hello " + auth.serviceSlug, auth });
+ *   });
  */
-export const dynamic = "force-dynamic";
-export function keysRouteHandler(client = daywalker()) {
-    return function GET() {
-        return Response.json(client.keys(), { headers: { "Cache-Control": "public, max-age=300" } });
+export function withDaywalkerAuth(handler, clientOrOptions) {
+    const client = clientOrOptions instanceof Daywalker
+        ? clientOrOptions
+        : clientOrOptions?.client ?? daywalker;
+    const serviceSlug = !(clientOrOptions instanceof Daywalker) ? clientOrOptions?.serviceSlug : undefined;
+    return async function daywalkerAuthHandler(req, context) {
+        const token = extractToken(req);
+        if (!token) {
+            return Response.json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }, { status: 401 });
+        }
+        const result = await client.validateToken(token, { serviceSlug });
+        if (!result.ok) {
+            return Response.json({ error: result.error, message: result.message, retryAfter: result.retryAfter }, {
+                status: result.status === 429 ? 429 : 401,
+                headers: result.retryAfter ? { "Retry-After": String(result.retryAfter) } : undefined,
+            });
+        }
+        const mergedContext = {
+            ...(context ?? {}),
+            auth: result.data,
+        };
+        return handler(req, mergedContext);
     };
 }
-export const GET = () => keysRouteHandler()();

package/dist/signing.d.ts

@@ -1,53 +1,3 @@
-import { type KeyObject } from "node:crypto";
-/**
- * Domain-signed requests to Daywalker Auth.
- *
- * Each request is signed with an Ed25519 key whose public half the calling service serves at
- * https://<domain>/.well-known/daywalker-keys.json. Daywalker fetches that key over HTTPS, so
- * a valid signature proves the request comes from whoever controls the domain, wherever the
- * service is hosted. This must match Daywalker's verifier exactly (src/lib/request-signature.ts
- * in daywalker-service-auth).
- */
-export declare const SIGNATURE_VERSION = "daywalker-v1";
+export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./crypto/index.js";
 export declare const KEYS_PATH = "/.well-known/daywalker-keys.json";
-export interface PublicJwk {
-    kty: "OKP";
-    crv: "Ed25519";
-    x: string;
-    kid: string;
-    use: "sig";
-    alg: "EdDSA";
-}
-export interface SigningKey {
-    privateKey: KeyObject;
-    publicJwk: PublicJwk;
-}
-/** Generate a new key; `privateKey` is base64 PKCS#8 DER, the format DAYWALKER_SIGNING_KEY expects. */
-export declare function generateSigningKey(): {
-    privateKey: string;
-    publicJwk: PublicJwk;
-};
-/**
- * Load a private key from env: PKCS#8 PEM (literal "\n" escapes are fine) or base64 PKCS#8 DER.
- * The key id is the RFC 7638 JWK thumbprint, so it's stable without extra configuration.
- */
-export declare function loadSigningKey(raw: string): SigningKey;
-export declare function canonicalPayload(p: {
-    method: string;
-    path: string;
-    domain: string;
-    timestamp: string;
-    nonce: string;
-    body: string;
-}): string;
-/** The X-Daywalker-* headers for one request. Send exactly `body` as the request body. */
-export declare function signRequest(params: {
-    method: string;
-    /** URL path only, e.g. /api/v1/tokens/validate */
-    path: string;
-    domain: string;
-    body: string;
-    key: SigningKey;
-    timestamp?: number;
-    nonce?: string;
-}): Record<string, string>;
+export type { PublicJwk, SigningKey, SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, } from "./types.js";

package/dist/signing.js

@@ -1,51 +1,2 @@
-import crypto from "node:crypto";
-/**
- * Domain-signed requests to Daywalker Auth.
- *
- * Each request is signed with an Ed25519 key whose public half the calling service serves at
- * https://<domain>/.well-known/daywalker-keys.json. Daywalker fetches that key over HTTPS, so
- * a valid signature proves the request comes from whoever controls the domain, wherever the
- * service is hosted. This must match Daywalker's verifier exactly (src/lib/request-signature.ts
- * in daywalker-service-auth).
- */
-export const SIGNATURE_VERSION = "daywalker-v1";
+export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./crypto/index.js";
 export const KEYS_PATH = "/.well-known/daywalker-keys.json";
-/** Generate a new key; `privateKey` is base64 PKCS#8 DER, the format DAYWALKER_SIGNING_KEY expects. */
-export function generateSigningKey() {
-    const { privateKey } = crypto.generateKeyPairSync("ed25519");
-    const der = privateKey.export({ format: "der", type: "pkcs8" }).toString("base64");
-    return { privateKey: der, publicJwk: loadSigningKey(der).publicJwk };
-}
-/**
- * Load a private key from env: PKCS#8 PEM (literal "\n" escapes are fine) or base64 PKCS#8 DER.
- * The key id is the RFC 7638 JWK thumbprint, so it's stable without extra configuration.
- */
-export function loadSigningKey(raw) {
-    const value = raw.trim();
-    const privateKey = value.includes("-----BEGIN")
-        ? crypto.createPrivateKey(value.replace(/\\n/g, "\n"))
-        : crypto.createPrivateKey({ key: Buffer.from(value, "base64"), format: "der", type: "pkcs8" });
-    if (privateKey.asymmetricKeyType !== "ed25519") {
-        throw new Error(`DAYWALKER_SIGNING_KEY must be an Ed25519 key (got ${privateKey.asymmetricKeyType})`);
-    }
-    const { x } = crypto.createPublicKey(privateKey).export({ format: "jwk" });
-    const kid = crypto.createHash("sha256").update(JSON.stringify({ crv: "Ed25519", kty: "OKP", x })).digest("base64url");
-    return { privateKey, publicJwk: { kty: "OKP", crv: "Ed25519", x, kid, use: "sig", alg: "EdDSA" } };
-}
-export function canonicalPayload(p) {
-    const bodySha256 = crypto.createHash("sha256").update(p.body, "utf8").digest("hex");
-    return [SIGNATURE_VERSION, p.method.toUpperCase(), p.path, p.domain.toLowerCase(), p.timestamp, p.nonce, bodySha256].join("\n");
-}
-/** The X-Daywalker-* headers for one request. Send exactly `body` as the request body. */
-export function signRequest(params) {
-    const timestamp = String(params.timestamp ?? Math.floor(Date.now() / 1000));
-    const nonce = params.nonce ?? crypto.randomBytes(24).toString("base64url");
-    const payload = canonicalPayload({ ...params, timestamp, nonce });
-    return {
-        "X-Daywalker-Domain": params.domain.toLowerCase(),
-        "X-Daywalker-Key-Id": params.key.publicJwk.kid,
-        "X-Daywalker-Timestamp": timestamp,
-        "X-Daywalker-Nonce": nonce,
-        "X-Daywalker-Signature": crypto.sign(null, Buffer.from(payload), params.key.privateKey).toString("base64url"),
-    };
-}

package/dist/types.d.ts

@@ -0,0 +1,122 @@
+export interface RateLimitWindow {
+    limit: number;
+    remaining: number;
+    reset: number;
+}
+export interface TokenPayload {
+    serviceSlug: string;
+    tenantId: string;
+    rateLimit: RateLimitWindow;
+    rateLimitHourly?: RateLimitWindow;
+    tokenId?: string;
+    tokenName?: string;
+    userId?: string;
+    stage?: string;
+    offlineVerified?: boolean;
+    [key: string]: unknown;
+}
+export type ValidateErrorCode = "EXPIRED" | "REVOKED" | "INVALID_TOKEN" | "RATE_LIMITED" | "NETWORK_ERROR" | "CONFIGURATION_ERROR" | string;
+export type ValidateResult = {
+    ok: true;
+    data: TokenPayload;
+} | {
+    ok: false;
+    error: ValidateErrorCode;
+    status: number;
+    message: string;
+    retryAfter?: number;
+};
+export interface PublicJwk {
+    kty: "OKP";
+    crv: "Ed25519";
+    x: string;
+    kid: string;
+    use?: "sig";
+    alg?: "EdDSA" | "ed25519";
+}
+export interface SigningKey {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicJwk: PublicJwk;
+    privateKeyPkcs8Base64?: string;
+}
+export interface RetryOptions {
+    maxRetries?: number;
+    initialDelayMs?: number;
+    maxDelayMs?: number;
+    backoffFactor?: number;
+    jitter?: boolean;
+}
+export interface DaywalkerConfig {
+    apiKey?: string;
+    signingKey?: string | SigningKey;
+    previousSigningKey?: string | SigningKey;
+    keyId?: string;
+    serviceSlug?: string;
+    domain?: string;
+    daywalkerPublicKey?: string | PublicJwk;
+    authUrl?: string;
+    cacheTtlMs?: number;
+    maxRetries?: number;
+    retry?: RetryOptions;
+    fetch?: typeof fetch;
+    env?: Record<string, string | undefined>;
+}
+export interface SelfCheckResult {
+    ok: boolean;
+    serviceSlug: string | null;
+    domain: string | null;
+    signing: boolean;
+    keyId: string | null;
+    offlineVerificationReady: boolean;
+    problems: string[];
+}
+export interface SignedHeaders {
+    "Content-Digest"?: string;
+    "Signature-Input": string;
+    Signature: string;
+    Authorization?: string;
+    [key: string]: string | undefined;
+}
+export interface SignRequestParams {
+    method: string;
+    path: string;
+    authority: string;
+    body?: string | Uint8Array | null;
+    key: SigningKey | string;
+    created?: number;
+    keyid?: string;
+    alg?: string;
+    apiKey?: string;
+    nonce?: string;
+}
+export interface VerifySignatureParams {
+    method: string;
+    path: string;
+    authority: string;
+    headers: Record<string, string | undefined> | Headers;
+    body?: string | Uint8Array | null;
+    publicKey: PublicJwk | CryptoKey | string;
+    currentTime?: number;
+    maxClockSkewSeconds?: number;
+    replayCheck?: boolean;
+}
+export interface VerifySignatureResult {
+    valid: boolean;
+    keyid?: string;
+    error?: string;
+}
+export declare class DaywalkerError extends Error {
+    readonly status?: number;
+    readonly code?: string;
+    constructor(message: string, status?: number, code?: string);
+    toJSON(): Record<string, unknown>;
+}
+export declare class DaywalkerAuthError extends DaywalkerError {
+    constructor(message: string, status?: number, code?: ValidateErrorCode);
+}
+export declare class DaywalkerRateLimitError extends DaywalkerError {
+    readonly retryAfter?: number;
+    constructor(message: string, retryAfter?: number);
+    toJSON(): Record<string, unknown>;
+}

package/dist/types.js

@@ -0,0 +1,46 @@
+import { redactSecrets } from "./crypto/encoding.js";
+export class DaywalkerError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        const cleanMessage = redactSecrets(message);
+        super(cleanMessage);
+        this.name = "DaywalkerError";
+        this.status = status;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            message: redactSecrets(this.message),
+            status: this.status,
+            code: this.code,
+        };
+    }
+    [Symbol.for("nodejs.util.inspect.custom")]() {
+        return this.toJSON();
+    }
+}
+export class DaywalkerAuthError extends DaywalkerError {
+    constructor(message, status = 401, code = "INVALID_TOKEN") {
+        super(message, status, code);
+        this.name = "DaywalkerAuthError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DaywalkerRateLimitError extends DaywalkerError {
+    retryAfter;
+    constructor(message, retryAfter) {
+        super(message, 429, "RATE_LIMITED");
+        this.name = "DaywalkerRateLimitError";
+        this.retryAfter = retryAfter;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    toJSON() {
+        return {
+            ...super.toJSON(),
+            retryAfter: this.retryAfter,
+        };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shelbyb/daywalker-sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Validate Daywalker API tokens and make domain-signed calls to Daywalker Auth from any service.",
   "type": "module",
   "main": "./dist/index.js",
@@ -14,16 +14,21 @@
       "types": "./dist/next.d.ts",
       "import": "./dist/next.js"
     },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.js"
+    },
     "./express": {
       "types": "./dist/express.d.ts",
       "import": "./dist/express.js"
     }
   },
   "bin": {
-    "daywalker": "./dist/cli.js"
+    "daywalker": "dist/cli.js"
   },
   "files": [
     "dist",
+    "assets",
     "README.md",
     "LICENSE"
   ],
@@ -33,7 +38,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "prepublishOnly": "npm run build"
+    "test": "npm run build && node --import tsx --test test/*.test.ts",
+    "prepublishOnly": "npm test"
   },
   "publishConfig": {
     "access": "public",
@@ -42,13 +48,13 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Shelbyb/daywalker-service-auth.git",
-    "directory": "packages/sdk"
+    "url": "git+https://github.com/Shelbyb/daywalker-sdk.git"
   },
   "license": "MIT",
   "devDependencies": {
     "@types/node": "^22.13.5",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "tsx": "^4.23.15"
   },
   "keywords": [
     "daywalker",
@@ -57,5 +63,8 @@
     "ed25519",
     "request-signing"
   ],
-  "homepage": "https://auth.daywalker.dev/docs"
+  "homepage": "https://auth.daywalker.dev/docs",
+  "bugs": {
+    "url": "https://github.com/Shelbyb/daywalker-sdk/issues"
+  }
 }