@shelbyb/daywalker-sdk 0.1.1 → 0.1.3

package/README.md

@@ -34,8 +34,8 @@ npm install @shelbyb/daywalker-sdk
 # Generate Ed25519 keypair and write .env.local
 npx daywalker init --service my-service-slug
 
-# Or register the public key immediately with Daywalker Auth:
-npx daywalker init --service my-service-slug --api-key srv_live_...
+# Or register the public key immediately with Daywalker Auth (domain is required by the API):
+npx daywalker init --service my-service-slug --domain app.example.com --api-key srv_live_...
 
 # Pipe JSON secrets directly into Vercel, Fly.io, DigitalOcean, or AWS SSM:
 npx daywalker init --service my-service-slug --api-key srv_live_... --json
@@ -43,7 +43,7 @@ npx daywalker init --service my-service-slug --api-key srv_live_... --json
 
 `daywalker init`:
 - Generates an Ed25519 keypair locally using WebCrypto (`crypto.subtle`)
-- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register`
+- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register` (`Authorization: Bearer <API key>`, body `{ keyId, domain, publicKey }`; responds `201`)
 - Writes `DAYWALKER_SERVICE_SLUG`, `DAYWALKER_KEY_ID`, `DAYWALKER_SIGNING_KEY`, and `DAYWALKER_AUTH_URL` to `.env.local`
 - No route injectors or public `/.well-known/` endpoints needed
 
@@ -193,6 +193,19 @@ const result = await client.validateToken(incomingJwt);
 
 ---
 
+## API Reference (per the [OpenAPI spec](https://auth.daywalker.dev/docs))
+
+| Endpoint | SDK usage | Notes |
+|---|---|---|
+| `POST /api/v1/tokens/validate` | `client.validateToken()` | Body `{ token, serviceSlug }`; signed with `Signature-Input`, `Signature`, `Content-Digest`. Errors: `400` (`DIGEST_MISMATCH`/missing fields), `401` (`INVALID_SIGNATURE`/invalid token), `403`, `429`. Response includes `valid`, `tokenId`, `tokenName`, `userId`, `stage`, `rateLimit`, `rateLimitHourly` and `X-RateLimit-*` / `X-RateLimit-Hourly-*` headers |
+| `POST /api/v1/keys/register` | `npx daywalker init` / `rotate` | Bearer auth; body `{ keyId, domain, publicKey }` |
+| `POST /api/v1/leases/issue` | `client.issueLease(ttlSeconds?)` | Signed request returns `{ lease, tokenType, expiresAt, jwksUri }` (EdDSA JWT) |
+| `GET /.well-known/jwks.json` | `client.fetchJwks()` | Daywalker public JWKS for offline lease verification |
+
+Inbound tokens may be supplied as `x-api-token: srv_live_...` or `Authorization: Bearer <JWT or API key>`.
+
+---
+
 ## Request Signing Specification (RFC 9421 & RFC 9530)
 
 Each outbound request signed by `@shelbyb/daywalker-sdk` includes:

package/dist/cli.js

@@ -171,6 +171,7 @@ async function rotate(opts) {
     const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "").trim().toLowerCase();
     const apiKey = String(opts["api-key"] ?? existing.get("DAYWALKER_API_KEY") ?? process.env.DAYWALKER_API_KEY ?? "").trim() || null;
     const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    const rotateDomain = publicHostname(String(opts.domain ?? existing.get("DAYWALKER_DOMAIN") ?? process.env.DAYWALKER_DOMAIN ?? ""));
     const key = await generateSigningKey();
     if (apiKey && slug) {
         if (!isJson)
@@ -179,6 +180,7 @@ async function rotate(opts) {
             authUrl,
             apiKey,
             serviceSlug: slug,
+            domain: rotateDomain,
             publicJwk: key.publicJwk,
         });
         if (regResult.ok) {

package/dist/client.d.ts

@@ -42,6 +42,21 @@ export declare class Daywalker {
         serviceSlug?: string;
         offlineOnly?: boolean;
     }): Promise<TokenPayload>;
+    /**
+     * Exchanges an RFC 9421 signed request for a short-lived EdDSA JWT lease (POST /api/v1/leases/issue).
+     */
+    issueLease(ttlSeconds?: number): Promise<{
+        lease: string;
+        tokenType?: string;
+        expiresAt?: string;
+        jwksUri?: string;
+    }>;
+    /**
+     * Fetches Daywalker's public JWKS (GET /.well-known/jwks.json) for offline lease verification.
+     */
+    fetchJwks(): Promise<{
+        keys: PublicJwk[];
+    }>;
     /**
      * The public JWK(s) configured for this service.
      */

package/dist/client.js

@@ -1,6 +1,6 @@
 import { resolveConfig } from "./config.js";
 import { loadSigningKey, signRequest, verifyJwtLease, maskSecret, redactSecrets, } from "./crypto/index.js";
-import { DaywalkerAuthError, DaywalkerRateLimitError, } from "./types.js";
+import { DaywalkerAuthError, DaywalkerError, DaywalkerRateLimitError, } from "./types.js";
 function parseRetryAfter(headerValue) {
     if (!headerValue)
         return undefined;
@@ -311,6 +311,29 @@ export class Daywalker {
         }
         return result.data;
     }
+    /**
+     * Exchanges an RFC 9421 signed request for a short-lived EdDSA JWT lease (POST /api/v1/leases/issue).
+     */
+    async issueLease(ttlSeconds) {
+        const res = await this.fetch("/api/v1/leases/issue", {
+            method: "POST",
+            body: ttlSeconds ? { ttlSeconds } : {},
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (res.status !== 201 && res.status !== 200) {
+            throw new DaywalkerAuthError(redactSecrets(String(json.message || json.error || `Lease issue failed with HTTP ${res.status}`)), res.status, json.error);
+        }
+        return json;
+    }
+    /**
+     * Fetches Daywalker's public JWKS (GET /.well-known/jwks.json) for offline lease verification.
+     */
+    async fetchJwks() {
+        const res = await globalThis.fetch(`${this._config.authUrl.replace(/\/+$/, "")}/.well-known/jwks.json`, { headers: { Accept: "application/json" } });
+        if (!res.ok)
+            throw new DaywalkerError(`Could not fetch JWKS (HTTP ${res.status})`, res.status);
+        return (await res.json());
+    }
     /**
      * The public JWK(s) configured for this service.
      */

package/dist/crypto/signatures.js

@@ -296,6 +296,9 @@ export async function registerPublicKey(params) {
     const authUrl = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
     const registerUrl = `${authUrl}/api/v1/keys/register`;
     const doFetch = params.fetchFn ?? globalThis.fetch;
+    if (!params.domain) {
+        return { ok: false, status: 400, error: "domain is required to register a key (set --domain or DAYWALKER_DOMAIN)" };
+    }
     try {
         const res = await doFetch(registerUrl, {
             method: "POST",
@@ -306,8 +309,7 @@ export async function registerPublicKey(params) {
             },
             body: JSON.stringify({
                 keyId: params.publicJwk.kid,
-                domain: params.domain ?? undefined,
-                serviceSlug: params.serviceSlug ?? undefined,
+                domain: params.domain,
                 publicKey: params.publicJwk,
             }),
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shelbyb/daywalker-sdk",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Validate Daywalker API tokens and make domain-signed calls to Daywalker Auth from any service.",
   "type": "module",
   "main": "./dist/index.js",