@shelbyb/daywalker-sdk 0.2.0 → 0.3.0

package/README.md

@@ -62,7 +62,8 @@ The private key is never printed unless you pass `--print-key`.
 | `DAYWALKER_SIGNING_KEY_PREVIOUS` | during rotation | Previous private key, maintained during deployment transitions |
 | `DAYWALKER_DOMAIN` | optional | Optional caller identifier or host domain name |
 | `DAYWALKER_PUBLIC_KEY` | optional | Daywalker Auth public key for zero-egress offline JWT lease verification |
-| `DAYWALKER_AUTH_URL` | optional | Defaults to `https://auth.daywalker.dev` |
+| `DAYWALKER_AUTH_URL` | optional | Defaults to `https://auth.daywalker.dev`; must be `https://` (except localhost) |
+| `DAYWALKER_LEASE_ISSUER` | optional | Expected `iss` of offline-verified JWT leases |
 
 ---
 
@@ -81,7 +82,8 @@ const client = new Daywalker({
 });
 
 // Option 2: Default lazy singleton (reads process.env automatically)
-const result = await daywalker.validateToken();
+const result = await daywalker.validateToken(incomingToken);
+// Service health check of this service's own DAYWALKER_API_KEY: daywalker.validateServiceKey()
 
 if (result.ok) {
   console.log("Validated tenant:", result.data.tenantId);
@@ -135,6 +137,8 @@ export const config = {
 };
 ```
 
+Each request must carry `Authorization: Bearer <token>` or `x-api-token`; without one, API routes get `401` and pages redirect to `errorPath`. Only `/_next/static/`, `/_next/image`, the favicon and static file extensions outside `/api/` skip auth. To gate the app on this service's own API key instead (the self-healing error page), use `createDaywalkerServiceHealthMiddleware` with the same options.
+
 ### Route Handler Wrapper
 
 ```ts
@@ -181,6 +185,8 @@ const client = new Daywalker({
 const result = await client.validateToken(incomingJwt);
 ```
 
+Leases must have a numeric `exp` and an `aud` (or `serviceSlug`) equal to your service slug, so `serviceSlug` must be configured. Set `leaseIssuer` (or `DAYWALKER_LEASE_ISSUER`) to also check `iss`.
+
 ---
 
 ## CLI Reference

package/dist/analytics/index.d.ts

@@ -11,7 +11,7 @@ export type FlagSource = {
 export type AnalyticsOptions = {
     /** The project's public write key (dpa_…). */
     writeKey: string;
-    /** Your DevPulse URL, e.g. https://devpulse.example.com */
+    /** Your DevPulse URL, e.g. https://devpulse.example.com (https required except on localhost). */
     host: string;
     /** Capture $pageview on load and on client-side navigation (browsers). Default true. */
     autocapturePageviews?: boolean;
@@ -31,6 +31,12 @@ export type AnalyticsOptions = {
     respectDoNotTrack?: boolean;
     /** Start opted out (e.g. until the user accepts a consent banner). */
     optedOut?: boolean;
+    /**
+     * Send $current_url / $referrer with their full query string and fragment. Default false:
+     * the fragment is dropped and only campaign parameters (utm_*, gclid, fbclid, ref) are kept,
+     * so OAuth codes, reset tokens and the like never leave the page.
+     */
+    captureFullUrls?: boolean;
     fetch?: typeof fetch;
     onError?: (err: Error) => void;
 };
@@ -42,6 +48,8 @@ export type CaptureOptions = {
     $set_once?: Properties;
 };
 export declare const VERSION = "0.1.0";
+/** Drop the fragment and every query parameter outside the campaign allowlist. */
+export declare function sanitizeUrl(raw: string): string;
 /** Time-ordered UUID (v7). */
 export declare function uuidv7(ms?: number): string;
 export declare class Analytics {
@@ -85,6 +93,7 @@ export declare class Analytics {
     shutdown(): Promise<void>;
     private disabled;
     private context;
+    private url;
     private flagProps;
     /** Rolling session: renewed after inactivity or at most every 24 hours. */
     private session;

package/dist/analytics/index.js

@@ -1,9 +1,24 @@
-/**
- * DevPulse product analytics. Works in browsers (automatic page views,
- * sessions, persistence, sendBeacon on page hide) and in Node (pass a
- * distinctId per call). Events are batched and retried with backoff.
- */
+import { assertSecureUrl } from "../config.js";
 export const VERSION = "0.1.0";
+const KEPT_QUERY_PARAMS = new Set(["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content", "gclid", "fbclid", "ref"]);
+/** Drop the fragment and every query parameter outside the campaign allowlist. */
+export function sanitizeUrl(raw) {
+    if (!raw)
+        return raw;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return raw.split(/[?#]/)[0];
+    }
+    url.hash = "";
+    for (const key of [...url.searchParams.keys()]) {
+        if (!KEPT_QUERY_PARAMS.has(key))
+            url.searchParams.delete(key);
+    }
+    return url.toString();
+}
 const isBrowser = typeof window !== "undefined" && typeof document !== "undefined";
 const MAX_SESSION_MS = 24 * 3_600_000;
 /** Time-ordered UUID (v7). */
@@ -73,6 +88,7 @@ export class Analytics {
             throw new Error("writeKey is required");
         if (!options.host)
             throw new Error("host is required");
+        assertSecureUrl("host", options.host);
         this.opts = { flushAt: 20, flushInterval: isBrowser ? 2000 : 10000, maxQueueSize: 1000, sessionTimeoutMinutes: 30, ...options };
         this.endpoint = `${options.host.replace(/\/+$/, "")}/a/batch`;
         this.store = new Store(`dp_analytics_${options.writeKey}`, (options.persistence ?? (isBrowser ? "localStorage" : "memory")) === "localStorage" && isBrowser);
@@ -103,13 +119,13 @@ export class Analytics {
     pageview(properties = {}) {
         if (!isBrowser)
             return this.capture("$pageview", properties);
-        const url = location.href;
-        this.lastUrl = url;
+        this.lastUrl = location.href;
+        const url = this.url(location.href);
         const utm = Object.fromEntries([...new URLSearchParams(location.search)].filter(([k]) => /^utm_(source|medium|campaign|term|content)$/.test(k)));
         let setOnce;
         if (!this.state.initialSent) {
             setOnce = {
-                $initial_referrer: document.referrer || "$direct",
+                $initial_referrer: document.referrer ? this.url(document.referrer) : "$direct",
                 $initial_referring_domain: referringDomain(document.referrer) ?? "$direct",
                 $initial_current_url: url,
                 $initial_pathname: location.pathname,
@@ -212,10 +228,10 @@ export class Analytics {
             return base;
         return {
             ...base,
-            $current_url: location.href,
+            $current_url: this.url(location.href),
             $host: location.host,
             $pathname: location.pathname,
-            $referrer: document.referrer || "$direct",
+            $referrer: document.referrer ? this.url(document.referrer) : "$direct",
             $referring_domain: referringDomain(document.referrer) ?? "$direct",
             $screen_width: screen.width,
             $screen_height: screen.height,
@@ -225,6 +241,9 @@ export class Analytics {
             $device_id: this.state.identified ? undefined : this.state.distinctId,
         };
     }
+    url(raw) {
+        return this.opts.captureFullUrls ? raw : sanitizeUrl(raw);
+    }
     flagProps() {
         if (!this.opts.flags)
             return {};

package/dist/cli.js

@@ -76,6 +76,8 @@ function writeEnvFile(file, values) {
         out.push("# Daywalker Auth (managed by `daywalker init`)", ...added.map(([k, v]) => `${k}="${v}"`));
     }
     fs.writeFileSync(file, out.join("\n") + "\n", { mode: 0o600 });
+    // `mode` only applies when the file is created; tighten an existing file too.
+    fs.chmodSync(file, 0o600);
 }
 function ensureGitignored(dir, entry) {
     const file = path.join(dir, ".gitignore");
@@ -233,6 +235,9 @@ async function check() {
 async function main() {
     const [cmd, ...rest] = process.argv.slice(2);
     const parsedArgs = args(rest);
+    if (typeof parsedArgs["api-key"] === "string") {
+        console.warn("! --api-key exposes the key in shell history and process listings; prefer DAYWALKER_API_KEY in the environment or .env.local.");
+    }
     if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
         console.log(HELP);
         return;

package/dist/client.d.ts

@@ -1,5 +1,7 @@
 import { type ResolvedConfig } from "./config.js";
 import { type DaywalkerConfig, type PublicJwk, type RetryOptions, type SelfCheckResult, type TokenPayload, type ValidateResult } from "./types.js";
+/** Validation results kept in memory; the least recently used are evicted past this. */
+export declare const MAX_VALIDATION_CACHE_ENTRIES = 1000;
 export type DaywalkerFetchInit = Omit<RequestInit, "body"> & {
     body?: BodyInit | object | null;
     retry?: RetryOptions;
@@ -18,9 +20,13 @@ export declare class Daywalker {
      * Signs and executes requests with automatic retry and exponential backoff on 429 responses.
      */
     fetch(path: string, init?: DaywalkerFetchInit): Promise<Response>;
+    private _cacheGet;
+    private _cacheSet;
     /**
-     * Validates incoming bearer tokens with memory caching and discriminated union return.
+     * Validates an incoming bearer token with memory caching and discriminated union return.
      * Supports zero-egress offline verification for JWT token leases when Daywalker's public key is configured.
+     * A missing token is always rejected (401); it never falls back to this service's own API key —
+     * use `validateServiceKey()` for that.
      */
     validateToken(tokenOrOptions?: string | {
         token?: string;
@@ -33,6 +39,14 @@ export declare class Daywalker {
         offlineOnly?: boolean;
     }): Promise<ValidateResult>;
     private _validateOnline;
+    /**
+     * Service health check: validates this service's own configured API key (DAYWALKER_API_KEY).
+     * Never use this to authenticate an incoming request.
+     */
+    validateServiceKey(options?: {
+        serviceSlug?: string;
+        forceRefresh?: boolean;
+    }): Promise<ValidateResult>;
     /**
      * Throws DaywalkerAuthError or DaywalkerRateLimitError if token is invalid or rate limited.
      */

package/dist/client.js

@@ -1,5 +1,5 @@
 import { resolveConfig } from "./config.js";
-import { loadSigningKey, signRequest, verifyJwtLease, maskSecret, redactSecrets, } from "./crypto/index.js";
+import { loadSigningKey, signRequest, verifyJwtLease, maskSecret, redactSecrets, sha256Base64Url, } from "./crypto/index.js";
 import { DaywalkerAuthError, DaywalkerError, DaywalkerRateLimitError, } from "./types.js";
 function parseRetryAfter(headerValue) {
     if (!headerValue)
@@ -23,6 +23,8 @@ function generateNonce() {
         bin += String.fromCharCode(b);
     return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+/** Validation results kept in memory; the least recently used are evicted past this. */
+export const MAX_VALIDATION_CACHE_ENTRIES = 1000;
 export class Daywalker {
     _config;
     _rawConfig;
@@ -68,6 +70,11 @@ export class Daywalker {
     async fetch(path, init) {
         const authUrl = this._config.authUrl;
         const url = new URL(path, authUrl);
+        // Absolute URLs to other hosts would otherwise receive the API key and a valid signature.
+        const authOrigin = new URL(authUrl).origin;
+        if (url.origin !== authOrigin) {
+            throw new DaywalkerError(`Refusing to send Daywalker credentials to ${url.origin}; fetch() only targets ${authOrigin}`);
+        }
         const method = (init?.method ?? (init?.body !== undefined ? "POST" : "GET")).toUpperCase();
         const doFetch = this._rawConfig.fetch ?? globalThis.fetch;
         const retryOpts = {
@@ -157,9 +164,31 @@ export class Daywalker {
             return res;
         }
     }
+    _cacheGet(key) {
+        const entry = this._cache.get(key);
+        if (!entry)
+            return undefined;
+        this._cache.delete(key);
+        if (entry.expiresAt <= Date.now())
+            return undefined;
+        this._cache.set(key, entry); // most recently used goes last
+        return entry.result;
+    }
+    _cacheSet(key, result, ttlMs, notAfterMs = Infinity) {
+        const expiresAt = Math.min(Date.now() + ttlMs, notAfterMs);
+        if (expiresAt <= Date.now())
+            return;
+        this._cache.delete(key);
+        this._cache.set(key, { result, expiresAt });
+        while (this._cache.size > MAX_VALIDATION_CACHE_ENTRIES) {
+            this._cache.delete(this._cache.keys().next().value);
+        }
+    }
     /**
-     * Validates incoming bearer tokens with memory caching and discriminated union return.
+     * Validates an incoming bearer token with memory caching and discriminated union return.
      * Supports zero-egress offline verification for JWT token leases when Daywalker's public key is configured.
+     * A missing token is always rejected (401); it never falls back to this service's own API key —
+     * use `validateServiceKey()` for that.
      */
     async validateToken(tokenOrOptions, options) {
         let token;
@@ -173,7 +202,7 @@ export class Daywalker {
             offlineOnly = options?.offlineOnly ?? false;
         }
         else {
-            token = tokenOrOptions?.token ?? this._config.apiKey ?? undefined;
+            token = tokenOrOptions?.token ?? undefined;
             serviceSlug = (tokenOrOptions?.serviceSlug ?? this._config.serviceSlug ?? "").toLowerCase();
             forceRefresh = tokenOrOptions?.forceRefresh ?? false;
             offlineOnly = tokenOrOptions?.offlineOnly ?? false;
@@ -181,15 +210,16 @@ export class Daywalker {
         if (!token) {
             return {
                 ok: false,
-                error: "CONFIGURATION_ERROR",
-                status: 400,
+                error: "INVALID_TOKEN",
+                status: 401,
                 message: "Missing token to validate",
             };
         }
-        const cacheKey = `${serviceSlug || "default"}:${token}`;
-        const cached = this._cache.get(cacheKey);
-        if (!forceRefresh && cached && cached.expiresAt > Date.now()) {
-            return cached.result;
+        // Keyed by a hash so raw tokens are never held as cache keys.
+        const cacheKey = `${serviceSlug || "default"}:${await sha256Base64Url(token)}`;
+        const cached = forceRefresh ? undefined : this._cacheGet(cacheKey);
+        if (cached) {
+            return cached;
         }
         // Check for offline JWT lease verification
         if (this._config.daywalkerPublicKey && token.split(".").length === 3) {
@@ -197,6 +227,7 @@ export class Daywalker {
                 token,
                 publicKey: this._config.daywalkerPublicKey,
                 expectedServiceSlug: serviceSlug || undefined,
+                expectedIssuer: this._config.leaseIssuer ?? undefined,
             });
             if (jwtResult.valid && jwtResult.payload) {
                 const payload = jwtResult.payload;
@@ -220,7 +251,8 @@ export class Daywalker {
                     },
                 };
                 if (this._config.cacheTtlMs > 0) {
-                    this._cache.set(cacheKey, { result, expiresAt: Date.now() + this._config.cacheTtlMs });
+                    // Never cache a lease past its own expiry.
+                    this._cacheSet(cacheKey, result, this._config.cacheTtlMs, payload.exp * 1000);
                 }
                 return result;
             }
@@ -256,7 +288,7 @@ export class Daywalker {
         const negTtl = this._config.negativeCacheTtlMs;
         const fail = (result) => {
             if (negTtl > 0 && result.error !== "RATE_LIMITED" && result.error !== "NETWORK_ERROR") {
-                this._cache.set(cacheKey, { result, expiresAt: Date.now() + negTtl });
+                this._cacheSet(cacheKey, result, negTtl);
             }
             return result;
         };
@@ -288,7 +320,7 @@ export class Daywalker {
                     data,
                 };
                 if (this._config.cacheTtlMs > 0) {
-                    this._cache.set(cacheKey, { result, expiresAt: Date.now() + this._config.cacheTtlMs });
+                    this._cacheSet(cacheKey, result, this._config.cacheTtlMs);
                 }
                 return result;
             }
@@ -326,6 +358,21 @@ export class Daywalker {
             };
         }
     }
+    /**
+     * Service health check: validates this service's own configured API key (DAYWALKER_API_KEY).
+     * Never use this to authenticate an incoming request.
+     */
+    async validateServiceKey(options) {
+        if (!this._config.apiKey) {
+            return {
+                ok: false,
+                error: "CONFIGURATION_ERROR",
+                status: 500,
+                message: "DAYWALKER_API_KEY is not set",
+            };
+        }
+        return this.validateToken(this._config.apiKey, options);
+    }
     /**
      * Throws DaywalkerAuthError or DaywalkerRateLimitError if token is invalid or rate limited.
      */

package/dist/config.d.ts

@@ -8,6 +8,7 @@ export interface ResolvedConfig {
     domain: string | null;
     domainSource: string | null;
     daywalkerPublicKey: string | PublicJwk | null;
+    leaseIssuer: string | null;
     authUrl: string;
     cacheTtlMs: number;
     negativeCacheTtlMs: number;
@@ -19,4 +20,9 @@ export interface ResolvedConfig {
  * the internet (localhost, 0.0.0.0, IP addresses, single labels).
  */
 export declare function publicHostname(value: string | undefined | null): string | null;
+/**
+ * Throws unless `value` is an https: URL (http: is allowed only for localhost / 127.0.0.1 / [::1]),
+ * so API keys, SDK keys and write keys never travel in cleartext.
+ */
+export declare function assertSecureUrl(name: string, value: string): void;
 export declare function resolveConfig(options?: DaywalkerConfig): ResolvedConfig;

package/dist/config.js

@@ -45,6 +45,25 @@ export function publicHostname(value) {
     }
     return DOMAIN_PATTERN.test(host) ? host : null;
 }
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * Throws unless `value` is an https: URL (http: is allowed only for localhost / 127.0.0.1 / [::1]),
+ * so API keys, SDK keys and write keys never travel in cleartext.
+ */
+export function assertSecureUrl(name, value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${name} must be an absolute https:// URL (got "${value}")`);
+    }
+    if (url.protocol === "https:")
+        return;
+    if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname))
+        return;
+    throw new Error(`${name} must use https:// (http:// is only allowed for localhost); got "${value}"`);
+}
 export function resolveConfig(options = {}) {
     const env = options.env ?? (typeof process !== "undefined" && process.env ? process.env : {});
     const problems = [];
@@ -80,7 +99,9 @@ export function resolveConfig(options = {}) {
         }
     }
     const daywalkerPublicKey = options.daywalkerPublicKey ?? (env.DAYWALKER_PUBLIC_KEY ? env.DAYWALKER_PUBLIC_KEY.trim() : null);
+    const leaseIssuer = (options.leaseIssuer ?? env.DAYWALKER_LEASE_ISSUER ?? "").trim() || null;
     const authUrl = (options.authUrl ?? env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    assertSecureUrl("authUrl", authUrl);
     const cacheTtlMs = options.cacheTtlMs ?? 60_000;
     const negativeCacheTtlMs = options.negativeCacheTtlMs ?? 3_000;
     const maxRetries = options.maxRetries ?? (options.retry?.maxRetries ?? 3);
@@ -93,6 +114,7 @@ export function resolveConfig(options = {}) {
         domain,
         domainSource,
         daywalkerPublicKey,
+        leaseIssuer,
         authUrl,
         cacheTtlMs,
         negativeCacheTtlMs,

package/dist/crypto/signatures.d.ts

@@ -12,14 +12,21 @@ export declare function normalizePath(rawPath: string): string;
  * Validates that an identifier (keyId, serviceSlug, etc.) contains only safe alphanumeric/hyphen characters.
  */
 export declare function assertSafeIdentifier(name: string, value: string): void;
+/** Upper bound on remembered signatures; the oldest entries are evicted past this. */
+export declare const REPLAY_CACHE_MAX_ENTRIES = 10000;
 /**
- * In-memory LRU / sliding cache for nonces / signature replay protection.
+ * In-memory replay cache, keyed on keyid + decoded signature bytes (so re-encodings of the
+ * same signature collide). Insertion-ordered, so eviction drops the oldest entries first.
  */
-declare class SignatureReplayCache {
+export declare class SignatureReplayCache {
+    private readonly maxEntries;
     private seen;
-    private readonly ttlMs;
-    constructor(ttlSeconds?: number);
-    checkAndRecord(signatureId: string): boolean;
+    constructor(maxEntries?: number);
+    get size(): number;
+    /** True when the key was recorded and has not expired yet (a replay). */
+    has(key: string, now?: number): boolean;
+    record(key: string, ttlMs: number, now?: number): void;
+    clear(): void;
 }
 export declare const globalReplayCache: SignatureReplayCache;
 export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, };
@@ -53,14 +60,20 @@ export declare function signRequest(params: SignRequestParams): Promise<SignedHe
  * Verify an incoming RFC 9421 HTTP Message Signature.
  */
 export declare function verifyRequestSignature(params: VerifySignatureParams): Promise<VerifySignatureResult>;
+/** Clock skew tolerated on JWT lease `exp` / `nbf`. */
+export declare const JWT_CLOCK_SKEW_SECONDS = 60;
 /**
  * Zero-egress offline verification for asymmetric JWT token leases.
+ * Requires a numeric `exp` and an audience (`aud` or `serviceSlug`) equal to `expectedServiceSlug`;
+ * a verifier without an expected slug rejects every lease. `iss` is checked when `expectedIssuer` is set.
  */
 export declare function verifyJwtLease(params: {
     token: string;
     publicKey: string | PublicJwk | CryptoKey;
     expectedServiceSlug?: string;
+    expectedIssuer?: string;
     currentTime?: number;
+    clockSkewSeconds?: number;
 }): Promise<{
     valid: boolean;
     payload?: Record<string, unknown>;

package/dist/crypto/signatures.js

@@ -1,6 +1,7 @@
-import { base64ToBytes, base64UrlToBytes, bytesToBase64, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
+import { base64ToBytes, base64UrlToBytes, bytesToBase64, bytesToHex, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
 import { computeContentDigest } from "./digest.js";
 import { loadPublicKey, loadSigningKey } from "./keys.js";
+import { assertSecureUrl } from "../config.js";
 export const SIGNATURE_VERSION = "rfc9421";
 export const SIGNATURE_LABEL = "sig1";
 export const SIGNATURE_ALG = "ed25519";
@@ -30,29 +31,41 @@ export function assertSafeIdentifier(name, value) {
         throw new Error(`Invalid ${name}: must be 1-128 safe characters (alphanumeric, '_', '-', '.')`);
     }
 }
+/** Upper bound on remembered signatures; the oldest entries are evicted past this. */
+export const REPLAY_CACHE_MAX_ENTRIES = 10_000;
 /**
- * In-memory LRU / sliding cache for nonces / signature replay protection.
+ * In-memory replay cache, keyed on keyid + decoded signature bytes (so re-encodings of the
+ * same signature collide). Insertion-ordered, so eviction drops the oldest entries first.
  */
-class SignatureReplayCache {
+export class SignatureReplayCache {
+    maxEntries;
     seen = new Map();
-    ttlMs;
-    constructor(ttlSeconds = 360) {
-        this.ttlMs = ttlSeconds * 1000;
-    }
-    checkAndRecord(signatureId) {
-        const now = Date.now();
-        if (this.seen.size > 5000) {
-            for (const [k, exp] of this.seen.entries()) {
-                if (exp <= now)
-                    this.seen.delete(k);
-            }
+    constructor(maxEntries = REPLAY_CACHE_MAX_ENTRIES) {
+        this.maxEntries = maxEntries;
+    }
+    get size() {
+        return this.seen.size;
+    }
+    /** True when the key was recorded and has not expired yet (a replay). */
+    has(key, now = Date.now()) {
+        const expiresAt = this.seen.get(key);
+        return expiresAt !== undefined && expiresAt > now;
+    }
+    record(key, ttlMs, now = Date.now()) {
+        this.seen.delete(key);
+        this.seen.set(key, now + ttlMs);
+        if (this.seen.size <= this.maxEntries)
+            return;
+        for (const [k, exp] of this.seen) {
+            if (exp <= now)
+                this.seen.delete(k);
         }
-        const expiresAt = this.seen.get(signatureId);
-        if (expiresAt && expiresAt > now) {
-            return false; // Replay detected
+        while (this.seen.size > this.maxEntries) {
+            this.seen.delete(this.seen.keys().next().value);
         }
-        this.seen.set(signatureId, now + this.ttlMs);
-        return true;
+    }
+    clear() {
+        this.seen.clear();
     }
 }
 export const globalReplayCache = new SignatureReplayCache();
@@ -176,11 +189,16 @@ export async function verifyRequestSignature(params) {
         }
         seenComponents.add(c);
     }
-    const sigMatch = signatureHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=:([A-Za-z0-9+/=_-]+):`));
-    if (!sigMatch) {
+    // RFC 8941 byte sequence (`:base64:`), standard alphabet with padding only, so each signature
+    // has exactly one accepted encoding.
+    const sigMatch = signatureHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=:([A-Za-z0-9+/]*={0,2}):(?=\\s*(?:,|$))`));
+    if (!sigMatch || sigMatch[1].length % 4 !== 0) {
+        return { valid: false, error: `Signature header does not contain valid ${SIGNATURE_LABEL} byte sequence` };
+    }
+    const signatureBytes = base64ToBytes(sigMatch[1]);
+    if (bytesToBase64(signatureBytes) !== sigMatch[1]) {
         return { valid: false, error: `Signature header does not contain valid ${SIGNATURE_LABEL} byte sequence` };
     }
-    const signatureBase64 = sigMatch[1].trim();
     const createdMatch = signatureParams.match(/created=(\d+)/);
     if (!createdMatch) {
         return { valid: false, error: "Signature-Input missing created timestamp" };
@@ -191,12 +209,6 @@ export async function verifyRequestSignature(params) {
     if (Math.abs(now - created) > maxSkew) {
         return { valid: false, error: `Signature timestamp expired or clock skew too large (created=${created}, now=${now})` };
     }
-    if (params.replayCheck !== false) {
-        const replayKey = `${signatureBase64}:${created}`;
-        if (!globalReplayCache.checkAndRecord(replayKey)) {
-            return { valid: false, error: "Replay detected: request signature was already presented" };
-        }
-    }
     const keyidMatch = signatureParams.match(/keyid="([^"]+)"/);
     const keyid = keyidMatch ? keyidMatch[1] : undefined;
     if (keyid) {
@@ -207,6 +219,12 @@ export async function verifyRequestSignature(params) {
             return { valid: false, error: e.message };
         }
     }
+    // Entries must outlive the whole acceptance window (created ± maxSkew).
+    const replayKey = `${keyid ?? ""}:${bytesToHex(signatureBytes)}`;
+    const replayTtlMs = 2 * Math.max(maxSkew, 1) * 1000;
+    if (params.replayCheck !== false && globalReplayCache.has(replayKey)) {
+        return { valid: false, error: "Replay detected: request signature was already presented" };
+    }
     const algMatch = signatureParams.match(/alg="([^"]+)"/);
     const alg = algMatch ? algMatch[1] : undefined;
     if (alg && alg.toLowerCase() !== "ed25519" && alg.toLowerCase() !== "eddsa") {
@@ -230,21 +248,29 @@ export async function verifyRequestSignature(params) {
     });
     try {
         const { publicKey } = await loadPublicKey(params.publicKey);
-        const signatureBytes = signatureBase64.includes("-") || signatureBase64.includes("_")
-            ? base64UrlToBytes(signatureBase64)
-            : base64ToBytes(signatureBase64);
         const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, stringToUtf8(signatureBase));
         if (!isValid) {
             return { valid: false, error: "Cryptographic signature verification failed" };
         }
+        // Record only verified signatures; re-check synchronously in case a concurrent copy won.
+        if (params.replayCheck !== false) {
+            if (globalReplayCache.has(replayKey)) {
+                return { valid: false, error: "Replay detected: request signature was already presented" };
+            }
+            globalReplayCache.record(replayKey, replayTtlMs);
+        }
         return { valid: true, keyid };
     }
     catch (err) {
         return { valid: false, error: `Verification error: ${err.message}` };
     }
 }
+/** Clock skew tolerated on JWT lease `exp` / `nbf`. */
+export const JWT_CLOCK_SKEW_SECONDS = 60;
 /**
  * Zero-egress offline verification for asymmetric JWT token leases.
+ * Requires a numeric `exp` and an audience (`aud` or `serviceSlug`) equal to `expectedServiceSlug`;
+ * a verifier without an expected slug rejects every lease. `iss` is checked when `expectedIssuer` is set.
  */
 export async function verifyJwtLease(params) {
     try {
@@ -257,9 +283,15 @@ export async function verifyJwtLease(params) {
         const payloadJson = utf8ToString(base64UrlToBytes(payloadB64));
         const header = JSON.parse(headerJson);
         const payload = JSON.parse(payloadJson);
+        if (!header || typeof header !== "object" || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+            return { valid: false, error: "JWT header and payload must be JSON objects" };
+        }
         if (header.alg !== "EdDSA" && header.alg !== "ed25519") {
             return { valid: false, error: `Unsupported JWT alg: ${header.alg}` };
         }
+        if (header.typ !== undefined && String(header.typ).toUpperCase() !== "JWT") {
+            return { valid: false, error: `Unsupported JWT typ: ${header.typ}` };
+        }
         const { publicKey } = await loadPublicKey(params.publicKey);
         const signedData = stringToUtf8(`${headerB64}.${payloadB64}`);
         const signatureBytes = base64UrlToBytes(signatureB64);
@@ -268,20 +300,41 @@ export async function verifyJwtLease(params) {
             return { valid: false, error: "JWT signature verification failed" };
         }
         const now = params.currentTime ?? Math.floor(Date.now() / 1000);
-        if (payload.exp && typeof payload.exp === "number" && payload.exp < now) {
+        const skew = Math.max(0, Math.min(params.clockSkewSeconds ?? JWT_CLOCK_SKEW_SECONDS, 300));
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+            return { valid: false, error: "JWT token lease has no numeric exp claim" };
+        }
+        if (payload.exp + skew <= now) {
             return { valid: false, error: "JWT token lease has expired" };
         }
-        if (payload.nbf && typeof payload.nbf === "number" && payload.nbf > now + 60) {
+        if (payload.nbf !== undefined && (typeof payload.nbf !== "number" || payload.nbf > now + skew)) {
             return { valid: false, error: "JWT token lease not active yet" };
         }
-        if (params.expectedServiceSlug) {
-            const tokenSlug = (payload.serviceSlug || payload.aud || "").toLowerCase();
-            if (tokenSlug && tokenSlug !== params.expectedServiceSlug.toLowerCase()) {
-                return {
-                    valid: false,
-                    error: `JWT audience mismatch: expected ${params.expectedServiceSlug}, got ${tokenSlug}`,
-                };
-            }
+        const expected = params.expectedServiceSlug?.trim().toLowerCase();
+        if (!expected) {
+            return { valid: false, error: "JWT audience cannot be checked: no expected service slug is configured" };
+        }
+        const audiences = [];
+        if (payload.serviceSlug !== undefined)
+            audiences.push(String(payload.serviceSlug));
+        if (Array.isArray(payload.aud))
+            audiences.push(...payload.aud.map(String));
+        else if (payload.aud !== undefined)
+            audiences.push(String(payload.aud));
+        if (audiences.length === 0) {
+            return { valid: false, error: "JWT token lease has no aud or serviceSlug claim" };
+        }
+        const serviceSlugOk = payload.serviceSlug === undefined || String(payload.serviceSlug).toLowerCase() === expected;
+        const audOk = payload.aud === undefined ||
+            (Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((a) => String(a).toLowerCase() === expected);
+        if (!serviceSlugOk || !audOk) {
+            return {
+                valid: false,
+                error: `JWT audience mismatch: expected ${expected}, got ${audiences.join(", ").toLowerCase()}`,
+            };
+        }
+        if (params.expectedIssuer && payload.iss !== params.expectedIssuer) {
+            return { valid: false, error: `JWT issuer mismatch: expected ${params.expectedIssuer}, got ${payload.iss ?? "(none)"}` };
         }
         return { valid: true, payload };
     }
@@ -294,6 +347,12 @@ export async function verifyJwtLease(params) {
  */
 export async function registerPublicKey(params) {
     const authUrl = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    try {
+        assertSecureUrl("authUrl", authUrl);
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err.message };
+    }
     const registerUrl = `${authUrl}/api/v1/keys/register`;
     const doFetch = params.fetchFn ?? globalThis.fetch;
     if (!params.domain) {

package/dist/flags/client.d.ts

@@ -11,7 +11,7 @@ export interface FlagState {
 }
 export type FlagSet = Record<string, FlagState>;
 export interface ClientOptions {
-    /** Base URL of your DevPulse deployment, e.g. https://flags.example.com */
+    /** Base URL of your DevPulse deployment, e.g. https://flags.example.com (https required except on localhost). */
     baseUrl: string;
     /** Receive changes in real time over Server-Sent Events (default true). */
     streaming?: boolean;
@@ -66,6 +66,7 @@ export declare class DevPulseClient {
     private fetchFlags;
     private onStreamEvent;
     private replaceAll;
+    private flag;
     private markReady;
     private fail;
     private emitChanges;

package/dist/flags/client.js

@@ -1,4 +1,9 @@
 import { EventProcessor, SseClient, encodeContext, noopLogger } from "./common/index.js";
+import { assertSecureUrl } from "../config.js";
+/** A flag map without a prototype, so keys like `__proto__` or `toString` never resolve to inherited values. */
+function flagMap(entries = {}) {
+    return Object.assign(Object.create(null), entries);
+}
 function isFlagSet(x) {
     return !!x && typeof x === "object" && Object.values(x).every((v) => v && typeof v === "object" && "value" in v && "version" in v);
 }
@@ -15,7 +20,7 @@ export class DevPulseClient {
     clientSideId;
     context;
     options;
-    flags = {};
+    flags = flagMap();
     listeners = new Map();
     stream = null;
     events = null;
@@ -31,6 +36,7 @@ export class DevPulseClient {
         this.context = context;
         this.options = options;
         this.logger = options.logger ?? noopLogger;
+        assertSecureUrl("baseUrl", options.baseUrl);
         this.base = options.baseUrl.replace(/\/$/, "");
         this.ready = new Promise((res, rej) => {
             this.resolveReady = res;
@@ -39,14 +45,14 @@ export class DevPulseClient {
         this.ready.catch(() => undefined);
         if (options.bootstrap) {
             this.flags = isFlagSet(options.bootstrap)
-                ? { ...options.bootstrap }
-                : Object.fromEntries(Object.entries(options.bootstrap).map(([k, v]) => [k, { value: v, variation: null, version: 0 }]));
+                ? flagMap(options.bootstrap)
+                : flagMap(Object.fromEntries(Object.entries(options.bootstrap).map(([k, v]) => [k, { value: v, variation: null, version: 0 }])));
             this.markReady();
         }
         else if (options.cache) {
             const cached = this.readCache();
             if (cached)
-                this.flags = cached;
+                this.flags = flagMap(cached);
         }
         if (options.sendEvents !== false && typeof globalThis.fetch === "function") {
             this.events = new EventProcessor({
@@ -117,7 +123,7 @@ export class DevPulseClient {
                 this.replaceAll(payload);
             else if (type === "patch") {
                 const { key, ...state } = payload;
-                const prev = this.flags[key];
+                const prev = this.flag(key);
                 if (prev && prev.version > state.version)
                     return;
                 this.flags[key] = state;
@@ -126,7 +132,7 @@ export class DevPulseClient {
             }
             else if (type === "delete") {
                 const { key, version } = payload;
-                const prev = this.flags[key];
+                const prev = this.flag(key);
                 if (!prev || prev.version > version)
                     return;
                 delete this.flags[key];
@@ -141,17 +147,20 @@ export class DevPulseClient {
     replaceAll(next) {
         const changes = {};
         for (const key of new Set([...Object.keys(this.flags), ...Object.keys(next)])) {
-            const a = this.flags[key]?.value;
-            const b = next[key]?.value;
+            const a = this.flag(key)?.value;
+            const b = Object.hasOwn(next, key) ? next[key]?.value : undefined;
             if (JSON.stringify(a) !== JSON.stringify(b))
                 changes[key] = { current: b ?? null, previous: a };
         }
-        this.flags = { ...next };
+        this.flags = flagMap(next);
         this.writeCache();
         this.markReady();
         if (Object.keys(changes).length)
             this.emitChanges(changes);
     }
+    flag(key) {
+        return Object.hasOwn(this.flags, key) ? this.flags[key] : undefined;
+    }
     markReady() {
         if (this.initialized)
             return;
@@ -209,7 +218,7 @@ export class DevPulseClient {
         return this.variationDetail(key, defaultValue).value;
     }
     variationDetail(key, defaultValue) {
-        const f = this.flags[key];
+        const f = this.flag(key);
         let detail;
         if (!f)
             detail = { value: defaultValue, variationIndex: null, reason: { kind: "ERROR", errorKind: this.initialized ? "FLAG_NOT_FOUND" : "CLIENT_NOT_READY" } };

package/dist/flags/common/events.js

@@ -1,5 +1,23 @@
 import { parseContext } from "../engine/index.js";
 export const noopLogger = { debug() { }, info() { }, warn() { }, error() { } };
+/** Delete the value at `tokens` inside `target`, copying (not mutating) nested objects. */
+function removePointer(target, tokens) {
+    const [head, ...rest] = tokens;
+    if (!Object.hasOwn(target, head))
+        return false;
+    if (!rest.length) {
+        delete target[head];
+        return true;
+    }
+    const child = target[head];
+    if (!child || typeof child !== "object" || Array.isArray(child))
+        return false;
+    const copy = { ...child };
+    if (!removePointer(copy, rest))
+        return false;
+    target[head] = copy;
+    return true;
+}
 /**
  * Buffers analytics: per-flag summaries (counts per variation), context
  * index events (deduplicated), full feature events for tracked flags and
@@ -35,6 +53,14 @@ export class EventProcessor {
                 else
                     out[k] = v;
             }
+            // Nested JSON pointers (/address/zip): remove the leaf from a copy of each object on the path.
+            for (const ref of priv) {
+                const tokens = ref.startsWith("/") ? ref.slice(1).split("/").map((t) => t.replace(/~1/g, "/").replace(/~0/g, "~")) : [];
+                if (tokens.length < 2 || ["key", "kind", "anonymous", "_meta"].includes(tokens[0]))
+                    continue;
+                if (removePointer(out, tokens))
+                    redacted.push(ref);
+            }
             if (redacted.length)
                 out.redactedAttributes = redacted;
             return out;

package/dist/flags/engine/context.js

@@ -11,7 +11,8 @@ function parseSingle(kind, raw) {
         throw new ContextError(`Context "${kind}" needs a non-empty string key`);
     const meta = (obj._meta ?? {});
     const privateAttributes = Array.isArray(meta.privateAttributes) ? meta.privateAttributes.filter((a) => typeof a === "string") : [];
-    const attributes = {};
+    // No prototype: `constructor`, `toString`, `__proto__` resolve only if the context sets them.
+    const attributes = Object.create(null);
     for (const [k, v] of Object.entries(obj))
         if (k !== "_meta" && k !== "kind")
             attributes[k] = v;
@@ -53,7 +54,7 @@ export function getAttribute(ctx, ref) {
     if (ref === "key")
         return ctx.key;
     if (!ref.startsWith("/"))
-        return ctx.attributes[ref];
+        return Object.hasOwn(ctx.attributes, ref) ? ctx.attributes[ref] : undefined;
     const tokens = ref
         .slice(1)
         .split("/")
@@ -70,7 +71,7 @@ export function getAttribute(ctx, ref) {
             cur = cur[Number(t)];
         }
         else {
-            cur = cur[t];
+            cur = Object.hasOwn(cur, t) ? cur[t] : undefined;
         }
     }
     return cur;

package/dist/flags/engine/operators.d.ts

@@ -1,4 +1,12 @@
 import type { FlagValue, Operator } from "./types.js";
+/** `matches` limits: longer inputs or patterns never match. */
+export declare const MAX_MATCH_INPUT_LENGTH = 1024;
+export declare const MAX_MATCH_PATTERN_LENGTH = 500;
+/**
+ * Conservative ReDoS heuristic: a group that contains a quantifier or alternation and is itself
+ * repeated (`(a+)+`, `(a*)*`, `(a|aa)+`, `(?:x+y)*`, `(a+){2,}`). Character classes and escapes are skipped.
+ */
+export declare function hasNestedQuantifier(pattern: string): boolean;
 /** RFC 3339 timestamp or Unix milliseconds → epoch ms. */
 export declare function parseTime(v: unknown): number | null;
 /** Compare one context value with one clause value. Type mismatches never match. */

package/dist/flags/engine/operators.js

@@ -1,13 +1,61 @@
 import { compareSemVer, parseSemVer } from "./semver.js";
 const regexCache = new Map();
+/** `matches` limits: longer inputs or patterns never match. */
+export const MAX_MATCH_INPUT_LENGTH = 1024;
+export const MAX_MATCH_PATTERN_LENGTH = 500;
+let warnedUnsafePattern = false;
+/**
+ * Conservative ReDoS heuristic: a group that contains a quantifier or alternation and is itself
+ * repeated (`(a+)+`, `(a*)*`, `(a|aa)+`, `(?:x+y)*`, `(a+){2,}`). Character classes and escapes are skipped.
+ */
+export function hasNestedQuantifier(pattern) {
+    const stack = []; // per open group: contains a quantifier / alternation
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "\\") {
+            i++;
+        }
+        else if (ch === "[") {
+            for (i++; i < pattern.length && pattern[i] !== "]"; i++)
+                if (pattern[i] === "\\")
+                    i++;
+        }
+        else if (ch === "(") {
+            stack.push(false);
+            if (pattern[i + 1] === "?")
+                i++; // group modifier, not a quantifier
+        }
+        else if (ch === ")") {
+            const risky = stack.pop() ?? false;
+            const next = pattern[i + 1];
+            const repeated = next === "*" || next === "+" || next === "{";
+            if (risky && repeated)
+                return true;
+            if ((risky || repeated) && stack.length)
+                stack[stack.length - 1] = true;
+        }
+        else if ((ch === "*" || ch === "+" || ch === "?" || ch === "{" || ch === "|") && stack.length) {
+            stack[stack.length - 1] = true;
+        }
+    }
+    return false;
+}
 function regex(pattern) {
     if (!regexCache.has(pattern)) {
         let re = null;
-        try {
-            re = new RegExp(pattern);
+        if (pattern.length > MAX_MATCH_PATTERN_LENGTH || hasNestedQuantifier(pattern)) {
+            if (!warnedUnsafePattern) {
+                warnedUnsafePattern = true;
+                console.warn("DevPulse: a `matches` pattern was too long or had nested quantifiers and is treated as no match");
+            }
         }
-        catch {
-            re = null;
+        else {
+            try {
+                re = new RegExp(pattern);
+            }
+            catch {
+                re = null;
+            }
         }
         if (regexCache.size > 1000)
             regexCache.clear();
@@ -51,6 +99,8 @@ export function applyOperator(op, actual, expected) {
         case "matches": {
             if (typeof actual !== "string" || typeof expected !== "string")
                 return false;
+            if (actual.length > MAX_MATCH_INPUT_LENGTH)
+                return false;
             return regex(expected)?.test(actual) ?? false;
         }
         case "lessThan":

package/dist/flags/node.d.ts

@@ -3,7 +3,7 @@ import { type ContextInput, type EvaluationDetail, type FlagConfig, type FlagVal
 import { type Logger } from "./common/index.js";
 export type { ContextInput, EvaluationDetail, FlagValue, Logger };
 export interface NodeClientOptions {
-    /** Base URL of your DevPulse deployment. */
+    /** Base URL of your DevPulse deployment (https required except on localhost). */
     baseUrl: string;
     /** Real-time updates over SSE (default). Set false to poll instead. */
     stream?: boolean;

package/dist/flags/node.js

@@ -2,6 +2,7 @@ import { createHmac } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { Evaluator, MemoryStore, evaluateFlag, parseContext } from "./engine/index.js";
 import { EventProcessor, SseClient, noopLogger } from "./common/index.js";
+import { assertSecureUrl } from "../config.js";
 /**
  * Server-side client. One instance per process and SDK key.
  *
@@ -41,6 +42,8 @@ export class DevPulseNodeClient extends EventEmitter {
             this.markReady();
             return;
         }
+        // Checked once the SDK key will actually be sent (offline / fixture clients make no requests).
+        assertSecureUrl("baseUrl", options.baseUrl);
         if (options.sendEvents !== false) {
             this.events = new EventProcessor({
                 url: `${this.base}/sdk/v1/events`,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { Daywalker, createDaywalker, daywalker, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, } from "./types.js";
 export type { DaywalkerConfig, RateLimitWindow, TokenPayload, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, PublicJwk, SigningKey, } from "./types.js";
-export { resolveConfig, publicHostname, } from "./config.js";
+export { resolveConfig, publicHostname, assertSecureUrl, } from "./config.js";
 export type { ResolvedConfig, } from "./config.js";
 export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
 export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, } from "./crypto/index.js";

package/dist/index.js

@@ -1,4 +1,4 @@
 export { Daywalker, createDaywalker, daywalker, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, } from "./types.js";
-export { resolveConfig, publicHostname, } from "./config.js";
+export { resolveConfig, publicHostname, assertSecureUrl, } from "./config.js";
 export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";

package/dist/next.d.ts

@@ -7,6 +7,13 @@ import type { TokenPayload } from "./types.js";
  */
 export declare const SERVER_ACTION_ID_PATTERN: RegExp;
 export declare const DEFAULT_BYPASS_PATHS: string[];
+/** File extensions treated as static assets (outside /api/) and passed through without auth. */
+export declare const STATIC_FILE_EXTENSIONS: RegExp;
+/**
+ * Static assets that skip auth: Next's build output and image optimizer, the favicon, and files with
+ * an allowlisted extension. `/_next/data/` (getServerSideProps JSON) and `/api/*` are never static.
+ */
+export declare function isStaticAssetPath(pathname: string): boolean;
 export interface NextMiddlewareOptions {
     client?: Daywalker;
     serviceSlug?: string;
@@ -28,8 +35,8 @@ export declare function sanitizeRedirectPath(path: string): string | null;
  * Implements:
  * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
  * 2. Static asset and health check bypass
- * 3. Self-healing service error page routing with `from` back-redirect
- * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect)
+ * 3. Per-request token auth: requests without `Authorization: Bearer` / `x-api-token` get 401
+ * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect to `errorPath` with `from`)
  *
  * Example:
  *   // middleware.ts
@@ -42,6 +49,12 @@ export declare function sanitizeRedirectPath(path: string): string | null;
  *   };
  */
 export declare function createDaywalkerMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;
+/**
+ * Service health gate: checks this service's own DAYWALKER_API_KEY (not the caller's token) and
+ * routes every request to `errorPath` while it is invalid, redirecting back once it heals.
+ * It does NOT authenticate callers; use `createDaywalkerMiddleware` or `withDaywalkerAuth` for that.
+ */
+export declare function createDaywalkerServiceHealthMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;
 /**
  * Next.js App Router route handler wrapper with Daywalker token validation.
  * Extracts `Authorization: Bearer <token>` or `x-api-token`, validates via client,

package/dist/next.js

@@ -12,6 +12,23 @@ export const DEFAULT_BYPASS_PATHS = [
     "/robots.txt",
     "/sitemap.xml",
 ];
+/** File extensions treated as static assets (outside /api/) and passed through without auth. */
+export const STATIC_FILE_EXTENSIONS = /\.(?:js|css|png|jpe?g|gif|webp|avif|svg|ico|woff2?|map|txt)$/i;
+/**
+ * Static assets that skip auth: Next's build output and image optimizer, the favicon, and files with
+ * an allowlisted extension. `/_next/data/` (getServerSideProps JSON) and `/api/*` are never static.
+ */
+export function isStaticAssetPath(pathname) {
+    if (pathname === "/api" || pathname.startsWith("/api/"))
+        return false;
+    if (pathname.startsWith("/_next/static/") || pathname === "/_next/image" || pathname.startsWith("/_next/image/"))
+        return true;
+    if (pathname === "/favicon.ico")
+        return true;
+    if (pathname.startsWith("/_next/"))
+        return false;
+    return STATIC_FILE_EXTENSIONS.test(pathname);
+}
 /**
  * Sanitizes open redirect path parameter (`from`).
  * Prevents protocol-relative URLs (`//evil.com`), backslashes (`/\evil.com`), and control characters.
@@ -42,8 +59,8 @@ function extractToken(req) {
  * Implements:
  * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
  * 2. Static asset and health check bypass
- * 3. Self-healing service error page routing with `from` back-redirect
- * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect)
+ * 3. Per-request token auth: requests without `Authorization: Bearer` / `x-api-token` get 401
+ * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect to `errorPath` with `from`)
  *
  * Example:
  *   // middleware.ts
@@ -57,6 +74,24 @@ function extractToken(req) {
  */
 export function createDaywalkerMiddleware(options = {}) {
     const client = options.client ?? daywalker;
+    return buildMiddleware(options, async (request) => {
+        const token = extractToken(request);
+        if (!token) {
+            return { ok: false, error: "INVALID_TOKEN", status: 401, message: "Missing Authorization header or x-api-token" };
+        }
+        return client.validateToken(token, { serviceSlug: options.serviceSlug });
+    });
+}
+/**
+ * Service health gate: checks this service's own DAYWALKER_API_KEY (not the caller's token) and
+ * routes every request to `errorPath` while it is invalid, redirecting back once it heals.
+ * It does NOT authenticate callers; use `createDaywalkerMiddleware` or `withDaywalkerAuth` for that.
+ */
+export function createDaywalkerServiceHealthMiddleware(options = {}) {
+    const client = options.client ?? daywalker;
+    return buildMiddleware(options, () => client.validateServiceKey({ serviceSlug: options.serviceSlug }));
+}
+function buildMiddleware(options, authenticate) {
     const bypassPaths = options.bypassPaths ?? DEFAULT_BYPASS_PATHS;
     const errorPath = options.errorPath ?? "/service-error";
     const homePath = options.homePath ?? "/";
@@ -80,20 +115,17 @@ export function createDaywalkerMiddleware(options = {}) {
             }
         }
         // 1. Bypass static files and health check probes
-        if (bypassPaths.some((path) => pathname === path || pathname.startsWith(`${path}/`)) ||
-            pathname.startsWith("/_next") ||
-            (pathname.includes(".") && !pathname.endsWith(".json"))) {
+        if (bypassPaths.some((path) => pathname === path || pathname.startsWith(`${path}/`)) || isStaticAssetPath(pathname)) {
             return globalThis.NextResponse?.next
                 ? globalThis.NextResponse.next()
                 : new Response(null, { headers: { "x-middleware-next": "1" } });
         }
-        // 2. Validate token (from request header, or service's configured DAYWALKER_API_KEY)
-        const incomingToken = extractToken(request);
-        const authResult = await client.validateToken(incomingToken ? { token: incomingToken, serviceSlug: options.serviceSlug } : { serviceSlug: options.serviceSlug });
+        // 2. Authenticate (caller's token, or the service key for the health gate)
+        const authResult = await authenticate(request);
         // 3. Handle service error page route
         if (pathname === errorPath) {
             if (authResult.ok) {
-                // If the service token is now valid, heal/redirect back to home or referer
+                // Authorized again: heal/redirect back to home
                 const redirectUrl = new URL(homePath, request.url);
                 return globalThis.NextResponse?.redirect
                     ? globalThis.NextResponse.redirect(redirectUrl)

package/dist/types.d.ts

@@ -55,6 +55,9 @@ export interface DaywalkerConfig {
     serviceSlug?: string;
     domain?: string;
     daywalkerPublicKey?: string | PublicJwk;
+    /** Expected `iss` of offline-verified JWT leases (env DAYWALKER_LEASE_ISSUER). Unchecked when unset. */
+    leaseIssuer?: string;
+    /** Must be https:// (http:// only for localhost). */
     authUrl?: string;
     cacheTtlMs?: number;
     /** Short cache for failed validations (not 429/network errors). Default 3000ms; 0 disables. */

package/docs/analytics.md

@@ -27,6 +27,6 @@ await analytics.shutdown();
 
 Add each flag's value to events (for breakdowns by variation) with `flags: client` where `client` is a `@shelbyb/daywalker-sdk/flags` instance (anything with `allFlags()`).
 
-Options: `autocapturePageviews` (default true), `flushAt` (20), `flushInterval` (2s browser / 10s Node), `maxQueueSize` (1000), `persistence` (`localStorage` | `memory`), `sessionTimeoutMinutes` (30), `respectDoNotTrack`, `optedOut` (consent), `onError`.
+Options: `autocapturePageviews` (default true), `flushAt` (20), `flushInterval` (2s browser / 10s Node), `maxQueueSize` (1000), `persistence` (`localStorage` | `memory`), `sessionTimeoutMinutes` (30), `respectDoNotTrack`, `optedOut` (consent), `captureFullUrls` (default false: URLs drop the fragment and all query parameters except `utm_*`, `gclid`, `fbclid`, `ref`), `onError`. `host` must be `https://` except on localhost.
 
 Events are sent to `POST {host}/a/batch`, which also accepts PostHog's capture format.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shelbyb/daywalker-sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Daywalker Auth service validation plus the DevPulse client SDKs (feature flags, OpenFeature, product analytics) in one zero-dependency package.",
   "type": "module",
   "main": "./dist/index.js",
@@ -84,11 +84,11 @@
     "@openfeature/core": "^1.12.0",
     "@openfeature/server-sdk": "^1.23.0",
     "@openfeature/web-sdk": "^1.10.0",
-    "@types/node": "^22.13.5",
+    "@types/node": "^26.6.4",
     "@types/react": "^19.3.0",
     "react": "^19.3.0",
     "tsx": "^4.23.15",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"
   },
   "keywords": [
     "api-token",