@shelbyb/daywalker-sdk 0.4.0 → 0.5.0

package/README.md

@@ -4,6 +4,10 @@
 
 # @shelbyb/daywalker-sdk
 
+[![npm](https://img.shields.io/npm/v/@shelbyb/daywalker-sdk)](https://www.npmjs.com/package/@shelbyb/daywalker-sdk)
+[![CI](https://github.com/Shelbyb/daywalker-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/Shelbyb/daywalker-sdk/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/@shelbyb/daywalker-sdk)](./LICENSE)
+
 Runtime-agnostic client library for [Daywalker Auth](https://auth.daywalker.dev). Supports **RFC 9421 (HTTP Message Signatures)**, **RFC 9530 (Digest Fields)**, **Web Crypto standards**, **Push Architecture key registration**, and **hardened web & Next.js middleware**.
 
 Runs on **Node.js 20.19+**, **Bun**, **Deno**, **Cloudflare Workers**, **Next.js Edge**, and browsers. ESM only; `require()` works on Node 20.19+ and 22.12+.
@@ -44,7 +48,7 @@ DAYWALKER_API_KEY=srv_live_... npx daywalker init --service my-service-slug --do
 
 `daywalker init`:
 - Generates an Ed25519 keypair locally using WebCrypto (`crypto.subtle`)
-- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register` (`Authorization: Bearer <API key>`, body `{ keyId, domain, publicKey }`; responds `201`)
+- Registers the public JWK directly with `POST https://auth.daywalker.dev/api/v1/keys/register` (`Authorization: Bearer <API key>`, body `{ keyId, domain, publicKey, serviceSlug }`; responds `201`, or `403 service_not_covered` when the API key doesn't cover the service)
 - Writes `DAYWALKER_SERVICE_SLUG`, `DAYWALKER_KEY_ID`, `DAYWALKER_SIGNING_KEY`, and `DAYWALKER_AUTH_URL` to `.env.local` (atomically, mode `0600`), and only after registration succeeds. `--skip-register` writes without registering.
 - `--force` replaces an existing key and keeps the old one as `DAYWALKER_SIGNING_KEY_PREVIOUS`
 - No route injectors or public `/.well-known/` endpoints needed
@@ -58,7 +62,7 @@ The private key is never printed unless you pass `--print-key`.
 | Variable | Required | Purpose |
 |---|---|---|
 | `DAYWALKER_API_KEY` | ✅ | The service's Daywalker API token (`srv_live_…`) or JWT lease |
-| `DAYWALKER_SERVICE_SLUG` | ✅ | The service slug to validate against (e.g. `sonalyze`) |
+| `DAYWALKER_SERVICE_SLUG` | ✅ | The service slug to validate against (e.g. `sonalyze`). One API key can cover several services: a comma-separated list (`gigpulse,devpulse`) is accepted and the first is the default. See [One API key, several services](#one-api-key-several-services) |
 | `DAYWALKER_SIGNING_KEY` | for signed requests | Ed25519 private key from `daywalker init` (PKCS#8 Base64 DER or PEM) |
 | `DAYWALKER_KEY_ID` | optional | RFC 7638 JWK thumbprint derived during key generation |
 | `DAYWALKER_SIGNING_KEY_PREVIOUS` | during rotation | Previous private key, maintained during deployment transitions |
@@ -177,6 +181,62 @@ app.get("/api/me", (c) => {
 
 ---
 
+## Express / Connect / Node `http` (`@shelbyb/daywalker-sdk/express`)
+
+```ts
+import express from "express";
+import { daywalkerAuth, daywalkerKeys } from "@shelbyb/daywalker-sdk/express";
+
+const app = express();
+app.use(daywalkerKeys()); // serves GET /.well-known/daywalker-keys.json
+app.use("/api", daywalkerAuth({ serviceSlug: "sonalyze" }));
+
+app.get("/api/me", (req, res) => res.json({ auth: req.auth }));
+```
+
+`daywalkerAuth` reads `Authorization: Bearer <token>` or `x-api-token`, answers `401` when neither is present, and otherwise returns the same status codes as the other middleware (`429` with `Retry-After`, `503` when Daywalker is unreachable). On success the validated payload is on `req.auth`. Both functions also work with plain `http.createServer` handlers.
+
+---
+
+## One API Key, Several Services
+
+A Daywalker API token can cover several services (say `gigpulse` and `devpulse`) and carry one allowlist of domains and IPs, so you manage a single set of client credentials instead of one per service. Ask for the extra services when you create the token in the Daywalker dashboard (**Also cover these services**), or with `additionalServiceIds` on `POST /api/v1/tokens` and `PATCH /api/v1/tokens/:id`.
+
+**Each app keeps its own service slug, with the same API key.** Every app (domain) generates and registers its own signing key:
+
+```bash
+# gigpulse app
+DAYWALKER_API_KEY=srv_live_… npx daywalker init --service gigpulse --domain gigpulse.daywalker.dev
+# devpulse app, same API key
+DAYWALKER_API_KEY=srv_live_… npx daywalker init --service devpulse --domain devpulse.daywalker.dev
+```
+
+`init` and `rotate` fail right away with `service_not_covered` if the API key doesn't cover the slug you name. An app that serves several services lists them all, `--service gigpulse,devpulse` (`DAYWALKER_SERVICE_SLUG="gigpulse,devpulse"`); the first is the default for `validateToken()`, and `client.config.serviceSlugs` holds the list.
+
+**The JWT lists every service.** Once your backend has authenticated with its signed request, ask for a lease. It lists all the service slugs the token covers (and may use right now):
+
+```ts
+const lease = await client.issueLease();
+lease.services; // ["gigpulse", "devpulse"]; also the JWT's `services` and `aud` claims
+
+// Least privilege: only what this process needs. A service the key doesn't cover is refused (403 SERVICE_NOT_GRANTED).
+const narrow = await client.issueLease({ services: ["devpulse"], ttlSeconds: 3600 });
+```
+
+Services that are inactive, in `DRAFT`, `TESTING` (unless an admin owns the token), or no longer entitled to the token's owner are left out. Check `lease.services` rather than assuming.
+
+Whoever receives the lease verifies it for **their own** service. It only passes when that slug is in the lease's `services` and `aud`:
+
+```ts
+const verifier = new Daywalker({ serviceSlug: "devpulse", daywalkerPublicKey: process.env.DAYWALKER_PUBLIC_KEY });
+const result = await verifier.validateToken(incomingJwt);
+if (result.ok) result.data.services; // ["gigpulse", "devpulse"]: everything this lease covers
+```
+
+Online validation of an `srv_live_…` token reports the same list in `result.data.services` (a server that predates multi-service tokens yields just the validated slug).
+
+---
+
 ## Zero-Egress Offline Verification
 
 When high-throughput internal microservices need zero latency and zero external egress, Daywalker Auth can issue asymmetric JWT leases. Configure `DAYWALKER_PUBLIC_KEY` (PEM or standard JWK) and token validation runs entirely in memory without network calls:
@@ -193,7 +253,7 @@ const client = new Daywalker({
 const result = await client.validateToken(incomingJwt);
 ```
 
-Leases must have a numeric `exp` and an `aud` (or `serviceSlug`) equal to your service slug, so `serviceSlug` must be configured. Set `leaseIssuer` (or `DAYWALKER_LEASE_ISSUER`) to also check `iss`.
+Leases must have a numeric `exp` and an `aud` (or `serviceSlug`) containing your service slug, so `serviceSlug` must be configured. A lease that lists `services` must list yours too. `result.data.services` is every service the lease covers (see [One API key, several services](#one-api-key-several-services)). Set `leaseIssuer` (or `DAYWALKER_LEASE_ISSUER`) to also check `iss`.
 
 ---
 
@@ -201,9 +261,9 @@ Leases must have a numeric `exp` and an `aud` (or `serviceSlug`) equal to your s
 
 | Command | Description |
 |---|---|
-| `npx daywalker init --service <slug> [--domain <host>] [--api-key-stdin] [--skip-register] [--force] [--json]` | Generate Ed25519 key, register with Daywalker Auth, and write `.env.local` or output JSON |
+| `npx daywalker init --service <slug[,slug…]> [--domain <host>] [--api-key-stdin] [--skip-register] [--force] [--json]` | Generate Ed25519 key, register with Daywalker Auth, and write `.env.local` or output JSON |
 | `npx daywalker check` | Validate configuration, signature readiness, and connection |
-| `npx daywalker rotate [--api-key-stdin] [--skip-register] [--json]` | Generate and register a new key while preserving the previous key in `.env.local` |
+| `npx daywalker rotate [--service <slug[,slug…]>] [--api-key-stdin] [--skip-register] [--json]` | Generate and register a new key while preserving the previous key in `.env.local` |
 
 ---
 
@@ -212,8 +272,8 @@ Leases must have a numeric `exp` and an `aud` (or `serviceSlug`) equal to your s
 | Endpoint | SDK usage | Notes |
 |---|---|---|
 | `POST /api/v1/tokens/validate` | `client.validateToken()` | Body `{ token, serviceSlug }`; signed with `Signature-Input`, `Signature`, `Content-Digest`. Errors: `400` (`DIGEST_MISMATCH`/missing fields), `401` (`INVALID_SIGNATURE`/invalid token), `403`, `429`. Response includes `valid`, `tokenId`, `tokenName`, `userId`, `stage`, `rateLimit`, `rateLimitHourly` and `X-RateLimit-*` / `X-RateLimit-Hourly-*` headers |
-| `POST /api/v1/keys/register` | `npx daywalker init` / `rotate` | Bearer auth; body `{ keyId, domain, publicKey }` |
-| `POST /api/v1/leases/issue` | `client.issueLease(ttlSeconds?)` | Signed request returns `{ lease, tokenType, expiresAt, jwksUri }` (EdDSA JWT) |
+| `POST /api/v1/keys/register` | `npx daywalker init` / `rotate` | Bearer auth; body `{ keyId, domain, publicKey, serviceSlug? }`; `403 service_not_covered` if the key doesn't cover `serviceSlug` |
+| `POST /api/v1/leases/issue` | `client.issueLease(ttlSeconds? \| { ttlSeconds?, services? })` | Signed request returns `{ lease, tokenType, expiresAt, jwksUri, services }` (EdDSA JWT listing every service the key covers; `services` narrows it) |
 | `GET /.well-known/jwks.json` | `client.fetchJwks()` | Daywalker public JWKS for offline lease verification |
 
 Inbound tokens may be supplied as `x-api-token: srv_live_...` or `Authorization: Bearer <JWT or API key>`.
@@ -257,6 +317,18 @@ const analytics = createAnalytics({ writeKey: "dpa_…", host: "https://devpulse
 
 ---
 
+## Provenance & Releases
+
+Releases are published from GitHub Actions ([`publish.yml`](./.github/workflows/publish.yml)) with [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): npm accepts a short-lived OIDC token from this repository's workflow, so there is no long-lived npm token anywhere. Each version carries a signed [provenance attestation](https://docs.npmjs.com/generating-provenance-statements) linking it to the commit and workflow run that built it. Check it on the npm page, or after installing:
+
+```bash
+npm audit signatures
+```
+
+To cut a release (maintainers): bump `version` in `package.json`, add a `CHANGELOG.md` entry, merge to `main`, then either push a matching tag (`git tag v0.5.0 && git push origin v0.5.0`) or run the **Publish** workflow from `main` with the version. The workflow refuses tags not on `main`, versions that don't match `package.json`, and versions already on npm. Tests and packing run in a job without the OIDC token; only the final job, which uploads the tested tarball, can publish.
+
+---
+
 ## License
 
 MIT

package/dist/cli.js

@@ -2,13 +2,13 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createDaywalker } from "./client.js";
-import { publicHostname } from "./config.js";
+import { parseServiceSlugs, publicHostname } from "./config.js";
 import { generateSigningKey, loadSigningKey, registerPublicKey, redactSecrets } from "./crypto/index.js";
 const HELP = `daywalker: connect a service to Daywalker Auth (RFC 9421 / Push Architecture)
 
 Usage:
-  daywalker init   --service <slug> [--api-key-stdin] [--domain <host>] [--auth-url <url>] [--force] [--skip-register] [--json|--export] [--print-key]
-  daywalker rotate [--service <slug>] [--api-key-stdin] [--domain <host>] [--auth-url <url>] [--skip-register] [--json|--export] [--print-key]
+  daywalker init   --service <slug[,slug…]> [--api-key-stdin] [--domain <host>] [--auth-url <url>] [--force] [--skip-register] [--json|--export] [--print-key]
+  daywalker rotate [--service <slug[,slug…]>] [--api-key-stdin] [--domain <host>] [--auth-url <url>] [--skip-register] [--json|--export] [--print-key]
   daywalker check
 
 init     Generates an Ed25519 keypair, registers the public key directly with Daywalker Auth
@@ -180,12 +180,11 @@ async function init(opts) {
     const dir = process.cwd();
     const envFile = path.join(dir, ".env.local");
     const existing = readEnvFile(envFile);
-    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "")
-        .trim()
-        .toLowerCase();
-    if (!slug || !/^[a-z0-9_-]+$/.test(slug)) {
-        fail("--service must be this service's Daywalker slug (e.g. --service sonalyze)");
+    const slugs = parseServiceSlugs(String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? ""));
+    if (slugs.length === 0 || !slugs.every((s) => /^[a-z0-9_-]+$/.test(s))) {
+        fail("--service must be this service's Daywalker slug (e.g. --service sonalyze), or a comma-separated list when one API key covers several (--service gigpulse,devpulse)");
     }
+    const slug = slugs.join(",");
     const rawDomain = opts.domain ? String(opts.domain) : existing.get("DAYWALKER_DOMAIN") ?? process.env.DAYWALKER_DOMAIN ?? "";
     let domain = null;
     if (rawDomain) {
@@ -268,7 +267,7 @@ async function rotate(opts) {
     const current = existing.get("DAYWALKER_SIGNING_KEY") ?? process.env.DAYWALKER_SIGNING_KEY;
     if (!current)
         fail("No DAYWALKER_SIGNING_KEY found; run `daywalker init` first");
-    const slug = String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "").trim().toLowerCase();
+    const slug = parseServiceSlugs(String(opts.service ?? existing.get("DAYWALKER_SERVICE_SLUG") ?? process.env.DAYWALKER_SERVICE_SLUG ?? "")).join(",");
     const apiKey = await resolveApiKey(opts, existing);
     const authUrl = String(opts["auth-url"] ?? existing.get("DAYWALKER_AUTH_URL") ?? process.env.DAYWALKER_AUTH_URL ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
     const rotateDomain = publicHostname(String(opts.domain ?? existing.get("DAYWALKER_DOMAIN") ?? process.env.DAYWALKER_DOMAIN ?? ""));
@@ -317,7 +316,9 @@ async function check() {
     const result = await client.selfCheck();
     if (result.ok) {
         console.log(`✔ Daywalker configuration looks good`);
-        if (result.serviceSlug)
+        if (result.serviceSlugs.length > 1)
+            console.log(`  • Services: ${result.serviceSlugs.join(", ")} (default: ${result.serviceSlug})`);
+        else if (result.serviceSlug)
             console.log(`  • Service slug: ${result.serviceSlug}`);
         if (result.domain)
             console.log(`  • Caller domain: ${result.domain}`);

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ResolvedConfig } from "./config.js";
-import { type DaywalkerConfig, type PublicJwk, type RetryOptions, type SelfCheckResult, type TokenPayload, type ValidateResult } from "./types.js";
+import { type DaywalkerConfig, type IssueLeaseOptions, type LeaseResponse, type PublicJwk, type RetryOptions, type SelfCheckResult, type TokenPayload, type ValidateResult } from "./types.js";
 /** Validation results kept in memory; the least recently used are evicted past this. */
 export declare const MAX_VALIDATION_CACHE_ENTRIES = 1000;
 /** Longest 429 `Retry-After` waited out by default (`retry.maxRetryAfterMs`); longer ones return the 429. */
@@ -85,13 +85,10 @@ export declare class Daywalker {
     }): Promise<TokenPayload>;
     /**
      * Exchanges an RFC 9421 signed request for a short-lived EdDSA JWT lease (POST /api/v1/leases/issue).
+     * The lease lists every service slug the API key covers (`services`, also the JWT's `services` and `aud`
+     * claims), so one set of credentials serves all of them. Pass `{ services: [...] }` to narrow it.
      */
-    issueLease(ttlSeconds?: number): Promise<{
-        lease: string;
-        tokenType?: string;
-        expiresAt?: string;
-        jwksUri?: string;
-    }>;
+    issueLease(options?: number | IssueLeaseOptions): Promise<LeaseResponse>;
     /**
      * Fetches Daywalker's public JWKS (GET /.well-known/jwks.json) for offline lease verification.
      * Uses the configured `fetch`, sends no credentials, never follows redirects and times out after `timeoutMs`.

package/dist/client.js

@@ -1,5 +1,5 @@
-import { resolveConfig } from "./config.js";
-import { loadSigningKey, signRequest, verifyJwtLease, maskSecret, redactSecrets, sha256Base64Url, } from "./crypto/index.js";
+import { parseServiceSlugs, resolveConfig } from "./config.js";
+import { loadSigningKey, signRequest, verifyJwtLease, leaseServices, maskSecret, redactSecrets, sha256Base64Url, } from "./crypto/index.js";
 import { DaywalkerAuthError, DaywalkerError, DaywalkerRateLimitError, } from "./types.js";
 function parseRetryAfter(headerValue) {
     if (!headerValue)
@@ -159,6 +159,9 @@ function malformedValidation(json, payloadData) {
             if (src[k] !== undefined && src[k] !== null && typeof src[k] !== "string")
                 return `${k} is not a string`;
         }
+        if (src.services !== undefined && src.services !== null && !(Array.isArray(src.services) && src.services.every((s) => typeof s === "string"))) {
+            return "services is not a list of strings";
+        }
         for (const k of ["rateLimit", "rateLimitHourly"]) {
             if (src[k] !== undefined && src[k] !== null && !isRateLimitWindow(src[k]))
                 return `${k} is not a rate limit window`;
@@ -416,7 +419,7 @@ export class Daywalker {
                 const result = {
                     ok: true,
                     data: {
-                        serviceSlug: serviceSlug || (payload.serviceSlug || payload.aud || ""),
+                        serviceSlug: serviceSlug || (payload.serviceSlug || payload.service || ""),
                         tenantId: (payload.tenantId || payload.sub || ""),
                         rateLimit: payload.rateLimit ?? {
                             limit: 1000,
@@ -430,6 +433,8 @@ export class Daywalker {
                         stage: payload.stage,
                         offlineVerified: true,
                         ...payload,
+                        // Every service the lease covers: its `services` claim, else its audience.
+                        services: leaseServices(payload),
                     },
                 };
                 if (this._config.cacheTtlMs > 0) {
@@ -535,6 +540,7 @@ export class Daywalker {
                     userId: (payloadData.userId || json.userId),
                     stage: (payloadData.stage || json.stage),
                     ...payloadData,
+                    services: (payloadData.services ?? json.services) ?? [json.serviceSlug || serviceSlug],
                 };
                 const result = {
                     ok: true,
@@ -604,17 +610,29 @@ export class Daywalker {
     }
     /**
      * Exchanges an RFC 9421 signed request for a short-lived EdDSA JWT lease (POST /api/v1/leases/issue).
+     * The lease lists every service slug the API key covers (`services`, also the JWT's `services` and `aud`
+     * claims), so one set of credentials serves all of them. Pass `{ services: [...] }` to narrow it.
      */
-    async issueLease(ttlSeconds) {
+    async issueLease(options) {
+        const opts = typeof options === "number" ? { ttlSeconds: options } : (options ?? {});
+        const services = opts.services ? parseServiceSlugs(opts.services) : undefined;
+        if (opts.services && (!services || services.length === 0)) {
+            throw new DaywalkerAuthError("issueLease: services must list at least one service slug", 400, "INVALID_REQUEST");
+        }
         const res = await this.fetch("/api/v1/leases/issue", {
             method: "POST",
-            body: ttlSeconds ? { ttlSeconds } : {},
+            body: { ...(opts.ttlSeconds ? { ttlSeconds: opts.ttlSeconds } : {}), ...(services ? { services } : {}) },
         });
         const json = (await res.json().catch(() => ({})));
         if (res.status !== 201 && res.status !== 200) {
             throw new DaywalkerAuthError(redactSecrets(String(json.message || json.error || `Lease issue failed with HTTP ${res.status}`)), res.status, json.error);
         }
-        return json;
+        if (typeof json.lease !== "string") {
+            throw new DaywalkerAuthError("Daywalker Auth returned a malformed lease response (no lease)", res.status, "SERVICE_UNAVAILABLE");
+        }
+        // Servers from before multi-service tokens don't list services; their lease covers the one configured slug.
+        const listed = Array.isArray(json.services) ? json.services.filter((s) => typeof s === "string") : [];
+        return { ...json, lease: json.lease, services: listed.length > 0 ? listed : this._config.serviceSlug ? [this._config.serviceSlug] : [] };
     }
     /**
      * Fetches Daywalker's public JWKS (GET /.well-known/jwks.json) for offline lease verification.
@@ -685,6 +703,7 @@ export class Daywalker {
         return {
             ok: problems.length === 0,
             serviceSlug: this._config.serviceSlug,
+            serviceSlugs: this._config.serviceSlugs,
             domain: this._config.domain,
             signing: Boolean(signingKey),
             keyId,

package/dist/config.d.ts

@@ -5,7 +5,10 @@ export interface ResolvedConfig {
     /** Never signs; `keys()` publishes its public JWK alongside the current key during rotation. */
     previousSigningKey: string | SigningKey | null;
     keyId: string | null;
+    /** The slug used when a call doesn't name one: the first of `serviceSlugs`. */
     serviceSlug: string | null;
+    /** Every service this deployment is configured for (one API key can cover several). */
+    serviceSlugs: string[];
     domain: string | null;
     domainSource: string | null;
     daywalkerPublicKey: string | PublicJwk | PublicJwks | null;
@@ -31,4 +34,9 @@ export declare function publicHostname(value: string | undefined | null): string
  * so API keys, SDK keys and write keys never travel in cleartext.
  */
 export declare function assertSecureUrl(name: string, value: string): void;
+/**
+ * Service slugs from a comma- or whitespace-separated string (`DAYWALKER_SERVICE_SLUG="gigpulse,devpulse"`)
+ * or an array: lower-cased, de-duplicated, in the order given (the first is the default service).
+ */
+export declare function parseServiceSlugs(value: string | readonly string[] | null | undefined): string[];
 export declare function resolveConfig(options?: DaywalkerConfig): ResolvedConfig;

package/dist/config.js

@@ -66,11 +66,20 @@ export function assertSecureUrl(name, value) {
         return;
     throw new Error(`${name} must use https:// (http:// is only allowed for localhost); got "${value}"`);
 }
+/**
+ * Service slugs from a comma- or whitespace-separated string (`DAYWALKER_SERVICE_SLUG="gigpulse,devpulse"`)
+ * or an array: lower-cased, de-duplicated, in the order given (the first is the default service).
+ */
+export function parseServiceSlugs(value) {
+    const parts = typeof value === "string" ? value.split(/[\s,]+/) : Array.isArray(value) ? value.flatMap((v) => String(v).split(/[\s,]+/)) : [];
+    return Array.from(new Set(parts.map((v) => v.trim().toLowerCase()).filter(Boolean)));
+}
 export function resolveConfig(options = {}) {
     const env = options.env ?? (typeof process !== "undefined" && process.env ? process.env : {});
     const problems = [];
     const apiKey = (options.apiKey ?? env.DAYWALKER_API_KEY ?? "").trim() || null;
-    const serviceSlug = (options.serviceSlug ?? env.DAYWALKER_SERVICE_SLUG ?? "").trim().toLowerCase() || null;
+    const serviceSlugs = parseServiceSlugs(options.serviceSlugs ?? options.serviceSlug ?? env.DAYWALKER_SERVICE_SLUG);
+    const serviceSlug = serviceSlugs[0] ?? null;
     if (!apiKey)
         problems.push("DAYWALKER_API_KEY is not set");
     if (!serviceSlug)
@@ -123,6 +132,7 @@ export function resolveConfig(options = {}) {
         previousSigningKey,
         keyId,
         serviceSlug,
+        serviceSlugs,
         domain,
         domainSource,
         daywalkerPublicKey,

package/dist/crypto/index.d.ts

@@ -1,5 +1,5 @@
 export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, timingSafeEqual, timingSafeEqualString, maskSecret, redactSecrets, } from "./encoding.js";
 export { DEFAULT_MAX_BODY_SIZE_BYTES, computeContentDigest, sha256Base64, sha256Base64Url, } from "./digest.js";
 export { calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, } from "./keys.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./signatures.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, } from "./signatures.js";
 export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, ReplayStore, } from "./signatures.js";

package/dist/crypto/index.js

@@ -1,4 +1,4 @@
 export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, timingSafeEqual, timingSafeEqualString, maskSecret, redactSecrets, } from "./encoding.js";
 export { DEFAULT_MAX_BODY_SIZE_BYTES, computeContentDigest, sha256Base64, sha256Base64Url, } from "./digest.js";
 export { calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, } from "./keys.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./signatures.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, } from "./signatures.js";

package/dist/crypto/signatures.d.ts

@@ -88,6 +88,11 @@ export declare function signRequest(params: SignRequestParams): Promise<SignedHe
  * Replay protection uses `replayStore` (default: per-process memory; use a shared store across instances).
  */
 export declare function verifyRequestSignature(params: VerifySignatureParams): Promise<VerifySignatureResult>;
+/**
+ * Every service slug a (verified) JWT lease covers: its `services` claim, else its audience, else the
+ * single `serviceSlug` / `service` claim of leases issued before multi-service tokens.
+ */
+export declare function leaseServices(payload: Record<string, unknown>): string[];
 /** Clock skew tolerated on JWT lease `exp` / `nbf`. */
 export declare const JWT_CLOCK_SKEW_SECONDS = 60;
 /**

package/dist/crypto/signatures.js

@@ -405,6 +405,16 @@ export async function verifyRequestSignature(params) {
         return { valid: false, error: `Verification error: ${err.message}` };
     }
 }
+/**
+ * Every service slug a (verified) JWT lease covers: its `services` claim, else its audience, else the
+ * single `serviceSlug` / `service` claim of leases issued before multi-service tokens.
+ */
+export function leaseServices(payload) {
+    const strings = (v) => (Array.isArray(v) ? v : v === undefined || v === null ? [] : [v]).filter((s) => typeof s === "string" && s !== "");
+    const listed = strings(payload.services);
+    const fallback = listed.length > 0 ? listed : strings(payload.aud).length > 0 ? strings(payload.aud) : strings(payload.serviceSlug ?? payload.service);
+    return Array.from(new Set(fallback.map((s) => s.toLowerCase())));
+}
 /** Clock skew tolerated on JWT lease `exp` / `nbf`. */
 export const JWT_CLOCK_SKEW_SECONDS = 60;
 /**
@@ -490,6 +500,16 @@ export async function verifyJwtLease(params) {
                 error: `JWT audience mismatch: expected ${expected}, got ${audiences.join(", ").toLowerCase()}`,
             };
         }
+        // A lease that lists its services must list this one (belt and braces next to `aud`).
+        if (payload.services !== undefined) {
+            const listed = Array.isArray(payload.services) ? payload.services : null;
+            if (!listed || !listed.some((s) => typeof s === "string" && s.toLowerCase() === expected)) {
+                return {
+                    valid: false,
+                    error: `JWT services mismatch: expected ${expected}, got ${listed ? listed.map(String).join(", ").toLowerCase() : "(not a list)"}`,
+                };
+            }
+        }
         if (params.expectedIssuer && payload.iss !== params.expectedIssuer) {
             return { valid: false, error: `JWT issuer mismatch: expected ${params.expectedIssuer}, got ${payload.iss ?? "(none)"}` };
         }
@@ -527,6 +547,8 @@ export async function registerPublicKey(params) {
                 keyId: params.publicJwk.kid,
                 domain: params.domain,
                 publicKey: params.publicJwk,
+                // Lets Daywalker refuse right away when the API key doesn't cover the service(s); a comma-separated list is fine
+                ...(params.serviceSlug ? { serviceSlug: params.serviceSlug } : {}),
             }),
         });
         if (res.ok) {

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, } from "./client.js";
 export type { DaywalkerFetchInit, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, UNAVAILABLE_ERROR_CODES, } from "./types.js";
-export type { DaywalkerConfig, RateLimitWindow, TokenPayload, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, PublicJwk, PublicJwks, SigningKey, } from "./types.js";
-export { resolveConfig, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
+export type { DaywalkerConfig, RateLimitWindow, TokenPayload, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, LeaseResponse, IssueLeaseOptions, PublicJwk, PublicJwks, SigningKey, } from "./types.js";
+export { resolveConfig, parseServiceSlugs, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
 export type { ResolvedConfig, } from "./config.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
 export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, ReplayStore, } from "./crypto/index.js";

package/dist/index.js

@@ -1,4 +1,4 @@
 export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, UNAVAILABLE_ERROR_CODES, } from "./types.js";
-export { resolveConfig, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
+export { resolveConfig, parseServiceSlugs, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";

package/dist/types.d.ts

@@ -12,6 +12,11 @@ export interface TokenPayload {
     tokenName?: string;
     userId?: string;
     stage?: string;
+    /**
+     * Every service slug the token (or JWT lease) covers. One API key can cover several services, so this
+     * can hold more than `serviceSlug`, which is the service this call validated for.
+     */
+    services?: string[];
     offlineVerified?: boolean;
     [key: string]: unknown;
 }
@@ -76,7 +81,13 @@ export interface DaywalkerConfig {
      */
     previousSigningKey?: string | SigningKey;
     keyId?: string;
+    /**
+     * The service this deployment validates tokens for (env DAYWALKER_SERVICE_SLUG). One API key can cover
+     * several services: a comma-separated list ("gigpulse,devpulse") is accepted, and the first is the default.
+     */
     serviceSlug?: string;
+    /** Same as a comma-separated `serviceSlug`, as an array. Takes precedence over `serviceSlug`. */
+    serviceSlugs?: string[];
     domain?: string;
     /** A JWK, a JWKS (`{ keys: [...] }`, selected by the lease's `kid`), PEM, or Base64 SPKI / raw key. */
     daywalkerPublicKey?: string | PublicJwk | PublicJwks;
@@ -98,9 +109,30 @@ export interface DaywalkerConfig {
     fetch?: typeof fetch;
     env?: Record<string, string | undefined>;
 }
+/** Response of `client.issueLease()` (POST /api/v1/leases/issue). */
+export interface LeaseResponse {
+    /** The signed EdDSA JWT. Verify it with Daywalker's public JWKS. */
+    lease: string;
+    tokenType?: string;
+    /** Unix seconds. */
+    expiresAt?: number | string;
+    jwksUri?: string;
+    /** Every service slug the lease covers (also its `services` and `aud` claims). */
+    services: string[];
+}
+export interface IssueLeaseOptions {
+    /** Lease lifetime in seconds (Daywalker clamps it to 1h-24h). */
+    ttlSeconds?: number;
+    /**
+     * Narrow the lease to these service slugs (least privilege). Each must be one the API key covers;
+     * otherwise Daywalker answers 403 `SERVICE_NOT_GRANTED`. Default: every service the key covers.
+     */
+    services?: string[];
+}
 export interface SelfCheckResult {
     ok: boolean;
     serviceSlug: string | null;
+    serviceSlugs: string[];
     domain: string | null;
     signing: boolean;
     keyId: string | null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shelbyb/daywalker-sdk",
-  "version": "0.4.0",
-  "description": "Daywalker Auth service validation plus the DevPulse client SDKs (feature flags, OpenFeature, product analytics) in one zero-dependency package.",
+  "version": "0.5.0",
+  "description": "Daywalker Auth service validation plus the DevPulse client SDKs (feature flags, OpenFeature, product analytics) in one package with a single runtime dependency (re2js).",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -68,6 +68,7 @@
   "files": [
     "dist",
     "docs",
+    "!docs/maintenance",
     "README.md",
     "LICENSE"
   ],