@shelbyb/daywalker-sdk 0.6.0 → 0.7.0

package/dist/crypto/webcrypto.d.ts

@@ -0,0 +1,38 @@
+export declare const webcrypto: Readonly<{
+    digest: (algorithm: AlgorithmIdentifier, data: BufferSource) => Promise<ArrayBuffer>;
+    sign: (algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams, key: CryptoKey, data: BufferSource) => Promise<ArrayBuffer>;
+    verify: (algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams, key: CryptoKey, signature: BufferSource, data: BufferSource) => Promise<boolean>;
+    importKey: {
+        (format: "jwk", keyData: JsonWebKey, algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKey>;
+        (format: Exclude<KeyFormat, "jwk">, keyData: BufferSource, algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+        (format: "jwk", keyData: JsonWebKey, algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKey>;
+        (format: Exclude<KeyFormat, "jwk">, keyData: BufferSource, algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: Iterable<KeyUsage>): Promise<CryptoKey>;
+    };
+    exportKey: {
+        (format: "jwk", key: CryptoKey): Promise<JsonWebKey>;
+        (format: Exclude<KeyFormat, "jwk">, key: CryptoKey): Promise<ArrayBuffer>;
+        (format: KeyFormat, key: CryptoKey): Promise<ArrayBuffer | JsonWebKey>;
+    };
+    generateKey: {
+        (algorithm: "Ed25519" | {
+            name: "Ed25519";
+        }, extractable: boolean, keyUsages: ReadonlyArray<"sign" | "verify">): Promise<CryptoKeyPair>;
+        (algorithm: "X25519" | {
+            name: "X25519";
+        }, extractable: boolean, keyUsages: ReadonlyArray<"deriveBits" | "deriveKey">): Promise<CryptoKeyPair>;
+        (algorithm: RsaHashedKeyGenParams | EcKeyGenParams, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKeyPair>;
+        (algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKey>;
+        (algorithm: AlgorithmIdentifier, extractable: boolean, keyUsages: KeyUsage[]): Promise<CryptoKeyPair | CryptoKey>;
+        (algorithm: "Ed25519" | {
+            name: "Ed25519";
+        }, extractable: boolean, keyUsages: ReadonlyArray<"sign" | "verify">): Promise<CryptoKeyPair>;
+        (algorithm: "X25519" | {
+            name: "X25519";
+        }, extractable: boolean, keyUsages: ReadonlyArray<"deriveBits" | "deriveKey">): Promise<CryptoKeyPair>;
+        (algorithm: RsaHashedKeyGenParams | EcKeyGenParams, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKeyPair>;
+        (algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params, extractable: boolean, keyUsages: ReadonlyArray<KeyUsage>): Promise<CryptoKey>;
+        (algorithm: AlgorithmIdentifier, extractable: boolean, keyUsages: Iterable<KeyUsage>): Promise<CryptoKeyPair | CryptoKey>;
+    };
+    getRandomValues: <T extends Exclude<BufferSource, ArrayBuffer>>(array: T) => T;
+    randomUUID: () => `${string}-${string}-${string}-${string}-${string}`;
+}>;

package/dist/crypto/webcrypto.js

@@ -0,0 +1,25 @@
+/**
+ * WebCrypto primitives captured once, when this module loads. Every signature, digest and key operation in
+ * the SDK goes through these, so code that later replaces `crypto.subtle.verify` (or `crypto.subtle`
+ * itself) can't make forged signatures or tokens verify. The object is frozen so the captured functions
+ * can't be swapped either. Without WebCrypto each call throws (fail closed) instead of the import failing.
+ */
+const cryptoRef = globalThis.crypto;
+const subtleRef = cryptoRef?.subtle;
+function missing() {
+    throw new Error("@shelbyb/daywalker-sdk needs WebCrypto (globalThis.crypto.subtle): Node.js 20.19+, Bun, Deno, Workers or a browser");
+}
+function capture(target, name) {
+    const fn = target?.[name];
+    return (typeof fn === "function" ? fn.bind(target) : missing);
+}
+export const webcrypto = Object.freeze({
+    digest: capture(subtleRef, "digest"),
+    sign: capture(subtleRef, "sign"),
+    verify: capture(subtleRef, "verify"),
+    importKey: capture(subtleRef, "importKey"),
+    exportKey: capture(subtleRef, "exportKey"),
+    generateKey: capture(subtleRef, "generateKey"),
+    getRandomValues: capture(cryptoRef, "getRandomValues"),
+    randomUUID: capture(cryptoRef, "randomUUID"),
+});

package/dist/express.d.ts

@@ -4,6 +4,8 @@ interface Req {
     method?: string;
     path?: string;
     url?: string;
+    originalUrl?: string;
+    protocol?: string;
     headers?: Record<string, string | string[] | undefined>;
     get?: (name: string) => string | undefined;
     auth?: TokenPayload;
@@ -22,5 +24,4 @@ export declare function daywalkerAuth(options?: {
     client?: Daywalker;
     serviceSlug?: string;
 }): (req: Req, res: Res, next?: (err?: unknown) => void) => Promise<void>;
-export declare function daywalkerKeys(client?: Daywalker): (req: Req, res: Res, next?: () => void) => Promise<void>;
 export {};

package/dist/express.js

@@ -1,5 +1,5 @@
 import { daywalker } from "./client.js";
-import { toAuthFailureResponse } from "./middleware.js";
+import { readCredentials, toAuthFailureResponse } from "./middleware.js";
 /**
  * Express / Connect / Node http middleware that validates incoming Daywalker tokens.
  */
@@ -8,34 +8,28 @@ export function daywalkerAuth(options = {}) {
     const serviceSlug = options.serviceSlug;
     return async (req, res, next) => {
         const getHeader = (name) => {
+            if (req.headers)
+                return req.headers[name.toLowerCase()];
             if (typeof req.get === "function")
                 return req.get(name);
-            if (req.headers) {
-                const val = req.headers[name.toLowerCase()] ?? req.headers[name];
-                return Array.isArray(val) ? val[0] : val;
-            }
             return undefined;
         };
-        const authHeader = getHeader("authorization");
-        const apiTokenHeader = getHeader("x-api-token");
-        let token = null;
-        if (authHeader && authHeader.toLowerCase().startsWith("bearer ")) {
-            token = authHeader.slice(7).trim();
-        }
-        else if (apiTokenHeader) {
-            token = apiTokenHeader.trim();
-        }
-        if (!token) {
+        const host = typeof getHeader("host") === "string" ? getHeader("host") : "localhost";
+        // The origin only matters for DPoP proofs, and is replaced by the client's `publicOrigin` when set.
+        const url = `${req.protocol === "https" ? "https" : "http"}://${/^[A-Za-z0-9.:[\]-]+$/.test(host) ? host : "localhost"}${req.originalUrl ?? req.url ?? "/"}`;
+        const credentials = readCredentials(getHeader, { method: req.method ?? "GET", url });
+        if (!credentials.ok) {
+            const body = { error: "INVALID_TOKEN", message: credentials.message };
             if (typeof res.status === "function" && typeof res.json === "function") {
-                res.status(401).json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" });
+                res.status(401).json(body);
                 return;
             }
             res.statusCode = 401;
             res.setHeader("Content-Type", "application/json");
-            res.end(JSON.stringify({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }));
+            res.end(JSON.stringify(body));
             return;
         }
-        const result = await client.validateToken(token, { serviceSlug });
+        const result = await client.validateToken(credentials.token, { serviceSlug, dpop: credentials.dpop });
         if (!result.ok) {
             const { status, ...body } = toAuthFailureResponse(result);
             if (body.retryAfter) {
@@ -54,17 +48,3 @@ export function daywalkerAuth(options = {}) {
         next?.();
     };
 }
-export function daywalkerKeys(client = daywalker) {
-    return async (req, res, next) => {
-        const path = req.path ?? (req.url ?? "").split("?")[0];
-        if ((req.method ?? "GET") === "GET" && path === "/.well-known/daywalker-keys.json") {
-            const keysDoc = await client.keys();
-            res.statusCode = 200;
-            res.setHeader("Content-Type", "application/json");
-            res.setHeader("Cache-Control", "public, max-age=300");
-            res.end(JSON.stringify(keysDoc));
-            return;
-        }
-        next?.();
-    };
-}

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, } from "./client.js";
+export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, MAX_CACHE_TTL_MS, MAX_TOKEN_LENGTH, JWKS_CACHE_TTL_MS, JWKS_REFETCH_COOLDOWN_MS, } from "./client.js";
 export type { DaywalkerFetchInit, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, UNAVAILABLE_ERROR_CODES, } from "./types.js";
-export type { DaywalkerConfig, RateLimitWindow, TokenPayload, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, TokenSet, GetTokensOptions, AccessTokenUser, PublicJwk, PublicJwks, SigningKey, } from "./types.js";
+export type { DaywalkerConfig, RateLimitWindow, TokenPayload, IncomingDpop, ValidateTokenOptions, ValidateErrorCode, ValidateResult, RetryOptions, SelfCheckResult, TokenSet, GetTokensOptions, AccessTokenUser, KeyStore, StoredSigningKey, MessageSigner, PublicJwk, PublicJwks, SigningKey, } from "./types.js";
 export { resolveConfig, parseServiceSlugs, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
 export type { ResolvedConfig, } from "./config.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
-export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, ReplayStore, } from "./crypto/index.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, importSigningKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, listSigningKeys, revokeSigningKey, keySlotFor, MIN_KEY_TTL_SECONDS, MAX_KEY_TTL_SECONDS, verifyDpopProof, MAX_DPOP_PROOF_LENGTH, DPOP_MAX_AGE_SECONDS, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
+export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, ReplayStore, VerifyDpopProofParams, SigningKeyRecord, KeyApiResult, } from "./crypto/index.js";
 export { buildTokenCookie, clearTokenCookie, daywalkerCookies, accessTokenUser } from "./cookies.js";
 export type { TokenCookieOptions } from "./cookies.js";

package/dist/index.js

@@ -1,5 +1,5 @@
-export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, } from "./client.js";
+export { Daywalker, createDaywalker, daywalker, MAX_RETRY_AFTER_MS, MAX_VALIDATION_CACHE_ENTRIES, MAX_CACHE_TTL_MS, MAX_TOKEN_LENGTH, JWKS_CACHE_TTL_MS, JWKS_REFETCH_COOLDOWN_MS, } from "./client.js";
 export { DaywalkerError, DaywalkerAuthError, DaywalkerRateLimitError, UNAVAILABLE_ERROR_CODES, } from "./types.js";
 export { resolveConfig, parseServiceSlugs, publicHostname, assertSecureUrl, DEFAULT_TIMEOUT_MS, } from "./config.js";
-export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, REPLAY_CACHE_MAX_ENTRIES, SignatureReplayCache, computeContentDigest, sha256Base64, sha256Base64Url, calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, importSigningKey, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, leaseServices, registerPublicKey, listSigningKeys, revokeSigningKey, keySlotFor, MIN_KEY_TTL_SECONDS, MAX_KEY_TTL_SECONDS, verifyDpopProof, MAX_DPOP_PROOF_LENGTH, DPOP_MAX_AGE_SECONDS, stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, base64UrlToBytesStrict, bytesToHex, hexToBytes, maskSecret, redactSecrets, } from "./crypto/index.js";
 export { buildTokenCookie, clearTokenCookie, daywalkerCookies, accessTokenUser } from "./cookies.js";

package/dist/keystore/file.d.ts

@@ -0,0 +1,14 @@
+import type { KeyStore } from "../types.js";
+export interface FileKeyStoreOptions {
+    /** Default `.daywalker/signing-key.json` in the working directory. Keep it out of version control. */
+    path?: string;
+}
+/**
+ * Keeps the key in a file (Node.js only), for VMs and containers with a persistent volume.
+ * - Written to a private 0600 temp file, then hard-linked into place inside a 0700 directory: `link()` fails
+ *   when the file exists, so of several processes starting at once exactly one publishes its key, and no reader
+ *   ever sees a half-written file.
+ * - Never follows a symlink and refuses a file that isn't a regular file, isn't owned by this user, or is
+ *   readable or writable by group or others, like ssh does for private keys.
+ */
+export declare function fileKeyStore(options?: FileKeyStoreOptions): KeyStore;

package/dist/keystore/file.js

@@ -0,0 +1,77 @@
+import fs from "node:fs/promises";
+import { constants } from "node:fs";
+import path from "node:path";
+import { parseStoredSigningKey } from "./index.js";
+/** Largest key file read. A real one is a few hundred bytes. */
+const MAX_FILE_BYTES = 4096;
+/**
+ * Keeps the key in a file (Node.js only), for VMs and containers with a persistent volume.
+ * - Written to a private 0600 temp file, then hard-linked into place inside a 0700 directory: `link()` fails
+ *   when the file exists, so of several processes starting at once exactly one publishes its key, and no reader
+ *   ever sees a half-written file.
+ * - Never follows a symlink and refuses a file that isn't a regular file, isn't owned by this user, or is
+ *   readable or writable by group or others, like ssh does for private keys.
+ */
+export function fileKeyStore(options = {}) {
+    const file = path.resolve(options.path ?? path.join(".daywalker", "signing-key.json"));
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    async function load() {
+        let handle;
+        try {
+            handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT")
+                return null;
+            if (code === "ELOOP")
+                throw new Error(`${file} is a symlink; refusing to read a signing key through it`);
+            throw err;
+        }
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                throw new Error(`${file} is not a regular file`);
+            if (process.platform !== "win32") {
+                if ((stat.mode & 0o077) !== 0)
+                    throw new Error(`${file} is readable or writable by others (mode ${(stat.mode & 0o777).toString(8)}); chmod 600 it`);
+                if (uid !== undefined && stat.uid !== uid)
+                    throw new Error(`${file} is not owned by this user`);
+            }
+            if (stat.size > MAX_FILE_BYTES)
+                throw new Error(`${file} is too large to be a signing key`);
+            return parseStoredSigningKey(JSON.parse(await handle.readFile("utf8")));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async function saveIfAbsent(key) {
+        const record = parseStoredSigningKey(key);
+        const dir = path.dirname(file);
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+        // Written in full to a private temp file first, then hard-linked into place: link() fails if the target
+        // exists, so publishing is atomic and a reader never sees a half-written key.
+        const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`);
+        const handle = await fs.open(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
+            await handle.sync();
+            await handle.close();
+            try {
+                await fs.link(tmp, file);
+                return true;
+            }
+            catch (err) {
+                if (err.code === "EEXIST")
+                    return false;
+                throw err;
+            }
+        }
+        finally {
+            await handle.close().catch(() => { });
+            await fs.rm(tmp, { force: true });
+        }
+    }
+    return Object.freeze({ load, saveIfAbsent });
+}

package/dist/keystore/index.d.ts

@@ -0,0 +1,18 @@
+import type { KeyStore, StoredSigningKey } from "../types.js";
+export type { KeyStore, StoredSigningKey } from "../types.js";
+/**
+ * Checks that `value` is a well-formed `StoredSigningKey` and returns a clean copy (unknown fields dropped),
+ * or throws. Run on everything a store returns, so a corrupted or hand-edited record is refused rather than used.
+ */
+export declare function parseStoredSigningKey(value: unknown): StoredSigningKey;
+/**
+ * Keeps the key in this process only. Every new process provisions (and registers) a new key, so use it for
+ * tests and single long-lived processes, not for serverless or several instances.
+ */
+export declare function memoryKeyStore(initial?: StoredSigningKey | null): KeyStore;
+/**
+ * Read-only: the key `daywalker init` wrote to DAYWALKER_SIGNING_KEY, DAYWALKER_KEY_ID and DAYWALKER_DOMAIN.
+ * It can't save, so a client using it never generates a key; set the variables with `daywalker init` (or
+ * your secret manager) first.
+ */
+export declare function envKeyStore(env?: Record<string, string | undefined>): KeyStore;

package/dist/keystore/index.js

@@ -0,0 +1,71 @@
+import { SAFE_IDENTIFIER_PATTERN } from "../crypto/signatures.js";
+import { publicHostname } from "../config.js";
+/** Longest accepted base64 PKCS#8 private key (an Ed25519 one is 64 characters). */
+const MAX_PKCS8_BASE64_LENGTH = 512;
+/**
+ * Checks that `value` is a well-formed `StoredSigningKey` and returns a clean copy (unknown fields dropped),
+ * or throws. Run on everything a store returns, so a corrupted or hand-edited record is refused rather than used.
+ */
+export function parseStoredSigningKey(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Stored signing key is not an object");
+    const v = value;
+    if (v.version !== 1)
+        throw new Error("Stored signing key has an unsupported version");
+    if (typeof v.keyId !== "string" || !SAFE_IDENTIFIER_PATTERN.test(v.keyId))
+        throw new Error("Stored signing key has an invalid keyId");
+    if (typeof v.domain !== "string" || publicHostname(v.domain) !== v.domain)
+        throw new Error("Stored signing key has an invalid domain");
+    if (typeof v.privateKeyPkcs8Base64 !== "string" ||
+        v.privateKeyPkcs8Base64.length > MAX_PKCS8_BASE64_LENGTH ||
+        !/^[A-Za-z0-9+/]+={0,2}$/.test(v.privateKeyPkcs8Base64)) {
+        throw new Error("Stored signing key has an invalid private key");
+    }
+    if (typeof v.createdAt !== "number" || !Number.isSafeInteger(v.createdAt) || v.createdAt < 0) {
+        throw new Error("Stored signing key has an invalid createdAt");
+    }
+    return Object.freeze({
+        version: 1,
+        keyId: v.keyId,
+        domain: v.domain,
+        privateKeyPkcs8Base64: v.privateKeyPkcs8Base64,
+        createdAt: v.createdAt,
+    });
+}
+/**
+ * Keeps the key in this process only. Every new process provisions (and registers) a new key, so use it for
+ * tests and single long-lived processes, not for serverless or several instances.
+ */
+export function memoryKeyStore(initial = null) {
+    let stored = initial ? parseStoredSigningKey(initial) : null;
+    return Object.freeze({
+        load: () => stored,
+        saveIfAbsent: (key) => {
+            if (stored)
+                return false;
+            stored = parseStoredSigningKey(key);
+            return true;
+        },
+    });
+}
+/**
+ * Read-only: the key `daywalker init` wrote to DAYWALKER_SIGNING_KEY, DAYWALKER_KEY_ID and DAYWALKER_DOMAIN.
+ * It can't save, so a client using it never generates a key; set the variables with `daywalker init` (or
+ * your secret manager) first.
+ */
+export function envKeyStore(env = typeof process !== "undefined" ? process.env : {}) {
+    return Object.freeze({
+        load: () => {
+            const raw = env.DAYWALKER_SIGNING_KEY?.trim();
+            if (!raw)
+                return null;
+            return parseStoredSigningKey({
+                version: 1,
+                keyId: env.DAYWALKER_KEY_ID?.trim(),
+                domain: publicHostname(env.DAYWALKER_DOMAIN ?? env.DAYWALKER_SIGNING_DOMAIN ?? ""),
+                privateKeyPkcs8Base64: raw,
+                createdAt: 0,
+            });
+        },
+    });
+}

package/dist/middleware.d.ts

@@ -1,11 +1,35 @@
 import { Daywalker } from "./client.js";
-import type { ValidateResult } from "./types.js";
+import type { IncomingDpop, ValidateResult } from "./types.js";
+/** Longest Authorization / x-api-token / DPoP header read; longer ones are refused unparsed. */
+export declare const MAX_AUTH_HEADER_LENGTH = 8300;
+export type Credentials = {
+    ok: true;
+    token: string;
+    dpop?: IncomingDpop;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * Reads the caller's token from `Authorization: Bearer <token>`, `Authorization: DPoP <token>` (with its
+ * `DPoP` proof header) or, when there is no Authorization header, `x-api-token`. An Authorization header
+ * with any other scheme, a malformed or oversized header, or a header given twice is refused rather than
+ * skipped, so a request can't pick which credential is checked. Shared by the Next, Web/Hono and Express
+ * adapters.
+ */
+export declare function readCredentials(getHeader: (name: string) => string | string[] | null | undefined, request: {
+    method: string;
+    url: string;
+}): Credentials;
 type ValidateFailure = Extract<ValidateResult, {
     ok: false;
 }>;
 export interface AuthFailureResponse {
-    /** 401 bad/expired/missing token, 429 rate limited, 500 server misconfiguration, 503 auth service unavailable. */
-    status: 401 | 429 | 500 | 503;
+    /**
+     * 401 bad/expired/missing token or DPoP proof, 403 token not valid for this service, 429 rate limited,
+     * 500 server misconfiguration, 503 auth service unavailable.
+     */
+    status: 401 | 403 | 429 | 500 | 503;
     error: string;
     message: string;
     retryAfter?: number;

package/dist/middleware.js

@@ -1,4 +1,46 @@
 import { daywalker } from "./client.js";
+/** Longest Authorization / x-api-token / DPoP header read; longer ones are refused unparsed. */
+export const MAX_AUTH_HEADER_LENGTH = 8_300;
+/**
+ * Reads the caller's token from `Authorization: Bearer <token>`, `Authorization: DPoP <token>` (with its
+ * `DPoP` proof header) or, when there is no Authorization header, `x-api-token`. An Authorization header
+ * with any other scheme, a malformed or oversized header, or a header given twice is refused rather than
+ * skipped, so a request can't pick which credential is checked. Shared by the Next, Web/Hono and Express
+ * adapters.
+ */
+export function readCredentials(getHeader, request) {
+    const one = (name) => {
+        const v = getHeader(name);
+        if (Array.isArray(v))
+            return v.length === 1 ? v[0] : null;
+        return v ?? undefined;
+    };
+    const authorization = one("authorization");
+    const apiToken = one("x-api-token");
+    if (authorization === null || apiToken === null)
+        return { ok: false, message: "Credentials header sent more than once" };
+    if (authorization !== undefined && authorization !== "") {
+        if (authorization.length > MAX_AUTH_HEADER_LENGTH)
+            return { ok: false, message: "Authorization header is too long" };
+        const m = /^(Bearer|DPoP) ([^\s,]+)$/i.exec(authorization.trim());
+        if (!m)
+            return { ok: false, message: "Authorization must be `Bearer <token>` or `DPoP <token>`" };
+        if (m[1].toLowerCase() === "bearer")
+            return { ok: true, token: m[2] };
+        const proof = one("dpop");
+        if (proof === null)
+            return { ok: false, message: "DPoP header sent more than once" };
+        if (proof !== undefined && proof.length > MAX_AUTH_HEADER_LENGTH)
+            return { ok: false, message: "DPoP header is too long" };
+        return { ok: true, token: m[2], dpop: { proof: proof?.trim(), method: request.method, url: request.url } };
+    }
+    if (apiToken !== undefined && apiToken.trim() !== "") {
+        if (apiToken.length > MAX_AUTH_HEADER_LENGTH)
+            return { ok: false, message: "x-api-token header is too long" };
+        return { ok: true, token: apiToken.trim() };
+    }
+    return { ok: false, message: "Missing Authorization header or x-api-token" };
+}
 /** Error codes that mean Daywalker Auth itself could not be reached or is degraded. */
 const UNAVAILABLE_ERROR_CODES = new Set(["NETWORK_ERROR", "SERVICE_UNAVAILABLE"]);
 /**
@@ -23,6 +65,9 @@ export function toAuthFailureResponse(result) {
             retryAfter,
         };
     }
+    if (result.status === 403) {
+        return { status: 403, error: result.error || "FORBIDDEN", message: result.message || "Forbidden" };
+    }
     return { status: 401, error: result.error || "INVALID_TOKEN", message: result.message || "Unauthorized" };
 }
 /**
@@ -41,36 +86,44 @@ export function daywalkerAuth(options = {}) {
     const client = options.client ?? daywalker;
     const serviceSlug = options.serviceSlug;
     return async function daywalkerMiddleware(c, next) {
-        let authHeader;
-        let apiTokenHeader;
-        if (typeof c?.req?.header === "function") {
-            authHeader = c.req.header("authorization");
-            apiTokenHeader = c.req.header("x-api-token");
+        let getHeader = () => undefined;
+        let method = "GET";
+        let url = "http://localhost/";
+        const raw = c?.req?.raw ?? (c instanceof Request ? c : undefined);
+        if (raw instanceof Request) {
+            getHeader = (name) => raw.headers.get(name);
+            method = raw.method;
+            url = raw.url;
+        }
+        else if (typeof c?.req?.header === "function") {
+            getHeader = (name) => c.req.header(name);
+            method = String(c.req.method ?? method);
+            url = String(c.req.url ?? url);
         }
         else if (c?.req?.headers instanceof Headers || c?.headers instanceof Headers) {
             const headers = (c.req?.headers ?? c.headers);
-            authHeader = headers.get("authorization") ?? undefined;
-            apiTokenHeader = headers.get("x-api-token") ?? undefined;
-        }
-        else if (typeof c?.req?.headers === "object" || typeof c?.headers === "object") {
-            const headers = c.req?.headers ?? c.headers;
-            authHeader = headers["authorization"] || headers["Authorization"];
-            apiTokenHeader = headers["x-api-token"] || headers["X-Api-Token"];
-        }
-        let token = null;
-        if (authHeader && authHeader.toLowerCase().startsWith("bearer ")) {
-            token = authHeader.slice(7).trim();
+            getHeader = (name) => headers.get(name);
+            method = String(c.req?.method ?? c.method ?? method);
+            url = String(c.req?.url ?? c.url ?? url);
         }
-        else if (apiTokenHeader) {
-            token = apiTokenHeader.trim();
+        else if (c?.req?.headers && typeof c.req.headers === "object") {
+            const headers = c.req.headers;
+            getHeader = (name) => {
+                const key = Object.keys(headers).filter((k) => k.toLowerCase() === name);
+                return key.length > 1 ? [String(headers[key[0]]), String(headers[key[1]])] : key.length === 1 ? headers[key[0]] : undefined;
+            };
+            method = String(c.req.method ?? method);
+            url = String(c.req.url ?? url);
         }
-        if (!token) {
+        const credentials = readCredentials(getHeader, { method, url });
+        if (!credentials.ok) {
+            const body = { error: "INVALID_TOKEN", message: credentials.message };
             if (typeof c?.json === "function") {
-                return c.json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }, 401);
+                return c.json(body, 401);
             }
-            return Response.json({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }, { status: 401 });
+            return Response.json(body, { status: 401 });
         }
-        const result = await client.validateToken(token, { serviceSlug });
+        const result = await client.validateToken(credentials.token, { serviceSlug, dpop: credentials.dpop });
         if (!result.ok) {
             const { status, ...body } = toAuthFailureResponse(result);
             const headers = body.retryAfter ? { "Retry-After": String(body.retryAfter) } : undefined;

package/dist/next.d.ts

@@ -64,7 +64,8 @@ export declare function sanitizeRedirectPath(path: string): string | null;
  * Implements:
  * 1. Server Action probe defense (CVE-2025-55182 scanner mitigation)
  * 2. Static asset and health check bypass
- * 3. Per-request token auth: requests without `Authorization: Bearer` / `x-api-token` get 401
+ * 3. Per-request token auth: requests without `Authorization: Bearer` / `Authorization: DPoP` (with its
+ *    proof) / `x-api-token` get 401
  * 4. Distinct handling for API routes (JSON + CORS) vs UI pages (redirect to `errorPath` with `from`)
  *
  * Only `/_next/static/`, `/_next/image`, `/favicon.ico` and `bypassPaths` skip auth by default.
@@ -82,8 +83,9 @@ export declare function sanitizeRedirectPath(path: string): string | null;
  */
 export declare function createDaywalkerMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;
 /**
- * Service health gate: checks this service's own DAYWALKER_API_KEY (not the caller's token) and
- * routes every request to `errorPath` while it is invalid, redirecting back once it heals.
+ * Service health gate: checks that this service's OAuth client credentials still get an access token
+ * covering its service (not the caller's token) and routes every request to `errorPath` while they don't,
+ * redirecting back once it heals.
  * It does NOT authenticate callers; use `createDaywalkerMiddleware` or `withDaywalkerAuth` for that.
  */
 export declare function createDaywalkerServiceHealthMiddleware(options?: NextMiddlewareOptions): (request: Request) => Promise<Response>;