@shelbyb/daywalker-sdk 0.6.0 → 0.8.0

package/dist/crypto/key-api.js

@@ -0,0 +1,217 @@
+import { webcrypto } from "./webcrypto.js";
+import { redactSecrets } from "./encoding.js";
+import { API_KEY_PATTERN, SAFE_IDENTIFIER_PATTERN, SERVICE_SLUG_PATTERN, assertSafeIdentifier } from "./signatures.js";
+import { assertSecureUrl, parseServiceSlugs, publicHostname } from "../config.js";
+/**
+ * Daywalker's signing-key lifecycle API (`/api/v1/keys*`), authenticated with the API key as
+ * `Authorization: Bearer`. Every call goes only to `authUrl`: redirects are refused (never followed with the
+ * key), requests time out after 10s, nothing is cached, inputs are validated first and answers are bounded.
+ */
+/** Per-attempt timeout for key API calls. */
+const KEY_API_TIMEOUT_MS = 10_000;
+/** Largest key API answer read. */
+const MAX_KEY_API_RESPONSE_BYTES = 262_144;
+/** Daywalker's `instanceId` format: one key slot per (domain, instanceId). */
+export const INSTANCE_ID_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+/** Key lifetime bounds Daywalker accepts for `ttlSeconds` (1 hour to 30 days). */
+export const MIN_KEY_TTL_SECONDS = 3_600;
+export const MAX_KEY_TTL_SECONDS = 2_592_000;
+/**
+ * The instance slot the SDK registers a key in: one slot per key (`dw-<keyId>`), so registering a key never
+ * demotes another one (Daywalker moves the previous key of the same slot to ROTATING, then revokes it).
+ */
+export function keySlotFor(keyId) {
+    const slot = `dw-${keyId}`.slice(0, 64);
+    if (!INSTANCE_ID_PATTERN.test(slot))
+        throw new Error("keyId can't be used as an instance slot");
+    return slot;
+}
+const seconds = (v) => {
+    if (typeof v !== "string" && typeof v !== "number")
+        return null;
+    const t = typeof v === "number" ? v * 1000 : Date.parse(v);
+    return Number.isFinite(t) ? Math.floor(t / 1000) : null;
+};
+/** A record from Daywalker, checked and normalized, or null when it isn't one. */
+function parseKeyRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const v = value;
+    if (typeof v.keyId !== "string" || !SAFE_IDENTIFIER_PATTERN.test(v.keyId))
+        return null;
+    if (typeof v.domain !== "string" || !publicHostname(v.domain))
+        return null;
+    if (v.status !== "ACTIVE" && v.status !== "ROTATING" && v.status !== "REVOKED")
+        return null;
+    const instanceId = typeof v.instanceId === "string" && INSTANCE_ID_PATTERN.test(v.instanceId) ? v.instanceId : null;
+    return Object.freeze({
+        ...(typeof v.id === "string" ? { id: v.id } : {}),
+        keyId: v.keyId,
+        domain: v.domain.toLowerCase(),
+        status: v.status,
+        instanceId,
+        expiresAt: seconds(v.expiresAt),
+        createdAt: seconds(v.createdAt),
+        lastUsedAt: seconds(v.lastUsedAt),
+    });
+}
+/** Validates the shared inputs; returns an error result, or the base URL. */
+function prepare(params) {
+    const base = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    try {
+        assertSecureUrl("authUrl", base);
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err.message };
+    }
+    if (typeof params.apiKey !== "string" || !API_KEY_PATTERN.test(params.apiKey)) {
+        return { ok: false, status: 400, error: "apiKey is missing or contains characters an API key can't have" };
+    }
+    return { base, doFetch: params.fetchFn ?? globalThis.fetch };
+}
+/** One key API call: no redirects, no cache, a timeout, a bounded JSON answer. */
+async function call(doFetch, url, apiKey, init) {
+    try {
+        const res = await doFetch(url, {
+            method: init.method,
+            headers: {
+                ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
+                Accept: "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            redirect: "manual",
+            cache: "no-store",
+            signal: AbortSignal.timeout(KEY_API_TIMEOUT_MS),
+        });
+        if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+            res.body?.cancel().catch(() => { });
+            return { ok: false, status: res.status, error: "Daywalker Auth answered with a redirect; refusing to follow it with the API key" };
+        }
+        const text = await res.text();
+        if (text.length > MAX_KEY_API_RESPONSE_BYTES)
+            return { ok: false, status: res.status, error: "Daywalker Auth answer is too large" };
+        let parsed = {};
+        try {
+            parsed = text ? JSON.parse(text) : {};
+        }
+        catch {
+            parsed = {};
+        }
+        const json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+        return { status: res.status, json };
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: redactSecrets(err.message) };
+    }
+}
+function failure(status, json) {
+    const code = typeof json.error === "string" ? json.error.slice(0, 64) : typeof json.code === "string" ? json.code.slice(0, 64) : undefined;
+    const message = typeof json.message === "string" ? json.message : code ?? `HTTP ${status}`;
+    return { ok: false, status, code, error: redactSecrets(message.slice(0, 500)) };
+}
+/**
+ * Register public key directly with Daywalker Auth via POST /api/v1/keys/register (Push Architecture).
+ * Re-registering the same key is idempotent (200). `instanceId` puts the key in a slot: registering a new key
+ * in an occupied slot moves the old one to ROTATING for 10 minutes, then revokes it; without `instanceId`
+ * the same happens to every other slot-less key of the domain, so the SDK always passes one (`keySlotFor`).
+ * `ttlSeconds` (1 hour to 30 days) or `expiresAt` make the key expire. Errors carry Daywalker's `code`
+ * (`KEY_LIMIT_REACHED`: 20 live keys per domain; `KEY_ID_CONFLICT`; `domain_not_allowed`).
+ */
+export async function registerPublicKey(params) {
+    const prepared = prepare(params);
+    if ("ok" in prepared)
+        return prepared;
+    if (!params.domain) {
+        return { ok: false, status: 400, error: "domain is required to register a key (set --domain or DAYWALKER_DOMAIN)" };
+    }
+    const domain = publicHostname(params.domain);
+    if (!domain) {
+        return { ok: false, status: 400, error: `domain (${params.domain}) is not a public hostname` };
+    }
+    const slugs = params.serviceSlug ? parseServiceSlugs(params.serviceSlug) : [];
+    if (!slugs.every((slug) => SERVICE_SLUG_PATTERN.test(slug))) {
+        return { ok: false, status: 400, error: "serviceSlug must be Daywalker service slug(s)" };
+    }
+    const jwk = params.publicJwk;
+    if (!jwk || jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(jwk.x) || "d" in jwk) {
+        return { ok: false, status: 400, error: "publicJwk must be an Ed25519 public JWK (never a private key)" };
+    }
+    try {
+        assertSafeIdentifier("keyId", jwk.kid);
+    }
+    catch (err) {
+        return { ok: false, status: 400, error: err.message };
+    }
+    if (params.instanceId !== undefined && !INSTANCE_ID_PATTERN.test(params.instanceId)) {
+        return { ok: false, status: 400, error: "instanceId must be 1-64 of A-Z a-z 0-9 . _ -" };
+    }
+    if (params.ttlSeconds !== undefined && (!Number.isInteger(params.ttlSeconds) || params.ttlSeconds < MIN_KEY_TTL_SECONDS || params.ttlSeconds > MAX_KEY_TTL_SECONDS)) {
+        return { ok: false, status: 400, error: `ttlSeconds must be a whole number from ${MIN_KEY_TTL_SECONDS} to ${MAX_KEY_TTL_SECONDS}` };
+    }
+    if (params.expiresAt !== undefined && (!(params.expiresAt instanceof Date) || !(params.expiresAt.getTime() > Date.now()))) {
+        return { ok: false, status: 400, error: "expiresAt must be a date in the future" };
+    }
+    const res = await call(prepared.doFetch, `${prepared.base}/api/v1/keys/register`, params.apiKey, {
+        method: "POST",
+        body: {
+            keyId: jwk.kid,
+            domain,
+            publicKey: { kty: "OKP", crv: "Ed25519", x: jwk.x, kid: jwk.kid, use: "sig", alg: "EdDSA" },
+            // Lets Daywalker refuse right away when the API key doesn't cover the service(s); a comma-separated list is fine
+            ...(slugs.length > 0 ? { serviceSlug: slugs.join(",") } : {}),
+            ...(params.instanceId ? { instanceId: params.instanceId } : {}),
+            ...(params.ttlSeconds ? { ttlSeconds: params.ttlSeconds } : {}),
+            ...(params.expiresAt ? { expiresAt: params.expiresAt.toISOString() } : {}),
+        },
+    });
+    if ("ok" in res)
+        return res;
+    if (res.status !== 200 && res.status !== 201)
+        return failure(res.status, res.json);
+    const key = parseKeyRecord(res.json);
+    // An answer for another key or domain is not a registration of this one.
+    if (key && (key.keyId !== jwk.kid || key.domain !== domain)) {
+        return { ok: false, status: 502, error: "Daywalker Auth answered with a different key or domain" };
+    }
+    return { ok: true, status: res.status, ...(key ? { key } : {}) };
+}
+/** Lists the signing keys registered for `domain` (GET /api/v1/keys), newest first. */
+export async function listSigningKeys(params) {
+    const prepared = prepare(params);
+    if ("ok" in prepared)
+        return prepared;
+    const domain = publicHostname(params.domain);
+    if (!domain)
+        return { ok: false, status: 400, error: `domain (${params.domain}) is not a public hostname` };
+    const res = await call(prepared.doFetch, `${prepared.base}/api/v1/keys?domain=${encodeURIComponent(domain)}`, params.apiKey, { method: "GET" });
+    if ("ok" in res)
+        return res;
+    if (res.status !== 200)
+        return failure(res.status, res.json);
+    if (!Array.isArray(res.json.keys))
+        return { ok: false, status: 502, error: "Daywalker Auth returned no key list" };
+    const keys = res.json.keys.map(parseKeyRecord).filter((k) => k !== null && k.domain === domain);
+    return { ok: true, status: 200, keys };
+}
+/**
+ * Revokes a signing key now (DELETE /api/v1/keys/{keyId}). Daywalker also ends every OAuth session that was
+ * authenticated with it. Revoking a key that is already revoked succeeds; an unknown key is 404 `key_not_found`.
+ */
+export async function revokeSigningKey(params) {
+    const prepared = prepare(params);
+    if ("ok" in prepared)
+        return prepared;
+    if (typeof params.keyId !== "string" || !SAFE_IDENTIFIER_PATTERN.test(params.keyId)) {
+        return { ok: false, status: 400, error: "keyId must be 1-128 safe characters" };
+    }
+    const res = await call(prepared.doFetch, `${prepared.base}/api/v1/keys/${encodeURIComponent(params.keyId)}`, params.apiKey, { method: "DELETE" });
+    if ("ok" in res)
+        return res;
+    return res.status === 200 ? { ok: true, status: 200 } : failure(res.status, res.json);
+}
+/** A random instance slot for a process (`dw-i-<random>`), for keys that live only as long as it does. */
+export function randomInstanceId() {
+    const bytes = webcrypto.getRandomValues(new Uint8Array(12));
+    return `dw-i-${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+}

package/dist/crypto/keys.d.ts

@@ -23,3 +23,8 @@ export declare function loadPublicKey(raw: string | PublicJwk | PublicJwks | Cry
     publicKey: CryptoKey;
     publicJwk: PublicJwk;
 }>;
+/**
+ * Imports a PKCS#8 (base64) Ed25519 private key for signing only, as a NON-extractable CryptoKey: once
+ * imported, nothing in the process (including this SDK) can export it again. The public JWK is derived first.
+ */
+export declare function importSigningKey(pkcs8Base64: string): Promise<SigningKey>;

package/dist/crypto/keys.js

@@ -1,3 +1,4 @@
+import { webcrypto } from "./webcrypto.js";
 import { base64ToBytes, base64UrlToBytes, bytesToBase64, bytesToBase64Url, } from "./encoding.js";
 import { sha256Base64Url } from "./digest.js";
 // PKCS#8 prefix for Ed25519 private keys (16 bytes)
@@ -21,12 +22,12 @@ export async function calculateJwkThumbprint(jwk) {
  * Generate a new Ed25519 keypair using WebCrypto.
  */
 export async function generateSigningKey() {
-    const keyPair = (await globalThis.crypto.subtle.generateKey("Ed25519", true, [
+    const keyPair = (await webcrypto.generateKey("Ed25519", true, [
         "sign",
         "verify",
     ]));
-    const jwk = (await globalThis.crypto.subtle.exportKey("jwk", keyPair.privateKey));
-    const pkcs8Buffer = await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+    const jwk = (await webcrypto.exportKey("jwk", keyPair.privateKey));
+    const pkcs8Buffer = await webcrypto.exportKey("pkcs8", keyPair.privateKey);
     const privateKeyPkcs8Base64 = bytesToBase64(new Uint8Array(pkcs8Buffer));
     const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
     const publicJwk = {
@@ -58,8 +59,8 @@ export async function loadSigningKey(raw) {
         try {
             const parsed = JSON.parse(trimmed);
             if (parsed.kty === "OKP" && parsed.crv === "Ed25519" && parsed.d) {
-                const privateKey = await globalThis.crypto.subtle.importKey("jwk", parsed, "Ed25519", true, ["sign"]);
-                const jwk = (await globalThis.crypto.subtle.exportKey("jwk", privateKey));
+                const privateKey = await webcrypto.importKey("jwk", parsed, "Ed25519", true, ["sign"]);
+                const jwk = (await webcrypto.exportKey("jwk", privateKey));
                 const kid = parsed.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x }));
                 const publicJwk = {
                     kty: "OKP",
@@ -69,8 +70,8 @@ export async function loadSigningKey(raw) {
                     use: "sig",
                     alg: "EdDSA",
                 };
-                const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
-                const pkcs8Buffer = await globalThis.crypto.subtle.exportKey("pkcs8", privateKey);
+                const publicKey = await webcrypto.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
+                const pkcs8Buffer = await webcrypto.exportKey("pkcs8", privateKey);
                 return {
                     privateKey,
                     publicKey,
@@ -107,12 +108,12 @@ export async function loadSigningKey(raw) {
     }
     let privateKey;
     try {
-        privateKey = await globalThis.crypto.subtle.importKey("pkcs8", keyBytes, "Ed25519", true, ["sign"]);
+        privateKey = await webcrypto.importKey("pkcs8", keyBytes, "Ed25519", true, ["sign"]);
     }
     catch (err) {
         throw new Error(`Failed to import Ed25519 private key: ${err.message}`);
     }
-    const jwk = (await globalThis.crypto.subtle.exportKey("jwk", privateKey));
+    const jwk = (await webcrypto.exportKey("jwk", privateKey));
     const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
     const publicJwk = {
         kty: "OKP",
@@ -122,7 +123,7 @@ export async function loadSigningKey(raw) {
         use: "sig",
         alg: "EdDSA",
     };
-    const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
+    const publicKey = await webcrypto.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
     return {
         privateKey,
         publicKey,
@@ -153,7 +154,7 @@ export async function loadPublicKey(raw, kid) {
         return loadPublicKey(selectJwk(raw, kid));
     }
     if (typeof raw === "object" && "type" in raw && raw.type === "public") {
-        const exported = (await globalThis.crypto.subtle.exportKey("jwk", raw));
+        const exported = (await webcrypto.exportKey("jwk", raw));
         const kid = exported.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: exported.x }));
         return {
             publicKey: raw,
@@ -169,7 +170,7 @@ export async function loadPublicKey(raw, kid) {
     }
     if (typeof raw === "object" && "kty" in raw && raw.kty === "OKP" && raw.crv === "Ed25519") {
         const kid = raw.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: raw.x }));
-        const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: raw.x }, "Ed25519", true, ["verify"]);
+        const publicKey = await webcrypto.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: raw.x }, "Ed25519", true, ["verify"]);
         return {
             publicKey,
             publicJwk: {
@@ -221,7 +222,7 @@ export async function loadPublicKey(raw, kid) {
     if (keyBytes.length === 32) {
         const x = bytesToBase64Url(keyBytes);
         const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x });
-        const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x }, "Ed25519", true, ["verify"]);
+        const publicKey = await webcrypto.importKey("jwk", { kty: "OKP", crv: "Ed25519", x }, "Ed25519", true, ["verify"]);
         return {
             publicKey,
             publicJwk: {
@@ -236,8 +237,8 @@ export async function loadPublicKey(raw, kid) {
     }
     // Try SPKI format
     try {
-        const publicKey = await globalThis.crypto.subtle.importKey("spki", keyBytes, "Ed25519", true, ["verify"]);
-        const jwk = (await globalThis.crypto.subtle.exportKey("jwk", publicKey));
+        const publicKey = await webcrypto.importKey("spki", keyBytes, "Ed25519", true, ["verify"]);
+        const jwk = (await webcrypto.exportKey("jwk", publicKey));
         const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
         return {
             publicKey,
@@ -255,3 +256,12 @@ export async function loadPublicKey(raw, kid) {
         throw new Error(`Failed to import public key: ${err.message}`);
     }
 }
+/**
+ * Imports a PKCS#8 (base64) Ed25519 private key for signing only, as a NON-extractable CryptoKey: once
+ * imported, nothing in the process (including this SDK) can export it again. The public JWK is derived first.
+ */
+export async function importSigningKey(pkcs8Base64) {
+    const derived = await loadSigningKey(pkcs8Base64);
+    const privateKey = await webcrypto.importKey("pkcs8", base64ToBytes(pkcs8Base64), "Ed25519", false, ["sign"]);
+    return { privateKey, publicKey: derived.publicKey, publicJwk: derived.publicJwk };
+}

package/dist/crypto/signatures.d.ts

@@ -4,6 +4,10 @@ export declare const SIGNATURE_LABEL = "sig1";
 export declare const SIGNATURE_ALG = "ed25519";
 export declare const MAX_CLOCK_SKEW_SECONDS = 300;
 export declare const SAFE_IDENTIFIER_PATTERN: RegExp;
+/** A Daywalker service slug. */
+export declare const SERVICE_SLUG_PATTERN: RegExp;
+/** An API key: printable, no whitespace, quotes or separators that could break out of a header. */
+export declare const API_KEY_PATTERN: RegExp;
 /**
  * Splits a request target into its RFC 9421 "@path" value (§2.2.6; dot segments resolved and repeated
  * slashes collapsed per RFC 3986, to prevent path traversal & signature confusion) and its "@query" value
@@ -88,19 +92,19 @@ export declare function signRequest(params: SignRequestParams): Promise<SignedHe
  * Replay protection uses `replayStore` (default: per-process memory; use a shared store across instances).
  */
 export declare function verifyRequestSignature(params: VerifySignatureParams): Promise<VerifySignatureResult>;
-/**
- * Every service slug a (verified) JWT lease covers: its `services` claim, else its audience, else the
- * single `serviceSlug` / `service` claim of leases issued before multi-service tokens.
- */
+/** Every service slug a (verified) access token covers: its `services` claim, else its audience. */
 export declare function leaseServices(payload: Record<string, unknown>): string[];
 /** Clock skew tolerated on JWT `exp` / `nbf`: 30 seconds, and never more (see `clockSkewSeconds`). */
 export declare const JWT_CLOCK_SKEW_SECONDS = 30;
+/** Longest accepted JWT (characters); longer input is refused before any parsing. */
+export declare const MAX_JWT_LENGTH = 16384;
 /**
- * Zero-egress offline verification for asymmetric JWT token leases.
- * Requires a numeric `exp` and an audience (`aud` or `serviceSlug`) equal to `expectedServiceSlug`;
- * a verifier without an expected slug rejects every lease. `iss` is checked when `expectedIssuer` is set
- * (Daywalker documents no fixed issuer, so there is no default). Segments must be canonical unpadded
- * base64url, a `crit` header is rejected, and a JWKS `publicKey` is searched by the header's `kid`.
+ * Zero-egress offline verification of Daywalker access tokens (RFC 9068 JWTs from the OAuth token endpoint).
+ * Requires `typ: at+jwt`, `alg: EdDSA`, a `jti`, a numeric `exp`, and an `aud` containing `expectedServiceSlug`
+ * (a verifier without an expected slug rejects every token). `iss` is checked when `expectedIssuer` is set.
+ * Segments must be canonical unpadded base64url, a `crit` header is rejected, and a JWKS `publicKey` is
+ * searched by the header's `kid`. A token with `cnf.jkt` is DPoP-bound: the caller must also check its
+ * proof (`verifyDpopProof`), as `Daywalker.validateToken()` does.
  */
 export declare function verifyJwtLease(params: {
     token: string;
@@ -114,18 +118,3 @@ export declare function verifyJwtLease(params: {
     payload?: Record<string, unknown>;
     error?: string;
 }>;
-/**
- * Register public key directly with Daywalker Auth via POST /api/v1/keys/register (Push Architecture).
- */
-export declare function registerPublicKey(params: {
-    authUrl?: string;
-    apiKey: string;
-    serviceSlug?: string;
-    domain?: string | null;
-    publicJwk: PublicJwk;
-    fetchFn?: typeof fetch;
-}): Promise<{
-    ok: boolean;
-    status: number;
-    error?: string;
-}>;

package/dist/crypto/signatures.js

@@ -1,12 +1,16 @@
+import { webcrypto } from "./webcrypto.js";
 import { base64ToBytes, base64UrlToBytesStrict, bytesToBase64, bytesToHex, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
 import { computeContentDigest } from "./digest.js";
 import { loadPublicKey, loadSigningKey } from "./keys.js";
-import { assertSecureUrl } from "../config.js";
 export const SIGNATURE_VERSION = "rfc9421";
 export const SIGNATURE_LABEL = "sig1";
 export const SIGNATURE_ALG = "ed25519";
 export const MAX_CLOCK_SKEW_SECONDS = 300;
 export const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z0-9_\-\.]{1,128}$/;
+/** A Daywalker service slug. */
+export const SERVICE_SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** An API key: printable, no whitespace, quotes or separators that could break out of a header. */
+export const API_KEY_PATTERN = /^[A-Za-z0-9_.~+\/=-]{8,512}$/;
 /**
  * Splits a request target into its RFC 9421 "@path" value (§2.2.6; dot segments resolved and repeated
  * slashes collapsed per RFC 3986, to prevent path traversal & signature confusion) and its "@query" value
@@ -212,9 +216,12 @@ export function createSignatureBase(params) {
  * "content-digest" (whenever there is a body, and always for POST / PUT / PATCH).
  */
 export async function signRequest(params) {
-    const signingKey = await loadSigningKey(params.key);
+    const signer = params.signer;
+    if (!signer && !params.key)
+        throw new Error("signRequest needs a key or a signer");
+    const signingKey = signer ? null : await loadSigningKey(params.key);
     const created = params.created ?? Math.floor(Date.now() / 1000);
-    const keyid = params.keyid ?? signingKey.publicJwk.kid;
+    const keyid = params.keyid ?? (signer ? signer.keyId : signingKey.publicJwk.kid);
     const alg = params.alg ?? SIGNATURE_ALG;
     const method = params.method.toUpperCase();
     const body = params.body ?? (BODY_METHODS.has(method) ? "" : null);
@@ -242,7 +249,13 @@ export async function signRequest(params) {
         signatureParams,
         components,
     });
-    const signatureBuffer = await globalThis.crypto.subtle.sign("Ed25519", signingKey.privateKey, stringToUtf8(signatureBase));
+    const baseBytes = stringToUtf8(signatureBase);
+    const signatureBuffer = signer
+        ? await signer.sign(baseBytes)
+        : await webcrypto.sign("Ed25519", signingKey.privateKey, baseBytes);
+    if (!(signatureBuffer instanceof ArrayBuffer || signatureBuffer instanceof Uint8Array) || signatureBuffer.byteLength !== 64) {
+        throw new Error("Signer must return a 64-byte Ed25519 signature");
+    }
     const signatureBase64 = bytesToBase64(new Uint8Array(signatureBuffer));
     const headers = {
         "Signature-Input": `${SIGNATURE_LABEL}=${signatureParams}`,
@@ -251,9 +264,6 @@ export async function signRequest(params) {
     if (contentDigest !== null) {
         headers["Content-Digest"] = contentDigest;
     }
-    if (params.apiKey) {
-        headers["Authorization"] = `Bearer ${params.apiKey}`;
-    }
     return headers;
 }
 /**
@@ -384,7 +394,7 @@ export async function verifyRequestSignature(params) {
             components,
         });
         const { publicKey } = await loadPublicKey(params.publicKey, keyid);
-        const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, stringToUtf8(signatureBase));
+        const isValid = await webcrypto.verify("Ed25519", publicKey, signatureBytes, stringToUtf8(signatureBase));
         if (!isValid) {
             return { valid: false, error: "Cryptographic signature verification failed" };
         }
@@ -405,27 +415,30 @@ export async function verifyRequestSignature(params) {
         return { valid: false, error: `Verification error: ${err.message}` };
     }
 }
-/**
- * Every service slug a (verified) JWT lease covers: its `services` claim, else its audience, else the
- * single `serviceSlug` / `service` claim of leases issued before multi-service tokens.
- */
+/** Every service slug a (verified) access token covers: its `services` claim, else its audience. */
 export function leaseServices(payload) {
     const strings = (v) => (Array.isArray(v) ? v : v === undefined || v === null ? [] : [v]).filter((s) => typeof s === "string" && s !== "");
     const listed = strings(payload.services);
-    const fallback = listed.length > 0 ? listed : strings(payload.aud).length > 0 ? strings(payload.aud) : strings(payload.serviceSlug ?? payload.service);
+    const fallback = listed.length > 0 ? listed : strings(payload.aud);
     return Array.from(new Set(fallback.map((s) => s.toLowerCase())));
 }
 /** Clock skew tolerated on JWT `exp` / `nbf`: 30 seconds, and never more (see `clockSkewSeconds`). */
 export const JWT_CLOCK_SKEW_SECONDS = 30;
+/** Longest accepted JWT (characters); longer input is refused before any parsing. */
+export const MAX_JWT_LENGTH = 16_384;
 /**
- * Zero-egress offline verification for asymmetric JWT token leases.
- * Requires a numeric `exp` and an audience (`aud` or `serviceSlug`) equal to `expectedServiceSlug`;
- * a verifier without an expected slug rejects every lease. `iss` is checked when `expectedIssuer` is set
- * (Daywalker documents no fixed issuer, so there is no default). Segments must be canonical unpadded
- * base64url, a `crit` header is rejected, and a JWKS `publicKey` is searched by the header's `kid`.
+ * Zero-egress offline verification of Daywalker access tokens (RFC 9068 JWTs from the OAuth token endpoint).
+ * Requires `typ: at+jwt`, `alg: EdDSA`, a `jti`, a numeric `exp`, and an `aud` containing `expectedServiceSlug`
+ * (a verifier without an expected slug rejects every token). `iss` is checked when `expectedIssuer` is set.
+ * Segments must be canonical unpadded base64url, a `crit` header is rejected, and a JWKS `publicKey` is
+ * searched by the header's `kid`. A token with `cnf.jkt` is DPoP-bound: the caller must also check its
+ * proof (`verifyDpopProof`), as `Daywalker.validateToken()` does.
  */
 export async function verifyJwtLease(params) {
     try {
+        if (typeof params.token !== "string" || params.token.length > MAX_JWT_LENGTH) {
+            return { valid: false, error: "Token is not a string or is too long" };
+        }
         const parts = params.token.trim().split(".");
         if (parts.length !== 3) {
             return { valid: false, error: "Token is not a valid 3-part JWT" };
@@ -447,11 +460,11 @@ export async function verifyJwtLease(params) {
         if (!header || typeof header !== "object" || !payload || typeof payload !== "object" || Array.isArray(payload)) {
             return { valid: false, error: "JWT header and payload must be JSON objects" };
         }
-        if (header.alg !== "EdDSA" && header.alg !== "ed25519") {
+        if (header.alg !== "EdDSA") {
             return { valid: false, error: `Unsupported JWT alg: ${header.alg}` };
         }
-        // "JWT" (older leases) or "at+jwt" (RFC 9068 access tokens); a refresh token ("rt+jwt") is never accepted here
-        if (header.typ !== undefined && !["JWT", "AT+JWT"].includes(String(header.typ).toUpperCase())) {
+        // RFC 9068 §4: only access tokens; a refresh token, ID token or any other JWT under the same key is refused
+        if (typeof header.typ !== "string" || header.typ.toLowerCase() !== "at+jwt") {
             return { valid: false, error: `Unsupported JWT typ: ${header.typ}` };
         }
         // RFC 7515 §4.1.11: extensions we don't understand must be rejected; we implement none.
@@ -463,7 +476,7 @@ export async function verifyJwtLease(params) {
         }
         const { publicKey } = await loadPublicKey(params.publicKey, header.kid);
         const signedData = stringToUtf8(`${headerB64}.${payloadB64}`);
-        const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, signedData);
+        const isValid = await webcrypto.verify("Ed25519", publicKey, signatureBytes, signedData);
         if (!isValid) {
             return { valid: false, error: "JWT signature verification failed" };
         }
@@ -485,25 +498,19 @@ export async function verifyJwtLease(params) {
         if (!expected) {
             return { valid: false, error: "JWT audience cannot be checked: no expected service slug is configured" };
         }
-        const audiences = [];
-        if (payload.serviceSlug !== undefined)
-            audiences.push(String(payload.serviceSlug));
-        if (Array.isArray(payload.aud))
-            audiences.push(...payload.aud.map(String));
-        else if (payload.aud !== undefined)
-            audiences.push(String(payload.aud));
+        const audiences = (Array.isArray(payload.aud) ? payload.aud : payload.aud === undefined ? [] : [payload.aud]).filter((a) => typeof a === "string");
         if (audiences.length === 0) {
-            return { valid: false, error: "JWT token lease has no aud or serviceSlug claim" };
+            return { valid: false, error: "JWT has no aud claim" };
         }
-        const serviceSlugOk = payload.serviceSlug === undefined || String(payload.serviceSlug).toLowerCase() === expected;
-        const audOk = payload.aud === undefined ||
-            (Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((a) => String(a).toLowerCase() === expected);
-        if (!serviceSlugOk || !audOk) {
+        if (!audiences.some((a) => a.toLowerCase() === expected)) {
             return {
                 valid: false,
                 error: `JWT audience mismatch: expected ${expected}, got ${audiences.join(", ").toLowerCase()}`,
             };
         }
+        if (payload.cnf !== undefined && (!payload.cnf || typeof payload.cnf !== "object" || typeof payload.cnf.jkt !== "string")) {
+            return { valid: false, error: "JWT cnf claim must carry a jkt thumbprint" };
+        }
         // A lease that lists its services must list this one (belt and braces next to `aud`).
         if (payload.services !== undefined) {
             const listed = Array.isArray(payload.services) ? payload.services : null;
@@ -523,53 +530,3 @@ export async function verifyJwtLease(params) {
         return { valid: false, error: `Failed to verify JWT lease: ${err.message}` };
     }
 }
-/**
- * Register public key directly with Daywalker Auth via POST /api/v1/keys/register (Push Architecture).
- */
-export async function registerPublicKey(params) {
-    const authUrl = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
-    try {
-        assertSecureUrl("authUrl", authUrl);
-    }
-    catch (err) {
-        return { ok: false, status: 0, error: err.message };
-    }
-    const registerUrl = `${authUrl}/api/v1/keys/register`;
-    const doFetch = params.fetchFn ?? globalThis.fetch;
-    if (!params.domain) {
-        return { ok: false, status: 400, error: "domain is required to register a key (set --domain or DAYWALKER_DOMAIN)" };
-    }
-    try {
-        const res = await doFetch(registerUrl, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Accept: "application/json",
-                Authorization: `Bearer ${params.apiKey}`,
-            },
-            body: JSON.stringify({
-                keyId: params.publicJwk.kid,
-                domain: params.domain,
-                publicKey: params.publicJwk,
-                // Lets Daywalker refuse right away when the API key doesn't cover the service(s); a comma-separated list is fine
-                ...(params.serviceSlug ? { serviceSlug: params.serviceSlug } : {}),
-            }),
-        });
-        if (res.ok) {
-            return { ok: true, status: res.status };
-        }
-        const data = (await res.json().catch(() => ({})));
-        return {
-            ok: false,
-            status: res.status,
-            error: data.message || data.error || `HTTP ${res.status}`,
-        };
-    }
-    catch (err) {
-        return {
-            ok: false,
-            status: 0,
-            error: err.message,
-        };
-    }
-}