@spfn/auth 0.2.0-beta.90 → 0.2.0-beta.91

package/dist/server.js

@@ -1735,8 +1735,8 @@ function RequiredKeys(properties) {
   return keys;
 }
 function _Object(properties, options) {
-  const required = RequiredKeys(properties);
-  const schematic = required.length > 0 ? { [Kind]: "Object", type: "object", properties, required } : { [Kind]: "Object", type: "object", properties };
+  const required2 = RequiredKeys(properties);
+  const schematic = required2.length > 0 ? { [Kind]: "Object", type: "object", properties, required: required2 } : { [Kind]: "Object", type: "object", properties };
   return CreateType(schematic, options);
 }
 var Object2;
@@ -4725,6 +4725,19 @@ var init_user_profiles = __esm({
   }
 });
 
+// src/server/client-proof/wire-headers.ts
+var SERVER_CONTRACT_HEADERS, CLIENT_KINDS;
+var init_wire_headers = __esm({
+  "src/server/client-proof/wire-headers.ts"() {
+    "use strict";
+    SERVER_CONTRACT_HEADERS = {
+      version: "x-spfn-server-contract-version",
+      supportedRange: "x-spfn-supported-contract-range"
+    };
+    CLIENT_KINDS = ["web", "ios", "android"];
+  }
+});
+
 // src/server/entities/user-public-keys.ts
 import { text as text4, boolean as boolean3, index as index4 } from "drizzle-orm/pg-core";
 import { id as id4, foreignKey as foreignKey3, enumText as enumText2, utcTimestamp as utcTimestamp2 } from "@spfn/core/db";
@@ -4733,6 +4746,7 @@ var init_user_public_keys = __esm({
   "src/server/entities/user-public-keys.ts"() {
     "use strict";
     init_types();
+    init_wire_headers();
     init_users();
     init_schema4();
     userPublicKeys = authSchema.table(
@@ -4771,6 +4785,26 @@ var init_user_public_keys = __esm({
         // null: the client sent none
         // Used for: the same list, alongside deviceName
         platform: enumText2("platform", KEY_PLATFORM),
+        // What the client said about itself on the last request signed by this key.
+        //
+        // The three come from x-spfn-client-kind, x-spfn-client-version and
+        // x-spfn-client-contract-version. They are client-supplied and
+        // unauthenticated, exactly like deviceName above: nothing is authorized by
+        // them, and a client that lies about its version gains nothing but a wrong
+        // entry in its owner's own device list.
+        //
+        // They exist so the server knows which release each deployed client runs.
+        // Refusing an outdated client is the last resort; reaching its owner first
+        // needs a list of who runs what, and announcing a version is not the same
+        // as the server having recorded it.
+        clientKind: enumText2("client_kind", CLIENT_KINDS),
+        clientVersion: text4("client_version"),
+        clientContractVersion: text4("client_contract_version"),
+        // When any of the three above last changed — an app update, in practice.
+        // Not when they were last seen: a value that moves on every request is a
+        // write on every request, and the question this answers is "since when has
+        // this device been on this release", which only a change can answer.
+        clientSeenAt: utcTimestamp2("client_seen_at"),
         // Key status
         // false: Key is deactivated (cannot be used for verification)
         // Used for: soft key rotation, temporary key suspension
@@ -5697,7 +5731,7 @@ var init_users_repository = __esm({
 
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
-import { eq as eq2, and as and2, or, isNull, lt, ne, desc } from "drizzle-orm";
+import { eq as eq2, and as and2, or, isNull, lt, ne, desc, sql as sql3 } from "drizzle-orm";
 var LAST_USED_THROTTLE_MS, KeysRepository, keysRepository;
 var init_keys_repository = __esm({
   "src/server/repositories/keys.repository.ts"() {
@@ -5916,17 +5950,44 @@ var init_keys_repository = __esm({
        * LAST_USED_THROTTLE_MS), so a busy key isn't UPDATEd on every request. The
        * throttle lives in the WHERE clause — atomic, no read-then-write race. No
        * RETURNING (callers fire-and-forget and discard the row).
+       *
+       * `identity` is what the client said about itself on this request. It is
+       * recorded on the same row, and the throttle does not apply to it: a version
+       * that changed is written immediately, because an app update is the event this
+       * column exists to catch and waiting a minute to notice it serves nobody. A
+       * version that did not change writes nothing extra — the UPDATE the throttle
+       * was already going to do carries it.
+       *
+       * `clientSeenAt` moves only when one of the three values differs from what is
+       * stored, so it answers "since when has this device been on this release"
+       * rather than "when was it last seen", which lastUsedAt already answers.
        */
-      async updateLastUsedById(id12) {
+      async updateLastUsedById(id12, identity) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
+        const lastUsedIsStale = or(
+          isNull(userPublicKeys.lastUsedAt),
+          lt(userPublicKeys.lastUsedAt, staleBefore)
+        );
+        if (!identity) {
+          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id12), lastUsedIsStale));
+          return;
+        }
+        const identityChanged = sql3`(
+            ${userPublicKeys.clientKind} IS DISTINCT FROM ${identity.kind}
+            OR ${userPublicKeys.clientVersion} IS DISTINCT FROM ${identity.version}
+            OR ${userPublicKeys.clientContractVersion} IS DISTINCT FROM ${identity.contractVersion}
+        )`;
+        const now = /* @__PURE__ */ new Date();
+        const nowParam = sql3`${now.toISOString()}::timestamptz`;
         await this.db.update(userPublicKeys).set({
-          lastUsedAt: /* @__PURE__ */ new Date()
+          lastUsedAt: now,
+          clientKind: identity.kind,
+          clientVersion: identity.version,
+          clientContractVersion: identity.contractVersion,
+          clientSeenAt: sql3`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
           eq2(userPublicKeys.id, id12),
-          or(
-            isNull(userPublicKeys.lastUsedAt),
-            lt(userPublicKeys.lastUsedAt, staleBefore)
-          )
+          or(lastUsedIsStale, identityChanged)
         ));
       }
     };
@@ -6511,7 +6572,7 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql3 } from "drizzle-orm";
+import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql4 } from "drizzle-orm";
 import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
@@ -6653,7 +6714,7 @@ var init_invitations_repository = __esm({
           conditions.push(eq9(userInvitations.invitedBy, invitedBy));
         }
         const whereClause = conditions.length > 0 ? and6(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql3`count(*)` }).from(userInvitations).where(whereClause);
+        const countResult = await this.readDb.select({ count: sql4`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -11094,21 +11155,8 @@ import {
   KeyExpiredError
 } from "@spfn/auth/errors";
 
-// src/server/middleware/auth-profiles.ts
-import {
-  BadRequestError as BadRequestError2,
-  ConflictError as ConflictError2,
-  ServiceUnavailableError,
-  UnauthorizedError
-} from "@spfn/core/errors";
-import {
-  authLogger as authLogger2,
-  keysRepository as keysRepository2,
-  usersRepository as usersRepository2,
-  userProfilesRepository as userProfilesRepository2,
-  getPendingDeletionInfo as getPendingDeletionInfo2
-} from "@spfn/auth/server";
-import { AccountDisabledError as AccountDisabledError3, AccountPendingDeletionError as AccountPendingDeletionError3 } from "@spfn/auth/errors";
+// src/server/client-proof/refusal.ts
+import { randomBytes } from "crypto";
 
 // src/server/client-proof/canonical-json.ts
 var CanonicalJsonError = class extends Error {
@@ -11456,82 +11504,7 @@ function encodeString(value) {
   return out + '"';
 }
 
-// src/server/client-proof/proof.ts
-import { createHash as createHash5, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
-var CLIENT_PROOF_PROFILE = "clientProofV1";
-var ABSENT_BODY_SHA256 = "0".repeat(64);
-var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
-var PROOF_INPUT_FIELDS = [
-  "profile",
-  "method",
-  "path",
-  "clientId",
-  "keyId",
-  "nonce",
-  "issuedAtMillis",
-  "bodySha256"
-];
-var PROOF_INPUT_SEPARATOR = "\n";
-var PROOF_SIGNATURE_BYTES = 64;
-var PROOF_SIGNATURE_HEX_LENGTH = PROOF_SIGNATURE_BYTES * 2;
-var PROOF_SIGNATURE_PATTERN = /^[0-9a-f]{128}$/;
-var RAW_SIGNATURE_ENCODING = "ieee-p1363";
-var ProofInputError = class extends Error {
-  constructor() {
-    super("proof input field contains a C0 control character");
-    this.name = "ProofInputError";
-  }
-};
-function canonicalProofInput(input) {
-  const values = {
-    profile: CLIENT_PROOF_PROFILE,
-    method: input.method,
-    path: input.path,
-    clientId: input.clientId,
-    keyId: input.keyId,
-    nonce: input.nonce,
-    issuedAtMillis: input.issuedAtMillis.toString(),
-    bodySha256: input.bodySha256
-  };
-  const fields = PROOF_INPUT_FIELDS.map((name) => values[name]);
-  for (const field of fields) {
-    for (const ch of field) {
-      if (ch.codePointAt(0) < 32) {
-        throw new ProofInputError();
-      }
-    }
-  }
-  return fields.join(PROOF_INPUT_SEPARATOR);
-}
-function parseClientProofPublicKey(spkiDerBase64) {
-  const key = createPublicKey({
-    key: Buffer.from(spkiDerBase64, "base64"),
-    format: "der",
-    type: "spki"
-  });
-  if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
-    throw new Error("a clientProofV1 public key must be an ECDSA P-256 key");
-  }
-  return key;
-}
-function verifyClientProof(input, presentedProof, publicKey) {
-  const data = Buffer.from(canonicalProofInput(input), "utf8");
-  if (!PROOF_SIGNATURE_PATTERN.test(presentedProof)) {
-    return false;
-  }
-  return verify2(
-    "sha256",
-    data,
-    { key: publicKey, dsaEncoding: RAW_SIGNATURE_ENCODING },
-    Buffer.from(presentedProof, "hex")
-  );
-}
-function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
-}
-
 // src/server/client-proof/refusal.ts
-import { randomBytes } from "crypto";
 var HTTP_STATUS = {
   PROOF_INVALID: 401,
   PROOF_REPLAYED: 401,
@@ -11540,6 +11513,9 @@ var HTTP_STATUS = {
   PROFILE_REJECTED: 400,
   CONTRACT_UNSUPPORTED: 409
 };
+function newHexId() {
+  return randomBytes(16).toString("hex");
+}
 var ClientProofRefusal = class _ClientProofRefusal {
   constructor(code, message) {
     this.code = code;
@@ -11609,6 +11585,18 @@ var ClientProofRefusal = class _ClientProofRefusal {
   static profileRejected() {
     return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
   }
+  /**
+   * A request that names a profile and presents Bearer credentials as well.
+   * The profile named is a real one, so this is not a shape the two ends
+   * disagree about: the request asked to be authenticated two ways at once
+   * and the profile it named is the one refused.
+   */
+  static credentialsMixed() {
+    return new _ClientProofRefusal(
+      "PROFILE_REJECTED",
+      "an auth profile and Bearer credentials must not be mixed in one request"
+    );
+  }
   // ---- auth: a new session might clear it (rule 1) -------------------------
   static sessionRevoked() {
     return new _ClientProofRefusal("SESSION_REVOKED", "the key or session was revoked");
@@ -11627,6 +11615,84 @@ function contractViolation(message) {
   return new ClientProofRefusal("CONTRACT_UNSUPPORTED", message);
 }
 
+// src/server/client-proof/contract-bundle.ts
+import { createHash as createHash6 } from "crypto";
+init_types();
+
+// src/server/client-proof/proof.ts
+import { createHash as createHash5, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+var CLIENT_PROOF_PROFILE = "clientProofV1";
+var ABSENT_BODY_SHA256 = "0".repeat(64);
+var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
+var PROOF_INPUT_FIELDS = [
+  "profile",
+  "method",
+  "path",
+  "clientId",
+  "keyId",
+  "nonce",
+  "issuedAtMillis",
+  "bodySha256"
+];
+var PROOF_INPUT_SEPARATOR = "\n";
+var PROOF_SIGNATURE_BYTES = 64;
+var PROOF_SIGNATURE_HEX_LENGTH = PROOF_SIGNATURE_BYTES * 2;
+var PROOF_SIGNATURE_PATTERN = /^[0-9a-f]{128}$/;
+var RAW_SIGNATURE_ENCODING = "ieee-p1363";
+var ProofInputError = class extends Error {
+  constructor() {
+    super("proof input field contains a C0 control character");
+    this.name = "ProofInputError";
+  }
+};
+function canonicalProofInput(input) {
+  const values = {
+    profile: CLIENT_PROOF_PROFILE,
+    method: input.method,
+    path: input.path,
+    clientId: input.clientId,
+    keyId: input.keyId,
+    nonce: input.nonce,
+    issuedAtMillis: input.issuedAtMillis.toString(),
+    bodySha256: input.bodySha256
+  };
+  const fields = PROOF_INPUT_FIELDS.map((name) => values[name]);
+  for (const field of fields) {
+    for (const ch of field) {
+      if (ch.codePointAt(0) < 32) {
+        throw new ProofInputError();
+      }
+    }
+  }
+  return fields.join(PROOF_INPUT_SEPARATOR);
+}
+function parseClientProofPublicKey(spkiDerBase64) {
+  const key = createPublicKey({
+    key: Buffer.from(spkiDerBase64, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+    throw new Error("a clientProofV1 public key must be an ECDSA P-256 key");
+  }
+  return key;
+}
+function verifyClientProof(input, presentedProof, publicKey) {
+  const data = Buffer.from(canonicalProofInput(input), "utf8");
+  if (!PROOF_SIGNATURE_PATTERN.test(presentedProof)) {
+    return false;
+  }
+  return verify2(
+    "sha256",
+    data,
+    { key: publicKey, dsaEncoding: RAW_SIGNATURE_ENCODING },
+    Buffer.from(presentedProof, "hex")
+  );
+}
+function sha256Hex(bytes) {
+  return createHash5("sha256").update(bytes).digest("hex");
+}
+
 // src/server/client-proof/admission.ts
 var CLIENT_PROOF_HEADERS = {
   profile: "x-spfn-auth-profile",
@@ -11681,6 +11747,253 @@ function isRequestContentType(value) {
   return value.split(";")[0].trim().toLowerCase() === CLIENT_PROOF_CONTENT_TYPE;
 }
 
+// src/server/client-proof/contract-bundle.ts
+init_wire_headers();
+var CONTRACT_VERSION = "0.8.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.8.0 <0.9.0";
+function required(name, type) {
+  return { name, type, optional: false };
+}
+function optional(name, type) {
+  return { name, type, optional: true };
+}
+var CONTRACT_TYPES = [
+  {
+    name: "HandshakeRequest",
+    fields: [
+      required("clientId", "string"),
+      required("keyId", "string"),
+      required("nonce", "string"),
+      required("issuedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "HandshakeResponse",
+    fields: [
+      required("sessionId", "string"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  {
+    name: "EchoRequest",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer")
+    ]
+  },
+  {
+    name: "EchoResponse",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer"),
+      required("serverTimeMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsRequest",
+    fields: [
+      required("limit", "integer"),
+      optional("cursor", "string")
+    ]
+  },
+  {
+    name: "Item",
+    fields: [
+      required("id", "string"),
+      required("name", "string"),
+      required("updatedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsResponse",
+    fields: [
+      required("items", "array<Item>"),
+      optional("nextCursor", "string")
+    ]
+  },
+  {
+    name: "RegisterRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("verificationToken", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RegisterResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string")
+    ]
+  },
+  {
+    name: "LoginRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      optional("oldKeyId", "string")
+    ]
+  },
+  {
+    name: "LoginResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("passwordChangeRequired", "boolean")
+    ]
+  },
+  {
+    name: "OauthNativeRequest",
+    fields: [
+      required("idToken", "string"),
+      required("nonce", "string"),
+      optional("accessToken", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "OauthNativeResponse",
+    fields: [
+      required("userId", "string"),
+      required("keyId", "string"),
+      required("isNewUser", "boolean")
+    ]
+  },
+  {
+    name: "RotateKeyRequest",
+    fields: [
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RotateKeyResponse",
+    fields: [
+      required("success", "boolean"),
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "ListKeysRequest",
+    fields: [
+      optional("includeRevoked", "boolean")
+    ]
+  },
+  {
+    name: "KeySummary",
+    fields: [
+      required("keyId", "string"),
+      optional("deviceName", "string"),
+      optional("platform", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      required("fingerprintPrefix", "string"),
+      required("createdAtMillis", "integer"),
+      optional("lastUsedAtMillis", "integer"),
+      optional("expiresAtMillis", "integer"),
+      required("isExpired", "boolean"),
+      required("isActive", "boolean"),
+      optional("revokedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListKeysResponse",
+    fields: [
+      required("keys", "array<KeySummary>")
+    ]
+  },
+  {
+    name: "RevokeKeyRequest",
+    fields: [
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "RevokeKeyResponse",
+    fields: [
+      required("keyId", "string"),
+      required("selfRevoked", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysRequest",
+    fields: [
+      optional("includeCurrent", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysResponse",
+    fields: [
+      required("revokedCount", "integer"),
+      required("currentKeyRevoked", "boolean")
+    ]
+  }
+];
+var CONTRACT_ENUMS = [
+  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] }
+];
+var BUNDLE_FILENAME = "spfn-mobile-contract.json";
+var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;
+
+// src/server/client-proof/wire-version.ts
+init_wire_headers();
+init_wire_headers();
+function serverContractHeaders() {
+  return {
+    [SERVER_CONTRACT_HEADERS.version]: CONTRACT_VERSION,
+    [SERVER_CONTRACT_HEADERS.supportedRange]: CONTRACT_SUPPORTED_RANGE
+  };
+}
+
+// src/server/client-proof/version-middleware.ts
+var CLIENT_IDENTITY_CONTEXT_KEY = "clientIdentity";
+function readContextClientIdentity(c) {
+  return c.get(CLIENT_IDENTITY_CONTEXT_KEY) ?? null;
+}
+
+// src/server/middleware/auth-profiles.ts
+import {
+  SerializableError,
+  ServiceUnavailableError,
+  UnauthorizedError
+} from "@spfn/core/errors";
+import {
+  authLogger as authLogger2,
+  keysRepository as keysRepository2,
+  usersRepository as usersRepository2,
+  userProfilesRepository as userProfilesRepository2,
+  getPendingDeletionInfo as getPendingDeletionInfo2
+} from "@spfn/auth/server";
+import { AccountDisabledError as AccountDisabledError3, AccountPendingDeletionError as AccountPendingDeletionError3 } from "@spfn/auth/errors";
+
+// src/server/client-proof/refusal-response.ts
+function clientProofRefusalResponse(c, refusal) {
+  const bytes = refusal.envelopeBytes(newHexId());
+  const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  return c.newResponse(buffer, refusal.httpStatus, {
+    "content-type": "application/json",
+    ...serverContractHeaders()
+  });
+}
+
 // src/server/client-proof/replay-store.ts
 import { getCache } from "@spfn/core/cache";
 function replayLedgerKey(clientId, nonce) {
@@ -11744,10 +12057,7 @@ function selectAuthProfile(c) {
     return null;
   }
   if (c.req.header("Authorization") !== void 0) {
-    throw new BadRequestError2({
-      message: "an auth profile and Bearer credentials must not be mixed in one request",
-      details: { code: "PROFILE_REJECTED" }
-    });
+    throw refusalError(ClientProofRefusal.credentialsMixed());
   }
   const verifier = AUTH_PROFILE_VERIFIERS.get(profile);
   if (verifier === void 0) {
@@ -11773,15 +12083,34 @@ async function resolveAuthenticatedUser(userId) {
   }
   return { user, role: role?.name ?? null, locale };
 }
-function refusalError(refusal) {
-  const data = { message: refusal.message, details: { code: refusal.code } };
-  if (refusal.code === "PROFILE_REJECTED") {
-    return new BadRequestError2(data);
+var ClientProofRefusalError = class extends SerializableError {
+  constructor(refusal) {
+    super(refusal.message);
+    this.refusal = refusal;
+    this.name = "ClientProofRefusalError";
+    this.statusCode = refusal.httpStatus;
   }
-  if (refusal.code === "CONTRACT_UNSUPPORTED") {
-    return new ConflictError2(data);
+  statusCode;
+  toJSON() {
+    return { __type: this.refusal.code, message: this.message };
+  }
+};
+function refusalError(refusal) {
+  return new ClientProofRefusalError(refusal);
+}
+async function runAuthProfile(c) {
+  try {
+    const verifier = selectAuthProfile(c);
+    if (verifier === null) {
+      return { kind: "none" };
+    }
+    return { kind: "authenticated", auth: await verifier.verify(c) };
+  } catch (err) {
+    if (err instanceof ClientProofRefusalError) {
+      return { kind: "refused", response: clientProofRefusalResponse(c, err.refusal) };
+    }
+    throw err;
   }
-  return new UnauthorizedError(data);
 }
 async function failClosed(operation) {
   try {
@@ -11841,7 +12170,7 @@ async function verifyClientProofProfile(c) {
     throw refusalError(ClientProofRefusal.proofReplayed());
   }
   const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
-  keysRepository2.updateLastUsedById(keyRecord.id).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
+  keysRepository2.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
   authLogger2.middleware.info("API access", {
     userId: user.id,
     email: user.email,
@@ -11900,11 +12229,14 @@ var AUTH_PROFILE_VERIFIERS = /* @__PURE__ */ new Map([
 
 // src/server/middleware/authenticate.ts
 var authenticate = defineMiddleware("auth", async (c, next) => {
-  const profileVerifier = selectAuthProfile(c);
-  if (profileVerifier !== null) {
-    c.set("auth", await profileVerifier.verify(c));
+  const profile = await runAuthProfile(c);
+  if (profile.kind === "refused") {
+    return profile.response;
+  }
+  if (profile.kind === "authenticated") {
+    c.set("auth", profile.auth);
     await next();
-    return;
+    return void 0;
   }
   const authHeader = c.req.header("Authorization");
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
@@ -11946,7 +12278,7 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
     throw new UnauthorizedError2({ message: "Authentication failed" });
   }
   const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
-  keysRepository3.updateLastUsedById(keyRecord.id).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
+  keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
   c.set("auth", {
     user,
     userId: String(user.id),
@@ -11967,35 +12299,39 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
     userAgent: c.req.header("user-agent")
   });
   await next();
+  return void 0;
 });
 var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
-  const profileVerifier = selectAuthProfile(c);
-  if (profileVerifier !== null) {
-    c.set("auth", await profileVerifier.verify(c));
+  const profile = await runAuthProfile(c);
+  if (profile.kind === "refused") {
+    return profile.response;
+  }
+  if (profile.kind === "authenticated") {
+    c.set("auth", profile.auth);
     await next();
-    return;
+    return void 0;
   }
   const authHeader = c.req.header("Authorization");
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
     await next();
-    return;
+    return void 0;
   }
   const token = authHeader.substring(7);
   try {
     const decoded = decodeToken2(token);
     if (!decoded || !decoded.keyId) {
       await next();
-      return;
+      return void 0;
     }
     const keyId = decoded.keyId;
     const keyRecord = await keysRepository3.findActiveByKeyId(keyId);
     if (!keyRecord) {
       await next();
-      return;
+      return void 0;
     }
     if (keyRecord.expiresAt && /* @__PURE__ */ new Date() > keyRecord.expiresAt) {
       await next();
-      return;
+      return void 0;
     }
     verifyClientToken2(
       token,
@@ -12008,10 +12344,10 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
     ]);
     if (!result || result.user.status !== "active") {
       await next();
-      return;
+      return void 0;
     }
     const { user, role } = result;
-    keysRepository3.updateLastUsedById(keyRecord.id).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
+    keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
     c.set("auth", {
       user,
       userId: String(user.id),
@@ -12023,6 +12359,7 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
   } catch {
   }
   await next();
+  return void 0;
 }, { skips: ["auth"] });
 
 // src/server/middleware/require-permission.ts
@@ -12487,7 +12824,7 @@ var userRouter = defineRouter3({
 // src/server/routes/oauth/index.ts
 init_esm();
 
-// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/url.js
 var tryDecode = (str, decoder) => {
   try {
     return decoder(str);
@@ -12501,10 +12838,12 @@ var tryDecode = (str, decoder) => {
     });
   }
 };
+var tryDecodeURIComponent = (str) => str.indexOf("%") !== -1 ? tryDecode(str, decodeURIComponent_) : str;
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/cookie.js
+// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/cookie.js
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 var trimCookieWhitespace = (value) => {
   let start = 0;
@@ -12537,7 +12876,7 @@ var parse = (cookie, name) => {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
@@ -12545,7 +12884,7 @@ var parse = (cookie, name) => {
       cookieValue = cookieValue.slice(1, -1);
     }
     if (validCookieValueRegEx.test(cookieValue)) {
-      parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
+      parsedCookie[cookieName] = tryDecodeURIComponent(cookieValue);
       if (name) {
         break;
       }
@@ -12624,7 +12963,7 @@ var serialize = (name, value, opt) => {
   return _serialize(name, value, opt);
 };
 
-// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/helper/cookie/index.js
+// ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/helper/cookie/index.js
 var getCookie = (c, key, prefix) => {
   const cookie = c.req.raw.headers.get("Cookie");
   if (typeof key === "string") {
@@ -13712,6 +14051,7 @@ export {
   roles,
   rolesRepository,
   rotateKeyService,
+  runAuthProfile,
   runBeforeRegister,
   sealSession,
   selectAuthProfile,