@stage-labs/metro 0.1.0-beta.135 → 0.1.0-beta.136

package/dist/serve.js

@@ -21,9 +21,12 @@ function portOf(raw) {
         throw new Error(`'${raw ?? ''}' is not a port — ${USAGE}`);
     return n;
 }
+const ORGANIZATION = /^org_[A-Za-z0-9]{10,64}$/;
 function ownerOf(raw) {
+    if (raw !== undefined && ORGANIZATION.test(raw))
+        return raw;
     if (raw === undefined || !ADDRESS.test(raw))
-        throw new Error(`'${raw ?? ''}' is not an Ethereum address — ${USAGE}`);
+        throw new Error(`'${raw ?? ''}' is neither an organization id (org_…) nor an Ethereum address — ${USAGE}`);
     return raw.toLowerCase();
 }
 export function parseServeArgs(argv) {
@@ -60,15 +63,17 @@ export function parseServeArgs(argv) {
 export function requireOwner(owner, dir = agentsDir()) {
     if (owner !== null || existsSync(join(dir, '.owner')))
         return;
-    throw new Error('no owner is set for this machine, so no wallet could sign in.\n' +
-        'Pass the wallet that owns it once; it is remembered in ' +
+    throw new Error('no owner is set for this machine, so nobody could sign in.\n' +
+        'Pass the organization (or wallet) that owns it once; it is remembered in ' +
         join(dir, '.owner') +
-        ':\n  metro serve --owner <address>');
+        ':\n  metro serve --owner <org_… or address>');
 }
 export function readOwner(dir = agentsDir()) {
     try {
-        const raw = readFileSync(join(dir, '.owner'), 'utf8').trim().toLowerCase();
-        return ADDRESS.test(raw) ? raw : null;
+        const raw = readFileSync(join(dir, '.owner'), 'utf8').trim();
+        if (ORGANIZATION.test(raw))
+            return raw;
+        return ADDRESS.test(raw.toLowerCase()) ? raw.toLowerCase() : null;
     }
     catch {
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.135",
+  "version": "0.1.0-beta.136",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.135",
+  "version": "0.1.0-beta.136",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agents/api.ts

@@ -4,7 +4,7 @@ import { parseId } from '@metro-labs/core/ids';
 import { errMsg, log } from '@metro-labs/core/log';
 import {
   apiFailure,
-  apiSession,
+  apiSession, requireAdmin,
   projectParam,
   cors,
   sendJson,
@@ -190,6 +190,7 @@ async function routeAgent(
   tgt: AgentTarget,
 ): Promise<void> {
   try {
+    if (tgt.kind !== 'collection') requireAdmin(session);
     if (tgt.kind === 'key') await handleResetKey(req, res, deps, session, tgt.id);
     else if (tgt.kind === 'agent')
       await handleDelete(req, res, deps, session, tgt.id);

package/runtime/node_modules/@metro-labs/daemon/src/agents/file-admin.ts

@@ -1,6 +1,7 @@
 import { readFileSync, rmdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
 import { ensureSecureDir, writeSecure } from '@metro-labs/core/secure-fs';
 import {
   AgentAdminError,
@@ -38,26 +39,31 @@ interface Stored {
 
 const missing = (): AgentAdminError => new AgentAdminError('no such agent', 404);
 
+export function parseOwner(raw: string): string | null {
+  const text = raw.trim();
+  return isOrganizationId(text) ? text : normalizeAddress(text);
+}
+
 export function localOwner(dir = agentsDir()): string | null {
   try {
-    return normalizeAddress(readFileSync(join(dir, OWNER_FILE), 'utf8'));
+    return parseOwner(readFileSync(join(dir, OWNER_FILE), 'utf8'));
   } catch {
     return null;
   }
 }
 
 export function setLocalOwner(raw: string, dir = agentsDir()): string {
-  const address = normalizeAddress(raw);
-  if (address === null) throw new ApiError(`'${raw}' is not an Ethereum address`, 400);
+  const owner = parseOwner(raw);
+  if (owner === null) throw new ApiError(`'${raw}' is neither an organization id nor an Ethereum address`, 400);
   ensureSecureDir(dir);
-  writeSecure(join(dir, OWNER_FILE), `${address}\n`);
-  return address;
+  writeSecure(join(dir, OWNER_FILE), `${owner}\n`);
+  return owner;
 }
 
 
 function isOwner(subject: string, dir: string): boolean {
   const owner = localOwner(dir);
-  return owner !== null && owner === normalizeAddress(subject);
+  return owner !== null && owner === parseOwner(subject);
 }
 
 export function storedAgents(dir: string): Stored[] {

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -26,6 +26,7 @@ import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { sessionRunning, stopSession, unwatchSession, watchSession } from '../claude/session.js';
 import { tryClaudeSetup } from '../claude/setup.js';
 import { applyLocalOwner } from './local-owner.js';
+import { installBearerSessions } from '../routes/bearer.js';
 import { ensureLocalAgent, localOwner } from '../agents/file-admin.js';
 import { migrateAgentLayout } from '../agents/files.js';
 import { ensureStationDeps } from '../stations/runtime-deps.js';
@@ -140,6 +141,7 @@ function startConnectors(): void {
 
 async function main(): Promise<void> {
   applyLocalOwner();
+installBearerSessions(agentsDir(), localOwner);
   migrateAgentLayout();
   log.info({ agent: await ensureLocalAgent() }, 'local daemon: agent');
   await materializeFrom(fileSource, { allowEmpty: true });

package/runtime/node_modules/@metro-labs/daemon/src/boot/local-owner.ts

@@ -9,6 +9,6 @@ export function applyLocalOwner(): string | null {
     return address;
   }
   const stored = localOwner();
-  if (stored === null) log.warn('local daemon: no owner set, so no wallet can sign in; restart with metro serve --owner <address>');
+  if (stored === null) log.warn('local daemon: no owner set, so nobody can sign in; restart with metro serve --owner <organization id or address>');
   return stored;
 }

package/runtime/node_modules/@metro-labs/daemon/src/channels/inbound.ts

@@ -311,6 +311,10 @@ export class InboundRelay {
     ev: Record<string, unknown>,
     base: EventBase,
   ): Promise<void> {
+    if (base.evType === 'msg' && base.text.trim() === '') {
+      this.deps.log('drop: empty message', base.station, base.line, str(ev.messageId));
+      return;
+    }
     if (base.evType === 'msg' && (await this.handlePermissionReply(base.text)))
       return;
     await this.notify('notifications/claude/channel', {
@@ -357,11 +361,6 @@ export class InboundRelay {
       await this.handleReact(ev, base);
       return;
     }
-    if (base.evType === 'msg' && base.text.trim() === '') {
-      this.deps.log('drop: empty message', base.station, base.line, str(ev.messageId));
-      return;
-    }
-
     await this.emitMessage(ev, base);
   }
 }

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
-import { apiFailure, apiSession, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { apiFailure, apiSession, requireAdmin, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
 import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './settings.js';
@@ -147,6 +147,7 @@ async function created(req: IncomingMessage, path: string, dir: string): Promise
   return createClaudeSkill(body.name, scope, typeof body.text === 'string' ? body.text : undefined, dir);
 }
 
+const ADMIN_ONLY = /^\/(login|session|version|setup)(\/|$)/;
 const LOGIN = 'login';
 const SESSION = 'session';
 const SETUP = 'setup';
@@ -343,6 +344,7 @@ export function handleClaudeRequest(
     .then(async (session) => {
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
+      if (req.method !== 'GET' && ADMIN_ONLY.test(path)) requireAdmin(session);
       if (await streamed(req, res, path, search, (deps.dir ?? claudeDir)())) return;
       sendJson(req, res, 200, await routed(req, path, search, deps));
     })

package/runtime/node_modules/@metro-labs/daemon/src/routes/bearer.ts

@@ -0,0 +1,35 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { setBearerSessions, type ApiSession } from '@metro-labs/http/api-http';
+import { bearerSession, clientId, jwksUrl, SigningKeys, workosBase, type KeyStore } from '@metro-labs/http/workos-token';
+import { ensureSecureDir, writeSecure } from '@metro-labs/core/secure-fs';
+
+const KEYS_FILE = '.jwks';
+
+export function jwksStore(dir: string): KeyStore {
+  const path = join(dir, KEYS_FILE);
+  return {
+    read: () => (existsSync(path) ? readFileSync(path, 'utf8') : null),
+    write: (text) => {
+      ensureSecureDir(dir);
+      writeSecure(path, text);
+    },
+  };
+}
+
+export function bearerSessionsFor(owner: () => string | null, keys: SigningKeys): (req: Parameters<typeof bearerSession>[0]) => Promise<ApiSession | null> {
+  return async (req) => {
+    const session = await bearerSession(req, keys);
+    if (session === null) return null;
+    const held = owner();
+    if (held === null || session.organization === null || session.organization !== held)
+      throw new ApiError('this machine belongs to another organization', 403);
+    return { subject: held, role: session.role === 'admin' ? 'admin' : 'member' };
+  };
+}
+
+export function installBearerSessions(dir: string, owner: () => string | null, env: NodeJS.ProcessEnv = process.env): void {
+  const keys = new SigningKeys(jwksUrl(clientId(env), workosBase(env)), jwksStore(dir));
+  setBearerSessions(bearerSessionsFor(owner, keys));
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/http.ts

@@ -33,6 +33,7 @@ import {
 import { attachmentEventUrl, handleAttachRequest } from '../files/attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
 import { handleIdentityRequest } from './identity.js';
+import { handleOwnerRequest } from './owner.js';
 import { attachTerminalSockets } from '../terminal/socket.js';
 import { tmuxCommand } from '../terminal/api.js';
 import { handleModeRequest } from '@metro-labs/http/mode-api';
@@ -327,6 +328,7 @@ function handleSignInRoutes(
   apis: SessionApis,
 ): boolean {
   if (apis.identity !== undefined && handleIdentityRequest(req, res, apis.identity)) return true;
+  if (apis.owner !== undefined && handleOwnerRequest(req, res, apis.owner)) return true;
   return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -43,6 +43,7 @@ import {
   localOwner,
   localResetAgentKey,
   readLocalAgentFile,
+  setLocalOwner,
 } from '../agents/file-admin.js';
 import { listAgentFiles, readAgentFile } from '../agents/files.js';
 import { readModelConfig } from '../gateway/model-config.js';
@@ -218,6 +219,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     gateway: { config: readModelConfig },
     terminalApi: { authorize: (subject) => { assertLocalOwner(subject); } },
     identity: { owner: localOwner },
+    owner: { owner: localOwner, setOwner: setLocalOwner },
     mode: localModeInfo,
   };
 }

package/runtime/node_modules/@metro-labs/daemon/src/routes/owner.ts

@@ -0,0 +1,49 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { resetIdentities } from '@metro-labs/http/identity-registry';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
+
+const PATH = '/api/owner';
+
+export interface OwnerRouteDeps {
+  owner: () => string | null;
+  setOwner: (owner: string) => string;
+}
+
+async function claim(req: IncomingMessage, deps: OwnerRouteDeps): Promise<{ owner: string; previous: string }> {
+  const session = await apiSession(req);
+  if (session === null) throw new ApiError('unauthorized', 401);
+  const previous = deps.owner();
+  if (previous === null) throw new ApiError('this machine has no owner yet', 403);
+  if (isOrganizationId(previous)) throw new ApiError('this machine already belongs to an organization', 409);
+  if (session.subject !== previous) throw new ApiError('only the wallet that owns this machine can hand it to an organization', 403);
+  const wanted = bodyField(await readJsonBody(req), 'owner');
+  if (typeof wanted !== 'string' || !isOrganizationId(wanted.trim())) throw new ApiError('owner must be an organization id (org_…)', 400);
+  const owner = deps.setOwner(wanted.trim());
+  resetIdentities();
+  log.info({ previous, owner }, 'owner: this machine now belongs to an organization; the wallet is no longer accepted');
+  return { owner, previous };
+}
+
+export function handleOwnerRequest(req: IncomingMessage, res: ServerResponse, deps: OwnerRouteDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  claim(req, deps)
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'owner');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -7,6 +7,7 @@ import {
 } from '../connectors/api.js';
 import type { RelayApiDeps } from '../connectors/relay.js';
 import type { IdentityRouteDeps } from './identity.js';
+import type { OwnerRouteDeps } from './owner.js';
 import { handleLocalCliRequest, type LocalCliDeps } from '../connectors/cli-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
@@ -32,6 +33,7 @@ export interface SessionApis {
   connectorApi?: ConnectorApiDeps;
   relayApi?: RelayApiDeps;
   identity?: IdentityRouteDeps;
+  owner?: OwnerRouteDeps;
   mode?: () => ModeInfo;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/routes/session.ts

@@ -20,7 +20,7 @@ export function handleSessionApiRequest(
   apiSession(req)
     .then((session) => {
       if (!session) sendJson(req, res, 401, { error: 'unauthorized' });
-      else sendJson(req, res, 200, { subject: session.subject });
+      else sendJson(req, res, 200, { subject: session.subject, role: session.role });
     })
     .catch((err: unknown) => {
       apiFailure(req, res, err, 'session');

package/runtime/node_modules/@metro-labs/daemon/src/server/control.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+import { apiFailure, apiSession, requireAdmin, cors, sendJson } from '@metro-labs/http/api-http';
 import { errMsg, log } from '@metro-labs/core/log';
 
 const STOP = '/api/stop';
@@ -44,6 +44,7 @@ export function handleControlRequest(req: IncomingMessage, res: ServerResponse,
       const session = await apiSession(req);
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
+      requireAdmin(session);
       if (!(deps.served ?? servedByCli)())
         throw new ApiError(
           'this daemon was not started by metro serve, so nothing on the machine would bring it back: use the shell instead',

package/runtime/node_modules/@metro-labs/daemon/src/server/update.ts

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
 import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+import { apiFailure, apiSession, requireAdmin, cors, sendJson } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { METRO_VERSION } from '@metro-labs/core/version';
 
@@ -98,6 +98,7 @@ export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, d
       const session = await apiSession(req);
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
+      if (req.method === 'POST') requireAdmin(session);
       const bin = binOrThrow(deps);
       if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };
       return apply(bin, deps);

package/runtime/node_modules/@metro-labs/daemon/src/terminal/api.ts

@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, apiSession, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { apiFailure, apiSession, requireAdmin, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
 import { log } from '@metro-labs/core/log';
 import { mintTerminalTicket } from './tickets.js';
 
@@ -80,6 +80,7 @@ export function handleTerminalRequest(req: IncomingMessage, res: ServerResponse,
     .then(async (session) => {
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
+      requireAdmin(session);
       if (path === PREFIX) {
         sendJson(req, res, 200, { available: tmuxAvailable(deps), sessions: tmuxSessions() });
         return;

package/runtime/node_modules/@metro-labs/http/package.json

@@ -12,7 +12,8 @@
     "./identity-key": "./src/identity-key.ts",
     "./identity-registry": "./src/identity-registry.ts",
     "./return-to": "./src/return-to.ts",
-    "./mode-api": "./src/mode-api.ts"
+    "./mode-api": "./src/mode-api.ts",
+    "./workos-token": "./src/workos-token.ts"
   },
   "scripts": {
     "build": "tsc",

package/runtime/node_modules/@metro-labs/http/src/api-http.ts

@@ -6,8 +6,23 @@ import { identitySubject } from './identity-registry.js';
 
 const BODY_MAX = 4 * 1024;
 
+export type Role = 'admin' | 'member';
+
 export interface ApiSession {
   subject: string;
+  role: Role;
+}
+
+export type BearerSessions = (req: IncomingMessage) => Promise<ApiSession | null>;
+
+let bearerSessions: BearerSessions | null = null;
+
+export function setBearerSessions(fn: BearerSessions | null): void {
+  bearerSessions = fn;
+}
+
+export function requireAdmin(session: ApiSession): void {
+  if (session.role !== 'admin') throw new ApiError('this needs the admin role in your organization', 403);
 }
 
 export function cors(req: IncomingMessage): Record<string, string> {
@@ -37,8 +52,11 @@ export function sendJson(
 
 export async function apiSession(req: IncomingMessage): Promise<ApiSession | null> {
   const address = await signedIdentity(req);
-  const subject = address === null ? undefined : identitySubject(address);
-  return subject === undefined ? null : { subject };
+  if (address !== null) {
+    const subject = identitySubject(address);
+    return subject === undefined ? null : { subject, role: 'admin' };
+  }
+  return bearerSessions === null ? null : bearerSessions(req);
 }
 
 export interface AgentIdentity {

package/runtime/node_modules/@metro-labs/http/src/workos-token.ts

@@ -0,0 +1,150 @@
+import type { IncomingMessage } from 'node:http';
+import { createPublicKey, verify, type JsonWebKey, type KeyObject } from 'node:crypto';
+
+export const WORKOS_API = 'https://api.workos.com';
+const ORG_RE = /^org_[A-Za-z0-9]{10,64}$/;
+export const isOrganizationId = (value: string): boolean => ORG_RE.test(value);
+export const WORKOS_ISSUER = 'https://api.workos.com';
+export const DEFAULT_CLIENT_ID = 'client_01M2TJJJ6RM9CT081QB4XZK3G2';
+const SKEW_S = 60;
+const REFETCH_COOLDOWN_MS = 60_000;
+const FETCH_MS = 10_000;
+
+export interface Session {
+  userId: string;
+  sessionId: string;
+  organization: string | null;
+  role: string | null;
+  expiresAt: number;
+}
+
+export interface KeyStore {
+  read: () => string | null;
+  write: (text: string) => void;
+}
+
+export const filled = (value: string | undefined): string | null => {
+  const text = value?.trim() ?? '';
+  return text === '' ? null : text;
+};
+
+export const clientId = (env: NodeJS.ProcessEnv = process.env): string => filled(env.WORKOS_CLIENT_ID) ?? DEFAULT_CLIENT_ID;
+export const workosBase = (env: NodeJS.ProcessEnv = process.env): string => filled(env.WORKOS_API_BASE) ?? WORKOS_API;
+export const jwksUrl = (id: string, base = WORKOS_API): string => `${base}/sso/jwks/${id}`;
+
+function jwksKeys(text: string): Map<string, KeyObject> {
+  const keys = new Map<string, KeyObject>();
+  const parsed: unknown = JSON.parse(text);
+  const list = typeof parsed === 'object' && parsed !== null ? (parsed as { keys?: unknown }).keys : undefined;
+  if (!Array.isArray(list)) return keys;
+  for (const jwk of list) {
+    if (typeof jwk !== 'object' || jwk === null) continue;
+    const { kid, kty } = jwk as { kid?: unknown; kty?: unknown };
+    if (typeof kid !== 'string' || kty !== 'RSA') continue;
+    try {
+      keys.set(kid, createPublicKey({ key: jwk as JsonWebKey, format: 'jwk' }));
+    } catch {
+      continue;
+    }
+  }
+  return keys;
+}
+
+export class SigningKeys {
+  private keys = new Map<string, KeyObject>();
+  private lastMiss = 0;
+  private loaded = false;
+
+  constructor(
+    private readonly url: string,
+    private readonly store?: KeyStore,
+  ) {}
+
+  private load(): void {
+    if (this.loaded) return;
+    this.loaded = true;
+    const cached = this.store?.read() ?? null;
+    if (cached !== null) this.keys = jwksKeys(cached);
+  }
+
+  private async refresh(now: number): Promise<void> {
+    if (now - this.lastMiss < REFETCH_COOLDOWN_MS) return;
+    const res = await fetch(this.url, { signal: AbortSignal.timeout(FETCH_MS) });
+    if (!res.ok) throw new Error(`the signing keys answered ${String(res.status)}`);
+    const text = await res.text();
+    const keys = jwksKeys(text);
+    if (keys.size === 0) throw new Error('the signing keys answered no RSA key');
+    this.keys = keys;
+    this.store?.write(text);
+  }
+
+  async keyFor(kid: string, now = Date.now()): Promise<KeyObject | null> {
+    this.load();
+    const held = this.keys.get(kid);
+    if (held !== undefined) return held;
+    await this.refresh(now);
+    const fetched = this.keys.get(kid);
+    if (fetched === undefined) this.lastMiss = now;
+    return fetched ?? null;
+  }
+}
+
+const b64url = (text: string): Buffer => Buffer.from(text.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+
+function jsonPart(text: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(b64url(text).toString('utf8'));
+    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+const str = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+const issuedBy = (iss: unknown, issuer: string): boolean => typeof iss === 'string' && (iss === issuer || iss.startsWith(`${issuer}/`));
+
+function sessionOf(claims: Record<string, unknown>, issuer: string, now: number): Session | null {
+  const exp = typeof claims.exp === 'number' ? claims.exp : null;
+  const userId = str(claims.sub);
+  const sessionId = str(claims.sid);
+  if (!issuedBy(claims.iss, issuer) || exp === null || userId === null || sessionId === null) return null;
+  if (exp * 1000 < now - SKEW_S * 1000) return null;
+  return { userId, sessionId, organization: str(claims.org_id), role: str(claims.role), expiresAt: exp * 1000 };
+}
+
+interface Parts {
+  signed: string;
+  body: string;
+  signature: Buffer;
+  kid: string;
+}
+
+function parseToken(token: string): Parts | null {
+  const [head, body, sig] = token.split('.');
+  if (head === undefined || body === undefined || sig === undefined) return null;
+  const header = jsonPart(head);
+  const kid = str(header?.kid);
+  if (header?.alg !== 'RS256' || kid === null) return null;
+  return { signed: `${head}.${body}`, body, signature: b64url(sig), kid };
+}
+
+export async function verifyToken(token: string, keys: SigningKeys, issuer = WORKOS_ISSUER, now = Date.now()): Promise<Session | null> {
+  const parts = parseToken(token);
+  if (parts === null) return null;
+  const key = await keys.keyFor(parts.kid, now).catch(() => null);
+  if (key === null || !verify('sha256', Buffer.from(parts.signed), key, parts.signature)) return null;
+  const claims = jsonPart(parts.body);
+  return claims === null ? null : sessionOf(claims, issuer, now);
+}
+
+export function bearerToken(req: IncomingMessage): string | null {
+  const header = req.headers.authorization ?? '';
+  const [scheme, token] = header.trim().split(/\s+/);
+  return scheme?.toLowerCase() === 'bearer' && token?.includes('.') === true ? token : null;
+}
+
+export async function bearerSession(req: IncomingMessage, keys: SigningKeys, issuer = WORKOS_ISSUER): Promise<Session | null> {
+  const token = bearerToken(req);
+  return token === null ? null : verifyToken(token, keys, issuer);
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.135"
+  "version": "0.1.0-beta.136"
 }