@t3b/hub-guard 0.1.0 → 0.2.0

package/README.md

@@ -2,11 +2,21 @@
 
 The lock every The3Beez module installs. A module **opens only by a ticket from the Hub** and
 refuses everything else with a plain "Open this from The3Beez" page (WORKFLOWS 2.2–2.4, 8.7).
-It holds no secret of the Hub — only the Hub's public key and the module's own key.
+
+**No key from the Hub, since 0.2.0 (WORKFLOWS 8b, D-048).** Nothing is pasted into a module:
+
+- **Towards the Hub** the module shows the ID Vercel gives each of its functions on its own — a
+  Vercel-signed token naming our team, the project, and production or preview. The Hub knows the
+  module by its Vercel project. Needs Vercel → the project → Settings → Security → *Secure backend
+  access with OIDC federation* on (Vercel's default).
+- **From the Hub** the module accepts only what the Hub signed with its own key: a person's
+  ticket, a relayed Shopify event, the Hub's request for the manifest or the health answer. The
+  public key is read from the Hub itself (`<hub>/api/hub/jwks`), kept 10 minutes, and fetched again
+  at once when the Hub starts using a new key.
 
 **Runs anywhere:** Web Crypto only (no `node:crypto`, no `Buffer`), so it works in Node 20+ and in
-edge runtimes — including Next.js 14 middleware, which runs only on the edge. A test fails if a
-shipped file ever imports a Node-only module.
+edge runtimes — including Next.js middleware. A test fails if a shipped file ever imports a
+Node-only module.
 
 ## Install
 
@@ -14,89 +24,70 @@ shipped file ever imports a Node-only module.
 npm install @t3b/hub-guard
 ```
 
-Environment (values live in the module's Vercel, names only here):
+Environment (names only; nothing here is secret):
 
 | Name | What |
 |---|---|
-| `T3B_MODULE_KEY` | the key the Hub made for this module (Settings → Modules → Make key), shown once |
-| `T3B_HUB_PUBLIC_KEY` | the Hub's public key (Settings → Modules → Copy) |
-| `T3B_HUB_PUBLIC_KEY_PREVIOUS` | only during a rotation: the previous public key, for one hour |
-| `T3B_HUB_URL` | `https://t3b-hub.com` (or the Hub's test address) |
+| `T3B_HUB_URL` | `https://t3b-hub.com` (the default) or the Hub's test address |
 | `T3B_CF_ACCESS_TEAM`, `T3B_CF_ACCESS_AUD` | Cloudflare Access proof, once the module host is behind it |
+| `VERCEL_ENV` | set by Vercel; a ticket, relay or call from the other environment's Hub is refused |
 
-## Next.js — three files
+## The two answers the Hub reads — to the Hub only
 
 ```ts
-// src/lib/guard.ts
-import { Guard, guardConfigFromEnv } from "@t3b/hub-guard";
-export const guard = new Guard({
-  ...guardConfigFromEnv(process.env, "currencies"),
-  openPaths: ["/api/hub/webhooks", /^\/api\/cron\//], // machine doors with their own locks
-});
+// src/app/api/hub/manifest/route.ts
+import { hubKeys, manifestResponse } from "@t3b/hub-guard";
+const HUB = process.env.T3B_HUB_URL ?? "https://t3b-hub.com";
+export async function GET(req: Request) {
+  return manifestResponse(req, {
+    id: "stores", name: { ar: "المتاجر", en: "Stores" }, sidebar: { order: 50, icon: "store" },
+    roles: ["owner", "manager"], scopes: ["read_products"], webhooks: [], carrier_services: [], settings: [],
+    health: "/api/hub/health",
+  }, { moduleId: "stores", keys: hubKeys(HUB), environment: process.env.VERCEL_ENV });
+}
 ```
 
 ```ts
-// src/middleware.ts (or src/proxy.ts on Next 16)
-import { NextResponse, type NextRequest } from "next/server";
-import { guard } from "@/lib/guard";
-export async function middleware(req: NextRequest) {
-  const r = await guard.check(req);
-  if (!r.allow) return r.response;
-  const res = NextResponse.next();
-  if (r.setCookie) res.headers.append("set-cookie", r.setCookie);
-  return res;
+// src/app/api/hub/health/route.ts — one line per connection the module has; the Hub shows each one
+import { healthResponse, hubKeys } from "@t3b/hub-guard";
+export async function GET(req: Request) {
+  return healthResponse(req, async () => [
+    { name: "Rate follow (MyFatoorah)", ok: await followedToday(), reason: "no follow for 30 hours" },
+    { name: "Database", ok: await dbReachable() },
+  ], { moduleId: "stores", keys: hubKeys(process.env.T3B_HUB_URL ?? "https://t3b-hub.com"), environment: process.env.VERCEL_ENV });
 }
-export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"] };
 ```
 
-```ts
-// src/app/hub/enter/route.ts
-import { guard } from "@/lib/guard";
-export const GET = (req: Request) => guard.enter(req);
-```
+Anyone else asking gets `401` and nothing — not the manifest, not the health lines, not the
+app's Vercel ID.
 
-## The two answers the Hub reads
+## Talking to the Hub
 
 ```ts
-// src/app/api/hub/manifest/route.ts
-import { signedManifest } from "@t3b/hub-guard";
-export async function GET() {
-  const { body, headers } = await signedManifest(
-    { id: "currencies", name: { ar: "العملات", en: "Currencies" }, sidebar: { order: 40, icon: "currency" },
-      roles: ["owner", "manager"], scopes: ["read_products", "write_products"],
-      webhooks: [{ topic: "products/create", path: "/api/hub/webhooks" }], carrier_services: [], settings: [],
-      health: "/api/hub/health" },
-    process.env.T3B_MODULE_KEY ?? "",
-  );
-  return new Response(body, { headers });
-}
+import { tokenBroker, audit } from "@t3b/hub-guard";
+const cfg = { hubUrl: process.env.T3B_HUB_URL ?? "https://t3b-hub.com" }; // the Vercel ID is found on its own
+const broker = tokenBroker(cfg);
+const t = await broker.get("kw");           // { ok, token: { accessToken, expiresAt, scopes } }, cached until an hour before expiry
+await audit(cfg, { action: "shopify.write", target: "kw", detail: { what: "product 123 price" } });
 ```
 
-```ts
-// src/app/api/hub/health/route.ts — one line per connection the module has; the Hub shows each as a chip
-import { healthAnswer } from "@t3b/hub-guard";
-export async function GET() {
-  const { status, body } = await healthAnswer(async () => [
-    { name: "rates source", ok: await ratesReachable(), reason: null },
-    { name: "database", ok: await dbReachable() },
-  ]);
-  return Response.json(body, { status });
-}
-```
+Without a Vercel ID (OIDC switched off, or a local run without `VERCEL_OIDC_TOKEN`) nothing is
+sent and the answer says why (`no_vercel_id`).
 
 ## Shopify's events (through the Hub)
 
 The module never holds the Shopify app secret. Shopify sends events to the Hub; the Hub checks
 them and passes the exact body to each module that declared the topic in its manifest and is on
-for that store, signed with the module's key. Answer 2xx once the event is taken; any other answer
-makes the Hub (and Shopify behind it) try again later.
+for that store, with a pass (`x-t3b-relay`) signed by the Hub for that module, that event and
+those exact bytes. Answer 2xx once the event is taken; any other answer makes the Hub (and
+Shopify behind it) try again later.
 
 ```ts
-// src/app/api/hub/webhooks/route.ts  (an open path - its lock is the signature)
-import { verifyRelay } from "@t3b/hub-guard";
+// src/app/api/hub/webhooks/route.ts  (an open path - its lock is the Hub's pass)
+import { hubKeys, verifyRelay } from "@t3b/hub-guard";
 export async function POST(req: Request) {
   const body = new Uint8Array(await req.arrayBuffer());      // the exact bytes - parse only after the check
-  const v = await verifyRelay(req.headers, body, process.env.T3B_MODULE_KEY ?? "");
+  const v = await verifyRelay(req.headers, body, { moduleId: "stores", keys: hubKeys(process.env.T3B_HUB_URL ?? "https://t3b-hub.com"), environment: process.env.VERCEL_ENV });
   if (!v.ok) return new Response(null, { status: 401 });
   if (await alreadyTaken(v.webhookId)) return new Response(null, { status: 200 }); // a repeat
   await handle(v.topic, v.store, JSON.parse(new TextDecoder().decode(body)));
@@ -104,20 +95,52 @@ export async function POST(req: Request) {
 }
 ```
 
-## Talking to the Hub
+## Opening from the Hub — three files
+
+For a module people open from the Hub's sidebar. `sessionSecret` signs the module's own session
+cookie (32+ characters); where a module gets it is settled with the first module that opens from
+the Hub (WORKFLOWS 8b, as built).
 
 ```ts
-import { tokenBroker, audit } from "@t3b/hub-guard";
-const cfg = { hubUrl: process.env.T3B_HUB_URL!, moduleKey: process.env.T3B_MODULE_KEY! };
-const broker = tokenBroker(cfg);
-const t = await broker.get("kw");           // { ok, token: { accessToken, expiresAt, scopes } }, cached until an hour before expiry
-await audit(cfg, { action: "shopify.write", target: "kw", detail: { what: "product 123 price" } });
+// src/lib/guard.ts
+import { Guard, guardConfigFromEnv } from "@t3b/hub-guard";
+export const guard = new Guard({
+  ...guardConfigFromEnv(process.env, "delivery"),
+  sessionSecret: mySessionSecret(),
+  openPaths: ["/api/hub/webhooks", /^\/api\/cron\//], // machine doors with their own locks
+});
+```
+
+```ts
+// src/middleware.ts (or src/proxy.ts on Next 16)
+import { NextResponse, type NextRequest } from "next/server";
+import { guard } from "@/lib/guard";
+export async function middleware(req: NextRequest) {
+  const r = await guard.check(req);
+  if (!r.allow) return r.response;
+  const res = NextResponse.next();
+  if (r.setCookie) res.headers.append("set-cookie", r.setCookie);
+  return res;
+}
+export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"] };
+```
+
+```ts
+// src/app/hub/enter/route.ts
+import { guard } from "@/lib/guard";
+export const GET = (req: Request) => guard.enter(req);
 ```
 
 ## What it enforces
 
-- `/hub/enter?ticket=…`: EdDSA ticket signed by the Hub, for this module, 60 seconds, single use → sets the module session (HttpOnly, Secure, SameSite=Strict) and sends to the page.
-- Every other request: no session → 403 (HTML for browsers, JSON for APIs), on **every host** the module answers on. Idle 15 minutes, absolute 8 hours. Every 15 minutes the Hub is asked whether the person's session still stands (sign-everyone-out, removal, lockout, grant changes). A Hub blip keeps the session until the next check.
-- Open paths (`/hub/enter`, `/api/hub/manifest`, `/api/hub/health` and what you add) never need a session — they carry their own locks (HMAC, cron secret, Shopify webhook HMAC).
+- `/hub/enter?ticket=…`: an EdDSA ticket signed by the Hub's published key, for this module, from this environment's Hub, 60 seconds, single use → sets the module session (HttpOnly, Secure, SameSite=Strict) and sends to the page.
+- Every other request: no session → 403 (HTML for browsers, JSON for APIs), on **every host** the module answers on. Idle 15 minutes, absolute 8 hours. Every 15 minutes the Hub is asked (with the app's Vercel ID) whether the person's session still stands. A Hub blip keeps the session until the next check.
+- Open paths (`/hub/enter`, `/api/hub/manifest`, `/api/hub/health` and what you add) never need a session — they carry their own locks (the Hub's pass, a cron secret).
 - Cloudflare Access proof checked first when the team and audience are set.
-- `verifyRelay`: the Hub's signature over timestamp, event id, topic, store and the exact body, with this module's key; refused when older or newer than 5 minutes.
+- `verifyRelay`, `manifestResponse`, `healthResponse`: the Hub's pass, for this module, for this purpose, from this environment's Hub; a relay also for these exact bytes and at most 5 minutes old; a call at most 60 seconds old.
+
+## Changes
+
+- **0.2.0** (8b): no module key and no pasted Hub public key. Hub → module: tokens signed by the Hub's key published at `/api/hub/jwks` (`verifyTicket`, `verifyRelay`, `verifyHubCall`, `manifestResponse`, `healthResponse`). Module → Hub: the app's own Vercel ID (`tokenBroker`, `audit`, `sessionCheck`). Removed: `signedManifest`, `relaySignature`, `importPublicKey`, the `moduleKey` / `hubPublicKeys` settings. `Guard` takes `sessionSecret`.
+- **0.1.1**: `enter()` answers with an absolute Location (B-016).
+- **0.1.0**: first publish, Web Crypto build.

package/dist/guard.d.ts

@@ -1,12 +1,18 @@
+import type { JWTVerifyGetKey } from "jose";
+import { type TokenProvider } from "./identity.js";
 import { type ModuleSession } from "./session.js";
 export type GuardConfig = {
     /** this module's id - the ticket's audience */
     moduleId: string;
-    /** the Hub's public key(s): the current one and, for an hour after a rotation, the previous one */
-    hubPublicKeys: string[];
-    /** the module key made in the Hub (Settings → Modules → Make key) */
-    moduleKey: string;
     hubUrl: string;
+    /** signs the module's own session cookie (32+ characters) */
+    sessionSecret: string;
+    /** the Hub's keys; by default read from `<hubUrl>/api/hub/jwks` */
+    keys?: JWTVerifyGetKey;
+    /** the app's Vercel ID; by default found on its own */
+    token?: TokenProvider;
+    /** this deployment's environment ("production" / "preview"); a ticket from another environment's Hub is refused */
+    environment?: string;
     /** the refusal page's link back */
     hubHomeUrl?: string;
     /** paths that are machine doors with their own locks (webhooks, crons, health, manifest, the enter route) - never a session */
@@ -30,8 +36,9 @@ export type CheckResult = {
 export declare class Guard {
     private readonly cfg;
     private readonly jti;
-    /** the session-cookie key, derived from the module key (same value as before the Web Crypto move) */
+    /** the session-cookie key, derived from the session secret */
     private readonly secretP;
+    private readonly keys;
     constructor(cfg: GuardConfig);
     private now;
     private hubClient;

package/dist/guard.js

@@ -1,24 +1,29 @@
 import { checkCloudflareAccess } from "./cf-access.js";
 import { sessionCheck } from "./hub-client.js";
+import { hubKeys } from "./identity.js";
 import { clearCookieHeader, cookieHeader, cookieValue, readSession, signSession, RECHECK_MS, SESSION_COOKIE } from "./session.js";
 import { JtiMemory, verifyTicket } from "./ticket.js";
 import { hmacSha256, toHex } from "./webcrypto.js";
 export class Guard {
     cfg;
     jti = new JtiMemory();
-    /** the session-cookie key, derived from the module key (same value as before the Web Crypto move) */
+    /** the session-cookie key, derived from the session secret */
     secretP;
+    keys;
     constructor(cfg) {
         this.cfg = cfg;
-        if (!cfg.moduleId || !cfg.moduleKey || !cfg.hubUrl || !cfg.hubPublicKeys?.length)
-            throw new Error("hub-guard: moduleId, moduleKey, hubUrl and hubPublicKeys are required");
-        this.secretP = hmacSha256(cfg.moduleKey, "t3b-hub-guard/session/v1").then(toHex);
+        if (!cfg.moduleId || !cfg.hubUrl)
+            throw new Error("hub-guard: moduleId and hubUrl are required");
+        if (!cfg.sessionSecret || cfg.sessionSecret.length < 32)
+            throw new Error("hub-guard: sessionSecret (32+ characters) is required to open a module from the Hub");
+        this.secretP = hmacSha256(cfg.sessionSecret, "t3b-hub-guard/session/v1").then(toHex);
+        this.keys = cfg.keys ?? hubKeys(cfg.hubUrl);
     }
     now() {
         return this.cfg.now ? this.cfg.now() : new Date();
     }
     hubClient() {
-        return { hubUrl: this.cfg.hubUrl, moduleKey: this.cfg.moduleKey, fetchImpl: this.cfg.fetchImpl };
+        return { hubUrl: this.cfg.hubUrl, token: this.cfg.token, fetchImpl: this.cfg.fetchImpl };
     }
     isOpenPath(pathname) {
         const defaults = ["/hub/enter", "/api/hub/manifest", "/api/hub/health"];
@@ -41,15 +46,16 @@ export class Guard {
         if (!cf.ok)
             return this.refuse(req, "The Cloudflare check did not pass.");
         const ticket = url.searchParams.get("ticket") ?? "";
-        const v = await verifyTicket(ticket, { publicKeys: this.cfg.hubPublicKeys, audience: this.cfg.moduleId, now: this.now(), jti: this.jti });
+        const v = await verifyTicket(ticket, { keys: this.keys, audience: this.cfg.moduleId, now: this.now(), jti: this.jti, environment: this.cfg.environment });
         if (!v.ok) {
-            const words = { expired: "The ticket has expired (it lives 60 seconds) - open the module again from the Hub.", wrong_audience: "This ticket was made for another module.", bad_signature: "This ticket was not signed by the Hub.", replayed: "This ticket was already used.", malformed: "No valid ticket." };
+            const words = { expired: "The ticket has expired (it lives 60 seconds) - open the module again from the Hub.", wrong_audience: "This ticket was made for another module.", bad_signature: "This ticket was not signed by the Hub.", replayed: "This ticket was already used.", malformed: "No valid ticket.", wrong_environment: "This ticket comes from another Hub (test or live)." };
             return this.refuse(req, words[v.reason] ?? "No valid ticket.");
         }
         const now = this.now().getTime();
         const session = { personId: v.claims.sub, name: v.claims.name, role: v.claims.role, stores: v.claims.stores, sv: v.claims.sv, iat: now, lastSeen: now, checkedAt: now };
         const target = new URL(v.claims.path, url.origin);
-        return new Response(null, { status: 303, headers: { Location: target.pathname + target.search, "Set-Cookie": cookieHeader(await signSession(session, await this.secretP), { secure: url.protocol === "https:", maxAgeS: Math.floor((this.cfg.absoluteMs ?? 8 * 3_600_000) / 1000) }), "Cache-Control": "no-store" } });
+        // Absolute: Next.js middleware refuses a relative redirect ("Invalid URL", B-016); any client accepts this.
+        return new Response(null, { status: 303, headers: { Location: target.toString(), "Set-Cookie": cookieHeader(await signSession(session, await this.secretP), { secure: url.protocol === "https:", maxAgeS: Math.floor((this.cfg.absoluteMs ?? 8 * 3_600_000) / 1000) }), "Cache-Control": "no-store" } });
     }
     /** Every other request: open path → allow; else the session must stand, be fresh, and pass the 15-minute Hub check. */
     async check(req) {

package/dist/hub-client.d.ts

@@ -1,6 +1,9 @@
+import { type JWTVerifyGetKey } from "jose";
+import { type TokenProvider } from "./identity.js";
 export type HubClientConfig = {
     hubUrl: string;
-    moduleKey: string;
+    /** the app's Vercel ID; by default found on its own (ownVercelToken) */
+    token?: TokenProvider;
     fetchImpl?: typeof fetch;
     timeoutMs?: number;
 };
@@ -30,18 +33,39 @@ export declare function audit(cfg: HubClientConfig, line: {
     target?: string;
     detail?: Record<string, unknown>;
 }): Promise<boolean>;
-/** C-5: the manifest body signed with the module key - the exact bytes sent are the bytes signed. */
-export declare function signedManifest(manifest: Record<string, unknown>, moduleKey: string): Promise<{
-    body: string;
-    headers: Record<string, string>;
-}>;
+export type HubCallCheck = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "missing" | "bad_signature" | "expired" | "wrong_module" | "wrong_use" | "wrong_environment";
+};
+/** Is this request the Hub's own, for this module and this purpose? (`Authorization: Bearer <pass>`) */
+export declare function verifyHubCall(req: Request, opts: {
+    moduleId: string;
+    keys: JWTVerifyGetKey;
+    use: "manifest" | "health";
+    now?: Date;
+    environment?: string;
+}): Promise<HubCallCheck>;
+export type AnswerConfig = {
+    moduleId: string;
+    keys: JWTVerifyGetKey;
+    token?: TokenProvider;
+    now?: Date;
+    environment?: string;
+};
+/**
+ * C-5 / 8b.4: the manifest, only to the Hub. The answer carries this app's own Vercel ID so the
+ * Hub knows which Vercel project answered; nobody else ever sees that ID.
+ */
+export declare function manifestResponse(req: Request, manifest: Record<string, unknown>, cfg: AnswerConfig): Promise<Response>;
 export type Connection = {
     name: string;
     ok: boolean;
     reason?: string | null;
     store?: string | null;
 };
-/** 8.4 / 7.6: the health answer. `ok` is false when any connection is red; the Hub shows each connection as its own chip. */
+/** 8.4 / 7.6: the health answer's shape. `ok` is false when any connection is red; the Hub shows each connection as its own line. */
 export declare function healthAnswer(check: () => Promise<Connection[]> | Connection[]): Promise<{
     status: number;
     body: {
@@ -51,3 +75,5 @@ export declare function healthAnswer(check: () => Promise<Connection[]> | Connec
         checked_at: string;
     };
 }>;
+/** 8b.4: the health answer, in full, only to the Hub; anyone else gets 401 and nothing. */
+export declare function healthResponse(req: Request, check: () => Promise<Connection[]> | Connection[], cfg: Omit<AnswerConfig, "token">): Promise<Response>;

package/dist/hub-client.js

@@ -1,11 +1,16 @@
-import { hmacSha256, toHex } from "./webcrypto.js";
+import { jwtVerify } from "jose";
+import { APP_ID_HEADER, HUB_ISSUER, ownVercelToken, TYP, tokenFrom } from "./identity.js";
+const NO_ID = "This app has no Vercel ID to show the Hub - Vercel → the project → Settings → Security → Secure backend access (OIDC) must be on.";
 async function post(cfg, path, body) {
+    const id = await tokenFrom(cfg.token);
+    if (!id)
+        return { status: 0, json: { error: "no_vercel_id", message: NO_ID } };
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), cfg.timeoutMs ?? 6_000);
     try {
         const res = await (cfg.fetchImpl ?? fetch)(new URL(path, cfg.hubUrl).toString(), {
             method: "POST",
-            headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${cfg.moduleKey}` },
+            headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${id}` },
             body: JSON.stringify(body),
             signal: ctrl.signal,
         });
@@ -58,13 +63,49 @@ export async function audit(cfg, line) {
     const r = await post(cfg, "/api/hub/audit", line);
     return r.status === 200 || r.status === 201;
 }
-/** C-5: the manifest body signed with the module key - the exact bytes sent are the bytes signed. */
-export async function signedManifest(manifest, moduleKey) {
-    const body = JSON.stringify(manifest);
-    const sig = `sha256=${toHex(await hmacSha256(moduleKey, body))}`;
-    return { body, headers: { "Content-Type": "application/json", "x-t3b-signature": sig, "Cache-Control": "no-store" } };
+/** Is this request the Hub's own, for this module and this purpose? (`Authorization: Bearer <pass>`) */
+export async function verifyHubCall(req, opts) {
+    const auth = req.headers.get("authorization") ?? "";
+    const token = auth.startsWith("Bearer ") ? auth.slice(7).trim() : "";
+    if (!token || token.length > 4096)
+        return { ok: false, reason: "missing" };
+    let p;
+    try {
+        ({ payload: p } = await jwtVerify(token, opts.keys, { issuer: HUB_ISSUER, audience: opts.moduleId, algorithms: ["EdDSA"], typ: TYP.call, currentDate: opts.now, clockTolerance: 5, maxTokenAge: 65 }));
+    }
+    catch (e) {
+        const code = e.code ?? "";
+        if (code === "ERR_JWT_EXPIRED")
+            return { ok: false, reason: "expired" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && /"aud"/.test(e.message))
+            return { ok: false, reason: "wrong_module" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED")
+            return { ok: false, reason: "expired" };
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (p.use !== opts.use)
+        return { ok: false, reason: "wrong_use" };
+    if (opts.environment && p.env !== opts.environment)
+        return { ok: false, reason: "wrong_environment" };
+    return { ok: true };
 }
-/** 8.4 / 7.6: the health answer. `ok` is false when any connection is red; the Hub shows each connection as its own chip. */
+function jsonResponse(status, body, extra = {}) {
+    return new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...extra } });
+}
+/**
+ * C-5 / 8b.4: the manifest, only to the Hub. The answer carries this app's own Vercel ID so the
+ * Hub knows which Vercel project answered; nobody else ever sees that ID.
+ */
+export async function manifestResponse(req, manifest, cfg) {
+    const v = await verifyHubCall(req, { moduleId: cfg.moduleId, keys: cfg.keys, use: "manifest", now: cfg.now, environment: cfg.environment });
+    if (!v.ok)
+        return jsonResponse(401, { error: "hub_only", reason: v.reason });
+    const own = cfg.token ? await tokenFrom(cfg.token) : ownVercelToken(req);
+    if (!own)
+        return jsonResponse(503, { error: "no_vercel_id", message: NO_ID });
+    return jsonResponse(200, manifest, { [APP_ID_HEADER]: own });
+}
+/** 8.4 / 7.6: the health answer's shape. `ok` is false when any connection is red; the Hub shows each connection as its own line. */
 export async function healthAnswer(check) {
     let connections;
     try {
@@ -79,3 +120,11 @@ export async function healthAnswer(check) {
         body: { ok: red.length === 0, reason: red.length ? red.map((c) => `${c.name}: ${c.reason ?? "not ok"}`).join("; ").slice(0, 200) : null, connections, checked_at: new Date().toISOString() },
     };
 }
+/** 8b.4: the health answer, in full, only to the Hub; anyone else gets 401 and nothing. */
+export async function healthResponse(req, check, cfg) {
+    const v = await verifyHubCall(req, { moduleId: cfg.moduleId, keys: cfg.keys, use: "health", now: cfg.now, environment: cfg.environment });
+    if (!v.ok)
+        return jsonResponse(401, { error: "hub_only", reason: v.reason });
+    const a = await healthAnswer(check);
+    return jsonResponse(a.status, a.body);
+}

package/dist/identity.d.ts

@@ -0,0 +1,27 @@
+import { type JWTVerifyGetKey } from "jose";
+export declare const OIDC_HEADER = "x-vercel-oidc-token";
+/** The header a manifest answer carries the app's own Vercel ID on (the Hub checks it). */
+export declare const APP_ID_HEADER = "x-t3b-vercel-id";
+export declare const HUB_ISSUER = "t3b-hub";
+export declare const TYP: {
+    readonly ticket: "t3b-ticket+jwt";
+    readonly call: "t3b-call+jwt";
+    readonly relay: "t3b-relay+jwt";
+};
+/** Where the app's Vercel ID comes from; the default finds it on its own. */
+export type TokenProvider = () => string | null | undefined | Promise<string | null | undefined>;
+/**
+ * This app's own Vercel ID: the given request's header, else the request Vercel is serving right
+ * now (the lookup @vercel/oidc makes), else VERCEL_OIDC_TOKEN (builds, local runs). Needs Vercel →
+ * the project → Settings → Security → Secure backend access (OIDC) on - Vercel's default.
+ */
+export declare function ownVercelToken(from?: Request | Headers | null): string | null;
+export declare function tokenFrom(provider: TokenProvider | undefined): Promise<string | null>;
+/**
+ * The Hub's published keys, fetched from `<hubUrl>/api/hub/jwks`, kept 10 minutes, fetched again
+ * at once when a token names a key id not yet seen (a new Hub key works immediately; a retired one
+ * stops within 10 minutes).
+ */
+export declare function hubKeys(hubUrl: string): JWTVerifyGetKey;
+/** This deployment's environment as Vercel names it; undefined off Vercel. */
+export declare function ownEnvironment(): string | undefined;

package/dist/identity.js

@@ -0,0 +1,51 @@
+import { createRemoteJWKSet } from "jose";
+// WORKFLOWS 8b (D-048): an app holds no key from the Hub. Towards the Hub it shows the ID Vercel
+// gives each of its functions on its own (a Vercel-signed token naming the team, the project and
+// production or preview); from the Hub it accepts only what is signed with the Hub's own key,
+// read from the Hub's one public address (/api/hub/jwks).
+export const OIDC_HEADER = "x-vercel-oidc-token";
+/** The header a manifest answer carries the app's own Vercel ID on (the Hub checks it). */
+export const APP_ID_HEADER = "x-t3b-vercel-id";
+export const HUB_ISSUER = "t3b-hub";
+export const TYP = { ticket: "t3b-ticket+jwt", call: "t3b-call+jwt", relay: "t3b-relay+jwt" };
+const REQUEST_CONTEXT = Symbol.for("@vercel/request-context");
+/**
+ * This app's own Vercel ID: the given request's header, else the request Vercel is serving right
+ * now (the lookup @vercel/oidc makes), else VERCEL_OIDC_TOKEN (builds, local runs). Needs Vercel →
+ * the project → Settings → Security → Secure backend access (OIDC) on - Vercel's default.
+ */
+export function ownVercelToken(from) {
+    const h = from instanceof Headers ? from : from?.headers;
+    const direct = h?.get(OIDC_HEADER);
+    if (direct)
+        return direct;
+    const ctx = globalThis[REQUEST_CONTEXT];
+    const fromCtx = ctx?.get?.()?.headers?.[OIDC_HEADER];
+    if (fromCtx)
+        return fromCtx;
+    const env = globalThis.process?.env;
+    return env?.VERCEL_OIDC_TOKEN || null;
+}
+export async function tokenFrom(provider) {
+    return (provider ? await provider() : ownVercelToken()) || null;
+}
+const keySets = new Map();
+/**
+ * The Hub's published keys, fetched from `<hubUrl>/api/hub/jwks`, kept 10 minutes, fetched again
+ * at once when a token names a key id not yet seen (a new Hub key works immediately; a retired one
+ * stops within 10 minutes).
+ */
+export function hubKeys(hubUrl) {
+    const url = new URL("/api/hub/jwks", hubUrl).toString();
+    let k = keySets.get(url);
+    if (!k) {
+        k = createRemoteJWKSet(new URL(url), { cacheMaxAge: 600_000, cooldownDuration: 30_000, timeoutDuration: 5_000 });
+        keySets.set(url, k);
+    }
+    return k;
+}
+/** This deployment's environment as Vercel names it; undefined off Vercel. */
+export function ownEnvironment() {
+    const env = globalThis.process?.env;
+    return env?.VERCEL_TARGET_ENV || env?.VERCEL_ENV || undefined;
+}

package/dist/index.d.ts

@@ -1,16 +1,20 @@
 export { Guard, type GuardConfig, type CheckResult } from "./guard.js";
-export { verifyTicket, importPublicKey, JtiMemory, TICKET_ISSUER, TICKET_TTL_S, TICKET_ALG, type TicketClaims, type VerifyResult } from "./ticket.js";
+export { verifyTicket, JtiMemory, TICKET_ISSUER, TICKET_TTL_S, TICKET_ALG, type TicketClaims, type VerifyResult } from "./ticket.js";
 export { readSession, signSession, cookieHeader, clearCookieHeader, cookieValue, SESSION_COOKIE, IDLE_MS, ABSOLUTE_MS, RECHECK_MS, type ModuleSession } from "./session.js";
-export { sessionCheck, tokenBroker, audit, signedManifest, healthAnswer, type HubClientConfig, type BrokerToken, type Connection } from "./hub-client.js";
+export { sessionCheck, tokenBroker, audit, verifyHubCall, manifestResponse, healthResponse, healthAnswer, type HubClientConfig, type HubCallCheck, type AnswerConfig, type BrokerToken, type Connection, } from "./hub-client.js";
 export { checkCloudflareAccess } from "./cf-access.js";
-export { verifyRelay, relaySignature, RELAY_HEADERS, RELAY_MAX_AGE_S, type RelayCheck, type RelayFields } from "./relay.js";
-/** Reads the guard's configuration from a module's environment (names only; values live in Vercel). */
+export { verifyRelay, RELAY_HEADERS, RELAY_MAX_AGE_S, type RelayCheck } from "./relay.js";
+export { ownVercelToken, ownEnvironment, hubKeys, APP_ID_HEADER, OIDC_HEADER, type TokenProvider } from "./identity.js";
+/**
+ * Reads the guard's settings from a module's environment. Nothing secret: the Hub's address
+ * (T3B_HUB_URL, default https://t3b-hub.com), the Cloudflare door's team and audience, and the
+ * environment Vercel runs the app as. Since 0.2.0 (8b) no key from the Hub is pasted anywhere.
+ */
 export declare function guardConfigFromEnv(env: Record<string, string | undefined>, moduleId: string): {
     moduleId: string;
-    hubPublicKeys: string[];
-    moduleKey: string;
     hubUrl: string;
     hubHomeUrl: string;
+    environment: string | undefined;
     cloudflare: {
         team: string | undefined;
         audience: string | undefined;

package/dist/index.js

@@ -1,18 +1,22 @@
 export { Guard } from "./guard.js";
-export { verifyTicket, importPublicKey, JtiMemory, TICKET_ISSUER, TICKET_TTL_S, TICKET_ALG } from "./ticket.js";
+export { verifyTicket, JtiMemory, TICKET_ISSUER, TICKET_TTL_S, TICKET_ALG } from "./ticket.js";
 export { readSession, signSession, cookieHeader, clearCookieHeader, cookieValue, SESSION_COOKIE, IDLE_MS, ABSOLUTE_MS, RECHECK_MS } from "./session.js";
-export { sessionCheck, tokenBroker, audit, signedManifest, healthAnswer } from "./hub-client.js";
+export { sessionCheck, tokenBroker, audit, verifyHubCall, manifestResponse, healthResponse, healthAnswer, } from "./hub-client.js";
 export { checkCloudflareAccess } from "./cf-access.js";
-export { verifyRelay, relaySignature, RELAY_HEADERS, RELAY_MAX_AGE_S } from "./relay.js";
-/** Reads the guard's configuration from a module's environment (names only; values live in Vercel). */
+export { verifyRelay, RELAY_HEADERS, RELAY_MAX_AGE_S } from "./relay.js";
+export { ownVercelToken, ownEnvironment, hubKeys, APP_ID_HEADER, OIDC_HEADER } from "./identity.js";
+/**
+ * Reads the guard's settings from a module's environment. Nothing secret: the Hub's address
+ * (T3B_HUB_URL, default https://t3b-hub.com), the Cloudflare door's team and audience, and the
+ * environment Vercel runs the app as. Since 0.2.0 (8b) no key from the Hub is pasted anywhere.
+ */
 export function guardConfigFromEnv(env, moduleId) {
-    const keys = [env.T3B_HUB_PUBLIC_KEY, env.T3B_HUB_PUBLIC_KEY_PREVIOUS].filter((k) => Boolean(k));
+    const hubUrl = (env.T3B_HUB_URL ?? "https://t3b-hub.com").replace(/\/$/, "");
     return {
         moduleId,
-        hubPublicKeys: keys,
-        moduleKey: env.T3B_MODULE_KEY ?? "",
-        hubUrl: env.T3B_HUB_URL ?? "https://t3b-hub.com",
-        hubHomeUrl: env.T3B_HUB_URL ? `${env.T3B_HUB_URL.replace(/\/$/, "")}/home` : "https://t3b-hub.com/home",
+        hubUrl,
+        hubHomeUrl: `${hubUrl}/home`,
+        environment: env.VERCEL_TARGET_ENV || env.VERCEL_ENV || undefined,
         cloudflare: { team: env.T3B_CF_ACCESS_TEAM, audience: env.T3B_CF_ACCESS_AUD },
     };
 }

package/dist/relay.d.ts

@@ -1,6 +1,6 @@
+import { type JWTVerifyGetKey } from "jose";
 export declare const RELAY_HEADERS: {
-    readonly signature: "x-t3b-relay-signature";
-    readonly timestamp: "x-t3b-relay-timestamp";
+    readonly token: "x-t3b-relay";
     readonly webhookId: "x-t3b-webhook-id";
     readonly topic: "x-t3b-topic";
     readonly store: "x-t3b-store";
@@ -8,14 +8,6 @@ export declare const RELAY_HEADERS: {
 };
 /** A relayed event older than this is refused (the Hub signs every attempt afresh). */
 export declare const RELAY_MAX_AGE_S = 300;
-export type RelayFields = {
-    timestamp: number;
-    webhookId: string;
-    topic: string;
-    store: string;
-};
-/** The bytes signed: `<ts>.<webhookId>.<topic>.<store>.` followed by the body exactly as received. */
-export declare function relaySignature(moduleKey: string, f: RelayFields, body: Uint8Array | string): Promise<string>;
 export type RelayCheck = {
     ok: true;
     webhookId: string;
@@ -24,10 +16,15 @@ export type RelayCheck = {
     shop: string | null;
 } | {
     ok: false;
-    reason: "missing_header" | "stale" | "bad_signature" | "no_key";
+    reason: "missing_header" | "stale" | "bad_signature" | "wrong_module" | "body_changed" | "wrong_environment";
 };
 /**
  * Checks one relayed event. Read the body as raw bytes (`await req.arrayBuffer()`) before parsing
- * it - the signature covers the exact bytes. Use the webhook id to ignore a repeat.
+ * it - the pass covers the exact bytes. Use the webhook id to ignore a repeat.
  */
-export declare function verifyRelay(headers: Headers, body: Uint8Array | string, moduleKey: string, now?: Date): Promise<RelayCheck>;
+export declare function verifyRelay(headers: Headers, body: Uint8Array | string, opts: {
+    moduleId: string;
+    keys: JWTVerifyGetKey;
+    now?: Date;
+    environment?: string;
+}): Promise<RelayCheck>;

package/dist/relay.js

@@ -1,11 +1,14 @@
-import { constantTimeEqual, hmacSha256, toHex } from "./webcrypto.js";
-// WORKFLOWS 10.4 / SPEC C-20: Shopify's events reach a module only through the Hub. The Hub
-// checks Shopify's signature and which store sent the event, then re-sends the exact body to each
-// module that asked for the topic, signed with that module's key. A module never holds the
-// Shopify app secret; it checks this signature instead.
+import { jwtVerify } from "jose";
+import { HUB_ISSUER, TYP } from "./identity.js";
+import { b64urlEncode, sha256 } from "./webcrypto.js";
+// WORKFLOWS 10.4 / 8b.3 (SPEC C-20): Shopify's events reach a module only through the Hub. The
+// Hub checks Shopify's signature and which store sent the event, then re-sends the exact body to
+// each module that asked for the topic, with a pass in `x-t3b-relay` signed by the Hub's key: for
+// this module (aud), this event, this exact body (its SHA-256), five minutes. A module never holds
+// the Shopify app secret, and since 0.2.0 no key from the Hub either - it checks the pass against
+// the Hub's published key.
 export const RELAY_HEADERS = {
-    signature: "x-t3b-relay-signature",
-    timestamp: "x-t3b-relay-timestamp",
+    token: "x-t3b-relay",
     webhookId: "x-t3b-webhook-id",
     topic: "x-t3b-topic",
     store: "x-t3b-store",
@@ -13,29 +16,37 @@ export const RELAY_HEADERS = {
 };
 /** A relayed event older than this is refused (the Hub signs every attempt afresh). */
 export const RELAY_MAX_AGE_S = 300;
-/** The bytes signed: `<ts>.<webhookId>.<topic>.<store>.` followed by the body exactly as received. */
-export async function relaySignature(moduleKey, f, body) {
-    return `sha256=${toHex(await hmacSha256(moduleKey, `${f.timestamp}.${f.webhookId}.${f.topic}.${f.store}.`, body))}`;
-}
 /**
  * Checks one relayed event. Read the body as raw bytes (`await req.arrayBuffer()`) before parsing
- * it - the signature covers the exact bytes. Use the webhook id to ignore a repeat.
+ * it - the pass covers the exact bytes. Use the webhook id to ignore a repeat.
  */
-export async function verifyRelay(headers, body, moduleKey, now = new Date()) {
-    if (!moduleKey)
-        return { ok: false, reason: "no_key" };
-    const sig = headers.get(RELAY_HEADERS.signature) ?? "";
-    const tsRaw = headers.get(RELAY_HEADERS.timestamp) ?? "";
-    const webhookId = headers.get(RELAY_HEADERS.webhookId) ?? "";
-    const topic = headers.get(RELAY_HEADERS.topic) ?? "";
-    const store = headers.get(RELAY_HEADERS.store) ?? "";
-    if (!sig || !/^\d{9,11}$/.test(tsRaw) || !webhookId || !topic || !store)
+export async function verifyRelay(headers, body, opts) {
+    const token = headers.get(RELAY_HEADERS.token) ?? "";
+    if (!token || token.length > 4096)
         return { ok: false, reason: "missing_header" };
-    const timestamp = Number(tsRaw);
-    if (Math.abs(Math.floor(now.getTime() / 1000) - timestamp) > RELAY_MAX_AGE_S)
-        return { ok: false, reason: "stale" };
-    const expected = await relaySignature(moduleKey, { timestamp, webhookId, topic, store }, body);
-    if (!constantTimeEqual(sig, expected))
+    let p;
+    try {
+        ({ payload: p } = await jwtVerify(token, opts.keys, { issuer: HUB_ISSUER, audience: opts.moduleId, algorithms: ["EdDSA"], typ: TYP.relay, currentDate: opts.now, clockTolerance: 5, maxTokenAge: RELAY_MAX_AGE_S + 5 }));
+    }
+    catch (e) {
+        const code = e.code ?? "";
+        if (code === "ERR_JWT_EXPIRED")
+            return { ok: false, reason: "stale" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && /"aud"/.test(e.message))
+            return { ok: false, reason: "wrong_module" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED")
+            return { ok: false, reason: "stale" };
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (p.use !== "relay")
         return { ok: false, reason: "bad_signature" };
-    return { ok: true, webhookId, topic, store, shop: headers.get(RELAY_HEADERS.shop) };
+    if (opts.environment && p.env !== opts.environment)
+        return { ok: false, reason: "wrong_environment" };
+    const s = (k) => (typeof p[k] === "string" ? p[k] : "");
+    if (!s("webhook_id") || !s("topic") || !s("store") || !s("body_sha256"))
+        return { ok: false, reason: "missing_header" };
+    const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body;
+    if (b64urlEncode(await sha256(bytes)) !== s("body_sha256"))
+        return { ok: false, reason: "body_changed" };
+    return { ok: true, webhookId: s("webhook_id"), topic: s("topic"), store: s("store"), shop: s("shop") || null };
 }

package/dist/ticket.d.ts

@@ -1,3 +1,4 @@
+import { type JWTVerifyGetKey } from "jose";
 export declare const TICKET_ISSUER = "t3b-hub";
 export declare const TICKET_TTL_S = 60;
 export declare const TICKET_ALG = "EdDSA";
@@ -17,7 +18,7 @@ export type VerifyResult = {
     claims: TicketClaims;
 } | {
     ok: false;
-    reason: "expired" | "wrong_audience" | "bad_signature" | "replayed" | "malformed";
+    reason: "expired" | "wrong_audience" | "bad_signature" | "replayed" | "malformed" | "wrong_environment";
 };
 /** Seen ticket ids, kept for two minutes (C-4). One instance's memory; a replay across instances is stopped by the 60-s life. */
 export declare class JtiMemory {
@@ -27,11 +28,10 @@ export declare class JtiMemory {
     /** returns true when the id was already seen */
     check(jti: string, now?: number): boolean;
 }
-/** Accepts a public key as base64 SPKI (DER) or as a PEM block. */
-export declare function importPublicKey(key: string): Promise<CryptoKey>;
 export declare function verifyTicket(ticket: string, opts: {
-    publicKeys: string[];
+    keys: JWTVerifyGetKey;
     audience: string;
     now?: Date;
     jti?: JtiMemory;
+    environment?: string;
 }): Promise<VerifyResult>;

package/dist/ticket.js

@@ -1,8 +1,10 @@
-import { importSPKI, jwtVerify } from "jose";
-// SPEC C-4: the entry ticket. EdDSA (Ed25519) JWT signed by the Hub's private key; a module holds
-// the public key(s) only. Claims: iss "t3b-hub", aud = module id, sub = person id, jti, iat,
-// exp = iat + 60 s, role, stores[], path, name, sv (the person's session version).
-export const TICKET_ISSUER = "t3b-hub";
+import { jwtVerify } from "jose";
+import { HUB_ISSUER, TYP } from "./identity.js";
+// SPEC C-4: the entry ticket. EdDSA (Ed25519) JWT signed by the Hub's key; since 0.2.0 (8b) the
+// module reads the Hub's public key from the Hub's own address instead of holding a pasted copy.
+// Header typ "t3b-ticket+jwt", kid. Claims: iss "t3b-hub", aud = module id, sub = person id, jti,
+// iat, exp = iat + 60 s, use "enter", env, role, stores[], path, name, sv (session version).
+export const TICKET_ISSUER = HUB_ISSUER;
 export const TICKET_TTL_S = 60;
 export const TICKET_ALG = "EdDSA";
 /** Seen ticket ids, kept for two minutes (C-4). One instance's memory; a replay across instances is stopped by the 60-s life. */
@@ -23,40 +25,29 @@ export class JtiMemory {
         return false;
     }
 }
-/** Accepts a public key as base64 SPKI (DER) or as a PEM block. */
-export async function importPublicKey(key) {
-    const trimmed = key.trim();
-    const pem = trimmed.includes("-----BEGIN") ? trimmed : `-----BEGIN PUBLIC KEY-----\n${trimmed.replace(/\s+/g, "").match(/.{1,64}/g)?.join("\n") ?? ""}\n-----END PUBLIC KEY-----`;
-    return importSPKI(pem, TICKET_ALG);
-}
 export async function verifyTicket(ticket, opts) {
     if (typeof ticket !== "string" || ticket.split(".").length !== 3 || ticket.length > 4096)
         return { ok: false, reason: "malformed" };
     const now = opts.now ?? new Date();
-    let payload = null;
-    let lastReason = "bad_signature";
-    for (const k of opts.publicKeys.filter(Boolean)) {
-        try {
-            const key = await importPublicKey(k);
-            const r = await jwtVerify(ticket, key, { issuer: TICKET_ISSUER, audience: opts.audience, algorithms: [TICKET_ALG], currentDate: now, clockTolerance: 5 });
-            payload = r.payload;
-            break;
-        }
-        catch (e) {
-            const code = e.code ?? "";
-            if (code === "ERR_JWT_EXPIRED")
-                lastReason = "expired";
-            else if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && /aud/.test(e.message))
-                lastReason = "wrong_audience";
-            else if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED")
-                lastReason = "wrong_audience";
-            else
-                lastReason = lastReason === "bad_signature" ? "bad_signature" : lastReason;
-        }
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(ticket, opts.keys, { issuer: TICKET_ISSUER, audience: opts.audience, algorithms: [TICKET_ALG], typ: TYP.ticket, currentDate: now, clockTolerance: 5 }));
+    }
+    catch (e) {
+        const code = e.code ?? "";
+        if (code === "ERR_JWT_EXPIRED")
+            return { ok: false, reason: "expired" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && /"aud"/.test(e.message))
+            return { ok: false, reason: "wrong_audience" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED")
+            return { ok: false, reason: "malformed" };
+        return { ok: false, reason: "bad_signature" };
     }
-    if (!payload)
-        return { ok: false, reason: lastReason };
     const p = payload;
+    if (p.use !== "enter")
+        return { ok: false, reason: "malformed" };
+    if (opts.environment && p.env !== opts.environment)
+        return { ok: false, reason: "wrong_environment" };
     if (typeof p.sub !== "string" || typeof p.jti !== "string" || typeof p.role !== "string" || !Array.isArray(p.stores) || typeof p.path !== "string" || typeof p.exp !== "number" || typeof p.iat !== "number") {
         return { ok: false, reason: "malformed" };
     }

package/dist/webcrypto.d.ts

@@ -6,3 +6,5 @@ export declare function b64urlEncode(b: Uint8Array): string;
 export declare function b64urlDecodeText(s: string): string;
 /** Compares two strings in time that does not depend on where they first differ. */
 export declare function constantTimeEqual(a: string, b: string): boolean;
+/** SHA-256 of the bytes. */
+export declare function sha256(bytes: Uint8Array): Promise<Uint8Array>;

package/dist/webcrypto.js

@@ -1,6 +1,6 @@
 // Web Crypto only (globalThis.crypto.subtle), so the guard runs in Node 20+, in edge runtimes
 // (Next.js middleware before Next 15.5, Vercel Edge, Cloudflare Workers) and in Deno alike.
-// Nothing here imports node:crypto or uses Buffer.
+// Nothing here imports node:crypto or uses Node's Buffer type.
 const enc = new TextEncoder();
 const keys = new Map();
 function subtle() {
@@ -64,3 +64,7 @@ export function constantTimeEqual(a, b) {
         diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
     return diff === 0;
 }
+/** SHA-256 of the bytes. */
+export async function sha256(bytes) {
+    return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@t3b/hub-guard",
-  "version": "0.1.0",
-  "description": "The3Beez Hub guard: a module opens only by a Hub-signed ticket and refuses everything else. Entry route, refusal page, module session, idle rule, 15-minute re-check with the Hub, Cloudflare Access proof, broker and audit clients, signed manifest and health answers. Web Crypto only: runs in Node 20+ and in edge runtimes.",
+  "version": "0.2.0",
+  "description": "The3Beez Hub guard: a module opens only by a Hub-signed ticket and refuses everything else. No key from the Hub: towards the Hub the app shows its own Vercel ID; from the Hub it accepts only what is signed by the key the Hub publishes. Entry route, refusal page, module session, idle rule, 15-minute re-check, Cloudflare Access proof, broker and audit clients, manifest and health answers for the Hub only. Web Crypto only: runs in Node 20+ and in edge runtimes.",
   "license": "UNLICENSED",
   "type": "module",
   "main": "./dist/index.js",