@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/server/consumer-session-user.d.ts

@@ -0,0 +1,11 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/** Admit the consumer's signed-in user without lending that identity to the request. */
+export declare function requireConsumerSessionUser(runtime: VibesRuntime): Promise<{
+    readonly kind: "user";
+    readonly userId: string;
+    readonly jwt: string;
+    readonly orgId?: string;
+    readonly roles?: readonly string[];
+    readonly sessionId?: string;
+} & import("@vibesdotdev/kernel").RequestPrincipalVerifiedFacts>;
+//# sourceMappingURL=consumer-session-user.d.ts.map

package/dist/server/consumer-session-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-session-user.d.ts","sourceRoot":"","sources":["../../src/server/consumer-session-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzE,wFAAwF;AACxF,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,YAAY;;;;;;;iEAgBrE"}

package/dist/server/consumer-session-user.js

@@ -0,0 +1,23 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { loadStoredCredentials } from "../features/services/credential-store.js";
+/** Admit the consumer's signed-in user without lending that identity to the request. */
+export async function requireConsumerSessionUser(runtime) {
+    const principal = runtime.requestPrincipal();
+    if (principal.kind !== 'user')
+        throw new CapabilityError('Sign in to use this machine.', 'AUTH_REQUIRED', {
+            reason: 'consumer-user-required', retryable: false
+        });
+    // This is the consumer's stored login, independent of the browser request or
+    // an injected agent key. Auth owns its environment partition and persistence.
+    const consumer = await runtime.runOutsideInvocation(() => loadStoredCredentials(runtime));
+    if (!consumer?.userId || consumer.type === 'none')
+        throw new CapabilityError('Sign in to Vibes on this machine first.', 'AUTH_REQUIRED', {
+            reason: 'consumer-session-required', retryable: false
+        });
+    if (consumer.userId !== principal.userId)
+        throw new CapabilityError('This account cannot use this machine.', 'PERMISSION_DENIED', {
+            reason: 'consumer-user-mismatch', retryable: false
+        });
+    return principal;
+}
+//# sourceMappingURL=consumer-session-user.js.map

package/dist/server/consumer-session-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-session-user.js","sourceRoot":"","sources":["../../src/server/consumer-session-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAqB;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,eAAe,EAAE;YACzG,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK;SAClD,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACxI,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK;SACrD,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,mBAAmB,EAAE;YACjI,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK;SAClD,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/server/cookie-domain.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Parent cookie domain for a hostname.
+ * Never `.omniframe.co`: that cookie would be sent to runner.omniframe.co.
+ */
+export declare function parentCookieDomain(hostname: string): string | undefined;
+/** Drop Domain= so the cookie stays on the responding host. */
+export declare function hostOnlySetCookie(setCookie: string): string;
+//# sourceMappingURL=cookie-domain.d.ts.map

package/dist/server/cookie-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-domain.d.ts","sourceRoot":"","sources":["../../src/server/cookie-domain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYvE;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAK3D"}

package/dist/server/cookie-domain.js

@@ -0,0 +1,25 @@
+/**
+ * Parent cookie domain for a hostname.
+ * Never `.omniframe.co`: that cookie would be sent to runner.omniframe.co.
+ */
+export function parentCookieDomain(hostname) {
+    if (hostname === 'localhost' ||
+        /^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname) ||
+        hostname.includes(':')) {
+        return undefined;
+    }
+    if (hostname === 'omniframe.co' || hostname.endsWith('.omniframe.co'))
+        return undefined;
+    const parts = hostname.split('.').filter(Boolean);
+    if (parts.length < 2)
+        return undefined;
+    return `.${parts.slice(-2).join('.')}`;
+}
+/** Drop Domain= so the cookie stays on the responding host. */
+export function hostOnlySetCookie(setCookie) {
+    return setCookie
+        .split(';')
+        .filter((part) => !part.trim().toLowerCase().startsWith('domain='))
+        .join(';');
+}
+//# sourceMappingURL=cookie-domain.js.map

package/dist/server/cookie-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-domain.js","sourceRoot":"","sources":["../../src/server/cookie-domain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAClD,IACC,QAAQ,KAAK,WAAW;QACxB,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,SAAS;SACd,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC"}

package/dist/server/issuer-session-verifier.impl.d.ts

@@ -0,0 +1,23 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type SessionJwtVerifier } from './session-verifier.ts';
+/** Native hosts ask the issuer, which owns the real revocation store. No success cache. */
+export default class IssuerSessionVerifier extends BaseRuntimeClient<VibesRuntime> implements SessionJwtVerifier {
+    verify(input: Parameters<SessionJwtVerifier['verify']>[0]): Promise<{
+        [x: string]: unknown;
+        sub: string;
+        iss?: string | undefined;
+        aud?: string | string[] | undefined;
+        exp?: number | undefined;
+        nbf?: number | undefined;
+        iat?: number | undefined;
+        jti?: string | undefined;
+        email?: string | undefined;
+        name?: string | null | undefined;
+        userId?: string | undefined;
+        org?: string | undefined;
+        roles?: string[] | undefined;
+        sessionId?: string | undefined;
+    }>;
+}
+//# sourceMappingURL=issuer-session-verifier.impl.d.ts.map

package/dist/server/issuer-session-verifier.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session-verifier.impl.d.ts","sourceRoot":"","sources":["../../src/server/issuer-session-verifier.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAgC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE9F,2FAA2F;AAC3F,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,iBAAiB,CAAC,YAAY,CAAE,YAAW,kBAAkB;IACzG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;CA4B/D"}

package/dist/server/issuer-session-verifier.impl.js

@@ -0,0 +1,38 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { SessionJwtVerificationSchema } from "./session-verifier.js";
+/** Native hosts ask the issuer, which owns the real revocation store. No success cache. */
+export default class IssuerSessionVerifier extends BaseRuntimeClient {
+    async verify(input) {
+        try {
+            return await this.runtime.lifecycle.wait(async (signal) => {
+                const response = await input.fetcher(new URL('/api/session/verify', input.authOrigin), {
+                    method: 'POST', headers: { authorization: `Bearer ${input.token}` },
+                    redirect: 'error', cache: 'no-store', signal
+                });
+                if (response.status !== 200 && response.status !== 401)
+                    throw new CapabilityError('Auth session verification is unavailable.', 'UNAVAILABLE', {
+                        reason: 'session-verifier-unavailable', retryable: true, details: { status: response.status }
+                    });
+                const answer = SessionJwtVerificationSchema.parse(await response.json());
+                if (response.status !== 200 || answer.status === 'invalid')
+                    throw new CapabilityError('The session is no longer valid.', 'AUTH_REQUIRED', {
+                        reason: answer.status === 'invalid' && answer.reason === 'revoked' ? 'session-revoked' : 'session-invalid', retryable: false
+                    });
+                return answer.payload;
+            }, {
+                timeoutMs: input.jwksFetchTimeoutMs,
+                reason: 'auth-issuer-session-verification',
+                signal: this.runtime.invocationSignal
+            });
+        }
+        catch (cause) {
+            if (cause instanceof CapabilityError && (cause.code === 'AUTH_REQUIRED' || cause.reason === 'session-verifier-unavailable'))
+                throw cause;
+            throw new CapabilityError('Auth session verification is unavailable.', 'UNAVAILABLE', {
+                reason: 'session-verifier-unavailable', retryable: true, cause: CaughtFailureSchema.parse(cause)
+            });
+        }
+    }
+}
+//# sourceMappingURL=issuer-session-verifier.impl.js.map

package/dist/server/issuer-session-verifier.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session-verifier.impl.js","sourceRoot":"","sources":["../../src/server/issuer-session-verifier.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAA2B,MAAM,uBAAuB,CAAC;AAE9F,2FAA2F;AAC3F,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,iBAA+B;IACjF,KAAK,CAAC,MAAM,CAAC,KAAkD;QAC9D,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;gBACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;oBACtF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;oBACnE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM;iBAC5C,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,aAAa,EAAE;wBAC7I,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;qBAC7F,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,eAAe,EAAE;wBACzI,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK;qBAC5H,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,OAAO,CAAC;YACvB,CAAC,EAAE;gBACF,SAAS,EAAE,KAAK,CAAC,kBAAkB;gBACnC,MAAM,EAAE,kCAAkC;gBAC1C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;aACrC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,eAAe,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,8BAA8B,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzI,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,aAAa,EAAE;gBACrF,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;aAChG,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD"}

package/dist/server/issuer-session-verifier.plugin.d.ts

@@ -0,0 +1,3 @@
+declare const issuerSessionVerifierPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default issuerSessionVerifierPlugin;
+//# sourceMappingURL=issuer-session-verifier.plugin.d.ts.map

package/dist/server/issuer-session-verifier.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session-verifier.plugin.d.ts","sourceRoot":"","sources":["../../src/server/issuer-session-verifier.plugin.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,2BAA2B,6CAG/B,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/server/issuer-session-verifier.plugin.js

@@ -0,0 +1,8 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import descriptor from "./bound-session-verifier.descriptor.js";
+const issuerSessionVerifierPlugin = createRuntimePlugin({
+    id: 'auth-issuer-session-verifier', name: 'Issuer session verification', dependencies: ['auth-api-client'],
+    loaders: [loader(descriptor.id, { kind: descriptor.kind, scope: 'consumer' }, () => import("./issuer-session-verifier.impl.js"))]
+});
+export default issuerSessionVerifierPlugin;
+//# sourceMappingURL=issuer-session-verifier.plugin.js.map

package/dist/server/issuer-session-verifier.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-session-verifier.plugin.js","sourceRoot":"","sources":["../../src/server/issuer-session-verifier.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,UAAU,MAAM,wCAAwC,CAAC;AAEhE,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IACvD,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,6BAA6B,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC;IAC1G,OAAO,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;CACjI,CAAC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/server/jwks-response-cache.d.ts

@@ -0,0 +1,50 @@
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+export declare const VIBES_JWKS_ROTATION_INTERVAL_SECONDS: number;
+export declare const VIBES_JWKS_GRACE_PERIOD_SECONDS: number;
+export interface JwksCacheLike {
+    match(request: Request): Promise<Response | undefined>;
+    put(request: Request, response: Response): Promise<void>;
+}
+export interface JwksResponseCacheOptions {
+    /**
+     * Keep this deliberately short. A cache entry containing only the previous
+     * signing keys delays discovery of a newly rotated `kid` until it expires.
+     */
+    ttlSeconds?: number;
+    now?: () => number;
+    /** Told of each failure of the edge cache; the cache is then skipped for that call. */
+    onCacheError?: (failure: CaughtFailure) => void;
+}
+export interface JwksResponseOptions {
+    edgeCache?: JwksCacheLike;
+}
+export interface JwksDatabaseLike {
+    prepare(query: string): {
+        all(): Promise<{
+            results?: unknown[];
+        }>;
+    };
+}
+export interface ReadPublicJwksOptions {
+    algorithm?: string;
+    gracePeriodSeconds?: number;
+    now?: () => number;
+}
+/**
+ * Read Better Auth's public JWKS projection directly from its SQLite/D1 table.
+ *
+ * This intentionally never selects `private_key`. It exists so public key
+ * discovery does not need to initialize the full auth runtime on a cold
+ * isolate. `null` means a new/empty database and lets the caller fall back to
+ * Better Auth's key-initialization path.
+ */
+export declare function readPublicJwksFromDatabase(database: JwksDatabaseLike, options?: ReadPublicJwksOptions): Promise<Response | null>;
+/**
+ * Collapses concurrent public-JWKS reads inside an isolate and optionally uses
+ * the Workers Cache API to share the same tiny response across isolates in a
+ * Cloudflare colo. Only validated public key sets are cached.
+ */
+export declare function createJwksResponseCache(options?: JwksResponseCacheOptions): {
+    respond(request: Request, load: () => Promise<Response>, responseOptions?: JwksResponseOptions): Promise<Response>;
+};
+//# sourceMappingURL=jwks-response-cache.d.ts.map

package/dist/server/jwks-response-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-response-cache.d.ts","sourceRoot":"","sources":["../../src/server/jwks-response-cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQzD,eAAO,MAAM,oCAAoC,QAAoB,CAAC;AACtE,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACvD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uFAAuF;IACvF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAWD,MAAM,WAAW,gBAAgB;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG;QACvB,GAAG,IAAI,OAAO,CAAC;YAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC,CAAC;KACxC,CAAC;CACF;AAKD,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAyCD;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC/C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA+C1B;AAmDD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B;qBAwDlE,OAAO,QACV,MAAM,OAAO,CAAC,QAAQ,CAAC,oBACZ,mBAAmB,GAClC,OAAO,CAAC,QAAQ,CAAC;EA0BrB"}

package/dist/server/jwks-response-cache.js

@@ -0,0 +1,207 @@
+import * as z from 'zod/v4';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { attempt, attemptSync } from "../features/utils/attempt.js";
+const DEFAULT_TTL_SECONDS = 5;
+const PRIVATE_JWK_FIELDS = new Set(['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k']);
+const JWKS_SELECT = 'SELECT id, public_key, alg, crv, expires_at FROM jwks ORDER BY created_at DESC';
+export const VIBES_JWKS_ROTATION_INTERVAL_SECONDS = 60 * 60 * 24 * 30;
+export const VIBES_JWKS_GRACE_PERIOD_SECONDS = 60 * 60 * 24 * 7;
+/** A row of Better Auth's `jwks` table, as the public projection reads it. */
+const jwksRowSchema = z.looseObject({
+    id: z.string(),
+    public_key: z.string(),
+    alg: z.string().nullish().catch(undefined),
+    crv: z.string().nullish().catch(undefined),
+    expires_at: z.union([z.number(), z.string(), z.null()]).optional().catch(undefined)
+});
+/** A stored public JWK: a JSON object with a string `kty`. */
+const publicJwkSchema = z.record(z.string(), JsonValueSchema).refine((jwk) => z.string().safeParse(jwk.kty).success);
+function canonicalCacheRequest(request) {
+    return new Request(request.url, {
+        method: 'GET',
+        headers: { accept: 'application/json' }
+    });
+}
+function hasPrivateKeyMaterial(fields) {
+    return fields.some((field) => PRIVATE_JWK_FIELDS.has(field));
+}
+function epochMilliseconds(value, field) {
+    if (value === null || value === undefined)
+        return null;
+    const numeric = Number(value);
+    if (!Number.isFinite(numeric) || numeric < 0) {
+        throw new TypeError(`Invalid JWKS ${field} timestamp`);
+    }
+    // The original migration default used SQLite unixepoch() seconds while
+    // Drizzle's current timestamp_ms mapper writes milliseconds.
+    return numeric < 100_000_000_000 ? numeric * 1_000 : numeric;
+}
+/**
+ * Read Better Auth's public JWKS projection directly from its SQLite/D1 table.
+ *
+ * This intentionally never selects `private_key`. It exists so public key
+ * discovery does not need to initialize the full auth runtime on a cold
+ * isolate. `null` means a new/empty database and lets the caller fall back to
+ * Better Auth's key-initialization path.
+ */
+export async function readPublicJwksFromDatabase(database, options = {}) {
+    const algorithm = options.algorithm ?? 'EdDSA';
+    const gracePeriodMs = (options.gracePeriodSeconds ?? VIBES_JWKS_GRACE_PERIOD_SECONDS) * 1_000;
+    const now = (options.now ?? Date.now)();
+    const result = await database.prepare(JWKS_SELECT).all();
+    const rows = result.results ?? [];
+    if (rows.length === 0)
+        return null;
+    const keys = rows
+        .map((rawRow, index) => {
+        const parsedRow = jwksRowSchema.safeParse(rawRow);
+        if (!parsedRow.success) {
+            throw new TypeError(`Invalid JWKS row at index ${index}`, { cause: parsedRow.error });
+        }
+        const row = parsedRow.data;
+        const expiresAt = epochMilliseconds(row.expires_at, 'expires_at');
+        if (expiresAt !== null && expiresAt + gracePeriodMs <= now)
+            return null;
+        const publicKey = attemptSync(() => publicJwkSchema.safeParse(JSON.parse(row.public_key)));
+        if (!publicKey.ok) {
+            throw new TypeError(`Invalid public JWK JSON at index ${index}`, { cause: publicKey.failure });
+        }
+        const parsedJwk = publicKey.value;
+        if (!parsedJwk.success) {
+            throw new TypeError(`Unsafe public JWK at index ${index}`, { cause: parsedJwk.error });
+        }
+        const publicJwk = parsedJwk.data;
+        if (hasPrivateKeyMaterial(Object.keys(publicJwk))) {
+            throw new TypeError(`Unsafe public JWK at index ${index}`);
+        }
+        // Better Auth stores the algorithm with each key. A changed signing
+        // default must not relabel older keys that are still active/in grace.
+        // Stored public fields retain Better Auth's precedence; the row owns kid.
+        // The row only fills in `crv`: the stored JWK's own fields come later
+        // and win. An absent `crv` is undefined, which Response.json omits.
+        return {
+            crv: row.crv ?? undefined,
+            alg: row.alg ?? algorithm,
+            ...publicJwk,
+            kid: row.id
+        };
+    })
+        .filter((key) => key !== null);
+    return Response.json({ keys });
+}
+/** The keys a cacheable JWKS answer carries: each has a string `kid` and `kty` and no private material. */
+const publicJwksBodySchema = z.object({
+    keys: z
+        .array(z.looseObject({ kid: z.string(), kty: z.string() }))
+        .min(1)
+        .refine((keys) => keys.every((key) => !hasPrivateKeyMaterial(Object.keys(key))))
+});
+async function isSafePublicJwksResponse(response) {
+    if (response.status !== 200)
+        return false;
+    // An answer whose body cannot be read as JSON is not a cacheable JWKS response: fail closed.
+    const read = await attempt(async () => publicJwksBodySchema.safeParse(await response.clone().json()));
+    return read.ok && read.value.success;
+}
+async function snapshotResponse(response, ttlSeconds) {
+    const headers = new Headers(response.headers);
+    if (ttlSeconds !== undefined) {
+        headers.delete('set-cookie');
+        headers.set('cache-control', `public, max-age=${ttlSeconds}, s-maxage=${ttlSeconds}, must-revalidate`);
+    }
+    return {
+        body: await response.arrayBuffer(),
+        headers: Array.from(headers.entries()),
+        status: response.status,
+        statusText: response.statusText
+    };
+}
+function responseFromSnapshot(snapshot, cacheStatus) {
+    const headers = new Headers(snapshot.headers);
+    if (cacheStatus)
+        headers.set('x-vibes-jwks-cache', cacheStatus);
+    return new Response(snapshot.body.slice(0), {
+        status: snapshot.status,
+        statusText: snapshot.statusText,
+        headers
+    });
+}
+/**
+ * Collapses concurrent public-JWKS reads inside an isolate and optionally uses
+ * the Workers Cache API to share the same tiny response across isolates in a
+ * Cloudflare colo. Only validated public key sets are cached.
+ */
+export function createJwksResponseCache(options = {}) {
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const now = options.now ?? Date.now;
+    const memory = new Map();
+    const inFlight = new Map();
+    if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+        throw new TypeError('JWKS response cache ttlSeconds must be greater than zero');
+    }
+    const reportCacheError = (failure) => {
+        options.onCacheError?.(failure);
+    };
+    const resolveResponse = async (cacheRequest, load, edgeCache) => {
+        if (edgeCache) {
+            const edge = await attempt(async () => {
+                const edgeHit = await edgeCache.match(cacheRequest);
+                if (!edgeHit || !(await isSafePublicJwksResponse(edgeHit)))
+                    return null;
+                return snapshotResponse(edgeHit, ttlSeconds);
+            });
+            if (!edge.ok)
+                reportCacheError(edge.failure);
+            else if (edge.value) {
+                memory.set(cacheRequest.url, {
+                    expiresAt: now() + ttlSeconds * 1_000,
+                    snapshot: edge.value
+                });
+                return { snapshot: edge.value, status: 'EDGE_HIT' };
+            }
+        }
+        const loaded = await load();
+        if (!(await isSafePublicJwksResponse(loaded))) {
+            return { snapshot: await snapshotResponse(loaded), status: 'MISS' };
+        }
+        const snapshot = await snapshotResponse(loaded, ttlSeconds);
+        memory.set(cacheRequest.url, {
+            expiresAt: now() + ttlSeconds * 1_000,
+            snapshot
+        });
+        if (edgeCache) {
+            const stored = await attempt(() => edgeCache.put(cacheRequest, responseFromSnapshot(snapshot)));
+            if (!stored.ok)
+                reportCacheError(stored.failure);
+        }
+        return { snapshot, status: 'MISS' };
+    };
+    return {
+        async respond(request, load, responseOptions = {}) {
+            if (request.method !== 'GET')
+                return load();
+            const cacheRequest = canonicalCacheRequest(request);
+            const memoryHit = memory.get(cacheRequest.url);
+            if (memoryHit && memoryHit.expiresAt > now()) {
+                return responseFromSnapshot(memoryHit.snapshot, 'HIT');
+            }
+            if (memoryHit)
+                memory.delete(cacheRequest.url);
+            const collapsed = inFlight.get(cacheRequest.url);
+            if (collapsed) {
+                const result = await collapsed;
+                return responseFromSnapshot(result.snapshot, 'COLLAPSED');
+            }
+            const resolving = resolveResponse(cacheRequest, load, responseOptions.edgeCache);
+            inFlight.set(cacheRequest.url, resolving);
+            try {
+                const result = await resolving;
+                return responseFromSnapshot(result.snapshot, result.status);
+            }
+            finally {
+                inFlight.delete(cacheRequest.url);
+            }
+        }
+    };
+}
+//# sourceMappingURL=jwks-response-cache.js.map

package/dist/server/jwks-response-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-response-cache.js","sourceRoot":"","sources":["../../src/server/jwks-response-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,MAAM,WAAW,GAAG,gFAAgF,CAAC;AAErG,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAsBhE,8EAA8E;AAC9E,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACnF,CAAC,CAAC;AAQH,8DAA8D;AAC9D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;AAyBrH,SAAS,qBAAqB,CAAC,OAAgB;IAC9C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACvC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyC,EAAE,KAAa;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gBAAgB,KAAK,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,OAAO,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,QAA0B,EAC1B,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAC/C,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,GAAG,KAAK,CAAC;IAC9F,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,6BAA6B,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,aAAa,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,SAAS,CAAC,oCAAoC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,8BAA8B,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;QACjC,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;QACpE,OAAO;YACN,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,SAAS;YACzB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,SAAS;YACzB,GAAG,SAAS;YACZ,GAAG,EAAE,GAAG,CAAC,EAAE;SACX,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAEhC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,2GAA2G;AAC3G,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACjF,CAAC,CAAC;AAEH,KAAK,UAAU,wBAAwB,CAAC,QAAkB;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,6FAA6F;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,QAAkB,EAClB,UAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CACV,eAAe,EACf,mBAAmB,UAAU,cAAc,UAAU,mBAAmB,CACxE,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,MAAM,QAAQ,CAAC,WAAW,EAAE;QAClC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA0B,EAC1B,WAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAChE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACP,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAoC,EAAE;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,OAAsB,EAAQ,EAAE;QACzD,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC5B,YAAqB,EACrB,IAA6B,EAC7B,SAAoC,EACR,EAAE;QAC9B,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;gBACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpD,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxE,OAAO,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBACxC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC5B,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,KAAK;oBACrC,QAAQ,EAAE,IAAI,CAAC,KAAK;iBACpB,CAAC,CAAC;gBACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACrD,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE;YAC5B,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,KAAK;YACrC,QAAQ;SACR,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,OAAO,CACZ,OAAgB,EAChB,IAA6B,EAC7B,kBAAuC,EAAE;YAEzC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE5C,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;gBAC9C,OAAO,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAE/C,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;gBAC/B,OAAO,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACjF,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;gBAC/B,OAAO,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC;oBAAS,CAAC;gBACV,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/jwt-session-handle.d.ts

@@ -0,0 +1,113 @@
+import { type JwtSessionFetcher, type DelegatedActorVerificationOptions, type DelegatedActorClaims, type DelegatedActorVerification } from '../schemas/session-verification.ts';
+export { delegatedActorClaimsSchema, delegatedActorVerificationSchema, delegatedActorVerificationSchema as DelegatedActorVerificationSchema } from '../schemas/session-verification.ts';
+export type { JwtSessionFetcher, OrgClaim, DelegatedActorVerificationOptions, DelegatedActorClaims, DelegatedActorVerification } from '../schemas/session-verification.ts';
+export { SessionJwtVerificationSchema, type SessionJwtVerification } from './session-verifier.ts';
+import type { Handle, RequestHandler, RequestEvent } from '@sveltejs/kit';
+import { type JWTPayload } from 'jose';
+import { type RequestPrincipal, type VibesRuntime } from '@vibesdotdev/kernel';
+import { type SessionJwtVerification } from './session-verifier.ts';
+/** Minimal fetcher shape; matches both `globalThis.fetch` and CF service-binding fetchers. */
+export interface JwtSessionHandleOptions {
+    authOrigin: string | ((event: RequestEvent) => string | Promise<string>);
+    clientName?: string;
+    /**
+     * Optional fetcher used to call auth endpoints such as `/api/session` and
+     * `/api/api-keys/validate`. When omitted, the handle looks for a Cloudflare
+     * service-binding registered under `serviceBindingName` (default
+     * `'AUTH_SERVICE'`) and uses its `.fetch` if found; otherwise it falls
+     * back to global `fetch`. NOTE: this override does NOT steer JWKS fetching —
+     * verification keys always come from the `AUTH_SERVICE` binding (the issuer
+     * worker) or, unbound, the public issuer origin (see the JWKS section below).
+     * Wrong keys fail verification safely, and `iss` is checked independently, so
+     * routing keys through the issuer binding is both correct and fast.
+     * Pass an explicit fetcher (or a getter that returns one) to override auth
+     * endpoint resolution — pass `null` to force the global-fetch path.
+     */
+    fetcher?: JwtSessionFetcher | (() => JwtSessionFetcher | undefined) | null;
+    /**
+     * Name of the runtime binding the handle should prefer for auth calls.
+     * Defaults to `'AUTH_SERVICE'`, which matches the convention used by
+     * each consumer app's `wrangler.jsonc`. Set to `null` to disable the
+     * binding lookup entirely.
+     */
+    serviceBindingName?: string | null;
+}
+/**
+ * Clear the JWKS cache. Test-only: tests that generate fresh key pairs need
+ * to bust the per-origin cache between cases, otherwise the first test's
+ * JWKS persists and subsequent verifies fail with "signature verification
+ * failed". Production code never needs this.
+ */
+export declare function _resetJwksCache(runtime: VibesRuntime): void;
+export declare function createJwtSessionHandle(options: JwtSessionHandleOptions): Handle;
+/**
+ * The request principal extractor for `createSvelteKitRuntime({ principal })`.
+ *
+ * Runs in `invocationHandle`, after {@link createJwtSessionHandle}, and reads
+ * only what that handle verified: the user from `locals.user` and the JWT from
+ * `locals.sessionToken`, which is the credential in force after a refresh. It
+ * never reads the `vibes.jwt` cookie, which can be the expired token the
+ * request arrived with (d48 revision). No verified user, or no token, is
+ * `{ kind: 'anonymous' }`.
+ */
+export declare function authRequestPrincipal(event: {
+    locals: object;
+}): RequestPrincipal;
+/**
+ * Create a same-origin route that binds an already verified bearer JWT as the
+ * host-only session cookie used by {@link createJwtSessionHandle}.
+ *
+ * The session handle must run before this route. It verifies the bearer against
+ * Auth's JWKS and populates `locals.user`; this handler refuses to write a
+ * cookie unless that verification succeeded. When the old cookie authenticated
+ * a renewal request, an explicit authOrigin lets it verify the new bearer too.
+ */
+export declare function createJwtSessionBindingHandler(options?: Pick<JwtSessionHandleOptions, 'authOrigin'> & {
+    /** Host admission for the exact verified bearer, before its cookie is written. */
+    admit?: (event: Parameters<RequestHandler>[0], principal: RequestPrincipal) => Promise<void>;
+}): RequestHandler;
+/**
+ * Verify a bearer against Auth, apply host admission, and write it as the
+ * host-only HttpOnly session cookie. Returns false when the bearer does not
+ * verify as a user session; admission refusals propagate from `admit`.
+ */
+export declare function bindVerifiedSessionJwt(event: Parameters<RequestHandler>[0], bearer: string, options: Pick<JwtSessionHandleOptions, 'authOrigin'> & {
+    admit?: (event: Parameters<RequestHandler>[0], principal: RequestPrincipal) => Promise<void>;
+}): Promise<boolean>;
+export declare function verifyBoundAuthJwt(token: string, authOrigin: string, fetcher: JwtSessionFetcher, options: {
+    viaServiceBinding?: boolean;
+    jwksFetchTimeoutMs: number;
+    runtime: VibesRuntime;
+}): Promise<JWTPayload>;
+/** The actor fields an org/tenant gate needs. Deliberately a SUBSET of the session user —
+ *  a delegated call proves who the end user is, not that they hold a live session here. */
+/**
+ * Verify a JWT that a TRUSTED internal service forwarded on an end user's behalf, and return
+ * only the claims a tenant gate reads.
+ *
+ * Why this exists. A service-to-service call (chat-web → ai-web's agent run/stream, the
+ * agent-execution tool) carries no session cookie, so `locals.user` is null and every
+ * org-scope check downstream sees a null actor. Two bad options follow from that: deny every
+ * org-scoped agent over the delegated path, or skip the tenant check for delegated callers —
+ * which reopens the IDOR the per-agent org gate exists to close, because the delegating
+ * surface applies no org gate of its own and the agent id is caller-controlled.
+ *
+ * The third option is this one: the delegating service already forwards the ACTOR'S OWN JWT
+ * (strip-protected, so staged or model-authored metadata cannot forge it), and that JWT
+ * carries the same `orgs` / `staff` claims `locals.user` is built from. Verifying it here
+ * gives the delegated path the SAME evidence the session path has, from the same issuer,
+ * through the same JWKS — rather than a second, weaker notion of "who is acting".
+ *
+ * Verification is the full session-handle path (issuer + `vibes-apps` audience + JWKS with
+ * kid-rotation retry); this is not a decode. Credential refusals return a typed invalid
+ * result. Revocation/JWKS dependency failures reject, preserving CapabilityError.
+ * The compatible nullable entrypoint below projects every unsuccessful result to null.
+ */
+export declare function verifyDelegatedActorClaimsResult(input: DelegatedActorVerificationOptions): Promise<DelegatedActorVerification>;
+/** Issuer endpoint projection. Decode only the exact token the full verifier just accepted. */
+export declare function verifySessionJwtResult(input: DelegatedActorVerificationOptions): Promise<SessionJwtVerification>;
+/** Compatibility projection: every unsuccessful verification remains nullable. */
+export declare function verifyDelegatedActorClaims(options: Parameters<typeof verifyDelegatedActorClaimsResult>[0]): Promise<DelegatedActorClaims | null>;
+/** Test-only cache reset for falsifiers that exercise repeated opaque bearers. */
+export declare function _resetApiKeyCache(runtime: VibesRuntime): void;
+//# sourceMappingURL=jwt-session-handle.d.ts.map

package/dist/server/jwt-session-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-session-handle.d.ts","sourceRoot":"","sources":["../../src/server/jwt-session-handle.ts"],"names":[],"mappings":"AACA,OAAO,EAA0E,KAAK,iBAAiB,EAAE,KAAK,iCAAiC,EAAoC,KAAK,oBAAoB,EAAE,KAAK,0BAA0B,EAAiF,MAAM,oCAAoC,CAAC;AACzW,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,IAAI,gCAAgC,EACpE,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iCAAiC,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAC3K,OAAO,EAAE,4BAA4B,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,KAAK,EAAW,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAwC,KAAK,UAAU,EAAsB,MAAM,MAAM,CAAC;AAEjG,OAAO,EAA2E,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAcxJ,OAAO,EAAqG,KAAK,sBAAsB,EAAkC,MAAM,uBAAuB,CAAC;AAOvM,8FAA8F;AAG9F,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAC3E;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAkPD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAK3D;AAiDD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAgJ/E;AAKD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAuBhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,YAAY,CAAC,GAAG;IACtG,kFAAkF;IAClF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F,GAAG,cAAc,CAqBjB;AAYD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC3C,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,YAAY,CAAC,GAAG;IACtD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F,GACC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAmVD,wBAAsB,kBAAkB,CACvC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACzF,OAAO,CAAC,UAAU,CAAC,CAuDrB;AAED;2FAC2F;AAG3F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gCAAgC,CACrD,KAAK,EAAE,iCAAiC,GACtC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC;AAED,+FAA+F;AAC/F,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAOtH;AAED,kFAAkF;AAClF,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAUtC;AAKD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAE7D"}