tapimo 0.15.0 → 0.18.0

package/dist/internal/Auth.js

@@ -15,11 +15,11 @@ import { tempoMainnet } from 'viem/tempo/chains';
 import * as z from 'zod/mini';
 import * as ApiKey from '../ApiKey.js';
 import * as ApiKeys from '../ApiKeys.js';
-import * as ApiKeyAdmissions from '../db/tables/apiKeyAdmissions.js';
-import * as ApiKeyOwnerTombstones from '../db/tables/apiKeyOwnerTombstones.js';
 import * as AuthAccounts from '../db/tables/authAccounts.js';
 import * as BetterAuth from './BetterAuth.js';
+import * as CliAuth from './CliAuth.js';
 import * as Db from '../db/Db.js';
+import * as ExecutionContext from './ExecutionContext.js';
 import * as Memberships from '../db/tables/memberships.js';
 import * as IpAllowlist from './IpAllowlist.js';
 import * as Metadata from '../apps/metadata.js';
@@ -35,11 +35,14 @@ import * as Timing from './Timing.js';
 import * as Users from '../db/tables/users.js';
 const policySymbol = Symbol('tempo-api.auth.policy');
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management');
+const trustedClientIps = new WeakMap();
 const defaultApiKeyRateLimit = { limit: 10_000, period: 'minute' };
 const defaultIdentitySessionTtl = 24 * 60 * 60;
 const defaultMppRateLimit = { limit: 100, period: 'minute' };
 const defaultPublicRateLimit = { limit: 60, period: 'minute' };
 const identityCookieName = 'tempo_identity';
+const privacyUrl = 'https://tempo.xyz/privacy-policy/';
+const termsUrl = 'https://console.tempo.xyz/legal/terms';
 const walletIdentityIssuer = 'https://wallet.tempo.xyz/api/oidc';
 function isIdentityTokenError(error) {
     return (error instanceof jose.errors.JOSEAlgNotAllowed ||
@@ -56,6 +59,15 @@ function isIdentityTokenError(error) {
 export function getPrincipal(c) {
     return c.get('principal') ?? null;
 }
+/** Resolves the caller IP from configured trusted metadata. */
+export function getTrustedClientIp(c) {
+    const auth = c.get('auth');
+    return auth ? trustedClientIp(c, auth) : resolveTrustedClientIp(c.req.raw, undefined);
+}
+/** Marks a synthesized in-process request with its trusted caller IP address. */
+export function trustClientIp(request, address) {
+    trustedClientIps.set(request, address);
+}
 /**
  * Guards `:orgId` routes and resolves the organization. Sessions require membership, API keys require ownership, and the super admin bypasses ownership.
  */
@@ -351,13 +363,15 @@ function createAuthMiddleware(options, resolve) {
                     ...(sessionChainIds ? { sessionChainIds: new Set(sessionChainIds) } : {}),
                 },
             }),
-        rateLimit: RateLimit.memory(options.rateLimit),
+        rateLimit: rateLimitStore(options.rateLimit),
         ...(options.session ? { session: options.session } : {}),
         ...(options.superAdmin?.secret
             ? { superAdmin: { tokenHash: ApiKey.hash(options.superAdmin.secret) } }
             : {}),
     };
     return createMiddleware((c, next) => {
+        // Every route records its credential, including unprotected and unmatched paths.
+        recordCredential(c, getApiKeyCredential(c));
         const resolved = resolveRequestPolicy(c, { base, defaults, options });
         if (!resolved)
             return next();
@@ -386,7 +400,9 @@ function resolveRequestPolicy(c, options) {
         const inheritedKey = `${inheritedMethod.toUpperCase()} ${key.slice(key.indexOf(' ') + 1)}`;
         return overrides?.[inheritedKey];
     })();
-    const routeOverride = management && configuredOverride ? { mpp: configuredOverride.mpp } : configuredOverride;
+    // Generated management routes already materialize the GET's MPP contract.
+    // Reapplying its override would also copy GET-only quota controls.
+    const routeOverride = management ? undefined : configuredOverride;
     return {
         management,
         policy: bindMppScope(resolvePolicy(options.base, options.defaults, [...routePolicies, routeOverride], description), scope),
@@ -394,15 +410,28 @@ function resolveRequestPolicy(c, options) {
 }
 function createApiKeyResolver(options) {
     const requests = new WeakMap();
-    const uncached = (c, token) => {
+    // Requests whose key came from KV in this request: `ApiKeys.resolve` already
+    // read the fences, so reading them again adds a round trip and nothing else.
+    const fenced = new WeakMap();
+    const uncached = async (c, token) => {
         const kv = contextKv(c);
-        return kv
-            ? ApiKeys.resolve(kv.store, token, { scopeCatalog: options.scopeCatalog })
-            : Promise.resolve(null);
+        if (!kv)
+            return null;
+        const apiKey = await ApiKeys.resolve(kv.store, token, { scopeCatalog: options.scopeCatalog });
+        fenced.set(c, ApiKey.hash(token));
+        return apiKey;
     };
     const cache = options.apiKey === false || options.apiKey?.cache === false
         ? { invalidate: () => { }, peek: () => undefined, resolve: uncached }
         : cachedResolve(uncached, options.apiKey?.cache ?? {});
+    // A cached record still checks its fences every request, so revocation and
+    // owner deletion never wait for the isolate cache to expire.
+    const active = async (c, token, apiKey) => {
+        const kv = contextKv(c);
+        if (!apiKey || !kv || fenced.get(c) === ApiKey.hash(token))
+            return apiKey;
+        return (await ApiKeys.isFenced(kv.store, apiKey)) ? null : apiKey;
+    };
     return {
         peek: (c, token) => {
             const tokenHash = ApiKey.hash(token);
@@ -411,18 +440,17 @@ function createApiKeyResolver(options) {
                 return existing.apiKey;
             return cache.peek(token);
         },
+        probe: async (c, token) => {
+            // Probes must not warm the resolution cache before rate-limit admission.
+            return active(c, token, await uncached(c, token));
+        },
         resolve: async (c, token) => {
             const tokenHash = ApiKey.hash(token);
             const existing = requests.get(c);
             if (existing?.tokenHash === tokenHash)
                 return existing.apiKey;
             const cached = await cache.resolve(c, token);
-            const kv = contextKv(c);
-            const apiKey = cached &&
-                ((kv && (await ApiKeys.isOwnerDeleted(kv.store, cached))) ||
-                    !(await apiKeyOwnerExists(cached, options.db)))
-                ? null
-                : cached;
+            const apiKey = await active(c, token, cached);
             if (cached && !apiKey)
                 cache.invalidate(token);
             requests.set(c, { apiKey, tokenHash });
@@ -430,17 +458,6 @@ function createApiKeyResolver(options) {
         },
     };
 }
-/** Rejects attributed keys fenced by a committed owner deletion. */
-async function apiKeyOwnerExists(apiKey, source) {
-    if (!source)
-        return true;
-    const db = Db.get(source);
-    if (!(await ApiKeyAdmissions.matches(db, apiKey)))
-        return false;
-    if (await ApiKeyOwnerTombstones.isDeleted(db, apiKey))
-        return false;
-    return true;
-}
 /** Zod schemas documenting the session sign-in surface. */
 var schema;
 (function (schema) {
@@ -534,7 +551,7 @@ export function install(options) {
             get email() {
                 return options.email();
             },
-            rateLimit: RateLimit.memory(options_middleware.rateLimit),
+            rateLimit: rateLimitStore(options_middleware.rateLimit),
             secret: options_session.secret,
             ...(options_session.google ? { google: options_session.google } : {}),
             ...(options_session.trustedOrigins
@@ -579,7 +596,10 @@ export function install(options) {
                     return value === null ? undefined : JSON.parse(value);
                 },
                 async set(key, value, options) {
-                    await kv.store.put(`auth:${key}`, JSON.stringify(value), options?.ttl ? { ttl: options.ttl * 1_000 } : {});
+                    const payload = key.startsWith('session:')
+                        ? { ...value, ...(await bindWalletSession(value)) }
+                        : value;
+                    await kv.store.put(`auth:${key}`, JSON.stringify(payload), options?.ttl ? { ttl: options.ttl * 1_000 } : {});
                 },
             },
             ...(ttl ? { ttl } : {}),
@@ -616,8 +636,51 @@ export function install(options) {
                 return { email: verifiedEmail ?? user.email ?? undefined, user };
             });
         }
+        async function bindWalletSession(payload) {
+            const user = await resolveWallet(payload);
+            if (!user)
+                throw new Error('Authenticated wallet user was not found');
+            if (!user.user.termsSharedAt)
+                await Users.recordTermsShared(Db.get(db), user.user.id);
+            return { email: user.email, userId: user.user.id };
+        }
+        async function resolveWalletSession(payload) {
+            // Legacy sessions cannot be safely rebound after an email or wallet reassignment.
+            if (!payload.userId)
+                return null;
+            const database = Db.get(db);
+            const [user, linkedUserId] = await Promise.all([
+                Users.get(database, payload.userId),
+                AuthAccounts.getWalletUserId(database, payload.address),
+            ]);
+            if (!user || linkedUserId !== payload.userId)
+                return null;
+            if (payload.email && (user.email !== payload.email || !user.emailVerified))
+                return null;
+            return { email: user.emailVerified ? user.email : undefined, user };
+        }
+        // CLI sessions act as the approving user; the principal's identity names the
+        // CLI session so handlers never mistake it for a wallet sign-in.
+        const resolveCli = async (token) => {
+            const record = await CliAuth.resolve(kv.store, token);
+            if (!record)
+                return null;
+            const user = await Users.get(Db.get(db), record.userId);
+            if (!user)
+                return null;
+            return {
+                cli: { expiresAt: record.expiresAt, scopes: record.scopes ?? [] },
+                ...(user.emailVerified && user.email ? { email: user.email } : {}),
+                id: user.id,
+                identity: { provider: 'cli', subject: record.id },
+                type: 'session',
+            };
+        };
         const session = {
             resolve: async (c) => {
+                const bearer = /^Bearer\s+(.+)$/i.exec(c.req.header('authorization') ?? '')?.[1];
+                if (bearer && CliAuth.isToken(bearer))
+                    return resolveCli(bearer);
                 const [betterAuth, identitySession, wallet] = await Promise.all([
                     (async () => {
                         const auth = BetterAuth.fromContext(c, options_betterAuth);
@@ -651,7 +714,7 @@ export function install(options) {
                         const payload = JSON.parse(value);
                         if (payload.expiresAt <= Math.floor(Date.now() / 1_000))
                             return null;
-                        const user = await resolveWallet(payload);
+                        const user = await resolveWalletSession(payload);
                         if (!user)
                             return null;
                         return {
@@ -665,7 +728,7 @@ export function install(options) {
                         const payload = await handler.getSession(c.req.raw);
                         if (!payload)
                             return null;
-                        const user = await resolveWallet(payload);
+                        const user = await resolveWalletSession(payload);
                         if (!user)
                             return null;
                         return {
@@ -688,6 +751,11 @@ export function install(options) {
         const policy_public = policy({ public: true });
         const describe = OpenApi.describeRoute({ hide: true });
         const app = new Hono()
+            .use('*', async (c, next) => {
+            await next();
+            c.header('Tempo-Terms-URL', termsUrl);
+            c.header('Tempo-Privacy-URL', privacyUrl);
+        })
             .use('/v1/auth/siwe', policy_public, describe)
             .use('/v1/auth/siwe/*', policy_public, describe);
         // Documented operations: pre-routes carrying the OpenAPI metadata and the
@@ -782,11 +850,12 @@ export function install(options) {
                     });
                 const address = Address.checksum(claims.subject);
                 await Users.upsertByAddress(Db.get(db), { address });
+                const binding = await bindWalletSession({ address, email: claims.email });
                 const issuedAt = Math.floor(Date.now() / 1_000);
                 const token = Hex.fromBytes(crypto.getRandomValues(new Uint8Array(32))).slice(2);
                 await kv.store.put(identitySessionKey(token), JSON.stringify({
                     address,
-                    ...(claims.email ? { email: claims.email } : {}),
+                    ...binding,
                     expiresAt: issuedAt + identitySessionTtl,
                     issuedAt,
                 }), { ttl: identitySessionTtl * 1_000 });
@@ -802,10 +871,12 @@ export function install(options) {
         app.post('/v1/auth/logout', policy(false), createMiddleware(async (c, next) => {
             const auth = c.get('auth');
             const principal = principalFromPublic(c, auth);
-            const result = await consumeRateLimit(auth, {
+            const result = await Timing.time(c, 'rate_limit', () => consumeRateLimit(auth, {
                 key: `public:${principal.id}`,
                 limit: auth.publicRateLimit ?? defaultPublicRateLimit,
-            });
+                principal: `public:${principal.id}`,
+                waitUntil: ExecutionContext.waitUntil(c),
+            }));
             if (result) {
                 setRateLimitHeaders(c, result);
                 if (!result.allowed)
@@ -815,7 +886,7 @@ export function install(options) {
             await next();
             return undefined;
         }), OpenApi.describeRoute({
-            description: 'Revokes auth sessions and clears their cookies.',
+            description: 'Revokes auth sessions and clears their cookies. A CLI session sent as `Authorization: Bearer` is revoked on its own.',
             hide: false,
             operationId: 'logout',
             responses: {
@@ -826,6 +897,22 @@ export function install(options) {
             summary: 'Sign out',
             tags: ['Authentication'],
         }), async (c) => {
+            // A CLI session carries only its bearer token; revoke it and leave browser sessions alone.
+            const bearer = /^Bearer\s+(.+)$/i.exec(c.req.header('authorization') ?? '')?.[1];
+            if (bearer && CliAuth.isToken(bearer)) {
+                try {
+                    await CliAuth.revoke(kv.store, bearer);
+                }
+                catch (cause) {
+                    c.error = cause instanceof Error ? cause : new Error('CLI logout failed', { cause });
+                    return Response.error(c, {
+                        code: 'session_logout_failed',
+                        message: 'Session logout failed',
+                        status: 500,
+                    });
+                }
+                return c.body(null, 204);
+            }
             const walletHeaders = (() => {
                 const authorization = c.req.header('authorization');
                 const cookie = c.req.header('cookie');
@@ -906,7 +993,7 @@ export function install(options) {
         Metadata.attach(app, {
             securitySchemes: {
                 session: {
-                    description: 'Session cookie established by email OTP, Wallet identity, or SIWE sign-in. Browsers send `tempo_auth.session_token`, `tempo_identity`, or `accounts_auth`; Accounts sessions may also use `Authorization: Bearer <token>`.', // prettier-ignore
+                    description: 'Session cookie established by email OTP, Wallet identity, or SIWE sign-in. Browsers send `tempo_auth.session_token`, `tempo_identity`, or `accounts_auth`; Accounts sessions may also use `Authorization: Bearer <token>`, and CLI sessions always use `Authorization: Bearer tempo:cli:…`.', // prettier-ignore
                     in: 'header',
                     name: 'Cookie',
                     type: 'apiKey',
@@ -917,7 +1004,6 @@ export function install(options) {
     })();
     const resolve = createApiKeyResolver({
         apiKey: options_middleware.apiKey,
-        db: options.db,
         scopeCatalog,
     });
     const defaults = laneDefaults(options_middleware);
@@ -930,12 +1016,15 @@ export function install(options) {
             : undefined;
         return createMiddleware(async (c, next) => {
             const credential = getApiKeyCredential(c);
+            recordCredential(c, credential);
             const resolved = resolveRequestPolicy(c, { base, defaults, options: options_middleware });
             const isSuperAdmin = credential &&
                 superAdminTokenHash !== undefined &&
                 ApiKey.hash(credential.token) === superAdminTokenHash;
+            // CLI session tokens are never API keys, so they skip key resolution here too.
             const canUseApiKeyQuota = credential &&
                 !isSuperAdmin &&
+                !CliAuth.isToken(credential.token) &&
                 !hasPaymentCredential(c) &&
                 options_middleware.apiKey !== false &&
                 resolved?.policy?.apiKey &&
@@ -943,11 +1032,20 @@ export function install(options) {
             const cached = canUseApiKeyQuota ? resolve.peek(c, credential.token) : undefined;
             if (cached)
                 return next();
-            const response = await Timing.time(c, 'edge_rate_limit', () => options_edgeRateLimit(c.req.raw));
+            const response = await Timing.time(c, 'edge_rate_limit', () => options_edgeRateLimit(c.req.raw, canUseApiKeyQuota
+                ? {
+                    resolvePartition: async () => {
+                        const apiKey = cached === undefined ? await resolve.probe(c, credential.token) : cached;
+                        // Rotating invalid credentials stays in the anonymous transport bucket.
+                        return apiKey ? `api-key:${ApiKey.hash(credential.token)}` : undefined;
+                    },
+                }
+                : {}));
             if (response)
                 return response;
+            // Cold keys resolve here, ahead of the auth lane, so time both under one name.
             if (canUseApiKeyQuota && cached === undefined)
-                await resolve.resolve(c, credential.token);
+                await Timing.sum(c, 'auth_key', () => resolve.resolve(c, credential.token));
             return next();
         });
     })();
@@ -1026,7 +1124,9 @@ export function installMppManagementRoutes(app, options = {}) {
             continue;
         if (postPaths.has(target.path))
             throw new Error(`MPP management POST conflicts with an existing route: ${target.path}`);
-        const management = policy({ mpp });
+        const management = policy({
+            mpp: { session: mpp.session },
+        });
         management[mppManagementSymbol] = { description: target.description };
         app.post(stripBasePath(target.path, options.basePath), management, OpenApi.describeRoute({ hide: true }));
     }
@@ -1101,6 +1201,7 @@ function resolveApiKeyLane(current, override, default_) {
         return current ?? default_;
     const base = current ?? default_;
     return {
+        bucket: override.bucket ?? base.bucket,
         rateLimit: override.rateLimit ?? base.rateLimit,
         scopes: override.scopes ?? base.scopes,
     };
@@ -1114,6 +1215,7 @@ function resolveMppLane(current, override, default_) {
         return current ?? default_;
     const base = current ?? default_;
     return {
+        bucket: override.bucket ?? base.bucket,
         rateLimit: override.rateLimit ?? base.rateLimit,
         session: { ...base.session, ...override.session },
     };
@@ -1126,7 +1228,10 @@ function resolvePublicLane(current, override, default_) {
     if (override === true)
         return current ?? default_;
     const base = current ?? default_;
-    return { rateLimit: override.rateLimit ?? base.rateLimit };
+    return {
+        bucket: override.bucket ?? base.bucket,
+        rateLimit: override.rateLimit ?? base.rateLimit,
+    };
 }
 function resolveSessionLane(current, override, default_) {
     if (override === undefined)
@@ -1273,6 +1378,7 @@ export function require(policy) {
     return createMiddleware(async (c, next) => {
         const auth = c.get('auth');
         const credential = getApiKeyCredential(c);
+        recordCredential(c, credential);
         const hasQueryApiKey = new URL(c.req.url).searchParams.has('key');
         // Auth owns `key`; strict route schemas must not validate it.
         stripApiKeyQuery(c);
@@ -1312,7 +1418,11 @@ export function require(policy) {
                 c.set('principal', { actor: 'super_admin', id: 'super_admin', type: 'super_admin' });
                 return proceed();
             }
-            const apiKey_resolved = await auth.apiKey?.resolve(c, credential.token);
+            // CLI session tokens are prefixed, so they skip the API-key lookup.
+            const cliToken = CliAuth.isToken(credential.token);
+            const apiKey_resolved = cliToken
+                ? null
+                : await Timing.sum(c, 'auth_key', () => auth.apiKey?.resolve(c, credential.token));
             if (!apiKey_resolved) {
                 if (unsupportedChain)
                     return Response.unsupportedChainId(c, unsupportedChain.chainId, unsupportedChain.supportedChainIds);
@@ -1326,6 +1436,18 @@ export function require(policy) {
                         return proceed();
                     }
                 }
+                if (cliToken)
+                    return jsonError(c, policy.session
+                        ? {
+                            code: 'session_invalid',
+                            message: 'CLI session is invalid or expired. Sign in again.',
+                            status: 401,
+                        }
+                        : {
+                            code: 'forbidden',
+                            message: 'CLI sessions cannot call this route. Use an API key.',
+                            status: 403,
+                        });
                 return jsonError(c, {
                     code: 'api_key_invalid',
                     message: 'Invalid API key',
@@ -1360,12 +1482,15 @@ export function require(policy) {
                 ? (policy.public?.rateLimit ?? auth.publicRateLimit ?? { limit: 60, period: 'minute' })
                 : resolveApiKeyLimit({ apiKey, auth, policy: policy.apiKey, scope });
             const paid = hasPayment && !throttled;
+            const bucket = policy.apiKey.bucket;
             const result = paid
                 ? null
-                : await consumeRateLimit(auth, {
-                    key: `api_key:${apiKey.id}:scope:${scope}`,
+                : await Timing.time(c, 'rate_limit', () => consumeRateLimit(auth, {
+                    key: rateLimitKey(`api_key:${apiKey.id}:scope:${scope}`, bucket),
                     limit,
-                });
+                    principal: `api_key:${apiKey.id}`,
+                    waitUntil: ExecutionContext.waitUntil(c),
+                }));
             if (result) {
                 setRateLimitHeaders(c, result);
                 // Surface the bucket so callers can correlate a 429 with the exhausted
@@ -1398,7 +1523,7 @@ export function require(policy) {
             if (missing.length > 0)
                 return jsonError(c, {
                     code: 'api_key_forbidden',
-                    message: 'API key missing required scope',
+                    message: `API key is missing required permissions: ${missing.join(', ')}. Use an API key with these scopes.`,
                     status: 403,
                 });
             if (paid)
@@ -1445,10 +1570,12 @@ export function require(policy) {
         }
         const limit = policy.public?.rateLimit;
         if (limit) {
-            const result = await consumeRateLimit(auth, {
-                key: `public:${publicPrincipal.id}`,
+            const result = await Timing.time(c, 'rate_limit', () => consumeRateLimit(auth, {
+                key: rateLimitKey(`public:${publicPrincipal.id}`, policy.public?.bucket),
                 limit,
-            });
+                principal: `public:${publicPrincipal.id}`,
+                waitUntil: ExecutionContext.waitUntil(c),
+            }));
             if (result)
                 setRateLimitHeaders(c, result);
             if (!result || result.allowed) {
@@ -1489,6 +1616,10 @@ export function require(policy) {
  * server-side — we just stop waiting for it.
  */
 const rateLimitConsumeTimeout = 300;
+/** Accepts a ready store or builds the counter-backed default from its options. */
+function rateLimitStore(options) {
+    return options && 'consume' in options ? options : RateLimit.memory(options);
+}
 /** Consumes one quota and returns null when its counter is unavailable, allowing callers to fail open. */
 export function consumeRateLimit(auth, options) {
     if (!auth.rateLimit)
@@ -1572,11 +1703,20 @@ function getApiKeyCredential(c) {
         return { token: apiKey };
     return null;
 }
+// Recorded before any lookup: requests that stall or are canceled during
+// resolution never receive a principal, but still need caller attribution.
+function recordCredential(c, credential) {
+    if (credential)
+        c.set('credential', 'api_key');
+    else if (hasPaymentCredential(c))
+        c.set('credential', 'payment');
+}
 function clientIp(c, auth) {
-    return auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip');
+    return (trustedClientIps.get(c.req.raw) ??
+        (auth.publicClientIp ? auth.publicClientIp(c.req.raw) : c.req.header('cf-connecting-ip')));
 }
 function trustedClientIp(c, auth) {
-    return resolveTrustedClientIp(c.req.raw, auth.publicClientIp);
+    return trustedClientIps.get(c.req.raw) ?? resolveTrustedClientIp(c.req.raw, auth.publicClientIp);
 }
 function resolveTrustedClientIp(request, resolve) {
     if (resolve)
@@ -1697,10 +1837,12 @@ function principalFromPublic(c, auth) {
 }
 async function requirePayment(c, next, options) {
     if (hasPaymentCredential(c)) {
-        const result = await consumeRateLimit(options.auth, {
-            key: `mpp:${options.principal.type}:${options.principal.id}`,
+        const result = await Timing.time(c, 'rate_limit', () => consumeRateLimit(options.auth, {
+            key: rateLimitKey(`mpp:${options.principal.type}:${options.principal.id}`, options.policy.mpp?.bucket),
             limit: options.policy.mpp?.rateLimit ?? options.auth.mpp?.rateLimit ?? defaultMppRateLimit,
-        });
+            principal: `mpp:${options.principal.type}:${options.principal.id}`,
+            waitUntil: ExecutionContext.waitUntil(c),
+        }));
         if (result) {
             setRateLimitHeaders(c, result);
             c.header('RateLimit-Scope', 'mpp');
@@ -1748,6 +1890,9 @@ function requirePaymentOrRateLimit(c, next, options) {
         return requirePayment(c, next, options);
     return rateLimitExceeded(c, options.rateLimit);
 }
+function rateLimitKey(key, bucket) {
+    return bucket === undefined ? key : `${key}:bucket:${bucket}`;
+}
 /** Emits a `429` with a `Retry-After` derived from the window reset. */
 function rateLimitExceeded(c, result) {
     c.header('Retry-After', String(Math.max(result.reset - Math.ceil(Date.now() / 1_000), 1)));
@@ -1778,18 +1923,12 @@ async function resolveSession(c, auth) {
 /** Maximum resolve-cache entries held per isolate before eviction. */
 const cachedMaxEntries = 10_000;
 /**
- * Wraps token resolution with a short-TTL per-isolate cache so hot keys skip
- * the backend read on every request. Positive results cache for `ttl`
- * (default 60s), negative for `negativeTtl` (default 10s) so a freshly minted
- * key is usable quickly; concurrent misses for one token are single-flighted.
- * Entries are keyed by the token's sha256 (`ApiKey.hash`) — never the
- * plaintext. Key updates may remain stale for up to `ttl`, the accepted
- * trade-off for removing a backend read from the auth path.
+ * Caches completed resolutions per isolate by token hash, with positive and negative TTLs.
+ * Each miss resolves independently so callers never await another request's pending I/O.
  */
-function cachedResolve(resolve, options) {
+export function cachedResolve(resolve, options) {
     const { negativeTtl = 10_000, now = Date.now, ttl = 60_000 } = options;
     const cells = new Map();
-    const flights = new Map();
     return {
         invalidate(token) {
             cells.delete(`v1:${ApiKey.hash(token)}`);
@@ -1812,31 +1951,19 @@ function cachedResolve(resolve, options) {
                 return cell.value;
             if (cell)
                 cells.delete(key);
-            const existing = flights.get(key);
-            if (existing)
-                return existing;
-            const flight = (async () => {
-                const value = await resolve(c, token);
-                // Bound the cache: random invalid tokens each add a (negative) entry,
-                // so sweep expired cells at the cap and then drop the oldest.
-                if (cells.size >= cachedMaxEntries) {
-                    const time = now();
-                    for (const [name, entry] of cells)
-                        if (entry.expiresAt <= time)
-                            cells.delete(name);
-                    while (cells.size >= cachedMaxEntries)
-                        cells.delete(cells.keys().next().value);
-                }
-                cells.set(key, { expiresAt: now() + (value ? ttl : negativeTtl), value });
-                return value;
-            })();
-            flights.set(key, flight);
-            try {
-                return await flight;
-            }
-            finally {
-                flights.delete(key);
+            const value = await resolve(c, token);
+            // Bound the cache: random invalid tokens each add a (negative) entry,
+            // so sweep expired cells at the cap and then drop the oldest.
+            if (cells.size >= cachedMaxEntries) {
+                const time = now();
+                for (const [name, entry] of cells)
+                    if (entry.expiresAt <= time)
+                        cells.delete(name);
+                while (cells.size >= cachedMaxEntries)
+                    cells.delete(cells.keys().next().value);
             }
+            cells.set(key, { expiresAt: now() + (value ? ttl : negativeTtl), value });
+            return value;
         },
     };
 }