@atlasauth/backend 0.29.0 → 0.30.0

package/dist/rp.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIRM_NOW_WINDOW_SECONDS = exports.usedMultiFactor = exports.authenticatedWithin = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.BACKCHANNEL_LOGOUT_EVENT = exports.AtlasApiError = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcCallback = exports.isSafeReturnTo = exports.AtlasOidcError = void 0;
+exports.createRelyingParty = createRelyingParty;
+/**
+ * `@atlasauth/backend/rp`: the server-side relying party for the hosted
+ * redirect, as `(Request) => Response` handlers for any framework.
+ *
+ *   const rp = createRelyingParty({ issuer, clientId, clientSecret, redirectUri, secret, secretKey });
+ *   app.get('/auth/sign-in', (req) => rp.start(req));
+ *   app.get('/auth/callback', async (req) => {
+ *     const { user, response } = await rp.callback(req);
+ *     // create your session for user.sub, keep user.sid on it, then:
+ *     response.headers.append('set-cookie', yourSessionCookie);
+ *     return response;
+ *   });
+ *
+ * This entry point loads only Web standards (fetch, Web Crypto, Request,
+ * Response, URL) and `jose`, itself Web Crypto only: no `Buffer`, no
+ * `node:*`. It runs unchanged on Node 18+, Deno, Bun and Workers. The full
+ * `@atlasauth/backend` entry (management client, migration bridges, ...) is
+ * never pulled in.
+ *
+ * Everything here is a thin layer over `oidc.start` / `oidc.callback` (state,
+ * nonce and PKCE S256 in one sealed short-lived cookie; ID-token checks with the
+ * algorithm pinned, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`, `at_hash`) plus
+ * the Atlas session calls a relying party that keeps its own session needs:
+ * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
+ * (`POST /v1/sessions/{id}/revoke`).
+ */
+const oidc_1 = require("./oidc");
+const error_1 = require("./client/error");
+const request_1 = require("./client/request");
+var oidc_2 = require("./oidc");
+Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_2.AtlasOidcError; } });
+Object.defineProperty(exports, "isSafeReturnTo", { enumerable: true, get: function () { return oidc_2.isSafeReturnTo; } });
+Object.defineProperty(exports, "oidcCallback", { enumerable: true, get: function () { return oidc_2.oidcCallback; } });
+Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_2.oidcLogoutUrl; } });
+Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_2.oidcStart; } });
+Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_2.oidcVerifyIdToken; } });
+Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_2.resetOidcCaches; } });
+var error_2 = require("./client/error");
+Object.defineProperty(exports, "AtlasApiError", { enumerable: true, get: function () { return error_2.AtlasApiError; } });
+// Back-channel logout: verify the logout_token (typ logout+jwt, events, no nonce, sid/sub, jti replay hook).
+var logout_token_1 = require("./logout-token");
+Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
+Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
+Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
+Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
+var backchannel_handlers_1 = require("./backchannel-handlers");
+Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.expressBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogoutPlugin; } });
+Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fetchBackchannelLogout; } });
+Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.handleBackchannelLogout; } });
+// Webhooks, verified with Web Crypto.
+var webhook_common_1 = require("./webhook-common");
+Object.defineProperty(exports, "ATLAS_WEBHOOK_HEADERS", { enumerable: true, get: function () { return webhook_common_1.ATLAS_WEBHOOK_HEADERS; } });
+var webhooks_web_1 = require("./webhooks-web");
+Object.defineProperty(exports, "verifyAtlasWebhook", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhook; } });
+Object.defineProperty(exports, "verifyAtlasWebhookRequest", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhookRequest; } });
+var recent_auth_1 = require("./recent-auth");
+Object.defineProperty(exports, "authenticatedWithin", { enumerable: true, get: function () { return recent_auth_1.authenticatedWithin; } });
+Object.defineProperty(exports, "usedMultiFactor", { enumerable: true, get: function () { return recent_auth_1.usedMultiFactor; } });
+const PASSTHROUGH = [
+    ['prompt', 'prompt'],
+    ['login_hint', 'loginHint'],
+    ['ui_locales', 'uiLocales'],
+    ['organization', 'organization'],
+    ['return_to', 'returnTo'],
+];
+const DEFAULT_TOUCH_INTERVAL_MS = 5 * 60_000;
+/** How long a `requireRecentAuth(…, 0)` confirmation counts, in seconds. */
+exports.CONFIRM_NOW_WINDOW_SECONDS = 60;
+/** Create the relying party once, at startup; reuse it for every request. */
+function createRelyingParty(config) {
+    if (typeof config.secret !== 'string' || config.secret.length < 32) {
+        throw new TypeError('createRelyingParty: `secret` (at least 32 characters) is required to seal the sign-in cookie.');
+    }
+    const afterSignIn = config.afterSignInPath ?? '/';
+    if (!(0, oidc_1.isSafeReturnTo)(afterSignIn))
+        throw new TypeError('createRelyingParty: `afterSignInPath` must be a path starting with a single `/`.');
+    const base = {
+        issuer: config.issuer,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        secret: config.secret,
+        cookieName: config.cookieName ?? oidc_1.OIDC_FLOW_COOKIE,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+    };
+    const clock = () => (config.now ?? Date.now)();
+    const doFetch = (input, init) => (config.fetchImpl ?? fetch)(input, init);
+    const interval = config.touchIntervalMs ?? DEFAULT_TOUCH_INTERVAL_MS;
+    async function start(request, overrides = {}) {
+        const query = new URL(request.url).searchParams;
+        const fromQuery = {};
+        for (const [param, key] of PASSTHROUGH) {
+            const v = query.get(param);
+            // A bad return_to from the query is dropped, never an error page.
+            if (v && (key !== 'returnTo' || (0, oidc_1.isSafeReturnTo)(v)))
+                fromQuery[key] = v;
+        }
+        const maxAge = query.get('max_age');
+        if (maxAge !== null && /^\d{1,9}$/.test(maxAge))
+            fromQuery.maxAge = Number(maxAge);
+        const { url, cookie } = await (0, oidc_1.oidcStart)({ ...base, scope: config.scope, ...fromQuery, ...overrides });
+        return redirect(url, [cookie]);
+    }
+    async function callback(request) {
+        const identity = await (0, oidc_1.oidcCallback)({
+            ...base,
+            clientSecret: config.clientSecret,
+            clientAuth: config.clientAuth,
+            query: new URL(request.url).searchParams,
+            cookie: request.headers.get('cookie'),
+        });
+        const c = identity.claims;
+        const user = {
+            sub: identity.sub,
+            sid: identity.sid,
+            email: identity.email,
+            email_verified: identity.emailVerified,
+            name: identity.name,
+            ...(typeof c.external_id === 'string' && c.external_id ? { external_id: c.external_id } : {}),
+            ...(identity.organization ? { org_id: identity.organization.id, org_role: identity.organization.role } : {}),
+            auth_time: identity.authTime,
+        };
+        const tokens = {
+            id_token: identity.idToken,
+            access_token: identity.accessToken,
+            ...(identity.refreshToken ? { refresh_token: identity.refreshToken } : {}),
+            expires_at: identity.expiresAt,
+        };
+        return { user, tokens, identity, response: redirect(identity.returnTo ?? afterSignIn, [identity.clearCookie]) };
+    }
+    async function requireRecentAuth(request, maxAgeSeconds, options) {
+        if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds < 0) {
+            throw new TypeError('requireRecentAuth: `maxAgeSeconds` must be a whole number of seconds, 0 or more.');
+        }
+        if (typeof options?.sub !== 'string' || !options.sub)
+            throw new TypeError('requireRecentAuth: `sub` is required.');
+        const at = options.authTime;
+        // 0 means "confirm now": it still passes for a minute after the confirmation,
+        // or the request that comes back from it would be sent to confirm again, forever.
+        const allowed = maxAgeSeconds === 0 ? exports.CONFIRM_NOW_WINDOW_SECONDS : maxAgeSeconds;
+        if (typeof at === 'number' && Number.isFinite(at) && clock() / 1000 - at <= allowed)
+            return null;
+        const here = new URL(request.url);
+        const returnTo = options.returnTo ?? `${here.pathname}${here.search}`;
+        const { url, cookie } = await (0, oidc_1.oidcStart)({
+            ...base,
+            scope: config.scope,
+            maxAge: maxAgeSeconds,
+            expectedSub: options.sub,
+            ...(maxAgeSeconds === 0 ? { prompt: 'login' } : {}),
+            ...((0, oidc_1.isSafeReturnTo)(returnTo) ? { returnTo } : {}),
+        });
+        return redirect(url, [cookie]);
+    }
+    function sessionCall(sid, action) {
+        if (!config.secretKey)
+            throw new TypeError(`${action === 'touch' ? 'touchIfDue' : 'revokeSession'}: \`secretKey\` is not configured.`);
+        if (typeof sid !== 'string' || !sid)
+            throw new TypeError('A session id (`sid`) is required.');
+        const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/sessions/${encodeURIComponent(sid)}/${action}`;
+        return doFetch(url, { method: 'POST', headers: { authorization: `Bearer ${config.secretKey}`, accept: 'application/json' } });
+    }
+    async function touchIfDue(sid, lastTouchedAt) {
+        const now = clock();
+        if (typeof lastTouchedAt === 'number' && now - lastTouchedAt < interval && now >= lastTouchedAt) {
+            return { status: 'skipped', lastTouchedAt };
+        }
+        const res = await sessionCall(sid, 'touch');
+        const body = (await res.json().catch(() => null));
+        if (res.ok) {
+            return { status: 'touched', lastTouchedAt: now, idleExpiresAt: typeof body?.idle_expires_at === 'string' ? body.idle_expires_at : null };
+        }
+        if (res.status === 404)
+            return { status: 'ended', reason: 'not_found' };
+        if (res.status === 409) {
+            const code = errorsOf(body)[0]?.code;
+            if (code === 'SESSION_REVOKED')
+                return { status: 'ended', reason: 'revoked' };
+            if (code === 'SESSION_IDLE_EXPIRED')
+                return { status: 'ended', reason: 'idle_expired' };
+            return { status: 'ended', reason: 'expired' };
+        }
+        // A key, scope or availability problem is not "signed out": say so loudly.
+        throw new error_1.AtlasApiError(res.status, errorsOf(body));
+    }
+    async function revokeSession(sid) {
+        const res = await sessionCall(sid, 'revoke');
+        if (res.ok)
+            return 'revoked';
+        if (res.status === 404)
+            return 'not_found';
+        throw new error_1.AtlasApiError(res.status, errorsOf(await res.json().catch(() => null)));
+    }
+    async function signOut(options = {}) {
+        if (options.sid && config.secretKey)
+            await revokeSession(options.sid);
+        const url = await (0, oidc_1.oidcLogoutUrl)({
+            ...base,
+            postLogoutRedirectUri: options.postLogoutRedirectUri ?? config.postLogoutRedirectUri,
+            idTokenHint: options.idToken,
+            state: options.state,
+        });
+        return redirect(url, []);
+    }
+    return { start, callback, requireRecentAuth, touchIfDue, revokeSession, signOut };
+}
+/** A 302 built with `new Response` (not `Response.redirect`), so its headers stay mutable. */
+function redirect(location, cookies) {
+    const headers = new Headers({ location, 'cache-control': 'no-store' });
+    for (const c of cookies)
+        headers.append('set-cookie', c);
+    return new Response(null, { status: 302, headers });
+}
+function errorsOf(body) {
+    const errors = body?.errors;
+    return Array.isArray(errors) ? errors : [];
+}
+//# sourceMappingURL=rp.js.map

package/dist/rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":";;;AAmOA,gDAmIC;AAtWD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,iCAUgB;AAChB,0CAAoE;AACpE,8CAAmD;AAEnD,+BAAoI;AAA3H,sGAAA,cAAc,OAAA;AAAE,sGAAA,cAAc,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,qGAAA,aAAa,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEnH,wCAA+C;AAAtC,sGAAA,aAAa,OAAA;AACtB,6GAA6G;AAC7G,+CAKwB;AAJtB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAGnB,+DAMgC;AAL9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AAGzB,sCAAsC;AACtC,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAC9B,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAGtD,6CAAqE;AAA5D,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAsJ7C,MAAM,WAAW,GAAkD;IACjE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,WAAW,EAAE,UAAU,CAAC;CAC1B,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,+FAA+F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAgB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,YAA4B,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAA,qBAAc,EAAC,CAAC,CAAC,CAAC;gBAAG,SAA+C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACtG,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC;YAClC,GAAG,IAAI;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY;YACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAqB;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,aAAa;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,SAAS,EAAE,QAAQ,CAAC,QAAQ;SAC7B,CAAC;QACF,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,aAAqB,EAAE,OAA0B;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;QACjF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC;YACtC,GAAG,IAAI;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0B;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;QACvI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,aAAwC;QAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa,GAAG,QAAQ,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9E,IAAI,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAA0B,EAAE;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAa,EAAC;YAC9B,GAAG,IAAI;YACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB;YACpF,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpF,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAiB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAI,IAAoC,EAAE,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/verify.d.ts

@@ -175,6 +175,14 @@ export interface AtlasBackendOptions {
     jwks?: Jwks;
     /** Expected `iss`. Required — an unchecked issuer accepts any Atlas instance. */
     issuer: string;
+    /**
+     * Earlier issuers of THIS instance, also accepted: its old sign-in host while
+     * the instance moves to a new one (a custom domain or a path mount going
+     * active). The keys are the instance's own, so nothing else changes. The
+     * instance's discovery document lists them in `atlas_previous_issuers` with
+     * an `accepted_until`; remove them after that.
+     */
+    previousIssuers?: readonly string[];
     /**
      * §7.3 optional azp allowlist. When set, a token minted for a different
      * origin is refused, which is what stops a token issued to one of the

package/dist/verify.js

@@ -181,7 +181,9 @@ class AtlasBackend {
                 // Pinned. Without this, a token whose header says `alg: none` — or any
                 // algorithm the key material can be coerced into — verifies.
                 algorithms: algs_1.ATLAS_SIGNING_ALGS,
-                issuer: this.options.issuer,
+                issuer: this.options.previousIssuers?.length
+                    ? [this.options.issuer, ...this.options.previousIssuers]
+                    : this.options.issuer,
                 // §S4 enforce `aud` ONLY when the caller configured an expected audience.
                 // Unset leaves `aud` unchecked, so a token carrying its default
                 // instance-id audience still verifies (backwards compatible).

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AAmmBA,sCAEC;AAED,0BAEC;AAMD,4CAEC;AAGD,gCAEC;AAOD,kBAEC;AAMD,0BAIC;AAzoBD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAC7D,2CAA0E;AAC1E,iDAIwB;AACxB,iCAUgB;AAchB,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,iCAA4C;AAC5C,qDAAuF;AAEvF;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AA8GpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAgED,MAAa,YAAY;IAWM;IAVZ,IAAI,CAAY;IAChB,MAAM,CAAwB;IAE/C;;;;OAIG;IACM,IAAI,CAAmB;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6LAA6L,CAC9L,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAgC,CAAI,EAAE,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9D,WAAW,EAAE,sBAAe;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,qCAAoB,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,aAAa;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,qBAAqB,EAAE,0BAAkB;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACzC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAAa,EACb,OAAwD;QAExD,OAAO,IAAA,+BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,0EAA0E;QAC1E,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,2BAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAkC,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC/G,CAAC;gBACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,yBAAkB;gBAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,0EAA0E;gBAC1E,gEAAgE;gBAChE,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAA6B,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,CAAC;QAC/C,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AAjSD,oCAiSC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAqB,EAAE,UAAkB;IACxE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,MAAqB,EAAE,IAAY;IAC5D,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AA6mBA,sCAEC;AAED,0BAEC;AAMD,4CAEC;AAGD,gCAEC;AAOD,kBAEC;AAMD,0BAIC;AAnpBD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAC7D,2CAA0E;AAC1E,iDAIwB;AACxB,iCAUgB;AAchB,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,iCAA4C;AAC5C,qDAAuF;AAEvF;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AA8GpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAwED,MAAa,YAAY;IAWM;IAVZ,IAAI,CAAY;IAChB,MAAM,CAAwB;IAE/C;;;;OAIG;IACM,IAAI,CAAmB;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6LAA6L,CAC9L,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAgC,CAAI,EAAE,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9D,WAAW,EAAE,sBAAe;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,qCAAoB,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,aAAa;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,qBAAqB,EAAE,0BAAkB;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACzC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAAa,EACb,OAAwD;QAExD,OAAO,IAAA,+BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,0EAA0E;QAC1E,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,2BAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAkC,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC/G,CAAC;gBACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,yBAAkB;gBAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM;oBAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACxD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;gBACvB,0EAA0E;gBAC1E,gEAAgE;gBAChE,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAA6B,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,CAAC;QAC/C,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AAnSD,oCAmSC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAqB,EAAE,UAAkB;IACxE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,MAAqB,EAAE,IAAY;IAC5D,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/webhook-common.d.ts

@@ -0,0 +1,53 @@
+/** What both Atlas webhook verifiers share: headers, constants, the result shape and the options. No Node APIs. */
+export declare const SIGNATURE_VERSION = "v1";
+export declare const REPLAY_TOLERANCE_MS: number;
+/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
+export declare const ATLAS_WEBHOOK_HEADERS: {
+    readonly id: "atlas-id";
+    readonly timestamp: "atlas-timestamp";
+    readonly signature: "atlas-signature";
+};
+export type WebhookVerifyFailure = 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch';
+export interface WebhookVerifyResult<T = unknown> {
+    /** True only when the signature and timestamp both check out. */
+    verified: boolean;
+    /** Why verification failed, when it did. */
+    reason?: WebhookVerifyFailure;
+    /** The parsed event envelope `{ id, type, timestamp, instance_id, data }` — present only when `verified`. */
+    event?: T;
+    /**
+     * The signed `atlas-id` header — present only when `verified`. It is the same
+     * on every retry of one event, so it is the key to deduplicate deliveries on.
+     */
+    deliveryId?: string;
+    /** The signed `atlas-timestamp` header (epoch ms) of this attempt — present only when `verified`. */
+    timestamp?: number;
+}
+/** Read a header case-insensitively from a plain object or a Fetch `Headers`. */
+export declare function readHeader(headers: HeadersLike, name: string): string | undefined;
+/**
+ * The `v1` signatures in an `atlas-signature` header. The header carries one
+ * `v1,<base64>` entry, or several separated by spaces (while an endpoint
+ * secret rotates, Atlas signs with the old and the new secret). Entries of
+ * another version are skipped, so a future scheme never breaks this verifier.
+ */
+export declare function parseSignatures(header: string, version?: string): string[];
+export type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+export interface WebhookVerifyOptions {
+    /** The request headers (a plain object, Node `req.headers`, or a Fetch `Headers`). */
+    headers: HeadersLike;
+    /** The endpoint's signing secret (shown once when the endpoint was created/rotated). */
+    secret: string;
+    /** Override "now" (tests); defaults to the current time. */
+    now?: Date;
+    /** Override the ±replay tolerance (defaults to 5 minutes). */
+    toleranceMs?: number;
+    /**
+     * The exact URL Atlas POSTed to (your endpoint's `url`). When given, `v2`
+     * signature entries — which also cover the URL, for endpoints with
+     * `signature_versions` including `v2` — are checked too.
+     */
+    url?: string;
+    /** Accept only a `v2` entry (needs `url`): a delivery replayed to another URL then fails. */
+    requireV2?: boolean;
+}

package/dist/webhook-common.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATLAS_WEBHOOK_HEADERS = exports.REPLAY_TOLERANCE_MS = exports.SIGNATURE_VERSION = void 0;
+exports.readHeader = readHeader;
+exports.parseSignatures = parseSignatures;
+/** What both Atlas webhook verifiers share: headers, constants, the result shape and the options. No Node APIs. */
+exports.SIGNATURE_VERSION = 'v1';
+exports.REPLAY_TOLERANCE_MS = 5 * 60_000;
+/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
+exports.ATLAS_WEBHOOK_HEADERS = {
+    id: 'atlas-id',
+    timestamp: 'atlas-timestamp',
+    signature: 'atlas-signature',
+};
+/** Read a header case-insensitively from a plain object or a Fetch `Headers`. */
+function readHeader(headers, name) {
+    if (typeof headers.get === 'function') {
+        return headers.get(name) ?? undefined;
+    }
+    const bag = headers;
+    const direct = bag[name] ?? bag[name.toLowerCase()];
+    const v = Array.isArray(direct) ? direct[0] : direct;
+    if (v !== undefined)
+        return v;
+    // Fall back to a case-insensitive scan (Node lower-cases, but be safe).
+    const hit = Object.keys(bag).find((k) => k.toLowerCase() === name);
+    const found = hit ? bag[hit] : undefined;
+    return Array.isArray(found) ? found[0] : found;
+}
+/**
+ * The `v1` signatures in an `atlas-signature` header. The header carries one
+ * `v1,<base64>` entry, or several separated by spaces (while an endpoint
+ * secret rotates, Atlas signs with the old and the new secret). Entries of
+ * another version are skipped, so a future scheme never breaks this verifier.
+ */
+function parseSignatures(header, version = exports.SIGNATURE_VERSION) {
+    const out = [];
+    for (const entry of header.trim().split(/\s+/)) {
+        const comma = entry.indexOf(',');
+        if (comma <= 0)
+            continue;
+        const value = entry.slice(comma + 1);
+        if (entry.slice(0, comma) === version && value)
+            out.push(value);
+    }
+    return out;
+}
+//# sourceMappingURL=webhook-common.js.map

package/dist/webhook-common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-common.js","sourceRoot":"","sources":["../src/webhook-common.ts"],"names":[],"mappings":";;;AAkCA,gCAYC;AAQD,0CASC;AA/DD,mHAAmH;AACtG,QAAA,iBAAiB,GAAG,IAAI,CAAC;AACzB,QAAA,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE9C,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB,EAAE,IAAY;IAC3D,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAc,EAAE,UAAkB,yBAAiB;IACjF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,OAAO,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/webhooks-web.d.ts

@@ -0,0 +1,24 @@
+import { type WebhookVerifyOptions, type WebhookVerifyResult } from './webhook-common';
+export interface VerifyAtlasWebhookInput extends WebhookVerifyOptions {
+    /** The RAW request body: the string or bytes exactly as received, never a parsed object. */
+    body: string | Uint8Array | ArrayBuffer;
+}
+/**
+ * The Node `verifyWebhook` on Web Crypto only (no `Buffer`, no `node:crypto`), so
+ * it runs unchanged on Node 18+, Deno, Bun and Workers. Same signed material,
+ * same 5-minute window in both directions, same `v1` / `v2` handling, same
+ * result shape; never throws on a bad delivery.
+ *
+ * ```ts
+ * const { verified, event, deliveryId } = await verifyAtlasWebhook({
+ *   body: await request.text(), headers: request.headers, secret: env.ATLAS_WEBHOOK_SECRET,
+ * });
+ * ```
+ */
+export declare function verifyAtlasWebhook<T = unknown>(input: VerifyAtlasWebhookInput): Promise<WebhookVerifyResult<T>>;
+/**
+ * {@link verifyAtlasWebhook} straight from a Fetch `Request` (Hono, Workers,
+ * Deno, Bun, Next.js route handlers). Reads the body once, as text; do not
+ * read it before calling this.
+ */
+export declare function verifyAtlasWebhookRequest<T = unknown>(request: Request, options: Omit<VerifyAtlasWebhookInput, 'body' | 'headers'>): Promise<WebhookVerifyResult<T>>;

package/dist/webhooks-web.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAtlasWebhook = verifyAtlasWebhook;
+exports.verifyAtlasWebhookRequest = verifyAtlasWebhookRequest;
+const webhook_common_1 = require("./webhook-common");
+/**
+ * The Node `verifyWebhook` on Web Crypto only (no `Buffer`, no `node:crypto`), so
+ * it runs unchanged on Node 18+, Deno, Bun and Workers. Same signed material,
+ * same 5-minute window in both directions, same `v1` / `v2` handling, same
+ * result shape; never throws on a bad delivery.
+ *
+ * ```ts
+ * const { verified, event, deliveryId } = await verifyAtlasWebhook({
+ *   body: await request.text(), headers: request.headers, secret: env.ATLAS_WEBHOOK_SECRET,
+ * });
+ * ```
+ */
+async function verifyAtlasWebhook(input) {
+    const raw = typeof input.body === 'string' ? input.body : new TextDecoder().decode(input.body);
+    const id = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.id);
+    const timestampRaw = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.timestamp);
+    const signature = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.signature);
+    if (!id || !timestampRaw || !signature)
+        return { verified: false, reason: 'missing_headers' };
+    if (typeof input.secret !== 'string' || input.secret === '')
+        return { verified: false, reason: 'signature_mismatch' };
+    const provided = input.requireV2 ? [] : (0, webhook_common_1.parseSignatures)(signature);
+    const providedV2 = input.url ? (0, webhook_common_1.parseSignatures)(signature, 'v2') : [];
+    if (provided.length === 0 && providedV2.length === 0)
+        return { verified: false, reason: 'malformed_signature' };
+    const timestamp = Number(timestampRaw);
+    const now = (input.now ?? new Date()).getTime();
+    if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > (input.toleranceMs ?? webhook_common_1.REPLAY_TOLERANCE_MS)) {
+        return { verified: false, reason: 'stale_timestamp' };
+    }
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(input.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const mac = async (material) => toBase64(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(material))));
+    let matched = false;
+    if (provided.length > 0) {
+        const expected = await mac(`${id}.${timestamp}.${raw}`);
+        for (const candidate of provided)
+            if (constantTimeEqual(candidate, expected))
+                matched = true;
+    }
+    if (providedV2.length > 0) {
+        const expected = await mac(`${id}.${timestamp}.${input.url}.${raw}`);
+        for (const candidate of providedV2)
+            if (constantTimeEqual(candidate, expected))
+                matched = true;
+    }
+    if (!matched)
+        return { verified: false, reason: 'signature_mismatch' };
+    try {
+        return { verified: true, event: JSON.parse(raw), deliveryId: id, timestamp };
+    }
+    catch {
+        return { verified: true, deliveryId: id, timestamp };
+    }
+}
+/**
+ * {@link verifyAtlasWebhook} straight from a Fetch `Request` (Hono, Workers,
+ * Deno, Bun, Next.js route handlers). Reads the body once, as text; do not
+ * read it before calling this.
+ */
+async function verifyAtlasWebhookRequest(request, options) {
+    return verifyAtlasWebhook({ ...options, body: await request.text(), headers: request.headers });
+}
+function toBase64(bytes) {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
+/** Compares every byte whatever the lengths, so timing reveals neither where nor whether they differ early. */
+function constantTimeEqual(a, b) {
+    let diff = a.length ^ b.length;
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++)
+        diff |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    return diff === 0;
+}
+//# sourceMappingURL=webhooks-web.js.map

package/dist/webhooks-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks-web.js","sourceRoot":"","sources":["../src/webhooks-web.ts"],"names":[],"mappings":";;AA4BA,gDA0CC;AAOD,8DAKC;AAlFD,qDAO0B;AAS1B;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,kBAAkB,CAAc,KAA8B;IAClF,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,EAAE,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9F,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEtH,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEhH,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,oCAAmB,CAAC,EAAE,CAAC;QAC1G,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE,CACrC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,SAAS,IAAI,QAAQ;YAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU;YAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,OAA0D;IAE1D,OAAO,kBAAkB,CAAI,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/webhooks.d.ts

@@ -1,45 +1,28 @@
-/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
-export declare const ATLAS_WEBHOOK_HEADERS: {
-    readonly id: "atlas-id";
-    readonly timestamp: "atlas-timestamp";
-    readonly signature: "atlas-signature";
-};
-export type WebhookVerifyFailure = 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch';
-export interface WebhookVerifyResult<T = unknown> {
-    /** True only when the signature and timestamp both check out. */
-    verified: boolean;
-    /** Why verification failed, when it did. */
-    reason?: WebhookVerifyFailure;
-    /** The parsed event envelope `{ id, type, timestamp, instance_id, data }` — present only when `verified`. */
-    event?: T;
-    /**
-     * The signed `atlas-id` header — present only when `verified`. It is the same
-     * on every retry of one event, so it is the key to deduplicate deliveries on.
-     */
-    deliveryId?: string;
-    /** The signed `atlas-timestamp` header (epoch ms) of this attempt — present only when `verified`. */
-    timestamp?: number;
-}
-type HeadersLike = Headers | Record<string, string | string[] | undefined>;
-export interface VerifyWebhookInput {
+import { type HeadersLike, type WebhookVerifyOptions, type WebhookVerifyResult } from './webhook-common';
+export { ATLAS_WEBHOOK_HEADERS } from './webhook-common';
+export type { WebhookVerifyFailure, WebhookVerifyOptions, WebhookVerifyResult } from './webhook-common';
+export { verifyAtlasWebhook, verifyAtlasWebhookRequest } from './webhooks-web';
+export type { VerifyAtlasWebhookInput } from './webhooks-web';
+/**
+ * §12.2 — verify an inbound Atlas webhook, for the CUSTOMER consuming events.
+ *
+ * Atlas signs every delivery: `atlas-signature: v1,<base64>` is HMAC-SHA256 over
+ * `<id>.<timestamp>.<rawBody>` keyed with the endpoint secret, with `atlas-id`
+ * and `atlas-timestamp` (epoch ms) headers. The timestamp is INSIDE the signed
+ * material — a header-only timestamp would let an attacker replay a captured
+ * body under a fresh timestamp — and a delivery older than 5 minutes is rejected
+ * so a captured request cannot be replayed later. The header may carry several
+ * space-separated `v1,<base64>` entries (one per secret while a secret rotates
+ * with an overlap); the delivery verifies when any one of them matches.
+ *
+ * The signing logic is identical to the server's (`@atlas/core` `verifyWebhook`),
+ * reimplemented here with zero dependencies so an integrator gets a first-party
+ * verifier without pulling in Atlas internals. Verify over the RAW request body,
+ * BEFORE any JSON parse — re-serializing reorders keys and breaks the MAC.
+ */
+export interface VerifyWebhookInput extends WebhookVerifyOptions {
     /** The RAW request body as received — a string or Buffer, NOT a parsed object. */
     body: string | Buffer;
-    /** The request headers (a plain object, Node `req.headers`, or a Fetch `Headers`). */
-    headers: HeadersLike;
-    /** The endpoint's signing secret (shown once when the endpoint was created/rotated). */
-    secret: string;
-    /** Override "now" (tests); defaults to the current time. */
-    now?: Date;
-    /** Override the ±replay tolerance (defaults to 5 minutes). */
-    toleranceMs?: number;
-    /**
-     * The exact URL Atlas POSTed to (your endpoint's `url`). When given, `v2`
-     * signature entries — which also cover the URL, for endpoints with
-     * `signature_versions` including `v2` — are checked too.
-     */
-    url?: string;
-    /** Accept only a `v2` entry (needs `url`): a delivery replayed to another URL then fails. */
-    requireV2?: boolean;
 }
 /**
  * Verify and parse an Atlas webhook. Returns `{ verified, reason?, event?,
@@ -92,4 +75,3 @@ export interface VerifyStandardWebhookInput {
  * ```
  */
 export declare function verifyStandardWebhook<T = unknown>(input: VerifyStandardWebhookInput): WebhookVerifyResult<T>;
-export {};