@axtary/actionpass 0.1.0 → 0.2.0

package/README.md

@@ -1,6 +1,6 @@
 # @axtary/actionpass
 
-Scoped, signed ActionPass artifacts for runtime-governed AI agent actions.
+Scoped, signed and proof-of-possession-bound ActionPass artifacts for runtime-governed AI agent actions.
 
 Early `0.x` release: the runtime path is real and tested, but the API is not stable yet and may change between minor versions.
 
@@ -8,17 +8,54 @@ Early `0.x` release: the runtime path is real and tested, but the API is not sta
 npm install @axtary/actionpass
 ```
 
+The base format lives in `spec/actionpass-v0.md`; the sender-constrained
+`cnf`/DPoP and delegation profile is `spec/actionpass-v1.md`; authenticated
+status distribution is `spec/actionpass-v2.md`.
+
 ## What It Does
 
 - Validates normalized agent actions at runtime.
 - Produces canonical SHA-256 payload hashes.
 - Produces payload-bound approval artifacts for exact human or policy override approvals.
 - Issues signed ActionPass JWT/JWS artifacts for allowed actions.
-- Produces revocation records and rejects revoked passes during verification.
+- Issues ActionPass v1 bound to a holder key with RFC 7800 `cnf.jkt`.
+- Creates and verifies RFC 9449 DPoP proofs with method/URI/token binding,
+  nonce, clock-window, and replay enforcement.
+- Backs replay enforcement with a shared `DpopReplayStore`: an in-process
+  `InMemoryDpopReplayStore` and a durable, lock-serialized `FileDpopReplayStore`
+  (`0600`) that keeps a captured proof rejected across a verifier restart within
+  its window and compacts itself to the in-flight proof window. Single-host
+  state, not cross-host distribution.
+- Exchanges a holder-authorized v1 pass for an attenuated child pass, walks
+  root-to-leaf delegation chains, enforces remaining depth, and binds the child
+  to a distinct sub-agent key.
+- Applies one revocation source across the full delegation chain, so revoking a
+  root or intermediate parent invalidates every downstream child without
+  enumerating descendants.
+- Binds authority-owned budget reservation cost/limit/state into the pass so a
+  presenter cannot alter metering fields.
+- Produces durable local revocation records and rejects revoked passes during
+  verification; a revocation-source error also fails closed.
 - Verifies passes against a keyring by `kid` so rotated keys can coexist.
 - Persists local public verification keys and revocations in a JSON trust store.
+- Issues and verifies ActionPass v2 with a signed Token Status List reference,
+  freshness-bounded caching, and fail-closed unavailable/stale/invalid status.
+- Uses the IESG-approved Token Status List revision-21 wire format through the
+  pinned, stricter `axtary.status-list.v1` profile, so RFC number assignment is
+  not a runtime dependency.
+- Validates `axtary.provenance.v0` field/source bindings and binds their
+  canonical hash into ActionPasses and ledger records.
+- Persists the issuer ES256 keyring, publishes public JWKS by `kid`, and rotates
+  with bounded retired-key overlap.
+- Verifies generic final SSF/CAEP `session-revoked` SETs and maps their explicit
+  subjects to live delegation roots without inventing provider support.
 - Verifies that a signed pass and any embedded approval evidence still match the exact action payload.
-- Records ledger entries with hashable decision evidence.
+- Records ledger entries with hashable decision evidence and parent-to-child
+  delegation edges.
+- Owns the provider-neutral native-connector governance descriptors used to
+  derive GitHub/Jira/Linear/Postgres/Google Drive capability metadata, normalized evidence dispatch, config
+  defaults, and doctor scope/smoke metadata without importing secret-bearing
+  adapter runtimes.
 
 ## Current Status
 
@@ -27,13 +64,44 @@ npm install @axtary/actionpass
 Before production use, Axtary still needs:
 
 - Stable schema versioning.
-- External signing-key management.
+- External/HSM signing-key management.
 - Hosted approval queue integration.
 - External security review.
 
 The package builds to `dist/` and publishes JavaScript plus TypeScript declarations.
 
-## Quickstart
+## SDK facade
+
+For most callers the `axtary` facade is the simplest entry point: five verbs —
+`authorize`, `verify`, `record`, `revoke`, `explain` — over a flat request
+shape. It delegates to the lower-level functions below and adds no new
+authorization logic.
+
+```ts
+import { axtary } from "@axtary/actionpass";
+
+const decision = await axtary.authorize({
+  agent: "codex-prod",
+  human: "user@company.com",
+  intent: "Open a PR for Linear issue AXT-418",
+  tool: "github.pull_requests.create",
+  resource: "repo:company/web-app",
+  payload,
+});
+
+if (decision.status === "allow") {
+  await github.createPullRequest(payload);
+}
+```
+
+With no signing key configured, the facade signs with a **persistent local dev
+key** (`AXTARY_DEV_SIGNING_KEY`, else a `0600` keyring file under `.axtary/`), so
+quickstart passes verify across restarts with zero key code. Call
+`devKeypair()` to obtain that keypair explicitly, or
+`createAxtary({ issuer, signingKey, verificationKey })` to use your own issuer
+key in production. See the [SDK guide](https://docs.axtary.com/sdk).
+
+## Quickstart (low-level functions)
 
 This example runs as-is with Node 20+:
 
@@ -86,10 +154,24 @@ ActionPass is designed to fail closed:
 - Denied and step-up actions do not receive passes.
 - Verification rejects expired tokens.
 - Verification rejects revoked pass IDs.
+- Delegation verification checks every root-to-leaf member against the same
+  revocation source; an ancestor revoke cascades to all descendants.
+- Verification rejects when a configured revocation source cannot be queried;
+  it never treats source failure as an empty set.
 - Verification rejects payload hash mismatches.
 - Pass issuance rejects approval artifacts that were created for a different action or payload.
 - Keyring verification fails closed when the JWT `kid` is unknown.
-- The local trust store persists public verification JWKs only; signing keys should remain in KMS, env-managed dev secrets, or another controlled key custodian.
+- The local trust store is atomically written with mode `0600`. It persists
+  public verification JWKs and local revocation records only; signing keys
+  should remain in KMS, env-managed dev secrets, or another controlled key
+  custodian.
+- Local revocation records still rely on the trusted filesystem boundary.
+  ActionPass v2 additionally publishes signed freshness-bounded status evidence
+  for independent/multi-process verification.
 - Verification binds agent, human owner, runtime, task, tool, resource, and payload hash.
+- V1 verification additionally requires the holder key, fresh proof target,
+  exact ActionPass hash, and one-time proof `jti`.
+- V2 verification additionally requires authenticated fresh status evidence;
+  status-source failure or stale evidence blocks execution.
 
 Signing currently defaults to `ES256`.

package/dist/caep.d.ts

@@ -0,0 +1,89 @@
+import { type CryptoKey, type JWK, type KeyObject } from "jose";
+import { z } from "zod";
+export declare const SSF_SET_TYP = "secevent+jwt";
+export declare const CAEP_SESSION_REVOKED_EVENT = "https://schemas.openid.net/secevent/caep/event-type/session-revoked";
+export declare const CAEP_MAPPING_STORE_VERSION = "axtary.caep_mapping_store.v0";
+export declare const SSF_REPLAY_STORE_VERSION = "axtary.ssf_replay_store.v0";
+export declare const SsfSubjectIdentifierSchema: z.ZodObject<{
+    format: z.ZodString;
+}, z.core.$catchall<z.ZodType<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown, z.core.$ZodTypeInternals<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown>>>>;
+export type SsfSubjectIdentifier = z.infer<typeof SsfSubjectIdentifierSchema>;
+export declare const CaepSessionRevokedClaimsSchema: z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    iat: z.ZodNumber;
+    jti: z.ZodString;
+    txn: z.ZodOptional<z.ZodString>;
+    sub_id: z.ZodObject<{
+        format: z.ZodString;
+    }, z.core.$catchall<z.ZodType<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown, z.core.$ZodTypeInternals<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown>>>>;
+    events: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodType<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown, z.core.$ZodTypeInternals<string | number | boolean | Record<string, unknown> | unknown[] | null, unknown>>>>;
+}, z.core.$strip>;
+export type CaepSessionRevokedClaims = z.infer<typeof CaepSessionRevokedClaimsSchema>;
+export declare const CaepMappingSchema: z.ZodObject<{
+    transmitterIssuer: z.ZodString;
+    subjectKey: z.ZodString;
+    rootPassIds: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type CaepMapping = z.infer<typeof CaepMappingSchema>;
+export declare const CaepMappingStoreSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"axtary.caep_mapping_store.v0">;
+    mappings: z.ZodArray<z.ZodObject<{
+        transmitterIssuer: z.ZodString;
+        subjectKey: z.ZodString;
+        rootPassIds: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type CaepMappingStoreData = z.infer<typeof CaepMappingStoreSchema>;
+export declare function ssfSubjectKey(subjectInput: SsfSubjectIdentifier): string;
+export declare function verifyCaepSessionRevoked(input: {
+    token: string;
+    issuer: string;
+    audience: string;
+    verificationKeys?: Readonly<Record<string, JWK | KeyObject | CryptoKey | Uint8Array>> | ((kid: string | undefined) => JWK | KeyObject | CryptoKey | Uint8Array | undefined | Promise<JWK | KeyObject | CryptoKey | Uint8Array | undefined>);
+    jwksUri?: string;
+    currentDate?: Date;
+    maxAgeSeconds?: number;
+}): Promise<CaepSessionRevokedClaims>;
+export declare class LocalCaepMappingStore {
+    readonly filePath: string;
+    constructor(filePath: string);
+    read(): Promise<CaepMappingStoreData>;
+    put(input: {
+        transmitterIssuer: string;
+        subject: SsfSubjectIdentifier;
+        rootPassIds: string[];
+        createdAt?: Date;
+    }): Promise<CaepMapping>;
+    rootsFor(transmitterIssuer: string, subject: SsfSubjectIdentifier): Promise<string[]>;
+}
+export declare class LocalSsfReplayStore {
+    readonly filePath: string;
+    constructor(filePath: string);
+    consume(issuer: string, eventId: string, now?: Date, retentionSeconds?: number): Promise<boolean>;
+    processOnce<T>(issuer: string, eventId: string, operation: () => Promise<T>, now?: Date, retentionSeconds?: number): Promise<{
+        processed: true;
+        result: T;
+    } | {
+        processed: false;
+    }>;
+}
+export declare function processCaepSessionRevoked(input: {
+    token: string;
+    issuer: string;
+    audience: string;
+    verificationKeys?: Readonly<Record<string, JWK | KeyObject | CryptoKey | Uint8Array>> | ((kid: string | undefined) => JWK | KeyObject | CryptoKey | Uint8Array | undefined | Promise<JWK | KeyObject | CryptoKey | Uint8Array | undefined>);
+    jwksUri?: string;
+    mappingStore: LocalCaepMappingStore;
+    replayStore: LocalSsfReplayStore;
+    revoke: (rootPassId: string, claims: CaepSessionRevokedClaims) => Promise<void>;
+    currentDate?: Date;
+}): Promise<{
+    eventId: string;
+    subjectKey: string;
+    rootPassIds: string[];
+    status: "applied" | "unmapped" | "replayed";
+}>;
+//# sourceMappingURL=caep.d.ts.map

package/dist/caep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caep.d.ts","sourceRoot":"","sources":["../src/caep.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,GAAG,EAER,KAAK,SAAS,EACf,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAC1C,eAAO,MAAM,0BAA0B,wEACgC,CAAC;AACxE,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AACzE,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAerE,eAAO,MAAM,0BAA0B;;2NAIX,CAAC;AAC7B,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,sBAAsB;;;;;;;;iBAGjC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAY1E,wBAAgB,aAAa,CAAC,YAAY,EAAE,oBAAoB,GAAG,MAAM,CAExE;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC,GAClE,CAAC,CACC,GAAG,EAAE,MAAM,GAAG,SAAS,KAErB,GAAG,GACH,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,OAAO,CAAC,GAAG,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0CpC;AAED,qBAAa,qBAAqB;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;IAE/B,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAarC,GAAG,CAAC,KAAK,EAAE;QACf,iBAAiB,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,oBAAoB,CAAC;QAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC;IA8BlB,QAAQ,CACZ,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC;CAUrB;AAED,qBAAa,mBAAmB;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;IAE/B,OAAO,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,OAAa,EAChB,gBAAgB,SAAS,GACxB,OAAO,CAAC,OAAO,CAAC;IAYb,WAAW,CAAC,CAAC,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,GAAG,OAAa,EAChB,gBAAgB,SAAS,GACxB,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,KAAK,CAAA;KAAE,CAAC;CAoClE;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC,GAClE,CAAC,CACC,GAAG,EAAE,MAAM,GAAG,SAAS,KAErB,GAAG,GACH,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,OAAO,CAAC,GAAG,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,qBAAqB,CAAC;IACpC,WAAW,EAAE,mBAAmB,CAAC;IACjC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;CAC7C,CAAC,CAgCD"}

package/dist/caep.js

@@ -0,0 +1,258 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, } from "jose";
+import { lock } from "proper-lockfile";
+import { z } from "zod";
+export const SSF_SET_TYP = "secevent+jwt";
+export const CAEP_SESSION_REVOKED_EVENT = "https://schemas.openid.net/secevent/caep/event-type/session-revoked";
+export const CAEP_MAPPING_STORE_VERSION = "axtary.caep_mapping_store.v0";
+export const SSF_REPLAY_STORE_VERSION = "axtary.ssf_replay_store.v0";
+const JsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema),
+]));
+export const SsfSubjectIdentifierSchema = z
+    .object({
+    format: z.string().min(1),
+})
+    .catchall(JsonValueSchema);
+export const CaepSessionRevokedClaimsSchema = z.object({
+    iss: z.string().url(),
+    aud: z.union([z.string().min(1), z.array(z.string().min(1))]),
+    iat: z.number().int().positive(),
+    jti: z.string().min(1),
+    txn: z.string().min(1).optional(),
+    sub_id: SsfSubjectIdentifierSchema,
+    events: z.record(z.string(), z.record(z.string(), JsonValueSchema)),
+});
+export const CaepMappingSchema = z.object({
+    transmitterIssuer: z.string().url(),
+    subjectKey: z.string().min(1),
+    rootPassIds: z.array(z.string().min(1)).min(1),
+    createdAt: z.string().datetime(),
+});
+export const CaepMappingStoreSchema = z.object({
+    schemaVersion: z.literal(CAEP_MAPPING_STORE_VERSION),
+    mappings: z.array(CaepMappingSchema),
+});
+const SsfReplayEntrySchema = z.object({
+    issuer: z.string().url(),
+    eventId: z.string().min(1),
+    expiresAt: z.string().datetime(),
+});
+const SsfReplayStoreSchema = z.object({
+    schemaVersion: z.literal(SSF_REPLAY_STORE_VERSION),
+    entries: z.array(SsfReplayEntrySchema),
+});
+export function ssfSubjectKey(subjectInput) {
+    return stableStringify(SsfSubjectIdentifierSchema.parse(subjectInput));
+}
+export async function verifyCaepSessionRevoked(input) {
+    const header = decodeProtectedHeader(input.token);
+    if (header.typ !== SSF_SET_TYP) {
+        throw new Error("ssf_set_type_invalid");
+    }
+    const localKey = input.jwksUri
+        ? undefined
+        : await resolveKey(input.verificationKeys, header.kid);
+    if (!input.jwksUri && !localKey) {
+        throw new Error(header.kid
+            ? `ssf_verification_key_not_found:${header.kid}`
+            : "ssf_verification_key_id_required");
+    }
+    const currentDate = input.currentDate ?? new Date();
+    const verifyOptions = {
+        issuer: input.issuer,
+        audience: input.audience,
+        algorithms: ["ES256"],
+        currentDate,
+    };
+    const { payload } = input.jwksUri
+        ? await jwtVerify(input.token, createRemoteJWKSet(new URL(input.jwksUri)), verifyOptions)
+        : await jwtVerify(input.token, localKey, verifyOptions);
+    const claims = CaepSessionRevokedClaimsSchema.parse(payload);
+    const ageSeconds = Math.floor(currentDate.getTime() / 1000) - claims.iat;
+    if (ageSeconds < -5 || ageSeconds > (input.maxAgeSeconds ?? 300)) {
+        throw new Error("ssf_set_outside_accepted_window");
+    }
+    const eventKeys = Object.keys(claims.events);
+    if (eventKeys.length !== 1 ||
+        eventKeys[0] !== CAEP_SESSION_REVOKED_EVENT) {
+        throw new Error("caep_event_type_unsupported");
+    }
+    return claims;
+}
+export class LocalCaepMappingStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async read() {
+        try {
+            return CaepMappingStoreSchema.parse(JSON.parse(await readFile(this.filePath, "utf8")));
+        }
+        catch (error) {
+            if (isEnoent(error)) {
+                return { schemaVersion: CAEP_MAPPING_STORE_VERSION, mappings: [] };
+            }
+            throw error;
+        }
+    }
+    async put(input) {
+        const mapping = CaepMappingSchema.parse({
+            transmitterIssuer: input.transmitterIssuer,
+            subjectKey: ssfSubjectKey(input.subject),
+            rootPassIds: [...new Set(input.rootPassIds)].sort(),
+            createdAt: (input.createdAt ?? new Date()).toISOString(),
+        });
+        await withFileLock(this.filePath, async () => {
+            const data = await this.read();
+            await writePrivateJson(this.filePath, {
+                ...data,
+                mappings: [
+                    ...data.mappings.filter((entry) => !(entry.transmitterIssuer === mapping.transmitterIssuer &&
+                        entry.subjectKey === mapping.subjectKey)),
+                    mapping,
+                ].sort((left, right) => `${left.transmitterIssuer}:${left.subjectKey}`.localeCompare(`${right.transmitterIssuer}:${right.subjectKey}`)),
+            });
+        });
+        return mapping;
+    }
+    async rootsFor(transmitterIssuer, subject) {
+        const key = ssfSubjectKey(subject);
+        return ((await this.read()).mappings.find((entry) => entry.transmitterIssuer === transmitterIssuer &&
+            entry.subjectKey === key)?.rootPassIds ?? []);
+    }
+}
+export class LocalSsfReplayStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async consume(issuer, eventId, now = new Date(), retentionSeconds = 86_400) {
+        return (await this.processOnce(issuer, eventId, async () => undefined, now, retentionSeconds)).processed;
+    }
+    async processOnce(issuer, eventId, operation, now = new Date(), retentionSeconds = 86_400) {
+        return withFileLock(this.filePath, async () => {
+            let data;
+            try {
+                data = SsfReplayStoreSchema.parse(JSON.parse(await readFile(this.filePath, "utf8")));
+            }
+            catch (error) {
+                if (!isEnoent(error))
+                    throw error;
+                data = { schemaVersion: SSF_REPLAY_STORE_VERSION, entries: [] };
+            }
+            const live = data.entries.filter((entry) => Date.parse(entry.expiresAt) > now.getTime());
+            if (live.some((entry) => entry.issuer === issuer && entry.eventId === eventId)) {
+                return { processed: false };
+            }
+            const result = await operation();
+            live.push({
+                issuer,
+                eventId,
+                expiresAt: new Date(now.getTime() + retentionSeconds * 1000).toISOString(),
+            });
+            await writePrivateJson(this.filePath, {
+                schemaVersion: SSF_REPLAY_STORE_VERSION,
+                entries: live,
+            });
+            return { processed: true, result };
+        });
+    }
+}
+export async function processCaepSessionRevoked(input) {
+    const claims = await verifyCaepSessionRevoked(input);
+    const processed = await input.replayStore.processOnce(claims.iss, claims.jti, async () => {
+        const rootPassIds = await input.mappingStore.rootsFor(claims.iss, claims.sub_id);
+        for (const rootPassId of rootPassIds) {
+            await input.revoke(rootPassId, claims);
+        }
+        return rootPassIds;
+    }, input.currentDate);
+    if (!processed.processed) {
+        return {
+            eventId: claims.jti,
+            subjectKey: ssfSubjectKey(claims.sub_id),
+            rootPassIds: [],
+            status: "replayed",
+        };
+    }
+    const rootPassIds = processed.result;
+    return {
+        eventId: claims.jti,
+        subjectKey: ssfSubjectKey(claims.sub_id),
+        rootPassIds,
+        status: rootPassIds.length > 0 ? "applied" : "unmapped",
+    };
+}
+async function resolveKey(keys, kid) {
+    if (!keys)
+        return undefined;
+    return typeof keys === "function" ? keys(kid) : kid ? keys[kid] : undefined;
+}
+async function writePrivateJson(filePath, value) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    let renamed = false;
+    try {
+        const handle = await open(tmpPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(tmpPath, filePath);
+        renamed = true;
+    }
+    finally {
+        if (!renamed)
+            await rm(tmpPath, { force: true });
+    }
+}
+async function withFileLock(filePath, operation) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const release = await lock(filePath, {
+        realpath: false,
+        lockfilePath: `${filePath}.lock`,
+        stale: 10_000,
+        update: 5_000,
+        retries: {
+            retries: 100,
+            factor: 1.2,
+            minTimeout: 10,
+            maxTimeout: 100,
+        },
+    });
+    try {
+        return await operation();
+    }
+    finally {
+        await release();
+    }
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function isEnoent(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+//# sourceMappingURL=caep.js.map

package/dist/caep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caep.js","sourceRoot":"","sources":["../src/caep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,SAAS,GAKV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,MAAM,CAAC,MAAM,0BAA0B,GACrC,qEAAqE,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,MAAM,eAAe,GAEjB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACd,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,QAAQ,CAAC,eAAe,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;CACpE,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACrC,CAAC,CAAC;AAGH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,YAAkC;IAC9D,OAAO,eAAe,CAAC,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAkB9C;IACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,GAAG;YACR,CAAC,CAAC,kCAAkC,MAAM,CAAC,GAAG,EAAE;YAChD,CAAC,CAAC,kCAAkC,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IACpD,MAAM,aAAa,GAAqB;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO;QAC/B,CAAC,CAAC,MAAM,SAAS,CACb,KAAK,CAAC,KAAK,EACX,kBAAkB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC1C,aAAa,CACd;QACH,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,QAAS,EAAE,aAAa,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IACE,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,qBAAqB;IACX;IAArB,YAAqB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEzC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,OAAO,sBAAsB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAKT;QACC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;YACnD,SAAS,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACpC,GAAG,IAAI;gBACP,QAAQ,EAAE;oBACR,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,CACC,KAAK,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB;wBACrD,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CACxC,CACJ;oBACD,OAAO;iBACR,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAC1D,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,UAAU,EAAE,CACjD,CACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,iBAAyB,EACzB,OAA6B;QAE7B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAC/B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,iBAAiB,KAAK,iBAAiB;YAC7C,KAAK,CAAC,UAAU,KAAK,GAAG,CAC3B,EAAE,WAAW,IAAI,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACT;IAArB,YAAqB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEzC,KAAK,CAAC,OAAO,CACX,MAAc,EACd,OAAe,EACf,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,gBAAgB,GAAG,MAAM;QAEzB,OAAO,CACL,MAAM,IAAI,CAAC,WAAW,CACpB,MAAM,EACN,OAAO,EACP,KAAK,IAAI,EAAE,CAAC,SAAS,EACrB,GAAG,EACH,gBAAgB,CACjB,CACF,CAAC,SAAS,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,OAAe,EACf,SAA2B,EAC3B,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,gBAAgB,GAAG,MAAM;QAEzB,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,IAAI,IAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAClC,IAAI,GAAG,EAAE,aAAa,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CACvD,CAAC;YACF,IACE,IAAI,CAAC,IAAI,CACP,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAChE,EACD,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,KAAc,EAAE,CAAC;YACvC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,CACjB,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CACxC,CAAC,WAAW,EAAE;aAChB,CAAC,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACpC,aAAa,EAAE,wBAAwB;gBACvC,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAoB/C;IAMC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CACnD,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,GAAG,EACV,KAAK,IAAI,EAAE;QACT,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CACnD,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,CACd,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC;IACrC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,GAAG;QACnB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,WAAW;QACX,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAWa,EACb,GAAuB;IAEvB,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAc;IAC9D,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO;YAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,SAA2B;IAE3B,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,GAAG,QAAQ,OAAO;QAChC,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,GAAG;SAChB;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;aACzE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,MAAM,IAAI,KAAK;QACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC"}

package/dist/dev-key.d.ts

@@ -0,0 +1,50 @@
+import { type JWK, type KeyObject } from "jose";
+/** Env var holding an ES256 private key (PEM, or base64-encoded PEM). */
+export declare const AXTARY_DEV_SIGNING_KEY_ENV = "AXTARY_DEV_SIGNING_KEY";
+/** Optional env var overriding the dev key id (`kid`). */
+export declare const AXTARY_DEV_KEY_ID_ENV = "AXTARY_DEV_KEY_ID";
+/** Env var pointing the local keyring at a directory other than ./.axtary. */
+export declare const AXTARY_HOME_ENV = "AXTARY_HOME";
+/** Filename of the file-backed dev keyring inside the resolved home dir. */
+export declare const AXTARY_DEV_KEYRING_FILENAME = "sdk-dev-keyring.json";
+/** Default `kid` for an env-backed dev key when none is supplied. */
+export declare const AXTARY_DEFAULT_DEV_KEY_ID = "axtary-dev";
+export type DevKeypairSource = "env" | "file";
+export type DevKeypair = {
+    /** ES256 private key, ready to pass to createAxtary({ signingKey }). */
+    signingKey: KeyObject;
+    /** Matching public JWK, used by verify(). */
+    verificationKey: JWK;
+    /** Key id stamped into issued passes (`kid`). */
+    signingKeyId: string;
+    algorithm: "ES256";
+    /** Where the key came from: an env var or the local keyring file. */
+    source: DevKeypairSource;
+    /** Keyring file path when source === "file"; omitted for env-backed keys. */
+    path?: string;
+};
+export type DevKeypairOptions = {
+    /** Override the keyring file path (file-backed source). */
+    path?: string;
+    /** Environment to read; defaults to process.env. */
+    env?: Record<string, string | undefined>;
+};
+/**
+ * Resolve the file-backed dev keyring path: an explicit override, else
+ * `$AXTARY_HOME/sdk-dev-keyring.json`, else project-local
+ * `.axtary/sdk-dev-keyring.json`.
+ */
+export declare function resolveDevKeyringPath(options?: DevKeypairOptions): string;
+/**
+ * Resolve a stable, persistent ES256 dev keypair with zero manual JWK code.
+ * Resolution order: AXTARY_DEV_SIGNING_KEY (env-backed, shared across
+ * processes) → a local keyring file (default `.axtary/sdk-dev-keyring.json`,
+ * `0600`, gitignored). Both verify across process restarts. Pass the result
+ * straight to the SDK: `createAxtary(await devKeypair())`.
+ *
+ * This is a development convenience. For production use a real issuer key or a
+ * hosted issuer; the file-backed key never leaves the machine and the env-backed
+ * key is whatever the operator provisions.
+ */
+export declare function devKeypair(options?: DevKeypairOptions): Promise<DevKeypair>;
+//# sourceMappingURL=dev-key.d.ts.map

package/dist/dev-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-key.d.ts","sourceRoot":"","sources":["../src/dev-key.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAa,KAAK,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,CAAC;AAG3D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,8EAA8E;AAC9E,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,eAAe,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9C,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,UAAU,EAAE,SAAS,CAAC;IACtB,6CAA6C;IAC7C,eAAe,EAAE,GAAG,CAAC;IACrB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAU7E;AAgCD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAkBrB"}