@heyatom/bastion-client 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.9.0
+
+### Added
+
+- `verifyWebhookSignature` verifies [Standard Webhooks](https://www.standardwebhooks.com/) headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`: space-separated `v1,<base64 HMAC-SHA256("<id>.<timestamp>.<body>")>`, secret used as UTF-8). When any of them is present they are the ones checked: same tolerance, any secret against any `v1` entry, `deliveryId` = `webhook-id`, result `version: 'standard'`.
+- Header name constants `WEBHOOK_ID_HEADER`, `WEBHOOK_TIMESTAMP_HEADER`, `WEBHOOK_SIGNATURE_HEADER`.
+
+### Changed
+
+- Without Standard Webhooks headers, `X-Bastion-Signature-V2` is verified exactly as before, so receivers keep working against an older Bastion. Bastion sends both for one release and will then drop V2. `allowLegacySignature` is unchanged.
+- Whitespace-only entries in `secrets` (e.g. `' '` from an unset env var) are ignored instead of keying the HMAC; if none is left the result is `{ ok: false, reason: 'missing' }`. Other secrets are still used byte-exact (not trimmed).
+
+### Breaking (types)
+
+- `VerifyWebhookResult` gains the `version: 'standard'` variant: an exhaustive `switch` on `version` needs the new case.
+
+## 0.8.1
+
+### Added
+
+- Error code `STEP_UP_FAILED`: the 401 Bastion answers when the current password or 2FA code of a step-up protected route is wrong (or the step-up counter is locked). Tells a wrong factor apart from a dead session, also a 401 (`INVALID_CREDENTIALS`). Needs a Bastion that sends `code: 'STEP_UP_FAILED'`; an older one still classifies as `INVALID_CREDENTIALS`.
+
 ## 0.8.0
 
 ### Breaking

package/README.md

@@ -143,7 +143,8 @@ Every failed call throws `BastionHttpError` (core) or `BastionHttpException` (Ne
 
 `INVALID_CREDENTIALS`, `EMAIL_NOT_VERIFIED`, `NO_APP_ACCESS`, `ACCOUNT_INACTIVE`,
 `INVALID_APP_CONTEXT` (your configuration, not the user), `INVALID_REFRESH_TOKEN`,
-`INVALID_OAUTH_CODE`, `VALIDATION_FAILED`, `CONFLICT`, `RATE_LIMITED`, the age-gate codes
+`INVALID_OAUTH_CODE`, `VALIDATION_FAILED`, `STEP_UP_FAILED` (wrong current password or 2FA
+code on a step-up route: the session is fine), `CONFLICT`, `RATE_LIMITED`, the age-gate codes
 (`BIRTH_DATE_REQUIRED`, `BIRTH_DATE_INVALID`, `UNDER_MINIMUM_AGE`), the OAuth flow codes
 (`OAUTH_*`), `UNAVAILABLE` (Bastion unreachable or timed out) and `UPSTREAM`.
 
@@ -206,8 +207,12 @@ if (!result.ok) throw new UnauthorizedException(result.reason);
 // result.deliveryId: store it and ignore repeats
 ```
 
-Checks `X-Bastion-Signature-V2` (timestamp + delivery id + body, 5 min tolerance). Leave
-`allowLegacySignature` off.
+Checks [Standard Webhooks](https://www.standardwebhooks.com/) headers (`webhook-id`,
+`webhook-timestamp`, `webhook-signature`) when present: HMAC-SHA256 over id + timestamp + body,
+5 min tolerance, secret used as a UTF-8 string, `result.deliveryId` = `webhook-id`. Without them
+it falls back to `X-Bastion-Signature-V2` (same guarantees), so it works against an older Bastion
+too; Bastion will stop sending V2 in a later release. `result.version` says which one matched.
+Leave `allowLegacySignature` off.
 
 ## Changelog
 

package/dist/cjs/core/errors.d.ts

@@ -23,6 +23,8 @@ export declare const BastionErrorCode: {
     readonly INVALID_OAUTH_CODE: "INVALID_OAUTH_CODE";
     /** A 400 carrying field errors (`BastionHttpError.errors`): Bastion's `ValidationPipe`. */
     readonly VALIDATION_FAILED: "VALIDATION_FAILED";
+    /** A 401 from a step-up protected route (password change, email change, 2FA setup/confirm/disable, account delete): the current password or 2FA code is wrong, or the step-up counter is locked. The session is fine — do not log the user out. Bastion sends it as `code`; an older Bastion sends a plain 401, classified `INVALID_CREDENTIALS`. */
+    readonly STEP_UP_FAILED: "STEP_UP_FAILED";
     readonly CONFLICT: "CONFLICT";
     readonly RATE_LIMITED: "RATE_LIMITED";
     readonly BIRTH_DATE_REQUIRED: "BIRTH_DATE_REQUIRED";

package/dist/cjs/core/errors.js

@@ -32,6 +32,8 @@ exports.BastionErrorCode = {
     INVALID_OAUTH_CODE: 'INVALID_OAUTH_CODE',
     /** A 400 carrying field errors (`BastionHttpError.errors`): Bastion's `ValidationPipe`. */
     VALIDATION_FAILED: 'VALIDATION_FAILED',
+    /** A 401 from a step-up protected route (password change, email change, 2FA setup/confirm/disable, account delete): the current password or 2FA code is wrong, or the step-up counter is locked. The session is fine — do not log the user out. Bastion sends it as `code`; an older Bastion sends a plain 401, classified `INVALID_CREDENTIALS`. */
+    STEP_UP_FAILED: 'STEP_UP_FAILED',
     CONFLICT: 'CONFLICT',
     RATE_LIMITED: 'RATE_LIMITED',
     BIRTH_DATE_REQUIRED: 'BIRTH_DATE_REQUIRED',

package/dist/cjs/webhooks/index.d.ts

@@ -3,6 +3,10 @@ export declare const BASTION_SIGNATURE_HEADER = "x-bastion-signature";
 export declare const BASTION_SIGNATURE_V2_HEADER = "x-bastion-signature-v2";
 export declare const BASTION_EVENT_HEADER = "x-bastion-event";
 export declare const BASTION_DELIVERY_ID_HEADER = "x-bastion-delivery-id";
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export declare const WEBHOOK_ID_HEADER = "webhook-id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export declare const BASTION_LIFECYCLE_EVENTS: readonly ["user.deleted", "user.expired_unverified", "user.deactivated"];
 export interface BastionWebhookPayload {
@@ -33,12 +37,17 @@ export interface VerifyWebhookOptions {
      * left to migrate: leave it off.
      */
     allowLegacySignature?: boolean;
-    /** Max age of `t` on a v2 signature, default 300 s. */
+    /** Max distance of the signed timestamp from now (Standard Webhooks and v2), default 300 s. */
     toleranceSeconds?: number;
     /** For tests. */
     now?: () => number;
 }
 export type VerifyWebhookResult = {
+    ok: true;
+    version: 'standard';
+    timestamp: number;
+    deliveryId: string;
+} | {
     ok: true;
     version: 'v2';
     timestamp: number;
@@ -51,12 +60,17 @@ export type VerifyWebhookResult = {
     reason: 'missing' | 'malformed' | 'stale' | 'mismatch';
 };
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export declare function verifyWebhookSignature(options: VerifyWebhookOptions): VerifyWebhookResult;

package/dist/cjs/webhooks/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BASTION_LIFECYCLE_EVENTS = exports.BASTION_DELIVERY_ID_HEADER = exports.BASTION_EVENT_HEADER = exports.BASTION_SIGNATURE_V2_HEADER = exports.BASTION_SIGNATURE_HEADER = void 0;
+exports.BASTION_LIFECYCLE_EVENTS = exports.WEBHOOK_SIGNATURE_HEADER = exports.WEBHOOK_TIMESTAMP_HEADER = exports.WEBHOOK_ID_HEADER = exports.BASTION_DELIVERY_ID_HEADER = exports.BASTION_EVENT_HEADER = exports.BASTION_SIGNATURE_V2_HEADER = exports.BASTION_SIGNATURE_HEADER = void 0;
 exports.verifyWebhookSignature = verifyWebhookSignature;
 const node_crypto_1 = require("node:crypto");
 /** Headers Bastion sends with every delivery. Lower-case, as Node exposes them. */
@@ -8,14 +8,18 @@ exports.BASTION_SIGNATURE_HEADER = 'x-bastion-signature';
 exports.BASTION_SIGNATURE_V2_HEADER = 'x-bastion-signature-v2';
 exports.BASTION_EVENT_HEADER = 'x-bastion-event';
 exports.BASTION_DELIVERY_ID_HEADER = 'x-bastion-delivery-id';
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+exports.WEBHOOK_ID_HEADER = 'webhook-id';
+exports.WEBHOOK_TIMESTAMP_HEADER = 'webhook-timestamp';
+exports.WEBHOOK_SIGNATURE_HEADER = 'webhook-signature';
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 exports.BASTION_LIFECYCLE_EVENTS = ['user.deleted', 'user.expired_unverified', 'user.deactivated'];
 function header(headers, name) {
-    const direct = headers[name] ?? headers[name.toLowerCase()];
-    if (direct !== undefined)
-        return Array.isArray(direct) ? direct[0] : direct;
-    const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
-    const v = key ? headers[key] : undefined;
+    let v = headers[name];
+    if (v === undefined) {
+        const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
+        v = key === undefined ? undefined : headers[key];
+    }
     return Array.isArray(v) ? v[0] : v;
 }
 function macEquals(hexA, hexB) {
@@ -23,20 +27,54 @@ function macEquals(hexA, hexB) {
     const b = Buffer.from(hexB, 'hex');
     return a.length === b.length && a.length > 0 && (0, node_crypto_1.timingSafeEqual)(a, b);
 }
+function isFresh(timestamp, options) {
+    const now = Math.floor((options.now ?? Date.now)() / 1000);
+    return Math.abs(now - timestamp) <= (options.toleranceSeconds ?? 300);
+}
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 function verifyWebhookSignature(options) {
     const body = typeof options.rawBody === 'string' ? Buffer.from(options.rawBody, 'utf8') : options.rawBody;
-    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(Boolean);
+    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(
+    // A whitespace-only secret is a misconfiguration, never a key; the rest are used byte-exact.
+    (s) => typeof s === 'string' && s.trim() !== '');
     if (secrets.length === 0)
         return { ok: false, reason: 'missing' };
+    const stdId = header(options.headers, exports.WEBHOOK_ID_HEADER);
+    const stdTs = header(options.headers, exports.WEBHOOK_TIMESTAMP_HEADER);
+    const stdSig = header(options.headers, exports.WEBHOOK_SIGNATURE_HEADER);
+    if (stdId || stdTs || stdSig) {
+        const macs = (stdSig ?? '')
+            .split(' ')
+            .map((entry) => entry.split(','))
+            .filter(([version, value]) => version === 'v1' && value)
+            .map(([, value]) => Buffer.from(value, 'base64'));
+        if (!stdId || !stdTs || !/^\d+$/.test(stdTs) || macs.length === 0)
+            return { ok: false, reason: 'malformed' };
+        const timestamp = Number(stdTs);
+        if (!isFresh(timestamp, options))
+            return { ok: false, reason: 'stale' };
+        const signed = Buffer.concat([Buffer.from(`${stdId}.${stdTs}.`, 'utf8'), body]);
+        for (const secret of secrets) {
+            const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(signed).digest();
+            if (macs.some((mac) => mac.length === expected.length && (0, node_crypto_1.timingSafeEqual)(mac, expected))) {
+                return { ok: true, version: 'standard', timestamp, deliveryId: stdId };
+            }
+        }
+        return { ok: false, reason: 'mismatch' };
+    }
     const v2 = header(options.headers, exports.BASTION_SIGNATURE_V2_HEADER);
     if (v2) {
         const parts = v2.split(',').map((p) => p.trim());
@@ -46,8 +84,7 @@ function verifyWebhookSignature(options) {
         const timestamp = Number(t);
         if (!t || !id || macs.length === 0 || !Number.isFinite(timestamp))
             return { ok: false, reason: 'malformed' };
-        const now = Math.floor((options.now ?? Date.now)() / 1000);
-        if (Math.abs(now - timestamp) > (options.toleranceSeconds ?? 300))
+        if (!isFresh(timestamp, options))
             return { ok: false, reason: 'stale' };
         const signed = Buffer.concat([Buffer.from(`${timestamp}.${id}.`, 'utf8'), body]);
         for (const secret of secrets) {

package/dist/esm/core/errors.d.ts

@@ -23,6 +23,8 @@ export declare const BastionErrorCode: {
     readonly INVALID_OAUTH_CODE: "INVALID_OAUTH_CODE";
     /** A 400 carrying field errors (`BastionHttpError.errors`): Bastion's `ValidationPipe`. */
     readonly VALIDATION_FAILED: "VALIDATION_FAILED";
+    /** A 401 from a step-up protected route (password change, email change, 2FA setup/confirm/disable, account delete): the current password or 2FA code is wrong, or the step-up counter is locked. The session is fine — do not log the user out. Bastion sends it as `code`; an older Bastion sends a plain 401, classified `INVALID_CREDENTIALS`. */
+    readonly STEP_UP_FAILED: "STEP_UP_FAILED";
     readonly CONFLICT: "CONFLICT";
     readonly RATE_LIMITED: "RATE_LIMITED";
     readonly BIRTH_DATE_REQUIRED: "BIRTH_DATE_REQUIRED";

package/dist/esm/core/errors.js

@@ -26,6 +26,8 @@ export const BastionErrorCode = {
     INVALID_OAUTH_CODE: 'INVALID_OAUTH_CODE',
     /** A 400 carrying field errors (`BastionHttpError.errors`): Bastion's `ValidationPipe`. */
     VALIDATION_FAILED: 'VALIDATION_FAILED',
+    /** A 401 from a step-up protected route (password change, email change, 2FA setup/confirm/disable, account delete): the current password or 2FA code is wrong, or the step-up counter is locked. The session is fine — do not log the user out. Bastion sends it as `code`; an older Bastion sends a plain 401, classified `INVALID_CREDENTIALS`. */
+    STEP_UP_FAILED: 'STEP_UP_FAILED',
     CONFLICT: 'CONFLICT',
     RATE_LIMITED: 'RATE_LIMITED',
     BIRTH_DATE_REQUIRED: 'BIRTH_DATE_REQUIRED',

package/dist/esm/webhooks/index.d.ts

@@ -3,6 +3,10 @@ export declare const BASTION_SIGNATURE_HEADER = "x-bastion-signature";
 export declare const BASTION_SIGNATURE_V2_HEADER = "x-bastion-signature-v2";
 export declare const BASTION_EVENT_HEADER = "x-bastion-event";
 export declare const BASTION_DELIVERY_ID_HEADER = "x-bastion-delivery-id";
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export declare const WEBHOOK_ID_HEADER = "webhook-id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export declare const BASTION_LIFECYCLE_EVENTS: readonly ["user.deleted", "user.expired_unverified", "user.deactivated"];
 export interface BastionWebhookPayload {
@@ -33,12 +37,17 @@ export interface VerifyWebhookOptions {
      * left to migrate: leave it off.
      */
     allowLegacySignature?: boolean;
-    /** Max age of `t` on a v2 signature, default 300 s. */
+    /** Max distance of the signed timestamp from now (Standard Webhooks and v2), default 300 s. */
     toleranceSeconds?: number;
     /** For tests. */
     now?: () => number;
 }
 export type VerifyWebhookResult = {
+    ok: true;
+    version: 'standard';
+    timestamp: number;
+    deliveryId: string;
+} | {
     ok: true;
     version: 'v2';
     timestamp: number;
@@ -51,12 +60,17 @@ export type VerifyWebhookResult = {
     reason: 'missing' | 'malformed' | 'stale' | 'mismatch';
 };
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export declare function verifyWebhookSignature(options: VerifyWebhookOptions): VerifyWebhookResult;

package/dist/esm/webhooks/index.js

@@ -4,14 +4,18 @@ export const BASTION_SIGNATURE_HEADER = 'x-bastion-signature';
 export const BASTION_SIGNATURE_V2_HEADER = 'x-bastion-signature-v2';
 export const BASTION_EVENT_HEADER = 'x-bastion-event';
 export const BASTION_DELIVERY_ID_HEADER = 'x-bastion-delivery-id';
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export const WEBHOOK_ID_HEADER = 'webhook-id';
+export const WEBHOOK_TIMESTAMP_HEADER = 'webhook-timestamp';
+export const WEBHOOK_SIGNATURE_HEADER = 'webhook-signature';
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export const BASTION_LIFECYCLE_EVENTS = ['user.deleted', 'user.expired_unverified', 'user.deactivated'];
 function header(headers, name) {
-    const direct = headers[name] ?? headers[name.toLowerCase()];
-    if (direct !== undefined)
-        return Array.isArray(direct) ? direct[0] : direct;
-    const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
-    const v = key ? headers[key] : undefined;
+    let v = headers[name];
+    if (v === undefined) {
+        const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
+        v = key === undefined ? undefined : headers[key];
+    }
     return Array.isArray(v) ? v[0] : v;
 }
 function macEquals(hexA, hexB) {
@@ -19,20 +23,54 @@ function macEquals(hexA, hexB) {
     const b = Buffer.from(hexB, 'hex');
     return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
 }
+function isFresh(timestamp, options) {
+    const now = Math.floor((options.now ?? Date.now)() / 1000);
+    return Math.abs(now - timestamp) <= (options.toleranceSeconds ?? 300);
+}
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export function verifyWebhookSignature(options) {
     const body = typeof options.rawBody === 'string' ? Buffer.from(options.rawBody, 'utf8') : options.rawBody;
-    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(Boolean);
+    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(
+    // A whitespace-only secret is a misconfiguration, never a key; the rest are used byte-exact.
+    (s) => typeof s === 'string' && s.trim() !== '');
     if (secrets.length === 0)
         return { ok: false, reason: 'missing' };
+    const stdId = header(options.headers, WEBHOOK_ID_HEADER);
+    const stdTs = header(options.headers, WEBHOOK_TIMESTAMP_HEADER);
+    const stdSig = header(options.headers, WEBHOOK_SIGNATURE_HEADER);
+    if (stdId || stdTs || stdSig) {
+        const macs = (stdSig ?? '')
+            .split(' ')
+            .map((entry) => entry.split(','))
+            .filter(([version, value]) => version === 'v1' && value)
+            .map(([, value]) => Buffer.from(value, 'base64'));
+        if (!stdId || !stdTs || !/^\d+$/.test(stdTs) || macs.length === 0)
+            return { ok: false, reason: 'malformed' };
+        const timestamp = Number(stdTs);
+        if (!isFresh(timestamp, options))
+            return { ok: false, reason: 'stale' };
+        const signed = Buffer.concat([Buffer.from(`${stdId}.${stdTs}.`, 'utf8'), body]);
+        for (const secret of secrets) {
+            const expected = createHmac('sha256', secret).update(signed).digest();
+            if (macs.some((mac) => mac.length === expected.length && timingSafeEqual(mac, expected))) {
+                return { ok: true, version: 'standard', timestamp, deliveryId: stdId };
+            }
+        }
+        return { ok: false, reason: 'mismatch' };
+    }
     const v2 = header(options.headers, BASTION_SIGNATURE_V2_HEADER);
     if (v2) {
         const parts = v2.split(',').map((p) => p.trim());
@@ -42,8 +80,7 @@ export function verifyWebhookSignature(options) {
         const timestamp = Number(t);
         if (!t || !id || macs.length === 0 || !Number.isFinite(timestamp))
             return { ok: false, reason: 'malformed' };
-        const now = Math.floor((options.now ?? Date.now)() / 1000);
-        if (Math.abs(now - timestamp) > (options.toleranceSeconds ?? 300))
+        if (!isFresh(timestamp, options))
             return { ok: false, reason: 'stale' };
         const signed = Buffer.concat([Buffer.from(`${timestamp}.${id}.`, 'utf8'), body]);
         for (const secret of secrets) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",