@pymthouse/builder-sdk 0.3.1 → 0.4.1-rc.1

package/dist/index-BTDKEorK.d.ts

@@ -0,0 +1,64 @@
+import { F as FetchLike } from './types-BORaHW_x.js';
+import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-B-WFDMz6.js';
+import { TrustedHeadersEndUserAuthConfig } from './signer/webhook/adapters/trusted-headers.js';
+
+type WebhookIdentityClaimMapping = {
+    claimClientId: string;
+    claimUsageSubject: string;
+    usageSubjectType: string;
+};
+declare const DEFAULT_WEBHOOK_IDENTITY_CLAIMS: WebhookIdentityClaimMapping;
+declare function identityFromWebhookClaims(claims: Record<string, unknown>, mapping?: Partial<WebhookIdentityClaimMapping>): UsageIdentity;
+declare function claimExpirySeconds(claims: Record<string, unknown>, fallbackTtlSeconds?: number): number;
+
+type WebhookAuthorizeContext = {
+    authorization: string;
+    payload: PaymentWebhookRequest;
+    request: Request;
+    verified: VerifiedEndUserAuth;
+    identity: VerifiedEndUserAuth["identity"];
+};
+type RemoteSignerWebhookConfig = {
+    webhookSecret: string;
+    endUserAuth: EndUserAuthVerifier;
+    afterVerify?: (context: WebhookAuthorizeContext) => Promise<void>;
+};
+declare function authenticateWebhookCaller(request: Request, secret: string): boolean;
+declare function handleRemoteSignerAuthorize(request: Request, config: RemoteSignerWebhookConfig): Promise<Response>;
+declare function createRemoteSignerAuthorizeHandler(config: RemoteSignerWebhookConfig): (request: Request) => Promise<Response>;
+declare function routeRemoteSignerWebhookRequest(request: Request, config: RemoteSignerWebhookConfig): Promise<Response | null>;
+
+declare function bearerTokenFromAuthorization(authorization: string): string;
+
+type OidcEndUserAuthConfig = {
+    jwtIssuer: string;
+    jwtAudience: string;
+    claimMapping?: Partial<WebhookIdentityClaimMapping>;
+    allowInsecureHttp?: boolean;
+    fetch?: FetchLike;
+    requiredScopes?: string[];
+    webhookSecret: string;
+};
+declare function handleRemoteSignerRefreshJwks(request: Request, config: Pick<OidcEndUserAuthConfig, "webhookSecret" | "jwtIssuer" | "fetch" | "allowInsecureHttp">): Promise<Response>;
+declare function createOidcEndUserVerifier(config: OidcEndUserAuthConfig): EndUserAuthVerifier;
+
+type OidcRemoteSignerWebhookConfigInput = OidcEndUserAuthConfig & {
+    afterVerify?: (context: WebhookAuthorizeContext) => Promise<void>;
+};
+type SignerDmzRemoteSignerWebhookConfigInput = OidcRemoteSignerWebhookConfigInput & {
+    /** When true (default), accept Apache DMZ X-Livepeer-* identity headers. */
+    dmzTrustedHeaders?: boolean;
+    trustedHeaders?: Omit<TrustedHeadersEndUserAuthConfig, "expectedIssuer">;
+};
+declare function createOidcRemoteSignerWebhookConfig(input: OidcRemoteSignerWebhookConfigInput): RemoteSignerWebhookConfig;
+/**
+ * PymtHouse signer-dmz: Apache validates the end-user JWT (iss/aud = issuer), injects
+ * X-Livepeer-* headers, and go-livepeer forwards those headers to this webhook per
+ * go-livepeer remote-signer.md. Falls back to Bearer JWT verification when present.
+ */
+declare function createSignerDmzRemoteSignerWebhookConfig(input: SignerDmzRemoteSignerWebhookConfigInput): RemoteSignerWebhookConfig;
+declare function readOidcRemoteSignerWebhookConfigFromEnv(env?: NodeJS.ProcessEnv): RemoteSignerWebhookConfig;
+/** @deprecated Use readOidcRemoteSignerWebhookConfigFromEnv */
+declare const readRemoteSignerWebhookConfigFromEnv: typeof readOidcRemoteSignerWebhookConfigFromEnv;
+
+export { DEFAULT_WEBHOOK_IDENTITY_CLAIMS as D, type OidcRemoteSignerWebhookConfigInput as O, type RemoteSignerWebhookConfig as R, type SignerDmzRemoteSignerWebhookConfigInput as S, type WebhookAuthorizeContext as W, type OidcEndUserAuthConfig as a, type WebhookIdentityClaimMapping as b, authenticateWebhookCaller as c, bearerTokenFromAuthorization as d, claimExpirySeconds as e, createOidcEndUserVerifier as f, createOidcRemoteSignerWebhookConfig as g, createRemoteSignerAuthorizeHandler as h, createSignerDmzRemoteSignerWebhookConfig as i, handleRemoteSignerAuthorize as j, handleRemoteSignerRefreshJwks as k, identityFromWebhookClaims as l, readRemoteSignerWebhookConfigFromEnv as m, routeRemoteSignerWebhookRequest as n, readOidcRemoteSignerWebhookConfigFromEnv as r };

package/dist/index-BixH4VIG.d.cts

@@ -0,0 +1,64 @@
+import { F as FetchLike } from './types-BORaHW_x.cjs';
+import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-B-WFDMz6.cjs';
+import { TrustedHeadersEndUserAuthConfig } from './signer/webhook/adapters/trusted-headers.cjs';
+
+type WebhookIdentityClaimMapping = {
+    claimClientId: string;
+    claimUsageSubject: string;
+    usageSubjectType: string;
+};
+declare const DEFAULT_WEBHOOK_IDENTITY_CLAIMS: WebhookIdentityClaimMapping;
+declare function identityFromWebhookClaims(claims: Record<string, unknown>, mapping?: Partial<WebhookIdentityClaimMapping>): UsageIdentity;
+declare function claimExpirySeconds(claims: Record<string, unknown>, fallbackTtlSeconds?: number): number;
+
+type WebhookAuthorizeContext = {
+    authorization: string;
+    payload: PaymentWebhookRequest;
+    request: Request;
+    verified: VerifiedEndUserAuth;
+    identity: VerifiedEndUserAuth["identity"];
+};
+type RemoteSignerWebhookConfig = {
+    webhookSecret: string;
+    endUserAuth: EndUserAuthVerifier;
+    afterVerify?: (context: WebhookAuthorizeContext) => Promise<void>;
+};
+declare function authenticateWebhookCaller(request: Request, secret: string): boolean;
+declare function handleRemoteSignerAuthorize(request: Request, config: RemoteSignerWebhookConfig): Promise<Response>;
+declare function createRemoteSignerAuthorizeHandler(config: RemoteSignerWebhookConfig): (request: Request) => Promise<Response>;
+declare function routeRemoteSignerWebhookRequest(request: Request, config: RemoteSignerWebhookConfig): Promise<Response | null>;
+
+declare function bearerTokenFromAuthorization(authorization: string): string;
+
+type OidcEndUserAuthConfig = {
+    jwtIssuer: string;
+    jwtAudience: string;
+    claimMapping?: Partial<WebhookIdentityClaimMapping>;
+    allowInsecureHttp?: boolean;
+    fetch?: FetchLike;
+    requiredScopes?: string[];
+    webhookSecret: string;
+};
+declare function handleRemoteSignerRefreshJwks(request: Request, config: Pick<OidcEndUserAuthConfig, "webhookSecret" | "jwtIssuer" | "fetch" | "allowInsecureHttp">): Promise<Response>;
+declare function createOidcEndUserVerifier(config: OidcEndUserAuthConfig): EndUserAuthVerifier;
+
+type OidcRemoteSignerWebhookConfigInput = OidcEndUserAuthConfig & {
+    afterVerify?: (context: WebhookAuthorizeContext) => Promise<void>;
+};
+type SignerDmzRemoteSignerWebhookConfigInput = OidcRemoteSignerWebhookConfigInput & {
+    /** When true (default), accept Apache DMZ X-Livepeer-* identity headers. */
+    dmzTrustedHeaders?: boolean;
+    trustedHeaders?: Omit<TrustedHeadersEndUserAuthConfig, "expectedIssuer">;
+};
+declare function createOidcRemoteSignerWebhookConfig(input: OidcRemoteSignerWebhookConfigInput): RemoteSignerWebhookConfig;
+/**
+ * PymtHouse signer-dmz: Apache validates the end-user JWT (iss/aud = issuer), injects
+ * X-Livepeer-* headers, and go-livepeer forwards those headers to this webhook per
+ * go-livepeer remote-signer.md. Falls back to Bearer JWT verification when present.
+ */
+declare function createSignerDmzRemoteSignerWebhookConfig(input: SignerDmzRemoteSignerWebhookConfigInput): RemoteSignerWebhookConfig;
+declare function readOidcRemoteSignerWebhookConfigFromEnv(env?: NodeJS.ProcessEnv): RemoteSignerWebhookConfig;
+/** @deprecated Use readOidcRemoteSignerWebhookConfigFromEnv */
+declare const readRemoteSignerWebhookConfigFromEnv: typeof readOidcRemoteSignerWebhookConfigFromEnv;
+
+export { DEFAULT_WEBHOOK_IDENTITY_CLAIMS as D, type OidcRemoteSignerWebhookConfigInput as O, type RemoteSignerWebhookConfig as R, type SignerDmzRemoteSignerWebhookConfigInput as S, type WebhookAuthorizeContext as W, type OidcEndUserAuthConfig as a, type WebhookIdentityClaimMapping as b, authenticateWebhookCaller as c, bearerTokenFromAuthorization as d, claimExpirySeconds as e, createOidcEndUserVerifier as f, createOidcRemoteSignerWebhookConfig as g, createRemoteSignerAuthorizeHandler as h, createSignerDmzRemoteSignerWebhookConfig as i, handleRemoteSignerAuthorize as j, handleRemoteSignerRefreshJwks as k, identityFromWebhookClaims as l, readRemoteSignerWebhookConfigFromEnv as m, routeRemoteSignerWebhookRequest as n, readOidcRemoteSignerWebhookConfigFromEnv as r };

package/dist/index.cjs

@@ -244,8 +244,14 @@ var init_fetch_json = __esm({
 });
 
 // src/signer/handler-errors.ts
-function signerHandlerErrorResponse(error) {
+function isPmtHouseError(error) {
   if (error instanceof exports.PmtHouseError) {
+    return true;
+  }
+  return error instanceof Error && typeof error.status === "number" && typeof error.code === "string";
+}
+function signerHandlerErrorResponse(error) {
+  if (isPmtHouseError(error)) {
     return new Response(
       JSON.stringify({
         error: error.code,
@@ -298,6 +304,9 @@ var init_json_fields = __esm({
 });
 
 // src/signer/mint-token.ts
+function signerJwtAudience(issuerUrl) {
+  return stripTrailingSlashes(issuerUrl);
+}
 function parseMintUserSignerTokenResponse(body, ttlRefreshRatio = DEFAULT_TTL_REFRESH_RATIO) {
   const accessToken = readStringField(body, "access_token", TOKEN_RESPONSE_ERROR, "Token response");
   const expiresIn = readExpiresIn(body, TOKEN_RESPONSE_ERROR);
@@ -324,11 +333,11 @@ function parseMintUserSignerTokenResponse(body, ttlRefreshRatio = DEFAULT_TTL_RE
     lifetimeGrantedUsdMicros
   };
 }
-var LIVEPEER_REMOTE_SIGNER_AUDIENCE, DEFAULT_TTL_REFRESH_RATIO, TOKEN_RESPONSE_ERROR;
+var DEFAULT_TTL_REFRESH_RATIO, TOKEN_RESPONSE_ERROR;
 var init_mint_token = __esm({
   "src/signer/mint-token.ts"() {
+    init_string_utils();
     init_json_fields();
-    LIVEPEER_REMOTE_SIGNER_AUDIENCE = "livepeer-remote-signer";
     DEFAULT_TTL_REFRESH_RATIO = 0.8;
     TOKEN_RESPONSE_ERROR = "invalid_token_response";
   }
@@ -395,7 +404,7 @@ async function mintSignerTokenFromDeviceToken(options) {
       code: "oidc_discovery_invalid"
     });
   }
-  const audience = options.audience?.trim() || LIVEPEER_REMOTE_SIGNER_AUDIENCE;
+  const audience = options.audience?.trim() || signerJwtAudience(issuerUrl);
   const params = new URLSearchParams({
     grant_type: TOKEN_EXCHANGE_GRANT,
     subject_token: options.deviceToken,