permdock 0.1.0 → 0.2.0

package/dist/testing/saas/index.d.ts

@@ -1,7 +1,7 @@
-import { Qt as PermDockOptions, at as LimitStore, cr as CustomRole, ft as RelationSource, hr as Subject, ir as Actor, mr as Principal, pr as Membership, ur as Delegation } from "../../policy-CInmNGkM.js";
-import { d as Permission } from "../../permissions-B4apnahQ.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-B8vCg_bI.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Cq2fB8Q5.js";
+import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-CFZAr_Al.js";
+import { f as Permission } from "../../permissions-DttnqqxC.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D8UFyERw.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CofRqesP.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-BRrZzJkM.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-Bj_FFkjN.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-B8vCg_bI.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1,2 +1,2 @@
-import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CofRqesP.js";
+import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
 export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/token-CIWxJOCh.js

@@ -0,0 +1,50 @@
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/core/token.ts
+/**
+* Only stable identity goes into the token, so refreshing a session (new
+* roles, assurance or claims) does not orphan an outstanding approval.
+*/
+function principalIdentity(principal) {
+	if (principal === null) return null;
+	return {
+		id: principal.id,
+		tenant: principal.tenant ?? null,
+		issuer: principal.issuer ?? null
+	};
+}
+/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
+function versionOf(row, field) {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
+	const value = row[field];
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
+	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
+}
+/** The digest that binds a token to the call's data when no row id does. */
+function payloadDigest(data) {
+	return bytesToBase64Url(sha256(canonicalJson(data)));
+}
+/**
+* `version` is set only for an approval that goes stale on a resource
+* change; without it the payload, and so every other token, is unchanged.
+* `payload` is set when `resourceId` is `*` (a collection action or a row
+* without an id), so an approval covers the arguments it was given and no
+* others.
+*/
+function decisionToken(input) {
+	const payload = JSON.stringify({
+		key: input.key,
+		resourceId: input.resourceId,
+		principal: principalIdentity(input.principal),
+		actor: input.actor === void 0 ? null : {
+			id: input.actor.id,
+			kind: input.actor.kind
+		},
+		fingerprint: input.fingerprint,
+		...input.version === void 0 ? {} : { version: input.version },
+		...input.payload === void 0 ? {} : { payload: input.payload }
+	});
+	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+}
+//#endregion
+export { payloadDigest as n, versionOf as r, decisionToken as t };

package/dist/trpc/index.d.ts

@@ -1,10 +1,9 @@
-import { $ as DecisionSink, C as Policy, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { C as Policy, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { S as ConnectionOptions, b as Connection, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption } from "../create-BKF3dgFk.js";
-import { t as StreamProtectOptions } from "../stream-BhMfZOwr.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
@@ -17,27 +16,9 @@ type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
   }) => Promise<unknown>;
 };
 type TrpcMiddleware = AnyTRPCMiddlewareFunction;
-type TrpcPermDockOptions<TCtx = object, TUser = unknown> = {
-  readonly subject: (opts: TrpcMiddlewareOpts<TCtx>) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<TrpcMiddlewareOpts<TCtx>>;
+type TrpcPermDockOptions<TCtx = object, TUser = unknown> = ServerAdapterOptions<TrpcMiddlewareOpts<TCtx>, TUser> & {
   /** The Web `Request` behind a context; defaults to `ctx.request` or `ctx.req`. */
   readonly request?: (ctx: TCtx) => Request | null | undefined;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
   /** Ends or revalidates open subscriptions. */
   readonly revocations?: RevocationFeed;
 };
@@ -53,7 +34,7 @@ type TrpcOpenApiHooks = {
 };
 type TrpcPermDock<TCtx = object> = {
   readonly permdock: () => TrpcMiddleware;
-  readonly protect: (permission: Permission, loadData?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
+  readonly protect: (permission: Permission | null, loadData?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
   /** A long-lived connection for the request behind `ctx`. */
   readonly connection: (opts: TrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   readonly permdockHandler: (request: Request) => Promise<Response>;

package/dist/trpc/index.js

@@ -1,29 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { o as invalidSignatureResponse } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
-import { n as guardIterable, r as isAsyncIterable } from "../stream-Q_xlB6Ko.js";
+import { a as problemMessage } from "../http-SO7qGttf.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { n as attached } from "../bind-VnYn2HKq.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
-function requestFromCtx(ctx) {
-	if ("request" in ctx && ctx.request instanceof Request) return ctx.request;
-	if ("req" in ctx && ctx.req instanceof Request) return ctx.req;
-}
-function problemMessage(cause, fallback) {
-	if (cause !== null && typeof cause === "object" && "detail" in cause && typeof cause.detail === "string" && cause.detail.length > 0) return cause.detail;
-	return fallback;
-}
 const PROBLEM = Symbol.for("permdock.problem");
-function trpcCode(status) {
-	switch (status) {
-		case 400: return "BAD_REQUEST";
-		case 401: return "UNAUTHORIZED";
-		case 404: return "NOT_FOUND";
-		case 429: return "TOO_MANY_REQUESTS";
-		case 503: return "SERVICE_UNAVAILABLE";
-		default: return "FORBIDDEN";
-	}
-}
 /** A `TRPCError` for a revoked subscription; the Problem Details body rides on `cause`. */
 function trpcErrorFrom(error) {
 	const problem = error.toProblemDetails();
@@ -33,23 +15,18 @@ function trpcErrorFrom(error) {
 		enumerable: true
 	});
 	return new TRPCError({
-		code: trpcCode(problem.status),
+		code: rpcCode(problem.status),
 		message: error.code,
 		cause
 	});
 }
 async function throwTrpcError(response) {
-	let cause;
-	try {
-		cause = await response.json();
-	} catch {
-		cause = { status: response.status };
-	}
+	const cause = await problemBody(response);
 	if (cause !== null && typeof cause === "object") Object.defineProperty(cause, PROBLEM, {
 		value: true,
 		enumerable: true
 	});
-	const code = trpcCode(response.status);
+	const code = rpcCode(response.status);
 	throw new TRPCError({
 		code,
 		message: problemMessage(cause, code),
@@ -80,84 +57,27 @@ function errorFormatter(opts) {
 	};
 }
 function createPermDock(policy, options) {
-	const optsByRequest = /* @__PURE__ */ new WeakMap();
-	const requestByCtx = /* @__PURE__ */ new WeakMap();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => {
-			const opts = optsByRequest.get(request);
-			return opts === void 0 ? null : options.subject(opts);
-		},
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		revocations: options.revocations,
-		adapter: "trpc"
-	}));
-	const requestOf = (ctx) => {
-		if (options.request !== void 0) try {
-			return options.request(ctx) ?? void 0;
-		} catch {
-			return;
-		}
-		return requestFromCtx(ctx);
-	};
-	/**
-	* One `Request` per HTTP request, shared by every procedure in a batch. The
-	* subject reads the first procedure's opts; the tenant is resolved from each
-	* procedure's own opts in `scopeOf`, never through the shared `Request`.
-	*/
-	const bind = (opts) => {
-		const ctx = opts.ctx;
-		const hit = requestByCtx.get(ctx);
-		if (hit !== void 0) return hit;
-		const request = requestOf(opts.ctx) ?? new Request(`http://localhost/trpc/${opts.path}`, { method: "POST" });
-		requestByCtx.set(ctx, request);
-		if (!optsByRequest.has(request)) optsByRequest.set(request, opts);
-		return request;
-	};
-	const scopeOf = (opts) => tenantScope(options.tenant, opts);
-	const attach = (ctx, request) => {
-		requestByCtx.set(ctx, request);
-	};
+	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
 	const permdock = () => (async (opts) => {
 		const request = bind(opts);
-		let instance;
-		try {
-			instance = await kernel.permdock(request, await scopeOf(opts));
-		} catch (error) {
-			const response = invalidSignatureResponse(error);
-			if (response !== void 0) return throwTrpcError(response);
-			throw error;
-		}
+		const instance = await attached(async () => kernel.permdock(request, await scopeOf(opts)));
+		if (!instance.ok) return throwTrpcError(instance.response);
 		const nextCtx = {
 			...opts.ctx,
-			permdock: instance
+			permdock: instance.permdock
 		};
 		attach(nextCtx, request);
 		return mapDownstream(await opts.next({ ctx: nextCtx }));
 	});
-	const connection = async (opts, connectionOptions) => kernel.connection(bind(opts), connectionOptions, await scopeOf(opts));
 	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
 	const guardSubscription = async (result, opts, permission, loadData, protectOptions) => {
 		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
-		const conn = await connection(opts, compact({
-			permission,
-			data: loadData
-		}));
 		return {
 			...result,
-			data: guardIterable(result.data, conn, compact({
-				items: protectOptions?.items,
+			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, {
 				unwrap: (item) => isTrackedEnvelope(item) ? item[1] : item,
 				onRevoked: trpcErrorFrom
-			}))
+			})
 		};
 	};
 	const protect = (permission, loadData, protectOptions) => (async (opts) => {
@@ -170,20 +90,17 @@ function createPermDock(policy, options) {
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions);
+			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions);
 		}
 		return throwTrpcError(guard.response);
 	});
 	const permdockHandler = (request) => {
-		const opts = {
+		return evaluate(request, {
 			ctx: { req: request },
 			path: "permdock",
 			type: "unknown",
 			next: (nextOpts) => Promise.resolve(nextOpts ?? { ctx: { req: request } })
-		};
-		bind(opts);
-		const { POST, GET } = kernel.permdockHandler(() => scopeOf(opts));
-		return Promise.resolve(request.method === "GET" ? GET(request) : POST(request));
+		});
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {

package/dist/types-9AWO9EGt.d.ts

@@ -0,0 +1,197 @@
+import { Cr as Actor, Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, ct as JwtClaims, et as AuthEvent, gt as MembershipSource } from "./policy-CFZAr_Al.js";
+import { f as ApprovalStore } from "./types-vKyAMtcX.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/ssf/types.d.ts
+type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change";
+type SetSubject = {
+  readonly format: string;
+  readonly [key: string]: unknown;
+};
+type SsfSubject = {
+  readonly id: string;
+  readonly session?: string;
+  readonly issuer?: string;
+};
+type SsfSubjectMapper = (setSubject: SetSubject, meta?: {
+  readonly session?: string;
+  readonly issuer?: string;
+}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
+type SsfEventInput = {
+  readonly subject: SsfSubject;
+  readonly event: Readonly<Record<string, unknown>>;
+  readonly event_timestamp?: number;
+  readonly jti: string;
+  readonly type: string;
+};
+type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
+type SsfOnEvent = { readonly [K in CaepEventName]?: SsfEventHandler; } & {
+  readonly "*"?: SsfEventHandler;
+};
+/**
+ * Keys are opaque strings namespaced by issuer. A store that implements both
+ * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
+ * one with only `seen` and `remember` is checked and recorded non-atomically.
+ */
+type ReplayStore = {
+  seen(key: string): boolean | Promise<boolean>;
+  remember(key: string, expiresAt?: number): void | Promise<void>;
+  /** Records `key` and returns `true` only if it was not already recorded. */
+  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  /** Forgets a claimed `key` so a failed delivery can be retried. */
+  release?(key: string): void | Promise<void>;
+};
+type SsfAuditEvent = {
+  readonly type: string;
+  readonly subject?: SsfSubject;
+  readonly transmitter?: string;
+  readonly jti?: string;
+  readonly replayed?: true;
+  readonly cancelled?: number;
+  readonly unknown?: "event" | "subject";
+  readonly err?: string;
+  readonly cause?: TokenFailureCause;
+};
+type SsfEventListener = (event: SsfAuditEvent) => void;
+type PollOptions = {
+  readonly endpoint: string;
+  readonly every?: number | string;
+  readonly token?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+type PollHandle = {
+  readonly stop: () => void;
+};
+type PollResult = {
+  readonly acked: readonly string[];
+};
+type SsfPermDockOptions = {
+  readonly issuer?: string;
+  readonly audience: string | readonly string[];
+  readonly jwks?: JwtJwks | string;
+  readonly discovery?: DiscoveryInput;
+  readonly verifier?: TokenVerifier;
+  readonly subject: SsfSubjectMapper;
+  readonly onEvent?: SsfOnEvent;
+  readonly replay?: ReplayStore;
+  readonly approvals?: ApprovalStore;
+  /**
+   * Publishes `session-revoked` for a revoked session and `changed` for
+   * credential, assurance and claims changes, so open connections end or
+   * revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly clockTolerance?: number;
+};
+type SsfReceiver = {
+  push(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  poll(options: PollOptions): Promise<PollResult> | PollHandle;
+  on(event: "event", handler: SsfEventListener): () => void;
+};
+type SsfPermDock = {
+  readonly receiver: SsfReceiver;
+};
+//#endregion
+//#region src/jwt/types.d.ts
+type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
+type JwtProfile = "fapi2";
+type JsonWebKeySet = {
+  readonly keys: readonly Record<string, unknown>[];
+};
+type JwtJwks = URL | string | JsonWebKeySet | {
+  readonly secret: Uint8Array | string;
+};
+type DiscoveryInput = string | {
+  readonly issuer: string;
+  readonly metadata?: {
+    readonly issuer?: string;
+    readonly jwks_uri?: string;
+  };
+};
+type JwksCacheOptions = {
+  readonly minTtl?: number;
+  readonly maxTtl?: number;
+  readonly cooldown?: number;
+  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  readonly timeout?: number;
+};
+type JoseTokenVerifierOptions = {
+  readonly jwks?: JwtJwks;
+  readonly discovery?: DiscoveryInput;
+  readonly issuer?: string;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly typ?: string | readonly string[];
+  readonly audience?: string | readonly string[];
+  readonly clockTolerance?: number;
+  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
+  readonly decryptionAlgorithms?: readonly string[];
+  readonly profile?: JwtProfile;
+  readonly jwksCache?: JwksCacheOptions;
+  readonly fetch?: typeof fetch;
+};
+type JoseTokenSignerOptions = {
+  readonly key: Record<string, unknown> | Uint8Array;
+  readonly alg: JwtAlgorithm;
+  readonly kid: string;
+  readonly issuer?: string;
+};
+type JwtClaimPaths = {
+  readonly id?: string;
+  readonly roles?: string;
+  readonly groups?: string;
+  readonly entitlements?: string;
+  readonly plans?: string;
+  readonly tenant?: string;
+  readonly memberships?: string;
+  readonly kind?: string;
+  readonly assurance?: string | {
+    readonly acr?: string;
+    readonly amr?: string;
+    readonly authTime?: string;
+    /** OpenID Connect for Identity Assurance; default `verified_claims`. */
+    readonly verified?: string;
+  };
+  readonly session?: string;
+};
+type JwtDelegationPaths = {
+  readonly scopes?: string;
+  readonly authorizationDetails?: string;
+  readonly access?: string;
+};
+type JwtSubjectOptions = JoseTokenVerifierOptions & {
+  readonly accept?: "access-token" | "id-token";
+  readonly claims?: JwtClaimPaths;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly schema?: StandardSchemaV1;
+  readonly delegation?: JwtDelegationPaths;
+  readonly actor?: {
+    readonly from?: "act";
+    readonly kind?: string;
+    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    readonly clients?: ClientNames;
+  } | ((claims: JwtClaims) => Actor | undefined);
+  readonly sender?: "none" | "dpop" | "mtls";
+  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  readonly replay?: ReplayStore;
+  readonly memberships?: MembershipSource;
+  readonly verifier?: TokenVerifier;
+  readonly certificateThumbprint?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+type JwtPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type DpopProofResult = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: TokenFailureCause;
+};
+type MappedSubject = Subject<JwtPrincipal>;
+//#endregion
+export { SsfPermDock as C, SsfSubjectMapper as D, SsfSubject as E, SsfOnEvent as S, SsfReceiver as T, SetSubject as _, JsonWebKeySet as a, SsfEventInput as b, JwtJwks as c, MappedSubject as d, CaepEventName as f, ReplayStore as g, PollResult as h, JoseTokenVerifierOptions as i, JwtPrincipal as l, PollOptions as m, DpopProofResult as n, JwtAlgorithm as o, PollHandle as p, JoseTokenSignerOptions as r, JwtClaimPaths as s, DiscoveryInput as t, JwtSubjectOptions as u, SsfAuditEvent as v, SsfPermDockOptions as w, SsfEventListener as x, SsfEventHandler as y };