permdock 0.4.0 → 0.5.0

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-C0dee0Qf.js";
-import { t as memoryReplayStore } from "../replay-COpmZUfx.js";
-import { t as createPermDock } from "../index-DgM7w96K.js";
-export { type CaepEventName, type PollHandle, type PollOptions, type PollResult, type ReplayStore, type SetSubject, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfSubject, type SsfSubjectMapper, createPermDock, memoryReplayStore };
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DiQjupG2.js";
+import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
+import { _ as setPollHandler, a as CaepTokenClaimsChange, c as RiscEvents, d as caepEvents, f as pushSet, g as memorySetQueue, h as streamVerificationEvent, i as CaepEvents, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as createPermDock } from "../index-D8EovfsP.js";
+export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type PollHandle, type PollOptions, type PollResult, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStreamConfiguration, type SsfStreamStatus, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfVerification, caepEvents, createPermDock, memoryReplayStore, memorySetQueue, pushSet, riscEvents, setPollHandler, signSet, streamVerificationEvent };

package/dist/ssf/index.js

@@ -1,7 +1,9 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { t as cancelApprovals } from "../helpers-C9YmyBIa.js";
-import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DMr_Zmb_.js";
-import { t as memoryReplayStore } from "../replay-BsOyTrdV.js";
+import { o as epochSeconds } from "../time-DkWjdL98.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
+import { t as cancelApprovals } from "../helpers-DTcZOzhF.js";
+import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
+import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
 //#region src/ssf/claims.ts
 function asSubject(mapped, session, issuer) {
@@ -46,18 +48,39 @@ function subjectSession(subject) {
 //#endregion
 //#region src/ssf/events.ts
 const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/** SSF 1.0 section 8.1.4.1. */
+const VERIFICATION_EVENT = "https://schemas.openid.net/secevent/ssf/event-type/verification";
 const CAEP_PREFIX = "https://schemas.openid.net/secevent/caep/event-type/";
-const CAEP_NAMES = /* @__PURE__ */ new Set([
+const RISC_PREFIX = "https://schemas.openid.net/secevent/risc/event-type/";
+const CAEP_NAMES = [
 	"session-revoked",
 	"credential-change",
 	"assurance-level-change",
 	"token-claims-change",
-	"device-compliance-change"
-]);
-function caepName(uri) {
-	if (!uri.startsWith(CAEP_PREFIX)) return;
-	const name = uri.slice(52);
-	if (CAEP_NAMES.has(name)) return name;
+	"device-compliance-change",
+	"session-established",
+	"session-presented",
+	"risk-level-change"
+];
+const RISC_NAMES = [
+	"account-disabled",
+	"account-purged",
+	"credential-compromise"
+];
+/** The CAEP or RISC name of an event URI PermDock knows, else `undefined`. */
+function eventName(uri) {
+	if (uri.startsWith("https://schemas.openid.net/secevent/caep/event-type/")) {
+		const name = uri.slice(52);
+		return CAEP_NAMES.find((known) => known === name);
+	}
+	if (uri.startsWith("https://schemas.openid.net/secevent/risc/event-type/")) {
+		const name = uri.slice(52);
+		return RISC_NAMES.find((known) => known === name);
+	}
+}
+/** RISC events that end every session of the subject. */
+function revokesAccount(name) {
+	return RISC_NAMES.some((known) => known === name);
 }
 //#endregion
 //#region src/ssf/poll.ts
@@ -125,6 +148,13 @@ async function pollOnce(input) {
 //#region src/ssf/wire.ts
 const SET_TYP = "secevent+jwt";
 const LOGOUT_TYP = "logout+jwt";
+const SET_CONTENT = "application/secevent+jwt";
+const HANDLER_FAILED = {
+	ok: false,
+	err: "invalid_request",
+	description: "handler failed",
+	retry: true
+};
 function jsonResponse(status, body) {
 	return new Response(JSON.stringify(body), {
 		status,
@@ -178,17 +208,21 @@ function parseEvery(every) {
 }
 //#endregion
 //#region src/ssf/receiver.ts
+/** Seconds a SET without `exp` stays acceptable after its `iat`. */
+const DEFAULT_SET_MAX_AGE = 86400;
 const CHANGED_EVENTS = /* @__PURE__ */ new Set([
 	"credential-change",
 	"assurance-level-change",
 	"token-claims-change"
 ]);
-function replayExpiresAt(claims, clockTolerance = 0) {
-	if (typeof claims["exp"] === "number") return claims["exp"];
-	if (typeof claims["iat"] === "number") {
-		const until = claims["iat"] + clockTolerance;
-		return until > Date.now() / 1e3 ? until : void 0;
-	}
+/**
+* When the replay record of a SET may be dropped: its `exp`, or for a SET
+* without one (RFC 8417 section 2.2) the end of its acceptance window, so
+* the same `jti` cannot pass verification again once the record is gone.
+*/
+function replayExpiresAt(claims, clockTolerance = 0, maxTokenAge = DEFAULT_SET_MAX_AGE) {
+	if (typeof claims["exp"] === "number") return claims["exp"] + clockTolerance;
+	if (typeof claims["iat"] === "number") return claims["iat"] + maxTokenAge + clockTolerance;
 }
 function replayKey(issuer, jti, event) {
 	return JSON.stringify(event === void 0 ? [issuer ?? null, jti] : [
@@ -228,6 +262,12 @@ function createReceiver(config) {
 			description: "missing iat",
 			cause: "invalid-claims"
 		};
+		if (typeof result.claims.exp !== "number" && result.claims.iat + (config.maxTokenAge ?? 86400) + (config.clockTolerance ?? 0) <= epochSeconds()) return {
+			ok: false,
+			err: errForCause("expired"),
+			description: "expired",
+			cause: "expired"
+		};
 		return result;
 	}
 	async function resolveSubject(setSubject, session, issuer) {
@@ -256,21 +296,23 @@ function createReceiver(config) {
 	async function publishRevocation(input) {
 		const feed = config.revocations;
 		if (feed === void 0) return;
-		const kind = input.type === "session-revoked" ? "session-revoked" : CHANGED_EVENTS.has(input.type) ? "changed" : void 0;
+		const account = revokesAccount(input.type);
+		const kind = input.type === "session-revoked" || account ? "session-revoked" : CHANGED_EVENTS.has(input.type) ? "changed" : void 0;
 		if (kind === void 0) return;
 		try {
 			await feed.revoke(compact({
 				principal: input.subject.id,
-				session: kind === "session-revoked" ? input.subject.session : void 0,
+				session: kind === "session-revoked" && !account ? input.subject.session : void 0,
 				kind
 			}));
 		} catch {}
 	}
 	async function cancelSessionApprovals(input) {
-		if (config.approvals === void 0 || input.type !== "session-revoked") return;
+		const account = revokesAccount(input.type);
+		if (config.approvals === void 0 || input.type !== "session-revoked" && !account) return;
 		const count = await cancelApprovals(config.approvals, compact({
 			principalId: input.subject.id,
-			session: input.subject.session
+			session: account ? void 0 : input.subject.session
 		}), {
 			by: "ssf",
 			note: input.jti
@@ -283,7 +325,7 @@ function createReceiver(config) {
 		});
 	}
 	async function dispatch(type, input) {
-		const named = Object.hasOwn(config.onEvent, type) ? config.onEvent[type] : void 0;
+		const named = Object.hasOwn(config.onEvent, type) && type !== "verification" ? config.onEvent[type] : void 0;
 		const wildcard = config.onEvent["*"];
 		const handler = named ?? wildcard;
 		if (handler === void 0) {
@@ -301,11 +343,7 @@ function createReceiver(config) {
 		try {
 			await handler(input);
 		} catch {
-			return {
-				ok: false,
-				err: "invalid_request",
-				description: "handler failed"
-			};
+			return HANDLER_FAILED;
 		}
 		emit({
 			type,
@@ -317,6 +355,25 @@ function createReceiver(config) {
 		await cancelSessionApprovals(input);
 		return { ok: true };
 	}
+	async function verification(payload, issuer, jti) {
+		const state = typeof payload["state"] === "string" ? payload["state"] : void 0;
+		try {
+			await config.onEvent.verification?.(compact({
+				state,
+				jti,
+				issuer
+			}));
+		} catch {
+			return HANDLER_FAILED;
+		}
+		emit({
+			type: "verification",
+			transmitter: issuer,
+			jti,
+			state
+		});
+		return { ok: true };
+	}
 	async function dispatchEvents(entries, run) {
 		const [head, ...tail] = entries;
 		if (head === void 0) return { ok: true };
@@ -325,8 +382,14 @@ function createReceiver(config) {
 		const eventKey = replayKey(issuer, jti, uri);
 		if (run.perEvent && await config.replay.seen(eventKey)) return dispatchEvents(tail, run);
 		const payload = isRecord(raw) ? raw : {};
-		const type = caepName(uri) ?? uri;
-		if (caepName(uri) === void 0 && config.onEvent["*"] === void 0) {
+		if (uri === "https://schemas.openid.net/secevent/ssf/event-type/verification") {
+			const result = await verification(payload, issuer, jti);
+			if (!result.ok) return result;
+			return dispatchEvents(tail, run);
+		}
+		const named = eventName(uri);
+		const type = named ?? uri;
+		if (named === void 0 && config.onEvent["*"] === void 0) {
 			emit({
 				type,
 				transmitter: issuer,
@@ -380,7 +443,7 @@ function createReceiver(config) {
 			cause: "invalid-claims"
 		};
 		const key = replayKey(issuer, jti);
-		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance);
+		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance, config.maxTokenAge);
 		if (!await claimDelivery(key, expiresAt)) {
 			emit({
 				type: "replay",
@@ -391,11 +454,7 @@ function createReceiver(config) {
 			return { ok: true };
 		}
 		const entries = Object.entries(events);
-		let dispatched = {
-			ok: false,
-			err: "invalid_request",
-			description: "handler failed"
-		};
+		let dispatched = HANDLER_FAILED;
 		try {
 			dispatched = await dispatchEvents(entries, {
 				issuer,
@@ -447,7 +506,7 @@ function createReceiver(config) {
 		const jti = verified.claims["jti"];
 		const issuer = typeof verified.claims.iss === "string" ? verified.claims.iss : void 0;
 		const key = replayKey(issuer, jti);
-		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance);
+		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance, config.maxTokenAge);
 		if (!await claimDelivery(key, expiresAt)) {
 			emit({
 				type: "replay",
@@ -457,11 +516,7 @@ function createReceiver(config) {
 			});
 			return { ok: true };
 		}
-		let dispatched = {
-			ok: false,
-			err: "invalid_request",
-			description: "handler failed"
-		};
+		let dispatched = HANDLER_FAILED;
 		try {
 			dispatched = await dispatchLogout(verified.claims, {
 				issuer,
@@ -505,20 +560,28 @@ function createReceiver(config) {
 	}
 	return {
 		async push(request) {
-			if (request.method !== "POST") return rfc8935(400, "invalid_request", "POST required");
+			if (request.method !== "POST") return new Response(null, {
+				status: 405,
+				headers: { allow: "POST" }
+			});
 			if (contentType(request) !== "application/secevent+jwt") return rfc8935(400, "invalid_request", "application/secevent+jwt required");
-			const token = (await request.text()).trim();
+			const read = await readBodyText(request);
+			if (!read.ok) return read.cause === "too-large" ? rfc8935(413, "invalid_request", "body is too large") : rfc8935(400, "invalid_request", "unreadable body");
+			const token = read.text.trim();
 			if (token.length === 0) return rfc8935(400, "invalid_request", "empty body");
 			const result = await ingestSet(token);
-			if (!result.ok) return rfc8935(400, result.err, result.description);
+			if (!result.ok) return result.retry === true ? new Response(null, { status: 500 }) : rfc8935(400, result.err, result.description);
 			return new Response(null, { status: 202 });
 		},
 		async logout(request) {
 			if (request.method !== "POST") return jsonResponse(400, { error: "invalid_request" });
 			if (contentType(request) !== "application/x-www-form-urlencoded") return jsonResponse(400, { error: "invalid_request" });
-			const token = new URLSearchParams(await request.text()).get("logout_token");
+			const read = await readBodyText(request);
+			if (!read.ok) return jsonResponse(read.cause === "too-large" ? 413 : 400, { error: "invalid_request" });
+			const token = new URLSearchParams(read.text).get("logout_token");
 			if (token === null || token.length === 0) return jsonResponse(400, { error: "invalid_request" });
-			if (!(await ingestLogout(token)).ok) return jsonResponse(400, { error: "invalid_request" });
+			const result = await ingestLogout(token);
+			if (!result.ok) return result.retry === true ? new Response(null, { status: 500 }) : jsonResponse(400, { error: "invalid_request" });
 			return new Response(null, { status: 200 });
 		},
 		poll(options) {
@@ -586,8 +649,282 @@ function createPermDock(policy, options) {
 		replay: options.replay ?? memoryReplayStore(),
 		approvals: options.approvals,
 		revocations: options.revocations,
-		clockTolerance: options.clockTolerance
+		clockTolerance: options.clockTolerance,
+		maxTokenAge: options.maxTokenAge
 	})) };
 }
 //#endregion
-export { createPermDock, memoryReplayStore };
+//#region src/ssf/set-queue.ts
+/** The largest poll request body read: acknowledgements and errors for many SETs. */
+const MAX_POLL_BYTES = 262144;
+const DEFAULT_MAX_EVENTS = 100;
+/**
+* An in-process `SetQueue`: pending SETs per stream in insertion order. A
+* process restart loses them; a deployment with more than one instance needs
+* a shared queue.
+*/
+function memorySetQueue() {
+	const streams = /* @__PURE__ */ new Map();
+	const of = (stream) => {
+		let queue = streams.get(stream);
+		if (queue === void 0) {
+			queue = /* @__PURE__ */ new Map();
+			streams.set(stream, queue);
+		}
+		return queue;
+	};
+	return Object.freeze({
+		name: "memory",
+		enqueue(stream, jti, set) {
+			of(stream).set(jti, set);
+		},
+		pending(stream, max) {
+			return [...of(stream)].slice(0, Math.max(0, max)).map(([jti, set]) => ({
+				jti,
+				set
+			}));
+		},
+		ack(stream, jti) {
+			of(stream).delete(jti);
+		},
+		fail(stream, jti, _error) {
+			of(stream).delete(jti);
+		}
+	});
+}
+function setErrors(value) {
+	if (value === void 0) return [];
+	if (!isRecord(value)) return;
+	const out = [];
+	for (const [jti, entry] of Object.entries(value)) {
+		if (!isRecord(entry) || typeof entry["err"] !== "string" || typeof entry["description"] !== "string") return;
+		out.push([jti, {
+			err: entry["err"],
+			description: entry["description"]
+		}]);
+	}
+	return out;
+}
+function parsePollRequest(text) {
+	let parsed;
+	try {
+		parsed = text.trim() === "" ? {} : JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return;
+	const { maxEvents, acks = [] } = parsed;
+	const setErrs = setErrors(parsed["setErrs"]);
+	if (maxEvents !== void 0 && !(Number.isSafeInteger(maxEvents) && Number(maxEvents) >= 0) || !Array.isArray(acks) || !acks.every((jti) => typeof jti === "string") || setErrs === void 0) return;
+	return {
+		...maxEvents === void 0 ? {} : { maxEvents: Number(maxEvents) },
+		acks: acks.map(String),
+		setErrs
+	};
+}
+/**
+* The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's
+* `acks` and `setErrs`, then answers `{ sets, moreAvailable }` with up to
+* `maxEvents` pending SETs. It answers at once whatever `returnImmediately`
+* says, which RFC 8936 section 2.4 allows.
+*/
+function setPollHandler(options) {
+	const cap = options.maxEvents ?? DEFAULT_MAX_EVENTS;
+	return async (request) => {
+		if (request.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		let stream;
+		try {
+			stream = await options.authorize(request);
+		} catch {
+			stream = null;
+		}
+		if (stream === null) return rfc8935(401, "authentication_failed", "poll not authorized");
+		const read = await readBodyText(request, MAX_POLL_BYTES);
+		const body = read.ok ? parsePollRequest(read.text) : void 0;
+		if (body === void 0) return rfc8935(400, "invalid_request", "malformed poll request");
+		const { queue } = options;
+		for (const jti of body.acks) await queue.ack(stream, jti);
+		for (const [jti, error] of body.setErrs) await queue.fail(stream, jti, error);
+		const max = Math.min(body.maxEvents ?? cap, cap);
+		if (max === 0) return jsonResponse(200, { sets: {} });
+		const pending = await queue.pending(stream, max + 1);
+		const sets = {};
+		for (const { jti, set } of pending.slice(0, max)) sets[jti] = set;
+		return jsonResponse(200, {
+			sets,
+			...pending.length > max ? { moreAvailable: true } : {}
+		});
+	};
+}
+//#endregion
+//#region src/ssf/transmitter.ts
+/** SSF 1.0 delivery method URN for RFC 8935 push. */
+const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
+/** SSF 1.0 delivery method URN for RFC 8936 poll. */
+const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
+/** Milliseconds one push may take. */
+const PUSH_TIMEOUT_MS = 3e4;
+/** The largest error body `pushSet` reads. */
+const MAX_ERROR_BYTES = 16384;
+/**
+* Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
+* `sub_id` is the event's subject and `events` holds exactly one entry, as
+* SSF 1.0 requires. `iss` is the signer's own.
+*/
+function signSet(event, signer, options) {
+	return signer.sign(compact({
+		sub_id: event.subject,
+		events: { [event.type]: event.payload },
+		txn: options.txn
+	}), compact({
+		typ: SET_TYP,
+		audience: options.audience,
+		jti: options.jti,
+		issuedAt: options.issuedAt
+	}));
+}
+const ERR_CAUSES = {
+	invalid_request: "invalid-request",
+	invalid_key: "invalid-key",
+	invalid_issuer: "invalid-issuer",
+	invalid_audience: "invalid-audience",
+	authentication_failed: "authentication-failed",
+	access_denied: "access-denied"
+};
+async function errorBody(response) {
+	const read = await readBodyText(response, MAX_ERROR_BYTES);
+	if (!read.ok) return {};
+	try {
+		const parsed = JSON.parse(read.text);
+		if (!isRecord(parsed)) return {};
+		return compact({
+			err: typeof parsed["err"] === "string" ? parsed["err"] : void 0,
+			description: typeof parsed["description"] === "string" ? parsed["description"] : void 0
+		});
+	} catch {
+		return {};
+	}
+}
+/**
+* Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
+* maps the receiver's `err` to a cause; `401` and `403` are
+* `authentication-failed` and `access-denied`; a network failure, a timeout,
+* a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+*/
+async function pushSet(set, options) {
+	const fetchFn = options.fetch ?? globalThis.fetch;
+	let response;
+	try {
+		response = await fetchFn(options.endpoint, {
+			method: "POST",
+			headers: compact({
+				"content-type": SET_CONTENT,
+				accept: "application/json",
+				authorization: options.authorization
+			}),
+			body: set,
+			signal: timeoutSignal(PUSH_TIMEOUT_MS, options.signal)
+		});
+	} catch {
+		return {
+			ok: false,
+			cause: "unavailable",
+			retry: true
+		};
+	}
+	if (response.ok) {
+		await response.body?.cancel();
+		return { ok: true };
+	}
+	const { err, description } = await errorBody(response);
+	if (response.status === 429 || response.status >= 500) return compact({
+		ok: false,
+		cause: "unavailable",
+		description,
+		retry: true
+	});
+	const cause = (response.status === 401 ? "authentication-failed" : response.status === 403 ? "access-denied" : void 0) ?? (err !== void 0 && Object.hasOwn(ERR_CAUSES, err) ? ERR_CAUSES[err] : void 0) ?? "invalid-request";
+	return compact({
+		ok: false,
+		cause,
+		description,
+		retry: false
+	});
+}
+function reason(value) {
+	return typeof value === "string" ? { en: value } : value;
+}
+function caep(name, input, extra) {
+	return Object.freeze({
+		type: `${CAEP_PREFIX}${name}`,
+		subject: input.subject,
+		payload: Object.freeze(compact({
+			event_timestamp: input.eventTimestamp ?? epochSeconds(),
+			initiating_entity: input.initiatingEntity,
+			reason_admin: reason(input.reasonAdmin),
+			reason_user: reason(input.reasonUser),
+			...extra
+		}))
+	});
+}
+/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
+const caepEvents = Object.freeze({
+	sessionRevoked: (input) => caep("session-revoked", input, {}),
+	credentialChange: (input) => caep("credential-change", input, compact({
+		credential_type: input.credentialType,
+		change_type: input.changeType,
+		friendly_name: input.friendlyName,
+		x509_issuer: input.x509Issuer,
+		x509_serial: input.x509Serial,
+		fido2_aaguid: input.fido2Aaguid
+	})),
+	tokenClaimsChange: (input) => caep("token-claims-change", input, { claims: input.claims }),
+	assuranceLevelChange: (input) => caep("assurance-level-change", input, compact({
+		namespace: input.namespace,
+		current_level: input.currentLevel,
+		previous_level: input.previousLevel,
+		change_direction: input.changeDirection
+	})),
+	deviceComplianceChange: (input) => caep("device-compliance-change", input, {
+		previous_status: input.previousStatus,
+		current_status: input.currentStatus
+	})
+});
+function risc(name, subject, payload) {
+	return Object.freeze({
+		type: `${RISC_PREFIX}${name}`,
+		subject,
+		payload: Object.freeze(payload)
+	});
+}
+/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
+const riscEvents = Object.freeze({
+	accountDisabled: (input) => risc("account-disabled", input.subject, compact({ reason: input.reason })),
+	accountPurged: (input) => risc("account-purged", input.subject, {}),
+	credentialCompromise: (input) => risc("credential-compromise", input.subject, compact({
+		credential_type: input.credentialType,
+		event_timestamp: input.eventTimestamp ?? epochSeconds(),
+		initiating_entity: input.initiatingEntity,
+		reason_admin: reason(input.reasonAdmin),
+		reason_user: reason(input.reasonUser)
+	}))
+});
+/**
+* The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
+* receiver's `state`. Its subject is the stream, never a principal.
+*/
+function streamVerificationEvent(stream, state) {
+	return Object.freeze({
+		type: VERIFICATION_EVENT,
+		subject: Object.freeze({
+			format: "opaque",
+			id: stream
+		}),
+		payload: Object.freeze(compact({ state }))
+	});
+}
+//#endregion
+export { SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, caepEvents, createPermDock, memoryReplayStore, memorySetQueue, pushSet, riscEvents, setPollHandler, signSet, streamVerificationEvent };

package/dist/standard-webhooks-6lg8v_is.d.ts

@@ -0,0 +1,88 @@
+import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
+import { l as ReplayStore } from "./types-DiQjupG2.js";
+//#region src/server/standard-webhooks.d.ts
+/** The three Standard Webhooks headers a delivery carries. */
+type WebhookHeaders = {
+  readonly "webhook-id": string;
+  readonly "webhook-timestamp": string;
+  readonly "webhook-signature": string;
+};
+/** An OKP JWK; only `kty: "OKP"` with `crv: "Ed25519"` signs or verifies `v1a`. */
+type WebhookJwk = JsonWebKeyLike & {
+  readonly kid?: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly d?: string;
+};
+/** A Standard Webhooks signature version: `v1` HMAC-SHA256 or `v1a` Ed25519. */
+type WebhookAlgorithm = "v1" | "v1a";
+type WebhookSigningKey = {
+  readonly alg: "v1";
+  readonly secret: string;
+} | {
+  readonly alg: "v1a";
+  readonly privateKey: WebhookJwk;
+};
+type WebhookSignerOptions = {
+  /** Every key signs each delivery, so a receiver can rotate between them. */
+  readonly keys: readonly WebhookSigningKey[];
+};
+type WebhookMessage = {
+  /** A unique message id, kept across retries of the same message. */
+  readonly id: string;
+  readonly body: string;
+  readonly now?: Instant;
+};
+type WebhookSigner = {
+  sign(message: WebhookMessage): Promise<WebhookHeaders>;
+};
+/** An Ed25519 public JWK set for `v1a`, or the URL that serves one. */
+type WebhookJwks = {
+  readonly keys: readonly WebhookJwk[];
+} | URL | string;
+type WebhookVerifierOptions = {
+  /** `v1` secrets in `whsec_` form; more than one during a rotation. */
+  readonly secret?: string | readonly string[];
+  /** `v1a` public keys. */
+  readonly jwks?: WebhookJwks;
+  /** Records each `webhook-id` so a replayed delivery fails. */
+  readonly replay: ReplayStore;
+  /** Seconds a timestamp may differ from the clock. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Instant;
+  /** Fetches a `jwks` URL. Defaults to the global `fetch`. */
+  readonly fetch?: typeof fetch;
+};
+type WebhookFailureCause = "missing-headers" | "malformed" | "timestamp-out-of-range" | "invalid-signature" | "keys-unavailable" | "replayed";
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string | undefined>>;
+  readonly body: string;
+};
+type VerifiedWebhookMessage = {
+  readonly ok: true;
+  readonly id: string;
+  /** The `webhook-timestamp` as an RFC 3339 instant. */
+  readonly timestamp: string;
+  readonly body: string;
+} | {
+  readonly ok: false;
+  readonly cause: WebhookFailureCause;
+};
+type WebhookVerifier = {
+  /** Never throws; claims the `webhook-id` only after a signature verifies. */
+  verify(input: WebhookInput): Promise<VerifiedWebhookMessage>;
+};
+/**
+ * Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
+ * secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
+ * because both come from the sender's own configuration.
+ */
+declare function webhookSigner(options: WebhookSignerOptions): WebhookSigner;
+/**
+ * Verifies Standard Webhooks deliveries signed `v1` with one of `secret` or
+ * `v1a` with a key from `jwks`, within `tolerance` seconds, and records each
+ * `webhook-id` in `replay`. Throws only on an invalid `secret`.
+ */
+declare function webhookVerifier(options: WebhookVerifierOptions): WebhookVerifier;
+//#endregion
+export { WebhookInput as a, WebhookMessage as c, WebhookSigningKey as d, WebhookVerifier as f, webhookVerifier as h, WebhookHeaders as i, WebhookSigner as l, webhookSigner as m, WebhookAlgorithm as n, WebhookJwk as o, WebhookVerifierOptions as p, WebhookFailureCause as r, WebhookJwks as s, VerifiedWebhookMessage as t, WebhookSignerOptions as u };