permdock 0.6.0 → 0.7.0

package/dist/ssf/index.js

@@ -1,7 +1,9 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
 import { o as epochSeconds } from "../time-DkWjdL98.js";
 import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { t as cancelApprovals } from "../helpers-CBYVMjwh.js";
+import { a as methodNotAllowed, c as problemResponse, d as validationProblem, o as notFoundProblem } from "../problem-CTviyH5L.js";
+import { t as cancelApprovals } from "../helpers-DY3vXuGs.js";
 import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
 import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
@@ -78,73 +80,15 @@ function eventName(uri) {
 		return RISC_NAMES.find((known) => known === name);
 	}
 }
+/** Every CAEP and RISC event URI PermDock's receiver handles. */
+function knownEventTypes() {
+	return [...CAEP_NAMES.map((name) => `${CAEP_PREFIX}${name}`), ...RISC_NAMES.map((name) => `${RISC_PREFIX}${name}`)];
+}
 /** RISC events that end every session of the subject. */
 function revokesAccount(name) {
 	return RISC_NAMES.some((known) => known === name);
 }
 //#endregion
-//#region src/ssf/poll.ts
-/** Milliseconds a poll or acknowledgement request may take. */
-const POLL_TIMEOUT_MS = 3e4;
-/**
-* One RFC 8936 poll round: fetch the pending SETs, ingest them and acknowledge
-* the ones that were accepted. Returns the acknowledged `jti` values.
-*/
-async function pollOnce(input) {
-	const { options, acks, ingest, emit } = input;
-	const fetchFn = options.fetch ?? globalThis.fetch;
-	const headers = { "content-type": "application/json" };
-	if (options.token !== void 0) headers["authorization"] = `Bearer ${options.token}`;
-	const body = {
-		maxEvents: 100,
-		returnImmediately: true
-	};
-	if (acks.length > 0) body["acks"] = acks;
-	const requestInit = compact({
-		method: "POST",
-		headers,
-		body: JSON.stringify(body),
-		signal: timeoutSignal(POLL_TIMEOUT_MS, options.signal)
-	});
-	const response = await fetchFn(options.endpoint, requestInit);
-	if (!response.ok) {
-		emit({
-			type: "poll-failed",
-			err: "connection_failed"
-		});
-		return [];
-	}
-	const parsed = await response.json();
-	if (!isRecord(parsed) || !isRecord(parsed["sets"])) return [];
-	const tokens = Object.entries(parsed["sets"]).flatMap(([jti, jwt]) => typeof jwt === "string" ? [{
-		jti,
-		jwt
-	}] : []);
-	const outcomes = await Promise.all(tokens.map(async ({ jti, jwt }) => ({
-		jti,
-		result: await ingest(jwt)
-	})));
-	const processed = outcomes.flatMap((row) => row.result.ok ? [row.jti] : []);
-	const setErrs = {};
-	for (const { jti, result } of outcomes) if (!result.ok && result.cause !== void 0) setErrs[jti] = {
-		err: result.err,
-		description: result.description
-	};
-	const failed = Object.keys(setErrs).length;
-	if (processed.length > 0 || failed > 0) await fetchFn(options.endpoint, compact({
-		method: "POST",
-		headers,
-		body: JSON.stringify(compact({
-			acks: processed,
-			setErrs: failed > 0 ? setErrs : void 0,
-			maxEvents: 0,
-			returnImmediately: true
-		})),
-		signal: timeoutSignal(POLL_TIMEOUT_MS, options.signal)
-	}));
-	return processed;
-}
-//#endregion
 //#region src/ssf/wire.ts
 const SET_TYP = "secevent+jwt";
 const LOGOUT_TYP = "logout+jwt";
@@ -207,6 +151,282 @@ function parseEvery(every) {
 	return Number(match[1]) * scale;
 }
 //#endregion
+//#region src/ssf/transmitter.ts
+/** SSF 1.0 delivery method URN for RFC 8935 push. */
+const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
+/** SSF 1.0 delivery method URN for RFC 8936 poll. */
+const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
+/** Milliseconds one push may take. */
+const PUSH_TIMEOUT_MS = 3e4;
+/** The largest error body `pushSet` reads. */
+const MAX_ERROR_BYTES = 16384;
+/**
+* Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
+* `sub_id` is the event's subject and `events` holds exactly one entry, as
+* SSF 1.0 requires. `iss` is the signer's own.
+*/
+function signSet(event, signer, options) {
+	return signer.sign(compact({
+		sub_id: event.subject,
+		events: { [event.type]: event.payload },
+		txn: options.txn
+	}), compact({
+		typ: SET_TYP,
+		audience: options.audience,
+		jti: options.jti,
+		issuedAt: options.issuedAt
+	}));
+}
+const ERR_CAUSES = {
+	invalid_request: "invalid-request",
+	invalid_key: "invalid-key",
+	invalid_issuer: "invalid-issuer",
+	invalid_audience: "invalid-audience",
+	authentication_failed: "authentication-failed",
+	access_denied: "access-denied"
+};
+async function errorBody(response) {
+	const read = await readBodyText(response, MAX_ERROR_BYTES);
+	if (!read.ok) return {};
+	try {
+		const parsed = JSON.parse(read.text);
+		if (!isRecord(parsed)) return {};
+		return compact({
+			err: typeof parsed["err"] === "string" ? parsed["err"] : void 0,
+			description: typeof parsed["description"] === "string" ? parsed["description"] : void 0
+		});
+	} catch {
+		return {};
+	}
+}
+/**
+* Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
+* maps the receiver's `err` to a cause; `401` and `403` are
+* `authentication-failed` and `access-denied`; a network failure, a timeout,
+* a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+*/
+async function pushSet(set, options) {
+	const fetchFn = options.fetch ?? globalThis.fetch;
+	let response;
+	try {
+		response = await fetchFn(options.endpoint, {
+			method: "POST",
+			headers: compact({
+				"content-type": SET_CONTENT,
+				accept: "application/json",
+				authorization: options.authorization
+			}),
+			body: set,
+			signal: timeoutSignal(PUSH_TIMEOUT_MS, options.signal)
+		});
+	} catch {
+		return {
+			ok: false,
+			cause: "unavailable",
+			retry: true
+		};
+	}
+	if (response.ok) {
+		await response.body?.cancel();
+		return { ok: true };
+	}
+	return deliveryFailure(response);
+}
+/** The `SetDelivery` failure for a non-`2xx` RFC 8935 or RFC 8936 response. */
+async function deliveryFailure(response) {
+	const { err, description } = await errorBody(response);
+	if (response.status === 429 || response.status >= 500) return compact({
+		ok: false,
+		cause: "unavailable",
+		description,
+		retry: true
+	});
+	const cause = (response.status === 401 ? "authentication-failed" : response.status === 403 ? "access-denied" : void 0) ?? (err !== void 0 && Object.hasOwn(ERR_CAUSES, err) ? ERR_CAUSES[err] : void 0) ?? "invalid-request";
+	return compact({
+		ok: false,
+		cause,
+		description,
+		retry: false
+	});
+}
+function reason(value) {
+	return typeof value === "string" ? { en: value } : value;
+}
+function caep(name, input, extra) {
+	return Object.freeze({
+		type: `${CAEP_PREFIX}${name}`,
+		subject: input.subject,
+		payload: Object.freeze(compact({
+			event_timestamp: input.eventTimestamp ?? epochSeconds(),
+			initiating_entity: input.initiatingEntity,
+			reason_admin: reason(input.reasonAdmin),
+			reason_user: reason(input.reasonUser),
+			...extra
+		}))
+	});
+}
+/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
+const caepEvents = Object.freeze({
+	sessionRevoked: (input) => caep("session-revoked", input, {}),
+	credentialChange: (input) => caep("credential-change", input, compact({
+		credential_type: input.credentialType,
+		change_type: input.changeType,
+		friendly_name: input.friendlyName,
+		x509_issuer: input.x509Issuer,
+		x509_serial: input.x509Serial,
+		fido2_aaguid: input.fido2Aaguid
+	})),
+	tokenClaimsChange: (input) => caep("token-claims-change", input, { claims: input.claims }),
+	assuranceLevelChange: (input) => caep("assurance-level-change", input, compact({
+		namespace: input.namespace,
+		current_level: input.currentLevel,
+		previous_level: input.previousLevel,
+		change_direction: input.changeDirection
+	})),
+	deviceComplianceChange: (input) => caep("device-compliance-change", input, {
+		previous_status: input.previousStatus,
+		current_status: input.currentStatus
+	})
+});
+function risc(name, subject, payload) {
+	return Object.freeze({
+		type: `${RISC_PREFIX}${name}`,
+		subject,
+		payload: Object.freeze(payload)
+	});
+}
+/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
+const riscEvents = Object.freeze({
+	accountDisabled: (input) => risc("account-disabled", input.subject, compact({ reason: input.reason })),
+	accountPurged: (input) => risc("account-purged", input.subject, {}),
+	credentialCompromise: (input) => risc("credential-compromise", input.subject, compact({
+		credential_type: input.credentialType,
+		event_timestamp: input.eventTimestamp ?? epochSeconds(),
+		initiating_entity: input.initiatingEntity,
+		reason_admin: reason(input.reasonAdmin),
+		reason_user: reason(input.reasonUser)
+	}))
+});
+/**
+* The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
+* receiver's `state`. Its subject is the stream, never a principal.
+*/
+function streamVerificationEvent(stream, state) {
+	return Object.freeze({
+		type: VERIFICATION_EVENT,
+		subject: Object.freeze({
+			format: "opaque",
+			id: stream
+		}),
+		payload: Object.freeze(compact({ state }))
+	});
+}
+//#endregion
+//#region src/ssf/poll-client.ts
+/** Milliseconds one poll request may take. */
+const POLL_TIMEOUT_MS = 3e4;
+/** The largest poll response read. */
+const MAX_SETS_BYTES = 4194304;
+/**
+* One RFC 8936 poll request: sends `acks` and `setErrs` and answers the SETs
+* the transmitter returns, unverified. A failure maps as `pushSet`'s does; a
+* `2xx` body without a `sets` object is `invalid-request`. Never throws.
+*/
+async function pollSets(options) {
+	const fetchFn = options.fetch ?? globalThis.fetch;
+	const acks = options.acks ?? [];
+	const setErrs = options.setErrs ?? {};
+	let response;
+	try {
+		response = await fetchFn(options.endpoint, {
+			method: "POST",
+			headers: compact({
+				"content-type": "application/json",
+				accept: "application/json",
+				authorization: options.authorization
+			}),
+			body: JSON.stringify(compact({
+				acks: acks.length > 0 ? acks : void 0,
+				setErrs: Object.keys(setErrs).length > 0 ? setErrs : void 0,
+				maxEvents: options.maxEvents ?? 100,
+				returnImmediately: options.returnImmediately ?? true
+			})),
+			signal: timeoutSignal(POLL_TIMEOUT_MS, options.signal)
+		});
+	} catch {
+		return {
+			ok: false,
+			cause: "unavailable",
+			retry: true
+		};
+	}
+	if (!response.ok) return deliveryFailure(response);
+	const read = await readBodyText(response, MAX_SETS_BYTES);
+	let parsed;
+	try {
+		parsed = read.ok ? JSON.parse(read.text) : void 0;
+	} catch {
+		parsed = void 0;
+	}
+	if (!isRecord(parsed) || !isRecord(parsed["sets"])) return {
+		ok: false,
+		cause: "invalid-request",
+		description: "poll response has no sets object",
+		retry: false
+	};
+	return {
+		ok: true,
+		sets: Object.entries(parsed["sets"]).flatMap(([jti, set]) => typeof set === "string" ? [{
+			jti,
+			set
+		}] : []),
+		moreAvailable: parsed["moreAvailable"] === true
+	};
+}
+//#endregion
+//#region src/ssf/poll.ts
+/**
+* One RFC 8936 poll round: fetch the pending SETs, ingest them and acknowledge
+* the ones that were accepted. Returns the acknowledged `jti` values.
+*/
+async function pollOnce(input) {
+	const { options, acks, ingest, emit } = input;
+	const transport = compact({
+		endpoint: options.endpoint,
+		authorization: options.token === void 0 ? void 0 : `Bearer ${options.token}`,
+		fetch: options.fetch,
+		signal: options.signal
+	});
+	const polled = await pollSets({
+		...transport,
+		acks
+	});
+	if (!polled.ok) {
+		emit({
+			type: "poll-failed",
+			err: "connection_failed"
+		});
+		return [];
+	}
+	const outcomes = await Promise.all(polled.sets.map(async ({ jti, set }) => ({
+		jti,
+		result: await ingest(set)
+	})));
+	const processed = outcomes.flatMap((row) => row.result.ok ? [row.jti] : []);
+	const setErrs = {};
+	for (const { jti, result } of outcomes) if (!result.ok && result.cause !== void 0) setErrs[jti] = {
+		err: result.err,
+		description: result.description
+	};
+	if (processed.length > 0 || Object.keys(setErrs).length > 0) await pollSets({
+		...transport,
+		acks: processed,
+		setErrs,
+		maxEvents: 0
+	});
+	return processed;
+}
+//#endregion
 //#region src/ssf/receiver.ts
 /** Seconds a SET without `exp` stays acceptable after its `iat`. */
 const DEFAULT_SET_MAX_AGE = 86400;
@@ -760,171 +980,380 @@ function setPollHandler(options) {
 	};
 }
 //#endregion
-//#region src/ssf/transmitter.ts
-/** SSF 1.0 delivery method URN for RFC 8935 push. */
-const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
-/** SSF 1.0 delivery method URN for RFC 8936 poll. */
-const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
-/** Milliseconds one push may take. */
-const PUSH_TIMEOUT_MS = 3e4;
-/** The largest error body `pushSet` reads. */
-const MAX_ERROR_BYTES = 16384;
+//#region src/ssf/streams.ts
 /**
-* Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
-* `sub_id` is the event's subject and `events` holds exactly one entry, as
-* SSF 1.0 requires. `iss` is the signer's own.
+* An in-process `SsfStreamStore`. A process restart loses every stream; a
+* deployment with more than one instance needs a shared store.
 */
-function signSet(event, signer, options) {
-	return signer.sign(compact({
-		sub_id: event.subject,
-		events: { [event.type]: event.payload },
-		txn: options.txn
-	}), compact({
-		typ: SET_TYP,
-		audience: options.audience,
-		jti: options.jti,
-		issuedAt: options.issuedAt
-	}));
+function memorySsfStreamStore() {
+	const entries = /* @__PURE__ */ new Map();
+	return Object.freeze({
+		name: "memory",
+		create(owner, configuration) {
+			const id = configuration.stream_id;
+			entries.set(id, {
+				stream: Object.freeze({
+					owner,
+					configuration
+				}),
+				status: Object.freeze({
+					stream_id: id,
+					status: "enabled"
+				})
+			});
+		},
+		get(streamId) {
+			return entries.get(streamId)?.stream ?? null;
+		},
+		list(owner) {
+			return [...entries.values()].map((entry) => entry.stream).filter((stream) => owner === void 0 || stream.owner === owner);
+		},
+		update(configuration) {
+			const entry = entries.get(configuration.stream_id);
+			if (entry !== void 0) entries.set(configuration.stream_id, {
+				stream: Object.freeze({
+					owner: entry.stream.owner,
+					configuration
+				}),
+				status: entry.status
+			});
+		},
+		delete(streamId) {
+			entries.delete(streamId);
+		},
+		status(streamId) {
+			return entries.get(streamId)?.status ?? null;
+		},
+		setStatus(status) {
+			const entry = entries.get(status.stream_id);
+			if (entry !== void 0) entries.set(status.stream_id, {
+				stream: entry.stream,
+				status: Object.freeze({ ...status })
+			});
+		}
+	});
 }
-const ERR_CAUSES = {
-	invalid_request: "invalid-request",
-	invalid_key: "invalid-key",
-	invalid_issuer: "invalid-issuer",
-	invalid_audience: "invalid-audience",
-	authentication_failed: "authentication-failed",
-	access_denied: "access-denied"
-};
-async function errorBody(response) {
-	const read = await readBodyText(response, MAX_ERROR_BYTES);
-	if (!read.ok) return {};
-	try {
-		const parsed = JSON.parse(read.text);
-		if (!isRecord(parsed)) return {};
-		return compact({
-			err: typeof parsed["err"] === "string" ? parsed["err"] : void 0,
-			description: typeof parsed["description"] === "string" ? parsed["description"] : void 0
-		});
-	} catch {
-		return {};
-	}
+//#endregion
+//#region src/ssf/transmitter-handler.ts
+/** The largest stream-management request body read. */
+const MAX_BODY_BYTES = 65536;
+/** SETs drained or flushed per queue read. */
+const BATCH = 100;
+const STATUSES = [
+	"enabled",
+	"paused",
+	"disabled"
+];
+function isStatus(value) {
+	return STATUSES.some((status) => status === value);
+}
+function isHttpUrl(value) {
+	if (typeof value !== "string" || !URL.canParse(value)) return false;
+	const { protocol } = new URL(value);
+	return protocol === "https:" || protocol === "http:";
+}
+function readDelivery(value) {
+	if (!isRecord(value)) return "delivery must be an object";
+	const { method, endpoint_url, authorization_header } = value;
+	if (method === "urn:ietf:rfc:8936") return { method };
+	if (method !== "urn:ietf:rfc:8935") return `delivery.method must be ${SSF_PUSH_DELIVERY} or ${SSF_POLL_DELIVERY}`;
+	if (!isHttpUrl(endpoint_url)) return "delivery.endpoint_url must be an http or https URL for push";
+	if (authorization_header !== void 0 && typeof authorization_header !== "string") return "delivery.authorization_header must be a string";
+	return compact({
+		method,
+		endpoint_url,
+		authorization_header
+	});
 }
 /**
-* Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
-* maps the receiver's `err` to a cause; `401` and `403` are
-* `authentication-failed` and `access-denied`; a network failure, a timeout,
-* a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+* The receiver-supplied properties of a stream request (SSF 1.0 section
+* 8.1.1). `previous` keeps the properties a PATCH leaves out; without it an
+* absent property takes its default. Transmitter-supplied properties are ignored.
 */
-async function pushSet(set, options) {
-	const fetchFn = options.fetch ?? globalThis.fetch;
-	let response;
-	try {
-		response = await fetchFn(options.endpoint, {
-			method: "POST",
-			headers: compact({
-				"content-type": SET_CONTENT,
-				accept: "application/json",
-				authorization: options.authorization
-			}),
-			body: set,
-			signal: timeoutSignal(PUSH_TIMEOUT_MS, options.signal)
-		});
-	} catch {
-		return {
-			ok: false,
-			cause: "unavailable",
-			retry: true
-		};
+function readProperties(body, previous) {
+	let delivery = previous?.delivery ?? { method: "urn:ietf:rfc:8936" };
+	if (body["delivery"] !== void 0) {
+		const read = readDelivery(body["delivery"]);
+		if (typeof read === "string") return read;
+		delivery = read;
 	}
-	if (response.ok) {
-		await response.body?.cancel();
-		return { ok: true };
-	}
-	const { err, description } = await errorBody(response);
-	if (response.status === 429 || response.status >= 500) return compact({
-		ok: false,
-		cause: "unavailable",
-		description,
-		retry: true
+	const requested = body["events_requested"];
+	if (requested !== void 0 && !(Array.isArray(requested) && requested.every((event) => typeof event === "string"))) return "events_requested must be an array of strings";
+	const description = body["description"];
+	if (description !== void 0 && typeof description !== "string") return "description must be a string";
+	return compact({
+		delivery,
+		events_requested: requested ?? previous?.events_requested ?? [],
+		description: description ?? previous?.description
 	});
-	const cause = (response.status === 401 ? "authentication-failed" : response.status === 403 ? "access-denied" : void 0) ?? (err !== void 0 && Object.hasOwn(ERR_CAUSES, err) ? ERR_CAUSES[err] : void 0) ?? "invalid-request";
+}
+function propertiesOf(configuration) {
 	return compact({
-		ok: false,
-		cause,
-		description,
-		retry: false
+		delivery: configuration.delivery,
+		events_requested: configuration.events_requested ?? [],
+		description: configuration.description
 	});
 }
-function reason(value) {
-	return typeof value === "string" ? { en: value } : value;
+async function readBody(request) {
+	const read = await readBodyText(request, MAX_BODY_BYTES);
+	if (!read.ok) return problemResponse(statusProblem(413, `request body exceeds ${MAX_BODY_BYTES} bytes`));
+	let parsed;
+	try {
+		parsed = JSON.parse(read.text);
+	} catch {
+		return validationProblem("body was not valid JSON");
+	}
+	return isRecord(parsed) ? parsed : validationProblem("body must be a JSON object");
 }
-function caep(name, input, extra) {
-	return Object.freeze({
-		type: `${CAEP_PREFIX}${name}`,
-		subject: input.subject,
-		payload: Object.freeze(compact({
-			event_timestamp: input.eventTimestamp ?? epochSeconds(),
-			initiating_entity: input.initiatingEntity,
-			reason_admin: reason(input.reasonAdmin),
-			reason_user: reason(input.reasonUser),
-			...extra
+async function owned(streams, id, owner) {
+	if (typeof id !== "string" || id === "") return validationProblem("stream_id is required");
+	const stream = await streams.get(id);
+	return stream?.owner === owner ? stream : notFoundProblem();
+}
+/** Acknowledges every pending SET of `stream`; a queue that never empties is read at most until it repeats. */
+async function drain(queue, stream) {
+	let previous;
+	for (;;) {
+		const pending = await queue.pending(stream, BATCH);
+		const first = pending[0]?.jti;
+		if (first === void 0 || first === previous) return;
+		previous = first;
+		await Promise.all(pending.map(({ jti }) => Promise.resolve(queue.ack(stream, jti))));
+	}
+}
+/** Pushes the SETs a paused push stream held, oldest first, until one may be retried. */
+async function flush(queue, configuration, fetchFn) {
+	const { stream_id: stream, delivery } = configuration;
+	if (delivery.endpoint_url === void 0) return;
+	let previous;
+	for (;;) {
+		const pending = await queue.pending(stream, BATCH);
+		const first = pending[0]?.jti;
+		if (first === void 0 || first === previous) return;
+		previous = first;
+		for (const { jti, set } of pending) {
+			const result = await pushSet(set, compact({
+				endpoint: delivery.endpoint_url,
+				authorization: delivery.authorization_header,
+				fetch: fetchFn
+			}));
+			if (result.ok) await queue.ack(stream, jti);
+			else if (result.retry) return;
+			else await queue.fail(stream, jti, {
+				err: result.cause.replaceAll("-", "_"),
+				description: result.description ?? result.cause
+			});
+		}
+	}
+}
+async function deliver(stream, status, jti, set, options) {
+	const { stream_id: id, delivery } = stream.configuration;
+	if (delivery.method === "urn:ietf:rfc:8936" || status === "paused" || delivery.endpoint_url === void 0) {
+		await options.queue.enqueue(id, jti, set);
+		return {
+			stream: id,
+			jti,
+			queued: true,
+			delivery: { ok: true }
+		};
+	}
+	return {
+		stream: id,
+		jti,
+		queued: false,
+		delivery: await pushSet(set, compact({
+			endpoint: delivery.endpoint_url,
+			authorization: delivery.authorization_header,
+			fetch: options.fetch
 		}))
-	});
+	};
 }
-/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
-const caepEvents = Object.freeze({
-	sessionRevoked: (input) => caep("session-revoked", input, {}),
-	credentialChange: (input) => caep("credential-change", input, compact({
-		credential_type: input.credentialType,
-		change_type: input.changeType,
-		friendly_name: input.friendlyName,
-		x509_issuer: input.x509Issuer,
-		x509_serial: input.x509Serial,
-		fido2_aaguid: input.fido2Aaguid
-	})),
-	tokenClaimsChange: (input) => caep("token-claims-change", input, { claims: input.claims }),
-	assuranceLevelChange: (input) => caep("assurance-level-change", input, compact({
-		namespace: input.namespace,
-		current_level: input.currentLevel,
-		previous_level: input.previousLevel,
-		change_direction: input.changeDirection
-	})),
-	deviceComplianceChange: (input) => caep("device-compliance-change", input, {
-		previous_status: input.previousStatus,
-		current_status: input.currentStatus
-	})
-});
-function risc(name, subject, payload) {
-	return Object.freeze({
-		type: `${RISC_PREFIX}${name}`,
-		subject,
-		payload: Object.freeze(payload)
-	});
+/**
+* Signs `event` once per distinct stream audience and delivers it to every
+* stream that is not disabled and has the event in `events_delivered`: a
+* push stream through `pushSet`, a poll stream or a paused stream into the
+* queue. Answers one row per stream that took the event.
+*/
+async function fanOutSet(event, options) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const stream of await options.streams.list()) {
+		const { configuration } = stream;
+		const status = (await options.streams.status(configuration.stream_id))?.status;
+		const delivered = configuration.events_delivered ?? configuration.events_requested ?? [];
+		if (status === void 0 || status === "disabled" || !delivered.includes(event.type)) continue;
+		const key = JSON.stringify(configuration.aud);
+		const group = groups.get(key) ?? {
+			audience: configuration.aud,
+			targets: []
+		};
+		group.targets.push({
+			stream,
+			status
+		});
+		groups.set(key, group);
+	}
+	return (await Promise.all([...groups.values()].map(async ({ audience, targets }) => {
+		const jti = globalThis.crypto.randomUUID();
+		const set = await signSet(event, options.signer, {
+			audience,
+			jti
+		});
+		return Promise.all(targets.map(({ stream, status }) => deliver(stream, status, jti, set, options)));
+	}))).flat();
 }
-/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
-const riscEvents = Object.freeze({
-	accountDisabled: (input) => risc("account-disabled", input.subject, compact({ reason: input.reason })),
-	accountPurged: (input) => risc("account-purged", input.subject, {}),
-	credentialCompromise: (input) => risc("credential-compromise", input.subject, compact({
-		credential_type: input.credentialType,
-		event_timestamp: input.eventTimestamp ?? epochSeconds(),
-		initiating_entity: input.initiatingEntity,
-		reason_admin: reason(input.reasonAdmin),
-		reason_user: reason(input.reasonUser)
-	}))
-});
 /**
-* The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
-* receiver's `state`. Its subject is the stream, never a principal.
+* An SSF 1.0 transmitter as one Fetch handler, routed by path suffix:
+* `/.well-known/ssf-configuration` (section 7.1), `/stream` (8.1.1),
+* `/status` (8.1.2), `/verify` (8.1.4) and `/poll` (RFC 8936). Each receiver
+* sees only the streams it created. Disabling or deleting a stream drops its
+* pending SETs; a paused stream holds them until it is enabled again.
 */
-function streamVerificationEvent(stream, state) {
-	return Object.freeze({
-		type: VERIFICATION_EVENT,
-		subject: Object.freeze({
-			format: "opaque",
-			id: stream
-		}),
-		payload: Object.freeze(compact({ state }))
+function ssfTransmitter(options) {
+	const base = (options.endpoint ?? options.issuer).replace(/\/+$/u, "");
+	const supported = options.eventsSupported ?? knownEventTypes();
+	const audienceOf = options.audience ?? ((receiver) => receiver);
+	const cap = options.maxEvents ?? 100;
+	const { streams, queue } = options;
+	const metadata = compact({
+		spec_version: "1_0",
+		issuer: options.issuer,
+		jwks_uri: options.jwksUri,
+		delivery_methods_supported: [SSF_PUSH_DELIVERY, SSF_POLL_DELIVERY],
+		configuration_endpoint: `${base}/stream`,
+		status_endpoint: `${base}/status`,
+		verification_endpoint: `${base}/verify`,
+		authorization_schemes: [{ spec_urn: "urn:ietf:rfc:6750" }],
+		default_subjects: "ALL"
+	});
+	const configurationOf = (id, owner, properties) => compact({
+		stream_id: id,
+		iss: options.issuer,
+		aud: audienceOf(owner),
+		events_supported: supported,
+		events_requested: properties.events_requested,
+		events_delivered: properties.events_requested.filter((event) => supported.includes(event)),
+		delivery: properties.delivery.method === "urn:ietf:rfc:8936" ? {
+			method: SSF_POLL_DELIVERY,
+			endpoint_url: `${base}/poll?stream_id=${encodeURIComponent(id)}`
+		} : properties.delivery,
+		description: properties.description
 	});
+	const stream = async (request, url, owner) => {
+		switch (request.method) {
+			case "GET": {
+				const id = url.searchParams.get("stream_id");
+				if (id === null) return jsonResponse(200, (await streams.list(owner)).map((entry) => entry.configuration));
+				const found = await owned(streams, id, owner);
+				return found instanceof Response ? found : jsonResponse(200, found.configuration);
+			}
+			case "POST": {
+				const body = await readBody(request);
+				if (body instanceof Response) return body;
+				const properties = readProperties(body);
+				if (typeof properties === "string") return validationProblem(properties);
+				const configuration = configurationOf(globalThis.crypto.randomUUID(), owner, properties);
+				await streams.create(owner, configuration);
+				return jsonResponse(201, configuration);
+			}
+			case "PATCH":
+			case "PUT": {
+				const body = await readBody(request);
+				if (body instanceof Response) return body;
+				const found = await owned(streams, body["stream_id"], owner);
+				if (found instanceof Response) return found;
+				const properties = readProperties(body, request.method === "PATCH" ? propertiesOf(found.configuration) : void 0);
+				if (typeof properties === "string") return validationProblem(properties);
+				const configuration = configurationOf(found.configuration.stream_id, owner, properties);
+				await streams.update(configuration);
+				return jsonResponse(200, configuration);
+			}
+			case "DELETE": {
+				const found = await owned(streams, url.searchParams.get("stream_id"), owner);
+				if (found instanceof Response) return found;
+				await streams.delete(found.configuration.stream_id);
+				await drain(queue, found.configuration.stream_id);
+				return new Response(null, { status: 204 });
+			}
+			default: return methodNotAllowed("GET, POST, PATCH, PUT, DELETE");
+		}
+	};
+	const statusOf = async (id) => await streams.status(id) ?? {
+		stream_id: id,
+		status: "enabled"
+	};
+	const status = async (request, url, owner) => {
+		if (request.method === "GET") {
+			const found = await owned(streams, url.searchParams.get("stream_id"), owner);
+			return found instanceof Response ? found : jsonResponse(200, await statusOf(found.configuration.stream_id));
+		}
+		if (request.method !== "POST") return methodNotAllowed("GET, POST");
+		const body = await readBody(request);
+		if (body instanceof Response) return body;
+		const found = await owned(streams, body["stream_id"], owner);
+		if (found instanceof Response) return found;
+		const next = body["status"];
+		const reason = body["reason"];
+		if (!isStatus(next)) return validationProblem(`status must be one of ${STATUSES.join(", ")}`);
+		if (reason !== void 0 && typeof reason !== "string") return validationProblem("reason must be a string");
+		const id = found.configuration.stream_id;
+		const before = await statusOf(id);
+		const updated = compact({
+			stream_id: id,
+			status: next,
+			reason
+		});
+		await streams.setStatus(updated);
+		if (next === "disabled") await drain(queue, id);
+		else if (next === "enabled" && before.status === "paused" && found.configuration.delivery.method === "urn:ietf:rfc:8935") await flush(queue, found.configuration, options.fetch);
+		return jsonResponse(200, updated);
+	};
+	const verify = async (request, owner) => {
+		if (request.method !== "POST") return methodNotAllowed("POST");
+		const body = await readBody(request);
+		if (body instanceof Response) return body;
+		const found = await owned(streams, body["stream_id"], owner);
+		if (found instanceof Response) return found;
+		const state = body["state"];
+		if (state !== void 0 && typeof state !== "string") return validationProblem("state must be a string");
+		const { configuration } = found;
+		const current = await statusOf(configuration.stream_id);
+		if (current.status === "disabled") return problemResponse(statusProblem(409, "stream is disabled"));
+		const jti = globalThis.crypto.randomUUID();
+		const set = await signSet(streamVerificationEvent(configuration.stream_id, state), options.signer, {
+			audience: configuration.aud,
+			jti
+		});
+		await deliver(found, current.status, jti, set, options);
+		return new Response(null, { status: 204 });
+	};
+	const poll = async (request, url, owner) => {
+		const id = url.searchParams.get("stream_id");
+		const found = id === null ? null : await streams.get(id);
+		if (found?.owner !== owner || found.configuration.delivery.method !== "urn:ietf:rfc:8936") return notFoundProblem();
+		const current = await statusOf(found.configuration.stream_id);
+		return setPollHandler({
+			queue,
+			authorize: () => found.configuration.stream_id,
+			maxEvents: current.status === "enabled" ? cap : 0
+		})(request);
+	};
+	return async (request) => {
+		const url = new URL(request.url);
+		const path = url.pathname.replace(/\/+$/u, "");
+		if (path.endsWith("/.well-known/ssf-configuration")) return request.method === "GET" ? jsonResponse(200, metadata) : methodNotAllowed("GET");
+		let owner;
+		try {
+			owner = await options.authorize(request);
+		} catch {
+			owner = null;
+		}
+		if (owner === null) return problemResponse(statusProblem(401, "stream management not authorized"), void 0, void 0, { "WWW-Authenticate": "Bearer" });
+		if (path.endsWith("/stream")) return stream(request, url, owner);
+		if (path.endsWith("/status")) return status(request, url, owner);
+		if (path.endsWith("/verify")) return verify(request, owner);
+		if (path.endsWith("/poll")) return poll(request, url, owner);
+		return notFoundProblem();
+	};
 }
 //#endregion
-export { SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, caepEvents, createPermDock, memoryReplayStore, memorySetQueue, pushSet, riscEvents, setPollHandler, signSet, streamVerificationEvent };
+export { SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };