@calimero-network/mero-js 26.10.0 → 27.0.0

package/dist/invitation/invitation.d.ts

@@ -1,106 +0,0 @@
-/**
- * Minting a group invitation without a node.
- *
- * An invitation is not a governance op. Nothing is published when one is made:
- * it is a bearer credential, `GroupInvitationFromAdmin` borsh-encoded, hashed
- * with SHA-256 and signed by the inviter's key. A node mints one with its own
- * namespace key; an account with **no node** signs it here with its device key.
- *
- * Every peer that later folds the join resolves `inviter_identity` — the
- * signing key — to an account through the namespace's device bindings, and then
- * checks that account holds admin or `CAN_INVITE_MEMBERS` at the join's causal
- * cut. So the device key must be **bound** in the namespace first. It is when
- * the account joined through an invitation; an account that was added by
- * account (`MemberAdded`) has no binding, and a relay has to carry its device
- * link first — see `AdminApiClient.linkAccountDevice` and `signDeviceScope`.
- * Without that, every peer refuses the join as signed by a key "bound to no
- * account".
- *
- * Derived from core:
- *
- * - `GroupInvitationFromAdmin` / `SignedGroupOpenInvitation` —
- *   `crates/context/config/src/types.rs`
- * - the signing — `crates/context/src/handlers/create_group_invitation.rs`:
- *   `sign(sha256(borsh(invitation)))`
- * - the admitter default — `NamespaceMembershipService::default_admitters`
- *
- * The unit tests pin bytes and a signature produced by core's own types.
- */
-import type { GroupInvitationFromAdmin, GroupMember, SignedGroupOpenInvitation } from '../admin-api/admin-types.js';
-import { type Signer } from '../signer/signer.js';
-/**
- * Core's `MAX_INVITATION_VALIDITY_SECS`: one day. Core clamps what a node mints
- * to it, and this does the same, so a leaked invitation is redeemable no longer
- * than one a node would have issued.
- */
-export declare const MAX_INVITATION_VALIDITY_SECS: number;
-/** `invited_role` values, as core numbers them. */
-export declare const INVITED_ROLE: {
-    readonly Admin: 0;
-    readonly Member: 1;
-    readonly ReadOnly: 2;
-};
-/** Borsh-encode the signed body of an invitation, field for field with core. */
-export declare function encodeGroupInvitation(body: GroupInvitationFromAdmin): Uint8Array;
-/** `sha256(borsh(invitation))`: the 32 bytes the inviter's key signs. */
-export declare function groupInvitationHash(body: GroupInvitationFromAdmin): Promise<Uint8Array>;
-/**
- * The admitters a node names when its caller names none: the group's admins,
- * sorted by account bytes and deduplicated, as core's `BTreeSet` leaves them.
- *
- * Core also adds TEE-admitted accounts, which a member list cannot tell apart
- * from members by role alone; name those in `admitters` explicitly.
- */
-export declare function defaultAdmitters(members: readonly GroupMember[]): string[];
-/** What {@link signGroupInvitation} needs. */
-export interface GroupInvitationInput {
-    /** The group (or namespace) invited to, 64 hex. */
-    groupId: string;
-    /**
-     * The account the inviter acts as, 64 hex. An unsigned bootstrap hint the
-     * joiner seeds the group's admin view from; it confers nothing.
-     */
-    inviterAccount: string;
-    /** The device key as a {@link Signer}. Pass this or {@link deviceSecret}. */
-    signer?: Signer;
-    /** The device signing secret, 64 hex. Pass this or {@link signer}. */
-    deviceSecret?: string;
-    /**
-     * Accounts permitted to admit a claim, 64 hex each. Signed.
-     *
-     * Omitted or empty, it defaults to the group's admins, which is what a node
-     * does — pass {@link members} (from `listGroupMembers`) to derive them. An
-     * empty list would mean *claimable by broadcast*, which publishes the
-     * invitation to every subscriber of the namespace topic, so this never
-     * produces one.
-     */
-    admitters?: readonly string[];
-    /** The group's members, to default {@link admitters} from. */
-    members?: readonly GroupMember[];
-    /**
-     * The role granted, as {@link INVITED_ROLE} numbers it. Defaults to Member.
-     * Only an admin may invite an admin; peers refuse the join otherwise.
-     */
-    invitedRole?: number;
-    /**
-     * Seconds from now until it expires, clamped to
-     * {@link MAX_INVITATION_VALIDITY_SECS} (also the default).
-     */
-    validForSecs?: number;
-    /** Unix seconds to count from. Defaults to the clock; for tests. */
-    now?: number;
-    /** The 32-byte uniqueness nonce. Defaults to fresh random bytes. */
-    nonce?: Uint8Array;
-    /** Unsigned bootstrap: the group's application id, 64 hex. */
-    applicationId?: string;
-    /** Unsigned bootstrap: the group's `app_key` (core's `bytecode_id`), 64 hex. */
-    appKey?: string;
-    /** Unsigned bootstrap: multiaddrs for the admitters, `/p2p/<peer>` included. */
-    admitterAddrs?: readonly string[];
-}
-/**
- * Sign a group invitation with a device key, returning it in the JSON shape a
- * node's `createGroupInvitation` returns — so it goes to `joinGroup`,
- * `signMemberJoinOp` and `admitJoin` unchanged.
- */
-export declare function signGroupInvitation(input: GroupInvitationInput): Promise<SignedGroupOpenInvitation>;

package/dist/invitation/invitation.js

@@ -1,104 +0,0 @@
-import { concat, fromHex, hex, u32le, u64le } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-/**
- * Core's `MAX_INVITATION_VALIDITY_SECS`: one day. Core clamps what a node mints
- * to it, and this does the same, so a leaked invitation is redeemable no longer
- * than one a node would have issued.
- */
-export const MAX_INVITATION_VALIDITY_SECS = 24 * 60 * 60;
-/** `invited_role` values, as core numbers them. */
-export const INVITED_ROLE = { Admin: 0, Member: 1, ReadOnly: 2 };
-/** Borsh-encode the signed body of an invitation, field for field with core. */
-export function encodeGroupInvitation(body) {
-    const admitters = body.admitters ?? [];
-    return concat(
-    // `SignerId` and `ContextGroupId` cross JSON as 32 numbers; `AccountId`
-    // crosses as hex. Same width, different spelling.
-    bytes32(body.inviter_identity, 'inviter_identity'), bytes32(body.group_id, 'group_id'), u64le(body.expiration_timestamp), bytes32(body.secret_salt, 'secret_salt'), new Uint8Array([body.invited_role]), u32le(admitters.length), ...admitters.map((a, i) => fromHex(a, `admitters[${i}]`, 32)));
-}
-/** `sha256(borsh(invitation))`: the 32 bytes the inviter's key signs. */
-export async function groupInvitationHash(body) {
-    return new Uint8Array(await crypto.subtle.digest('SHA-256', encodeGroupInvitation(body)));
-}
-/**
- * The admitters a node names when its caller names none: the group's admins,
- * sorted by account bytes and deduplicated, as core's `BTreeSet` leaves them.
- *
- * Core also adds TEE-admitted accounts, which a member list cannot tell apart
- * from members by role alone; name those in `admitters` explicitly.
- */
-export function defaultAdmitters(members) {
-    const admins = new Set(members.filter((m) => m.role === 'Admin').map((m) => m.identity.toLowerCase()));
-    // Lowercase hex sorts as the bytes do.
-    return [...admins].sort();
-}
-/**
- * Sign a group invitation with a device key, returning it in the JSON shape a
- * node's `createGroupInvitation` returns — so it goes to `joinGroup`,
- * `signMemberJoinOp` and `admitJoin` unchanged.
- */
-export async function signGroupInvitation(input) {
-    const signer = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    const inviterKey = fromHex(signer.publicKey, 'signer.publicKey', 32);
-    const groupId = fromHex(input.groupId, 'groupId', 32);
-    fromHex(input.inviterAccount, 'inviterAccount', 32);
-    let admitters = [...(input.admitters ?? [])].map((a) => a.trim().toLowerCase());
-    if (admitters.length === 0) {
-        if (!input.members) {
-            throw new Error('name the admitters, or pass the group members to default them to its admins: ' +
-                'an invitation with no admitters is claimable by broadcast');
-        }
-        admitters = defaultAdmitters(input.members);
-        if (admitters.length === 0) {
-            throw new Error('the member list names no admin, so there is nobody to default the admitters to');
-        }
-    }
-    admitters.forEach((a, i) => fromHex(a, `admitters[${i}]`, 32));
-    const invitedRole = input.invitedRole ?? INVITED_ROLE.Member;
-    if (![0, 1, 2].includes(invitedRole)) {
-        throw new Error(`invitedRole must be 0 (Admin), 1 (Member) or 2 (ReadOnly), got ${invitedRole}`);
-    }
-    const now = input.now ?? Math.floor(Date.now() / 1000);
-    const validFor = Math.min(input.validForSecs ?? MAX_INVITATION_VALIDITY_SECS, MAX_INVITATION_VALIDITY_SECS);
-    if (!Number.isInteger(validFor) || validFor <= 0) {
-        throw new Error(`validForSecs must be a positive whole number, got ${input.validForSecs}`);
-    }
-    const nonce = input.nonce ?? crypto.getRandomValues(new Uint8Array(32));
-    if (nonce.length !== 32) {
-        throw new Error(`nonce must be 32 bytes, got ${nonce.length}`);
-    }
-    const invitation = {
-        inviter_identity: Array.from(inviterKey),
-        group_id: Array.from(groupId),
-        expiration_timestamp: now + validFor,
-        secret_salt: Array.from(nonce),
-        invited_role: invitedRole,
-        admitters,
-    };
-    const signature = await signer.sign(await groupInvitationHash(invitation));
-    if (signature.length !== 64) {
-        throw new Error(`signer returned ${signature.length} bytes, expected a 64-byte Ed25519 signature`);
-    }
-    const signed = {
-        invitation,
-        inviter_signature: hex(signature),
-        inviter_account: input.inviterAccount.trim().toLowerCase(),
-    };
-    if (input.admitterAddrs?.length)
-        signed.admitter_addrs = [...input.admitterAddrs];
-    if (input.applicationId) {
-        signed.application_id = Array.from(fromHex(input.applicationId, 'applicationId', 32));
-    }
-    if (input.appKey)
-        signed.app_key = Array.from(fromHex(input.appKey, 'appKey', 32));
-    // The brand marks a value as one to pass through unchanged. This one is
-    // signed, so it qualifies the same way a node's does.
-    return signed;
-}
-/** A required `[u8; 32]`, as JSON carries it: 32 byte values. */
-function bytes32(value, label) {
-    if (value.length !== 32) {
-        throw new Error(`${label} must be 32 bytes, got ${value.length}`);
-    }
-    return new Uint8Array(value);
-}

package/dist/login/index.d.ts

@@ -1,4 +0,0 @@
-export { signLoginStatement } from './login.js';
-export type { Audience, LoginStatementInput } from './login.js';
-export { login, generateSessionKey } from './session.js';
-export type { LoginConfig, DelegatedSession, SessionKeyPair, } from './session.js';

package/dist/login/index.js

@@ -1,3 +0,0 @@
-// Login-statement signing — the device's half of a password-free session
-export { signLoginStatement } from './login.js';
-export { login, generateSessionKey } from './session.js';

package/dist/login/login.d.ts

@@ -1,111 +0,0 @@
-/**
- * Sign the statement a device key presents to obtain a session on a node.
- *
- * This is the half of password-free login that has to run where the device key
- * lives, and for the case delegated execution exists for that is a browser tab.
- * Until this module, the only thing that could produce a login statement was
- * `merod account login-statement` — which is to say, a client had to hold a node
- * to ask a node for a session.
- *
- * **What this gets you, and what it does not.** A statement proves a device key
- * asked for this session. It says nothing about which account that device
- * belongs to: that is the `AccountProof` travelling beside it, which the node
- * checks separately. Signing here and presenting no proof gets a 401 that looks
- * exactly like a bad signature.
- *
- * **The session key is minted by the caller, not here.** The device key signs
- * once, over a short-lived key the caller generates and keeps; that key does the
- * talking for the rest of the session, which is what keeps the device key off
- * the wire. Passing a key you do not hold the private half of produces a session
- * you cannot speak on.
- *
- * **`node` must come from something you pinned.** Not from the challenge
- * response, and not from any field the node itself chose — an attacker who can
- * answer on the node's behalf would otherwise pick what your device signs about,
- * which is the whole reason the field exists. Read it out of band from the node
- * operator.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/login_wire_fixture.rs`, for the same reason the
- * warrant one is: `AUTH_LOGIN_SIGN_DOMAIN` is `pub(crate)` there and the field
- * order is implicit in a `derive`, so nothing on that side forces anyone to
- * notice this file depends on both. This module's test asserts the same vectors.
- */
-import { type Signer } from '../signer/signer.js';
-/**
- * The client surface a session is bound to.
- *
- * A session minted for one surface cannot be presented from another, so a single
- * compromised surface does not yield sessions usable everywhere.
- */
-export type Audience = {
-    /**
-     * A browser origin, spelled exactly as the browser spells it
-     * (`https://host:port`, no trailing slash).
-     *
-     * Compared byte for byte by the node. Do not normalize it here: two
-     * spellings of one origin would mean a verifier that disagrees with the
-     * browser about which one a token was for. `location.origin` is already
-     * the spelling you want.
-     */
-    kind: 'webOrigin';
-    origin: string;
-} | {
-    /** A signed native client, named by its code-signing identity. */
-    kind: 'codeSigningId';
-    id: string;
-} | {
-    /**
-     * A command-line client, which has no origin and no signing identity.
-     *
-     * Carries no payload deliberately: a string here would be an audience that
-     * binds nothing while looking like it binds something.
-     */
-    kind: 'cli';
-};
-/** What a device is asking for. */
-export interface LoginStatementInput {
-    /**
-     * The node this session is for, hex (32 bytes) — its identity public key, as
-     * you pinned it. See the module note: this must not come from the node.
-     */
-    node: string;
-    /** The client surface the session is bound to. */
-    audience: Audience;
-    /** The challenge this node issued, hex (32 bytes). Proves freshness. */
-    challenge: string;
-    /**
-     * The public half of the ephemeral key this session will speak with, hex (32
-     * bytes). Minted per session by the caller and thrown away with it.
-     */
-    sessionKey: string;
-    /** Unix seconds at signing. */
-    issuedAt: number | bigint;
-    /** Unix seconds after which the node must refuse it. */
-    expiresAt: number | bigint;
-    /**
-     * The device's ed25519 signing secret, hex (32 bytes).
-     *
-     * Never sent anywhere. It signs locally and only the signature travels, which
-     * is what lets a statement be minted by something holding no node.
-     *
-     * Mutually exclusive with {@link LoginStatementInput.signer}, and the weaker
-     * of the two in a browser: a secret that exists as a string can be read by
-     * anything running on the origin.
-     */
-    deviceSecret?: string;
-    /**
-     * The device's signer — use instead of
-     * {@link LoginStatementInput.deviceSecret} when the key cannot be exported.
-     */
-    signer?: Signer;
-}
-/**
- * Sign a login statement and return it hex-encoded, ready to present with an
- * account proof.
- *
- * Returns the encoding rather than an object for the reason `signWarrant` does:
- * the signature covers exactly these bytes, and a caller that rebuilt the fields
- * from JSON would have a second spelling able to disagree with what was signed.
- */
-export declare function signLoginStatement(input: LoginStatementInput): Promise<string>;

package/dist/login/login.js

@@ -1,110 +0,0 @@
-/**
- * Sign the statement a device key presents to obtain a session on a node.
- *
- * This is the half of password-free login that has to run where the device key
- * lives, and for the case delegated execution exists for that is a browser tab.
- * Until this module, the only thing that could produce a login statement was
- * `merod account login-statement` — which is to say, a client had to hold a node
- * to ask a node for a session.
- *
- * **What this gets you, and what it does not.** A statement proves a device key
- * asked for this session. It says nothing about which account that device
- * belongs to: that is the `AccountProof` travelling beside it, which the node
- * checks separately. Signing here and presenting no proof gets a 401 that looks
- * exactly like a bad signature.
- *
- * **The session key is minted by the caller, not here.** The device key signs
- * once, over a short-lived key the caller generates and keeps; that key does the
- * talking for the rest of the session, which is what keeps the device key off
- * the wire. Passing a key you do not hold the private half of produces a session
- * you cannot speak on.
- *
- * **`node` must come from something you pinned.** Not from the challenge
- * response, and not from any field the node itself chose — an attacker who can
- * answer on the node's behalf would otherwise pick what your device signs about,
- * which is the whole reason the field exists. Read it out of band from the node
- * operator.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/login_wire_fixture.rs`, for the same reason the
- * warrant one is: `AUTH_LOGIN_SIGN_DOMAIN` is `pub(crate)` there and the field
- * order is implicit in a `derive`, so nothing on that side forces anyone to
- * notice this file depends on both. This module's test asserts the same vectors.
- */
-import { concat, domainHash, fromHex, hex, u32le, u64le, } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-const SIGN_DOMAIN = new TextEncoder().encode('calimero.auth.login.v1');
-/** The borsh enum tag for each variant, in core's declaration order. */
-const AUDIENCE_TAG = {
-    webOrigin: 0,
-    codeSigningId: 1,
-    cli: 2,
-};
-/** The variant's payload as UTF-8 — empty for the payload-free `cli`. */
-function audienceBody(audience) {
-    const encoder = new TextEncoder();
-    switch (audience.kind) {
-        case 'webOrigin':
-            return encoder.encode(audience.origin);
-        case 'codeSigningId':
-            return encoder.encode(audience.id);
-        case 'cli':
-            return new Uint8Array(0);
-    }
-}
-/**
- * What the audience contributes to the **signing preimage**: tag then body, with
- * no length between them.
- *
- * `domainHash` length-prefixes every part it is handed, so a length written here
- * would be counted twice and the preimage would verify nowhere. This is the one
- * field spelled differently in the two encodings — see {@link audienceWire}.
- */
-function audienceSigningBytes(audience) {
-    return concat(Uint8Array.from([AUDIENCE_TAG[audience.kind]]), audienceBody(audience));
-}
-/**
- * What the audience contributes to the **wire encoding**: the borsh enum tag,
- * then for the two payload-carrying variants a borsh `String` — its own `u32`
- * little-endian length, then the UTF-8.
- *
- * `cli` is a bare tag. Writing a `u32` zero after it instead produces four extra
- * bytes that a node reads as the start of the challenge, so the statement fails
- * as a bad signature rather than as a malformed one.
- */
-function audienceWire(audience) {
-    const tag = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
-    if (audience.kind === 'cli') {
-        return tag;
-    }
-    const body = audienceBody(audience);
-    return concat(tag, u32le(body.length), body);
-}
-/**
- * Sign a login statement and return it hex-encoded, ready to present with an
- * account proof.
- *
- * Returns the encoding rather than an object for the reason `signWarrant` does:
- * the signature covers exactly these bytes, and a caller that rebuilt the fields
- * from JSON would have a second spelling able to disagree with what was signed.
- */
-export async function signLoginStatement(input) {
-    const node = fromHex(input.node, 'node', 32);
-    const challenge = fromHex(input.challenge, 'challenge', 32);
-    const sessionKey = fromHex(input.sessionKey, 'sessionKey', 32);
-    const signer = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    const deviceKey = fromHex(signer.publicKey, 'signer.publicKey', 32);
-    const issuedAt = u64le(input.issuedAt);
-    const expiresAt = u64le(input.expiresAt);
-    const preimage = await domainHash(SIGN_DOMAIN, [
-        node,
-        audienceSigningBytes(input.audience),
-        challenge,
-        sessionKey,
-        deviceKey,
-        issuedAt,
-        expiresAt,
-    ]);
-    const signature = await signer.sign(preimage);
-    return hex(concat(node, audienceWire(input.audience), challenge, sessionKey, deviceKey, issuedAt, expiresAt, signature));
-}

package/dist/login/session.d.ts

@@ -1,124 +0,0 @@
-/**
- * Obtain a session on a node using only a device key — the handshake around
- * {@link signLoginStatement}.
- *
- * Signing a statement was never the whole job. A client also has to fetch a
- * challenge, mint a session keypair, assemble a request body whose shape it
- * cannot see from here, and read a token out of the reply. Until now every
- * consumer wrote those two HTTP calls by hand, which is how the same three
- * mistakes kept being available to make:
- *
- * 1. **Asking for permissions.** `POST /auth/token` takes an optional
- *    `permissions` list. Left unset, the node grants the account-proof
- *    provider's own scopes — `context:intent`, `context:query`,
- *    `context:subscribe` — which are the whole delegated surface and
- *    deliberately nothing above it. This module never sends the field.
- *    `authenticate()` in this same package hardcodes `['admin']` (#84); a
- *    device-key session would be refused for that and should never ask.
- * 2. **Learning the node's key from the node.** {@link LoginConfig.node} is
- *    required and has no default, because a value read from the challenge
- *    response would let whoever answered choose what the device signs about.
- *    That is the whole attack the field exists to stop, so the awkwardness of
- *    having to supply it is the point rather than something to smooth away.
- * 3. **Losing the refresh token.** A browser tab outlives a short-lived
- *    session, so both tokens are returned. Nothing here refreshes on a timer
- *    (#87, #88 track that); this only makes it possible without a second
- *    breaking change.
- *
- * **The session key never leaves.** It is minted here, the device key signs
- * over it once, and the secret half is handed back to the caller. That is what
- * keeps a device key off the wire for the life of a session: a leaked token
- * cannot be escalated into use of the key that authorised it.
- */
-import { type Audience } from './login.js';
-import { type Signer } from '../signer/signer.js';
-/** A freshly minted ephemeral keypair, hex-encoded. */
-export interface SessionKeyPair {
-    /** The public half — what the statement is signed over. */
-    publicKey: string;
-    /** The private half. Held by the caller; never sent anywhere. */
-    secret: string;
-}
-/**
- * Mint the ephemeral keypair a session speaks with.
- *
- * An ed25519 secret *is* 32 random bytes, so this needs no key generation
- * ceremony — `getRandomValues` and the same derivation every other signer here
- * uses. Exported because a caller that wants to persist a session across a page
- * reload needs to mint the pair itself and keep the secret.
- */
-export declare function generateSessionKey(): Promise<SessionKeyPair>;
-/** What a device needs in order to ask for a session. */
-export interface LoginConfig {
-    /** The node's base URL, e.g. `https://node.example`. */
-    nodeUrl: string;
-    /**
-     * The node's device signing key, hex (32 bytes), **as this client pinned it**.
-     *
-     * Learn it out of band — from the node's operator, or a certificate you
-     * already trust. Never from the node you are about to log in to: see the
-     * module note.
-     */
-    node: string;
-    /**
-     * The device's ed25519 signing secret, hex (32 bytes). Never sent.
-     *
-     * Mutually exclusive with {@link LoginConfig.signer}, and the weaker of the
-     * two in a browser — see {@link Signer}.
-     */
-    deviceSecret?: string;
-    /**
-     * The device's signer — use instead of {@link LoginConfig.deviceSecret} when
-     * the key cannot be exported to hex.
-     */
-    signer?: Signer;
-    /**
-     * The device's account proof, hex — the credential certifying that this
-     * device belongs to its account.
-     *
-     * Travels beside the statement and is what settles *which account* is asking.
-     * The statement alone proves only that a device key asked, so logging in
-     * without this yields a 401 that looks exactly like a bad signature.
-     */
-    accountProof: string;
-    /** The client surface this session is bound to. */
-    audience: Audience;
-    /**
-     * The token request's `client_name`. Defaults to {@link LoginConfig.nodeUrl}.
-     *
-     * mero-auth records this value as the session's `node_url` and, on every
-     * later request, refuses one whose Host is not that URL's host ("Token is not
-     * valid for this host"). So it must name the node being logged in to — which
-     * is what core's own clients send. The audience is not a substitute: a browser
-     * page's origin is a different host from the relay it talks to, and a token
-     * bound to the page's host is refused on the first call.
-     */
-    clientName?: string;
-    /** Seconds the statement stays valid. Defaults to {@link DEFAULT_TTL_SECONDS}. */
-    ttlSeconds?: number;
-    /** Injectable for tests and non-browser runtimes. */
-    fetch?: typeof fetch;
-    /** Per-request timeout. Defaults to 10s. */
-    timeoutMs?: number;
-}
-/** A session minted without a password. */
-export interface DelegatedSession {
-    /** Bearer token for the delegated surface. */
-    accessToken: string;
-    /** Presented to renew the access token. See #87/#88 — nothing here schedules it. */
-    refreshToken: string;
-    /** The session's public half, as the node knows it. */
-    sessionKey: string;
-    /** The session's private half. The caller keeps this; it was never sent. */
-    sessionSecret: string;
-}
-/**
- * Log in with a device key and return the session.
- *
- * The challenge is fetched immediately before signing on purpose: it is
- * single-use and short-lived, so a statement minted against a stale one is
- * refused before any signature work is done.
- *
- * @throws {HTTPError} if the node refuses the challenge or the token request.
- */
-export declare function login(config: LoginConfig): Promise<DelegatedSession>;