@cavi-ai/api-client 0.1.0

package/dist/core/gateway/rpc/client.js

@@ -0,0 +1,675 @@
+// CANONICAL — single source of truth lives here. Do not duplicate. See packages/README.md.
+import { buildDeviceAuthPayloadV3, signPayload } from "./device-crypto.js";
+import { loadOrCreateDeviceIdentity, isDeviceIdentitySupported, } from "./device-store.js";
+import { GatewayRpcError } from "./error.js";
+import { GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS, resolveDeviceTokenOnlyFallbackMs, } from "./preauth-handshake.js";
+import { describeWebSocketClose, } from "../../ws/close.js";
+export { GatewayRpcError } from "./error.js";
+export { DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS, resolvePreauthHandshakeTimeoutMs, resolveDeviceTokenOnlyFallbackMs, resolvePreauthHandshakeTimeoutMsFromEnv, } from "./preauth-handshake.js";
+export { signPayload } from "./device-crypto.js";
+export { loadOrCreateDeviceIdentity, isDeviceIdentitySupported, } from "./device-store.js";
+export { BASELINE_SESSIONS_LIST_PARAMS, EMPTY_SESSIONS_USAGE, SESSIONS_DETAIL_CACHE_TTL_MS, canonicalizeSessionDetailParams, canonicalizeSessionsListParams, canonicalizeSessionsPreviewParams, canonicalizeSessionsUsageParams, createSessionLoaders, isUnchangedSessionsListPayload, normalizeSessionsListPayload, } from "../snapshots/session-loaders.js";
+const REQUEST_TIMEOUT_MS = 10_000;
+const MAX_CONCURRENT_RPC_REQUESTS = 3;
+export const DEFAULT_GATEWAY_PROTOCOL_VERSION = 4;
+const DEFAULT_GATEWAY_RPC_CLIENT_VERSION = "0.1.0";
+const DEFAULT_GATEWAY_RPC_CLIENT_SCOPES = ["operator.read"];
+function normalizeGatewayScopes(scopes) {
+    if (!scopes || scopes.length === 0) {
+        return [];
+    }
+    const seen = new Set();
+    const result = [];
+    for (const scope of scopes) {
+        if (typeof scope !== "string") {
+            continue;
+        }
+        const trimmed = scope.trim();
+        if (trimmed.length === 0 || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        result.push(trimmed);
+    }
+    return result;
+}
+export function resolveGatewayConnectScopes(options) {
+    const requested = normalizeGatewayScopes(options?.requestedScopes);
+    if (requested.length > 0) {
+        return requested;
+    }
+    const defaultRequested = normalizeGatewayScopes(options?.defaultRequestedScopes);
+    if (defaultRequested.length > 0) {
+        return defaultRequested;
+    }
+    return [...DEFAULT_GATEWAY_RPC_CLIENT_SCOPES];
+}
+export function resolveGatewayRpcClientProfile(options) {
+    const clientId = options?.clientId?.trim();
+    if (!clientId) {
+        throw new Error("Missing clientId. Pass clientId to useGatewayEventStream, GatewayClientProvider, or useGatewayClient.");
+    }
+    return {
+        clientId,
+        clientVersion: options?.clientVersion ?? DEFAULT_GATEWAY_RPC_CLIENT_VERSION,
+        clientPlatform: options?.clientPlatform ?? "web",
+        clientMode: options?.clientMode ?? "webchat",
+    };
+}
+function resolveGatewayProtocolRange(options) {
+    const minProtocol = options?.minProtocol ?? DEFAULT_GATEWAY_PROTOCOL_VERSION;
+    const maxProtocol = options?.maxProtocol ?? DEFAULT_GATEWAY_PROTOCOL_VERSION;
+    if (!Number.isInteger(minProtocol) ||
+        !Number.isInteger(maxProtocol) ||
+        minProtocol < 1 ||
+        maxProtocol < 1 ||
+        minProtocol > maxProtocol) {
+        throw new Error("Gateway protocol range must be positive integers with minProtocol <= maxProtocol.");
+    }
+    return { minProtocol, maxProtocol };
+}
+/** Defaults for React Native while preserving caller-provided client identity. */
+export function mergeGatewayRpcClientOptionsForReactNative(options) {
+    return {
+        ...options,
+        enableDeviceIdentity: options?.enableDeviceIdentity ?? true,
+        clientPlatform: options?.clientPlatform ?? "react-native",
+        clientMode: options?.clientMode,
+    };
+}
+export function createGatewayRpcConnectParams(params) {
+    const client = resolveGatewayRpcClientProfile(params.options);
+    const protocol = resolveGatewayProtocolRange(params.options);
+    const result = {
+        minProtocol: protocol.minProtocol,
+        maxProtocol: protocol.maxProtocol,
+        client: {
+            id: client.clientId,
+            version: client.clientVersion,
+            platform: client.clientPlatform,
+            mode: client.clientMode,
+        },
+        role: "operator",
+        scopes: resolveGatewayConnectScopes(params.options),
+        caps: [],
+        auth: params.authToken
+            ? {
+                token: params.authToken,
+                password: params.authToken,
+            }
+            : undefined,
+        userAgent: params.userAgent,
+        locale: params.locale,
+    };
+    if (params.device) {
+        result.device = params.device;
+    }
+    return result;
+}
+function normalizeGatewayRpcError(error, fallbackMessage, fallbackCode = "gateway_error") {
+    if (error instanceof GatewayRpcError) {
+        return error;
+    }
+    if (error instanceof Error) {
+        return new GatewayRpcError(error.message, fallbackCode);
+    }
+    return new GatewayRpcError(fallbackMessage, fallbackCode);
+}
+function redactGatewayRpcTraceParams(method, params) {
+    try {
+        const clone = JSON.parse(JSON.stringify(params));
+        if (method === "connect") {
+            const auth = clone.auth;
+            if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+                const a = auth;
+                if (typeof a.token === "string")
+                    a.token = "***";
+                if (typeof a.password === "string")
+                    a.password = "***";
+            }
+            const device = clone.device;
+            if (device && typeof device === "object" && !Array.isArray(device)) {
+                const d = device;
+                if (typeof d.signature === "string")
+                    d.signature = "***";
+                if (typeof d.publicKey === "string" && d.publicKey.length > 24) {
+                    d.publicKey = `${String(d.publicKey).slice(0, 12)}…(redacted)`;
+                }
+            }
+        }
+        return clone;
+    }
+    catch {
+        return { _redactionNote: "params not JSON-serializable", method };
+    }
+}
+function summarizeRpcTraceResult(value, maxChars) {
+    try {
+        const s = JSON.stringify(value);
+        if (s.length <= maxChars)
+            return s;
+        return `${s.slice(0, maxChars)}…[truncated ${s.length - maxChars} chars]`;
+    }
+    catch {
+        return String(value);
+    }
+}
+function serializeRpcTraceError(error) {
+    if (error instanceof GatewayRpcError) {
+        return { name: error.name, message: error.message, code: error.code };
+    }
+    return { name: error.name, message: error.message };
+}
+function createGatewaySocketClosedError(event) {
+    const closed = describeWebSocketClose(event, "gateway closed");
+    return new GatewayRpcError(closed.code === null && closed.reason === null
+        ? "gateway websocket closed"
+        : closed.message, "socket_closed");
+}
+function readGatewayPreauthHandshakeEnv() {
+    if (typeof process === "undefined") {
+        return undefined;
+    }
+    const env = {
+        [GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.timeoutMs]: process.env[GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.timeoutMs],
+    };
+    if (GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testTimeoutMs) {
+        env[GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testTimeoutMs] =
+            process.env[GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testTimeoutMs];
+    }
+    if (GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testFlag) {
+        env[GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testFlag] =
+            process.env[GATEWAY_PREAUTH_HANDSHAKE_ENV_KEYS.testFlag];
+    }
+    return env;
+}
+function resolvePositiveIntegerOption(value, fallback) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0
+        ? value
+        : fallback;
+}
+export class GatewayRpcClient {
+    wsUrl;
+    authToken;
+    options;
+    socket = null;
+    connectPromise = null;
+    pending = new Map();
+    activeRpcRequests = 0;
+    queuedRpcRequests = [];
+    sequence = 0;
+    connected = false;
+    /** Set when a connect RPC is explicitly rejected (auth failure, etc.) so onClose
+     *  does not emit a retryable socket_closed error that triggers an infinite reconnect loop. */
+    connectRejected = false;
+    eventListeners = new Set();
+    stateListeners = new Set();
+    state = "idle";
+    lastError = null;
+    intentionalClose = false;
+    emitRpcTrace(entry) {
+        const hook = this.options.onRpcTrace;
+        if (!hook) {
+            return;
+        }
+        try {
+            hook(entry);
+        }
+        catch {
+            /* ignore observer failures */
+        }
+    }
+    deviceIdentity = null;
+    deviceIdentityReady;
+    /** Incremented on each connect attempt; stale async connect paths must not resolve the outer promise. */
+    connectAttemptSeq = 0;
+    constructor(wsUrl, authToken, options = {}) {
+        this.wsUrl = wsUrl;
+        this.authToken = authToken;
+        this.options = options;
+        const enableDevice = options.enableDeviceIdentity !== false;
+        const identityLoader = enableDevice && options.deviceIdentityLoader
+            ? options.deviceIdentityLoader
+            : enableDevice && isDeviceIdentitySupported()
+                ? loadOrCreateDeviceIdentity
+                : null;
+        if (identityLoader) {
+            this.deviceIdentityReady = identityLoader().then((identity) => {
+                this.deviceIdentity = identity;
+            }, () => {
+                /* graceful degradation */
+            });
+        }
+        else {
+            this.deviceIdentityReady = Promise.resolve();
+        }
+    }
+    getConnectionState() {
+        return this.state;
+    }
+    getLastError() {
+        return this.lastError;
+    }
+    onEvent(listener) {
+        this.eventListeners.add(listener);
+        return () => {
+            this.eventListeners.delete(listener);
+        };
+    }
+    onStateChange(listener) {
+        this.stateListeners.add(listener);
+        // Defer the initial snapshot so React subscribers don't run setState synchronously
+        // during the same commit as subscribe (Strict Mode / navigation mount → "state update
+        // before component mounted" warnings on RN/React 19).
+        const deliverInitial = () => {
+            if (!this.stateListeners.has(listener)) {
+                return;
+            }
+            listener(this.state, this.lastError);
+        };
+        if (typeof queueMicrotask === "function") {
+            queueMicrotask(deliverInitial);
+        }
+        else {
+            void Promise.resolve().then(deliverInitial);
+        }
+        return () => {
+            this.stateListeners.delete(listener);
+        };
+    }
+    async connect() {
+        await this.ensureConnected();
+    }
+    async request(method, params = {}) {
+        await this.ensureConnected();
+        return this.runWithRpcBackpressure(() => this.requestRaw(method, params));
+    }
+    async close() {
+        this.connectAttemptSeq += 1;
+        this.intentionalClose = true;
+        this.connected = false;
+        this.connectPromise = null;
+        if (!this.socket) {
+            this.setState("idle", null);
+            return;
+        }
+        this.socket.close();
+        this.socket = null;
+        for (const pending of this.pending.values()) {
+            pending.reject(new GatewayRpcError("connection closed", "closed"));
+        }
+        this.pending.clear();
+        this.rejectQueuedRpcRequests(new GatewayRpcError("connection closed", "closed"));
+        this.setState("idle", null);
+    }
+    setState(state, error) {
+        this.state = state;
+        this.lastError = error;
+        for (const listener of this.stateListeners) {
+            listener(state, error);
+        }
+    }
+    getConnectClientInfo() {
+        if (typeof navigator !== "undefined") {
+            return {
+                userAgent: navigator.userAgent,
+                locale: navigator.language,
+            };
+        }
+        return { userAgent: "unknown", locale: "en" };
+    }
+    async ensureConnected() {
+        if (this.connected &&
+            this.socket &&
+            this.socket.readyState === WebSocket.OPEN) {
+            return;
+        }
+        if (this.connectPromise) {
+            return this.connectPromise;
+        }
+        this.setState("connecting", null);
+        this.connectPromise = new Promise((resolve, reject) => {
+            const ws = new WebSocket(this.wsUrl);
+            this.socket = ws;
+            this.intentionalClose = false;
+            this.connectRejected = false;
+            let connectPhase = "waiting";
+            let connectTimer = null;
+            const clearConnectTimer = () => {
+                if (connectTimer !== null) {
+                    clearTimeout(connectTimer);
+                    connectTimer = null;
+                }
+            };
+            const { userAgent, locale } = this.getConnectClientInfo();
+            const preferDeviceChallengeFirst = this.options.enableDeviceIdentity !== false &&
+                Boolean(this.options.deviceIdentityLoader ?? isDeviceIdentitySupported());
+            const handshakeEnv = this.options.preauthHandshakeEnv ?? readGatewayPreauthHandshakeEnv();
+            const tokenOnlyFallbackMs = preferDeviceChallengeFirst
+                ? resolveDeviceTokenOnlyFallbackMs({
+                    env: handshakeEnv,
+                    envKeys: this.options.preauthHandshakeEnvKeys,
+                    preauthHandshakeTimeoutMs: this.options.preauthHandshakeTimeoutMs,
+                })
+                : 0;
+            const isCurrentOpenSocket = () => this.socket === ws && ws.readyState === WebSocket.OPEN;
+            const sendConnect = (nonce) => {
+                if (connectPhase !== "waiting" || !isCurrentOpenSocket()) {
+                    return;
+                }
+                clearConnectTimer();
+                connectPhase = "requesting";
+                const seq = ++this.connectAttemptSeq;
+                const doConnect = async () => {
+                    await this.deviceIdentityReady;
+                    let device = null;
+                    if (this.deviceIdentity && nonce) {
+                        const client = resolveGatewayRpcClientProfile(this.options);
+                        const role = "operator";
+                        const scopes = resolveGatewayConnectScopes(this.options);
+                        const signedAtMs = Date.now();
+                        const token = this.authToken ?? "";
+                        const payload = buildDeviceAuthPayloadV3({
+                            deviceId: this.deviceIdentity.deviceId,
+                            clientId: client.clientId,
+                            clientMode: client.clientMode,
+                            role,
+                            scopes,
+                            signedAtMs,
+                            token,
+                            nonce,
+                            platform: client.clientPlatform,
+                        });
+                        const signature = await signPayload(this.deviceIdentity.privateKey, payload);
+                        device = {
+                            id: this.deviceIdentity.deviceId,
+                            publicKey: this.deviceIdentity.publicKeyBase64Url,
+                            signature,
+                            signedAt: signedAtMs,
+                            nonce,
+                        };
+                    }
+                    return this.requestRaw("connect", createGatewayRpcConnectParams({
+                        authToken: this.authToken,
+                        userAgent,
+                        locale,
+                        options: this.options,
+                        device,
+                    }));
+                };
+                void doConnect()
+                    .then(() => {
+                    if (seq !== this.connectAttemptSeq || connectPhase === "settled") {
+                        return;
+                    }
+                    if (!isCurrentOpenSocket()) {
+                        connectPhase = "settled";
+                        const closeError = createGatewaySocketClosedError();
+                        reject(closeError);
+                        return;
+                    }
+                    connectPhase = "settled";
+                    this.connected = true;
+                    this.setState("connected", null);
+                    resolve();
+                })
+                    .catch((error) => {
+                    if (seq !== this.connectAttemptSeq || connectPhase === "settled") {
+                        return;
+                    }
+                    if (this.connected) {
+                        return;
+                    }
+                    connectPhase = "settled";
+                    const normalizedError = normalizeGatewayRpcError(error, "gateway connect failed", "connect_failed");
+                    this.setState("error", normalizedError);
+                    this.connectRejected = true;
+                    this.intentionalClose = true;
+                    if (ws.readyState === WebSocket.OPEN ||
+                        ws.readyState === WebSocket.CONNECTING) {
+                        ws.close();
+                    }
+                    reject(normalizedError);
+                });
+            };
+            const onOpen = () => {
+                if (tokenOnlyFallbackMs <= 0) {
+                    sendConnect(undefined);
+                    return;
+                }
+                connectTimer = setTimeout(() => {
+                    sendConnect(undefined);
+                }, tokenOnlyFallbackMs);
+            };
+            const onMessage = (event) => {
+                if (typeof event.data === "string") {
+                    try {
+                        const parsed = JSON.parse(event.data);
+                        if (connectPhase === "waiting" &&
+                            parsed.type === "event" &&
+                            parsed.event === "connect.challenge" &&
+                            isCurrentOpenSocket()) {
+                            const nonce = typeof parsed.payload?.nonce === "string"
+                                ? parsed.payload.nonce
+                                : undefined;
+                            sendConnect(nonce);
+                            return;
+                        }
+                    }
+                    catch {
+                        // Let the regular frame handler ignore invalid payloads.
+                    }
+                }
+                this.handleMessage(event);
+            };
+            const onError = () => {
+                clearConnectTimer();
+                const error = new GatewayRpcError("gateway websocket failed", "socket_error");
+                this.setState("error", error);
+                if (connectPhase !== "settled") {
+                    connectPhase = "settled";
+                }
+                reject(error);
+            };
+            const onClose = (event) => {
+                clearConnectTimer();
+                this.connected = false;
+                this.connectPromise = null;
+                if (this.socket === ws) {
+                    this.socket = null;
+                }
+                const closeError = createGatewaySocketClosedError(event);
+                for (const pending of this.pending.values()) {
+                    pending.reject(closeError);
+                }
+                this.pending.clear();
+                this.rejectQueuedRpcRequests(closeError);
+                if (this.connectRejected) {
+                    this.intentionalClose = false;
+                    this.connectRejected = false;
+                    return;
+                }
+                if (this.intentionalClose) {
+                    this.intentionalClose = false;
+                    return;
+                }
+                this.setState("error", closeError);
+                if (connectPhase !== "settled") {
+                    connectPhase = "settled";
+                    reject(closeError);
+                }
+            };
+            ws.addEventListener("open", onOpen, { once: true });
+            ws.addEventListener("message", onMessage);
+            ws.addEventListener("error", onError, { once: true });
+            ws.addEventListener("close", onClose);
+        }).finally(() => {
+            this.connectPromise = null;
+        });
+        return this.connectPromise;
+    }
+    async requestRaw(method, params) {
+        const ws = this.socket;
+        if (!ws || ws.readyState !== WebSocket.OPEN) {
+            throw new GatewayRpcError("gateway websocket is not connected", "socket_unavailable");
+        }
+        // Per-client monotonic sequence + time; duplicate ids across tabs/processes are negligible for this protocol.
+        const id = `mc-${Date.now()}-${this.sequence++}`;
+        const frame = {
+            type: "req",
+            id,
+            method,
+            params,
+        };
+        const startedAt = Date.now();
+        const redactedParams = redactGatewayRpcTraceParams(method, params);
+        return await new Promise((resolve, reject) => {
+            const emitDone = (outcome) => {
+                const durationMs = Date.now() - startedAt;
+                if (outcome.ok) {
+                    this.emitRpcTrace({
+                        at: Date.now(),
+                        transport: "websocket",
+                        correlationId: id,
+                        method,
+                        durationMs,
+                        ok: true,
+                        params: redactedParams,
+                        resultPreview: summarizeRpcTraceResult(outcome.value, 24_000),
+                    });
+                }
+                else {
+                    this.emitRpcTrace({
+                        at: Date.now(),
+                        transport: "websocket",
+                        correlationId: id,
+                        method,
+                        durationMs,
+                        ok: false,
+                        params: redactedParams,
+                        error: serializeRpcTraceError(outcome.error),
+                    });
+                }
+            };
+            const requestTimeoutMs = resolvePositiveIntegerOption(this.options.requestTimeoutMs, REQUEST_TIMEOUT_MS);
+            const timeout = setTimeout(() => {
+                const p = this.pending.get(id);
+                this.pending.delete(id);
+                if (p) {
+                    p.reject(new GatewayRpcError(`request timed out: ${method}`, "timeout"));
+                }
+            }, requestTimeoutMs);
+            this.pending.set(id, {
+                resolve: (value) => {
+                    clearTimeout(timeout);
+                    emitDone({ ok: true, value });
+                    resolve(value);
+                },
+                reject: (error) => {
+                    clearTimeout(timeout);
+                    const err = error instanceof Error ? error : new Error(String(error));
+                    emitDone({ ok: false, error: err });
+                    reject(err);
+                },
+            });
+            try {
+                ws.send(JSON.stringify(frame));
+            }
+            catch (error) {
+                const p = this.pending.get(id);
+                this.pending.delete(id);
+                clearTimeout(timeout);
+                const err = normalizeGatewayRpcError(error, `gateway request failed: ${method}`, "socket_error");
+                if (p) {
+                    p.reject(err);
+                }
+                else {
+                    reject(err);
+                }
+            }
+        });
+    }
+    async runWithRpcBackpressure(run) {
+        let slotReserved = false;
+        const maxConcurrentRequests = resolvePositiveIntegerOption(this.options.maxConcurrentRequests, MAX_CONCURRENT_RPC_REQUESTS);
+        if (this.activeRpcRequests >= maxConcurrentRequests) {
+            await new Promise((resolve, reject) => {
+                this.queuedRpcRequests.push({
+                    resolve: () => {
+                        slotReserved = true;
+                        resolve();
+                    },
+                    reject,
+                });
+            });
+        }
+        if (!slotReserved) {
+            this.activeRpcRequests += 1;
+        }
+        try {
+            return await run();
+        }
+        finally {
+            this.activeRpcRequests = Math.max(0, this.activeRpcRequests - 1);
+            this.drainQueuedRpcRequests();
+        }
+    }
+    drainQueuedRpcRequests() {
+        const maxConcurrentRequests = resolvePositiveIntegerOption(this.options.maxConcurrentRequests, MAX_CONCURRENT_RPC_REQUESTS);
+        while (this.activeRpcRequests < maxConcurrentRequests &&
+            this.queuedRpcRequests.length > 0) {
+            const next = this.queuedRpcRequests.shift();
+            next?.resolve();
+            this.activeRpcRequests += 1;
+        }
+    }
+    rejectQueuedRpcRequests(error) {
+        const queued = this.queuedRpcRequests.splice(0);
+        for (const request of queued) {
+            request.reject(error);
+        }
+    }
+    handleMessage(event) {
+        if (typeof event.data !== "string") {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(event.data);
+        }
+        catch {
+            return;
+        }
+        if (!parsed || typeof parsed !== "object") {
+            return;
+        }
+        const eventFrame = parsed;
+        if (eventFrame.type === "event" && typeof eventFrame.event === "string") {
+            const streamEvent = {
+                event: eventFrame.event,
+                payload: eventFrame.payload,
+            };
+            for (const listener of this.eventListeners) {
+                listener(streamEvent);
+            }
+            return;
+        }
+        const frame = parsed;
+        if (frame.type !== "res" || typeof frame.id !== "string") {
+            return;
+        }
+        const pending = this.pending.get(frame.id);
+        if (!pending) {
+            return;
+        }
+        this.pending.delete(frame.id);
+        if (!frame.ok) {
+            const message = frame.error?.message ?? "gateway request failed";
+            pending.reject(new GatewayRpcError(message, frame.error?.code ?? "request_failed"));
+            return;
+        }
+        pending.resolve(frame.payload);
+    }
+}
+export { resolveGatewayTargets, tryResolveGatewayTargets, } from "../../ws/targets.js";
+export { PORTAL_CONFIG_PATCH_CLIENT_ID_HEADER, PORTAL_CONFIG_PATCH_CONTRACT, PORTAL_CONFIG_PATCH_CONTRACT_VERSION, PortalConfigPatchError, portalConfigPatchPath, postPortalConfigPatch, unflattenPortalConfigPatchKeys, } from "../portal/config-patch.js";

package/dist/core/gateway/rpc/device-crypto.d.ts

@@ -0,0 +1,19 @@
+export declare function base64UrlEncode(buf: Uint8Array): string;
+export declare function base64UrlDecode(input: string): Uint8Array;
+export declare function generateDeviceKeypair(): Promise<CryptoKeyPair>;
+export declare function exportPublicKeyRaw(key: CryptoKey): Promise<Uint8Array>;
+export declare function deriveDeviceId(publicKeyRaw: Uint8Array): Promise<string>;
+export declare function buildDeviceAuthPayloadV3(params: {
+    deviceId: string;
+    clientId: string;
+    clientMode: string;
+    role: string;
+    scopes: string[];
+    signedAtMs: number;
+    token: string;
+    nonce: string;
+    platform?: string | null;
+    deviceFamily?: string | null;
+}): string;
+export declare function signPayload(privateKey: CryptoKey, payload: string): Promise<string>;
+//# sourceMappingURL=device-crypto.d.ts.map

package/dist/core/gateway/rpc/device-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-crypto.d.ts","sourceRoot":"","sources":["../../../../src/core/gateway/rpc/device-crypto.ts"],"names":[],"mappings":"AAQA,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CASzD;AAID,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,aAAa,CAAC,CAEpE;AAID,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAG5E;AAID,wBAAsB,cAAc,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAgBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,MAAM,CAiBT;AAID,wBAAsB,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzF"}