@evalops/maestro 0.10.8 → 0.10.11

package/dist/oauth/connectors.js

@@ -0,0 +1,253 @@
+import { refreshRemoteConnection, registerRemoteConnection, revokeRemoteConnection, setRemoteSourceOfTruthPolicy, } from "../connectors/service-client.js";
+import { loadOAuthCredentials, saveOAuthCredentials, } from "./storage.js";
+const CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER = {
+    anthropic: "x-evalops:anthropic",
+    "github-copilot": "github",
+    "google-antigravity": "google",
+    "google-gemini-cli": "google",
+    openai: "x-evalops:openai",
+    "openai-codex": "x-evalops:openai",
+};
+const DISPLAY_NAME_BY_OAUTH_PROVIDER = {
+    anthropic: "Anthropic OAuth",
+    "github-copilot": "GitHub Copilot OAuth",
+    "google-antigravity": "Google Antigravity OAuth",
+    "google-gemini-cli": "Google Gemini CLI OAuth",
+    openai: "OpenAI OAuth",
+    "openai-codex": "OpenAI Codex OAuth",
+};
+export const CONNECTOR_SOURCE_OF_TRUTH_AREAS = [
+    "analytics",
+    "billing",
+    "crm",
+    "hris",
+    "support",
+];
+const SOURCE_OF_TRUTH_METADATA_KEYS = [
+    "connectorSourceOfTruthArea",
+    "connectorSourceOfTruthFallbackConnectionId",
+    "connectorSourceOfTruthPrimaryConnectionId",
+    "connectorSourceOfTruthWorkspaceId",
+    "sourceOfTruthArea",
+    "sourceOfTruthFallbackConnectionId",
+];
+function isConnectorOAuthProvider(provider) {
+    return Object.prototype.hasOwnProperty.call(CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER, provider);
+}
+function supportedConnectorOAuthProviders() {
+    return Object.keys(CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER).sort().join(", ");
+}
+function trimString(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+export function normalizeConnectorSourceOfTruthArea(area) {
+    const normalized = area
+        .trim()
+        .toLowerCase()
+        .replace(/^source_of_truth_area_/u, "")
+        .replace(/^source-of-truth-area-/u, "")
+        .replaceAll("_", "-");
+    for (const candidate of CONNECTOR_SOURCE_OF_TRUTH_AREAS) {
+        if (candidate === normalized ||
+            candidate.replaceAll("_", "-") === normalized) {
+            return candidate;
+        }
+    }
+    return null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getMetadataString(metadata, key) {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.trim().length > 0
+        ? value.trim()
+        : undefined;
+}
+function getMetadataStringArray(metadata, key) {
+    const value = metadata?.[key];
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const entries = value
+        .filter((entry) => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    return entries.length > 0 ? entries : undefined;
+}
+function getMetadataStringMap(metadata, key) {
+    const value = metadata?.[key];
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const entries = Object.entries(value)
+        .map(([entryKey, entryValue]) => [
+        entryKey.trim(),
+        typeof entryValue === "string" ? entryValue.trim() : "",
+    ])
+        .filter(([entryKey, entryValue]) => entryKey && entryValue);
+    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+function mergeConnectionMetadata(credentials, connection, providerId) {
+    if (!connection) {
+        return credentials;
+    }
+    return {
+        ...credentials,
+        metadata: {
+            ...credentials.metadata,
+            connectorConnectionId: connection.id,
+            connectorHealthStatus: connection.healthStatus,
+            connectorProviderId: connection.providerId || providerId,
+            connectorUpdatedAt: connection.updatedAt,
+            connectorWorkspaceId: connection.workspaceId,
+        },
+    };
+}
+function getSourceOfTruthArea(metadata) {
+    return (getMetadataString(metadata, "connectorSourceOfTruthArea") ??
+        getMetadataString(metadata, "sourceOfTruthArea"));
+}
+function getSourceOfTruthFallbackConnectionId(metadata) {
+    return (getMetadataString(metadata, "connectorSourceOfTruthFallbackConnectionId") ??
+        getMetadataString(metadata, "sourceOfTruthFallbackConnectionId"));
+}
+function mergeSourceOfTruthPolicyMetadata(credentials, policy) {
+    if (!policy) {
+        return credentials;
+    }
+    return {
+        ...credentials,
+        metadata: {
+            ...credentials.metadata,
+            connectorSourceOfTruthArea: policy.area,
+            connectorSourceOfTruthPrimaryConnectionId: policy.primaryConnectionId,
+            connectorSourceOfTruthWorkspaceId: policy.workspaceId,
+            ...(policy.fallbackConnectionId
+                ? {
+                    connectorSourceOfTruthFallbackConnectionId: policy.fallbackConnectionId,
+                }
+                : {}),
+        },
+    };
+}
+async function syncSourceOfTruthPolicy(credentials, connection) {
+    if (!connection) {
+        return credentials;
+    }
+    const area = getSourceOfTruthArea(credentials.metadata);
+    if (!area) {
+        return credentials;
+    }
+    const policy = await setRemoteSourceOfTruthPolicy({
+        workspaceId: connection.workspaceId,
+        area,
+        primaryConnectionId: connection.id,
+        fallbackConnectionId: getSourceOfTruthFallbackConnectionId(credentials.metadata),
+    });
+    return mergeSourceOfTruthPolicyMetadata(credentials, policy);
+}
+export async function syncOAuthProviderConnection(provider, credentials) {
+    if (!isConnectorOAuthProvider(provider)) {
+        return credentials;
+    }
+    const providerId = CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER[provider];
+    const connectionId = getMetadataString(credentials.metadata, "connectorConnectionId");
+    if (connectionId) {
+        const connection = await refreshRemoteConnection(connectionId);
+        return syncSourceOfTruthPolicy(mergeConnectionMetadata(credentials, connection, providerId), connection);
+    }
+    const connection = await registerRemoteConnection({
+        providerId,
+        displayName: DISPLAY_NAME_BY_OAUTH_PROVIDER[provider],
+        authType: "AUTH_TYPE_OAUTH2",
+        scopes: getMetadataStringArray(credentials.metadata, "scopes"),
+        credentials: getMetadataStringMap(credentials.metadata, "connectorCredentialRefs"),
+    });
+    return syncSourceOfTruthPolicy(mergeConnectionMetadata(credentials, connection, providerId), connection);
+}
+export async function syncStoredOAuthProviderConnection(provider) {
+    if (!isConnectorOAuthProvider(provider)) {
+        return;
+    }
+    const credentials = loadOAuthCredentials(provider);
+    if (!credentials) {
+        return;
+    }
+    const synced = await syncOAuthProviderConnection(provider, credentials);
+    if (synced !== credentials) {
+        saveOAuthCredentials(provider, synced);
+    }
+}
+export async function configureOAuthProviderSourceOfTruthPolicy(provider, input) {
+    if (!isConnectorOAuthProvider(provider)) {
+        throw new Error(`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`);
+    }
+    const credentials = loadOAuthCredentials(provider);
+    if (!credentials) {
+        throw new Error(`No OAuth credentials found for ${provider}`);
+    }
+    const area = normalizeConnectorSourceOfTruthArea(input.area);
+    if (!area) {
+        throw new Error(`Unsupported source-of-truth area: ${input.area}. Valid areas: ${CONNECTOR_SOURCE_OF_TRUTH_AREAS.join(", ")}`);
+    }
+    const metadata = { ...credentials.metadata };
+    metadata.connectorSourceOfTruthArea = area;
+    delete metadata.sourceOfTruthArea;
+    delete metadata.sourceOfTruthFallbackConnectionId;
+    delete metadata.connectorSourceOfTruthPrimaryConnectionId;
+    delete metadata.connectorSourceOfTruthWorkspaceId;
+    const fallbackConnectionId = trimString(input.fallbackConnectionId);
+    if (fallbackConnectionId) {
+        metadata.connectorSourceOfTruthFallbackConnectionId = fallbackConnectionId;
+    }
+    else {
+        delete metadata.connectorSourceOfTruthFallbackConnectionId;
+    }
+    saveOAuthCredentials(provider, { ...credentials, metadata });
+    await syncStoredOAuthProviderConnection(provider);
+    const synced = loadOAuthCredentials(provider) ?? { ...credentials, metadata };
+    const syncedMetadata = synced.metadata ?? {};
+    const connectorConnectionId = getMetadataString(syncedMetadata, "connectorConnectionId");
+    const primaryConnectionId = getMetadataString(syncedMetadata, "connectorSourceOfTruthPrimaryConnectionId");
+    const workspaceId = getMetadataString(syncedMetadata, "connectorSourceOfTruthWorkspaceId");
+    return {
+        provider,
+        area,
+        ...(fallbackConnectionId ? { fallbackConnectionId } : {}),
+        ...(connectorConnectionId ? { connectorConnectionId } : {}),
+        ...(primaryConnectionId ? { primaryConnectionId } : {}),
+        ...(workspaceId ? { workspaceId } : {}),
+    };
+}
+export function clearOAuthProviderSourceOfTruthPolicy(provider) {
+    if (!isConnectorOAuthProvider(provider)) {
+        throw new Error(`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`);
+    }
+    const credentials = loadOAuthCredentials(provider);
+    if (!credentials) {
+        throw new Error(`No OAuth credentials found for ${provider}`);
+    }
+    const metadata = { ...credentials.metadata };
+    const hadPolicyMetadata = SOURCE_OF_TRUTH_METADATA_KEYS.some((key) => key in metadata);
+    if (!hadPolicyMetadata) {
+        return false;
+    }
+    for (const key of SOURCE_OF_TRUTH_METADATA_KEYS) {
+        delete metadata[key];
+    }
+    saveOAuthCredentials(provider, { ...credentials, metadata });
+    return hadPolicyMetadata;
+}
+export async function revokeOAuthProviderConnection(provider, credentials) {
+    if (!isConnectorOAuthProvider(provider)) {
+        return;
+    }
+    const connectionId = getMetadataString(credentials?.metadata, "connectorConnectionId");
+    if (!connectionId) {
+        return;
+    }
+    await revokeRemoteConnection(connectionId);
+}
+//# sourceMappingURL=connectors.js.map

package/dist/oauth/connectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../../src/oauth/connectors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAItB,MAAM,oCAAoC,GAGtC;IACH,SAAS,EAAE,qBAAqB;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,oBAAoB,EAAE,QAAQ;IAC9B,mBAAmB,EAAE,QAAQ;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,cAAc,EAAE,kBAAkB;CAClC,CAAC;AAEF,MAAM,8BAA8B,GAA2C;IAC9E,SAAS,EAAE,iBAAiB;IAC5B,gBAAgB,EAAE,sBAAsB;IACxC,oBAAoB,EAAE,0BAA0B;IAChD,mBAAmB,EAAE,yBAAyB;IAC9C,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,oBAAoB;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC9C,WAAW;IACX,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;CACA,CAAC;AAmBX,MAAM,6BAA6B,GAAG;IACrC,4BAA4B;IAC5B,4CAA4C;IAC5C,2CAA2C;IAC3C,mCAAmC;IACnC,mBAAmB;IACnB,mCAAmC;CAC1B,CAAC;AAEX,SAAS,wBAAwB,CAChC,QAAgB;IAEhB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAC1C,oCAAoC,EACpC,QAAQ,CACR,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,IAAY;IAEZ,MAAM,UAAU,GAAG,IAAI;SACrB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,+BAA+B,EAAE,CAAC;QACzD,IACC,SAAS,KAAK,UAAU;YACxB,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,EAC5C,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,GAAG,CACH,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B;QACC,QAAQ,CAAC,IAAI,EAAE;QACf,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC9C,CACX;SACA,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAC/B,WAA6B,EAC7B,UAA4C,EAC5C,UAAkB;IAElB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,qBAAqB,EAAE,UAAU,CAAC,EAAE;YACpC,qBAAqB,EAAE,UAAU,CAAC,YAAY;YAC9C,mBAAmB,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU;YACxD,kBAAkB,EAAE,UAAU,CAAC,SAAS;YACxC,oBAAoB,EAAE,UAAU,CAAC,WAAW;SAC5C;KACD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;QACzD,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAChD,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAC5C,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4CAA4C,CAAC;QACzE,iBAAiB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAChE,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACxC,WAA6B,EAC7B,MAAwC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,0BAA0B,EAAE,MAAM,CAAC,IAAI;YACvC,yCAAyC,EAAE,MAAM,CAAC,mBAAmB;YACrE,iCAAiC,EAAE,MAAM,CAAC,WAAW;YACrD,GAAG,CAAC,MAAM,CAAC,oBAAoB;gBAC9B,CAAC,CAAC;oBACA,0CAA0C,EACzC,MAAM,CAAC,oBAAoB;iBAC5B;gBACF,CAAC,CAAC,EAAE,CAAC;SACN;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,WAA6B,EAC7B,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QACjD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,IAAI;QACJ,mBAAmB,EAAE,UAAU,CAAC,EAAE;QAClC,oBAAoB,EAAE,oCAAoC,CACzD,WAAW,CAAC,QAAQ,CACpB;KACD,CAAC,CAAC;IACH,OAAO,gCAAgC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,QAAgC,EAChC,WAA6B;IAE7B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,oCAAoC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,CAAC,QAAQ,EACpB,uBAAuB,CACvB,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU;QACV,WAAW,EAAE,8BAA8B,CAAC,QAAQ,CAAC;QACrD,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9D,WAAW,EAAE,oBAAoB,CAChC,WAAW,CAAC,QAAQ,EACpB,yBAAyB,CACzB;KACD,CAAC,CAAC;IACH,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,QAAgC;IAEhC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;IACR,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC5B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAAgB,EAChB,KAAqD;IAErD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,qCAAqC,KAAK,CAAC,IAAI,kBAAkB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,QAAQ,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAC3C,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IAClC,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAClD,OAAO,QAAQ,CAAC,yCAAyC,CAAC;IAC1D,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAElD,MAAM,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,oBAAoB,EAAE,CAAC;QAC1B,QAAQ,CAAC,0CAA0C,GAAG,oBAAoB,CAAC;IAC5E,CAAC;SAAM,CAAC;QACP,OAAO,QAAQ,CAAC,0CAA0C,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7C,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,cAAc,EACd,uBAAuB,CACvB,CAAC;IACF,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,cAAc,EACd,2CAA2C,CAC3C,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACpC,cAAc,EACd,mCAAmC,CACnC,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,QAAgB;IAEhB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACxB,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,QAAgC,EAChC,WAAoC;IAEpC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;IACR,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,EAAE,QAAQ,EACrB,uBAAuB,CACvB,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n\ttype RemoteConnectorConnection,\n\ttype RemoteSourceOfTruthPolicy,\n\trefreshRemoteConnection,\n\tregisterRemoteConnection,\n\trevokeRemoteConnection,\n\tsetRemoteSourceOfTruthPolicy,\n} from \"../connectors/service-client.js\";\nimport type { SupportedOAuthProvider } from \"./index.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\ntype ConnectorOAuthProvider = Exclude<SupportedOAuthProvider, \"evalops\">;\n\nconst CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER: Record<\n\tConnectorOAuthProvider,\n\tstring\n> = {\n\tanthropic: \"x-evalops:anthropic\",\n\t\"github-copilot\": \"github\",\n\t\"google-antigravity\": \"google\",\n\t\"google-gemini-cli\": \"google\",\n\topenai: \"x-evalops:openai\",\n\t\"openai-codex\": \"x-evalops:openai\",\n};\n\nconst DISPLAY_NAME_BY_OAUTH_PROVIDER: Record<ConnectorOAuthProvider, string> = {\n\tanthropic: \"Anthropic OAuth\",\n\t\"github-copilot\": \"GitHub Copilot OAuth\",\n\t\"google-antigravity\": \"Google Antigravity OAuth\",\n\t\"google-gemini-cli\": \"Google Gemini CLI OAuth\",\n\topenai: \"OpenAI OAuth\",\n\t\"openai-codex\": \"OpenAI Codex OAuth\",\n};\n\nexport const CONNECTOR_SOURCE_OF_TRUTH_AREAS = [\n\t\"analytics\",\n\t\"billing\",\n\t\"crm\",\n\t\"hris\",\n\t\"support\",\n] as const;\n\nexport type ConnectorSourceOfTruthArea =\n\t(typeof CONNECTOR_SOURCE_OF_TRUTH_AREAS)[number];\n\nexport interface ConfigureOAuthProviderSourceOfTruthPolicyInput {\n\tarea: string;\n\tfallbackConnectionId?: string;\n}\n\nexport interface ConfiguredOAuthProviderSourceOfTruthPolicy {\n\tprovider: ConnectorOAuthProvider;\n\tarea: ConnectorSourceOfTruthArea;\n\tfallbackConnectionId?: string;\n\tconnectorConnectionId?: string;\n\tprimaryConnectionId?: string;\n\tworkspaceId?: string;\n}\n\nconst SOURCE_OF_TRUTH_METADATA_KEYS = [\n\t\"connectorSourceOfTruthArea\",\n\t\"connectorSourceOfTruthFallbackConnectionId\",\n\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t\"connectorSourceOfTruthWorkspaceId\",\n\t\"sourceOfTruthArea\",\n\t\"sourceOfTruthFallbackConnectionId\",\n] as const;\n\nfunction isConnectorOAuthProvider(\n\tprovider: string,\n): provider is ConnectorOAuthProvider {\n\treturn Object.prototype.hasOwnProperty.call(\n\t\tCONNECTOR_PROVIDER_BY_OAUTH_PROVIDER,\n\t\tprovider,\n\t);\n}\n\nfunction supportedConnectorOAuthProviders(): string {\n\treturn Object.keys(CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER).sort().join(\", \");\n}\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nexport function normalizeConnectorSourceOfTruthArea(\n\tarea: string,\n): ConnectorSourceOfTruthArea | null {\n\tconst normalized = area\n\t\t.trim()\n\t\t.toLowerCase()\n\t\t.replace(/^source_of_truth_area_/u, \"\")\n\t\t.replace(/^source-of-truth-area-/u, \"\")\n\t\t.replaceAll(\"_\", \"-\");\n\tfor (const candidate of CONNECTOR_SOURCE_OF_TRUTH_AREAS) {\n\t\tif (\n\t\t\tcandidate === normalized ||\n\t\t\tcandidate.replaceAll(\"_\", \"-\") === normalized\n\t\t) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction getMetadataStringArray(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string[] | undefined {\n\tconst value = metadata?.[key];\n\tif (!Array.isArray(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n\treturn entries.length > 0 ? entries : undefined;\n}\n\nfunction getMetadataStringMap(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): Record<string, string> | undefined {\n\tconst value = metadata?.[key];\n\tif (!isRecord(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = Object.entries(value)\n\t\t.map(\n\t\t\t([entryKey, entryValue]) =>\n\t\t\t\t[\n\t\t\t\t\tentryKey.trim(),\n\t\t\t\t\ttypeof entryValue === \"string\" ? entryValue.trim() : \"\",\n\t\t\t\t] as const,\n\t\t)\n\t\t.filter(([entryKey, entryValue]) => entryKey && entryValue);\n\treturn entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nfunction mergeConnectionMetadata(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n\tproviderId: string,\n): OAuthCredentials {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorConnectionId: connection.id,\n\t\t\tconnectorHealthStatus: connection.healthStatus,\n\t\t\tconnectorProviderId: connection.providerId || providerId,\n\t\t\tconnectorUpdatedAt: connection.updatedAt,\n\t\t\tconnectorWorkspaceId: connection.workspaceId,\n\t\t},\n\t};\n}\n\nfunction getSourceOfTruthArea(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthArea\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthArea\")\n\t);\n}\n\nfunction getSourceOfTruthFallbackConnectionId(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthFallbackConnectionId\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthFallbackConnectionId\")\n\t);\n}\n\nfunction mergeSourceOfTruthPolicyMetadata(\n\tcredentials: OAuthCredentials,\n\tpolicy: RemoteSourceOfTruthPolicy | null,\n): OAuthCredentials {\n\tif (!policy) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorSourceOfTruthArea: policy.area,\n\t\t\tconnectorSourceOfTruthPrimaryConnectionId: policy.primaryConnectionId,\n\t\t\tconnectorSourceOfTruthWorkspaceId: policy.workspaceId,\n\t\t\t...(policy.fallbackConnectionId\n\t\t\t\t? {\n\t\t\t\t\t\tconnectorSourceOfTruthFallbackConnectionId:\n\t\t\t\t\t\t\tpolicy.fallbackConnectionId,\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t};\n}\n\nasync function syncSourceOfTruthPolicy(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n): Promise<OAuthCredentials> {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\tconst area = getSourceOfTruthArea(credentials.metadata);\n\tif (!area) {\n\t\treturn credentials;\n\t}\n\n\tconst policy = await setRemoteSourceOfTruthPolicy({\n\t\tworkspaceId: connection.workspaceId,\n\t\tarea,\n\t\tprimaryConnectionId: connection.id,\n\t\tfallbackConnectionId: getSourceOfTruthFallbackConnectionId(\n\t\t\tcredentials.metadata,\n\t\t),\n\t});\n\treturn mergeSourceOfTruthPolicyMetadata(credentials, policy);\n}\n\nexport async function syncOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n\tcredentials: OAuthCredentials,\n): Promise<OAuthCredentials> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn credentials;\n\t}\n\n\tconst providerId = CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER[provider];\n\tconst connectionId = getMetadataString(\n\t\tcredentials.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (connectionId) {\n\t\tconst connection = await refreshRemoteConnection(connectionId);\n\t\treturn syncSourceOfTruthPolicy(\n\t\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\t\tconnection,\n\t\t);\n\t}\n\n\tconst connection = await registerRemoteConnection({\n\t\tproviderId,\n\t\tdisplayName: DISPLAY_NAME_BY_OAUTH_PROVIDER[provider],\n\t\tauthType: \"AUTH_TYPE_OAUTH2\",\n\t\tscopes: getMetadataStringArray(credentials.metadata, \"scopes\"),\n\t\tcredentials: getMetadataStringMap(\n\t\t\tcredentials.metadata,\n\t\t\t\"connectorCredentialRefs\",\n\t\t),\n\t});\n\treturn syncSourceOfTruthPolicy(\n\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\tconnection,\n\t);\n}\n\nexport async function syncStoredOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n): Promise<void> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn;\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\treturn;\n\t}\n\tconst synced = await syncOAuthProviderConnection(provider, credentials);\n\tif (synced !== credentials) {\n\t\tsaveOAuthCredentials(provider, synced);\n\t}\n}\n\nexport async function configureOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n\tinput: ConfigureOAuthProviderSourceOfTruthPolicyInput,\n): Promise<ConfiguredOAuthProviderSourceOfTruthPolicy> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\tconst area = normalizeConnectorSourceOfTruthArea(input.area);\n\tif (!area) {\n\t\tthrow new Error(\n\t\t\t`Unsupported source-of-truth area: ${input.area}. Valid areas: ${CONNECTOR_SOURCE_OF_TRUTH_AREAS.join(\", \")}`,\n\t\t);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tmetadata.connectorSourceOfTruthArea = area;\n\tdelete metadata.sourceOfTruthArea;\n\tdelete metadata.sourceOfTruthFallbackConnectionId;\n\tdelete metadata.connectorSourceOfTruthPrimaryConnectionId;\n\tdelete metadata.connectorSourceOfTruthWorkspaceId;\n\n\tconst fallbackConnectionId = trimString(input.fallbackConnectionId);\n\tif (fallbackConnectionId) {\n\t\tmetadata.connectorSourceOfTruthFallbackConnectionId = fallbackConnectionId;\n\t} else {\n\t\tdelete metadata.connectorSourceOfTruthFallbackConnectionId;\n\t}\n\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\tawait syncStoredOAuthProviderConnection(provider);\n\n\tconst synced = loadOAuthCredentials(provider) ?? { ...credentials, metadata };\n\tconst syncedMetadata = synced.metadata ?? {};\n\tconst connectorConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tconst primaryConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t);\n\tconst workspaceId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthWorkspaceId\",\n\t);\n\treturn {\n\t\tprovider,\n\t\tarea,\n\t\t...(fallbackConnectionId ? { fallbackConnectionId } : {}),\n\t\t...(connectorConnectionId ? { connectorConnectionId } : {}),\n\t\t...(primaryConnectionId ? { primaryConnectionId } : {}),\n\t\t...(workspaceId ? { workspaceId } : {}),\n\t};\n}\n\nexport function clearOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n): boolean {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tconst hadPolicyMetadata = SOURCE_OF_TRUTH_METADATA_KEYS.some(\n\t\t(key) => key in metadata,\n\t);\n\tif (!hadPolicyMetadata) {\n\t\treturn false;\n\t}\n\tfor (const key of SOURCE_OF_TRUTH_METADATA_KEYS) {\n\t\tdelete metadata[key];\n\t}\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\treturn hadPolicyMetadata;\n}\n\nexport async function revokeOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n\tcredentials: OAuthCredentials | null,\n): Promise<void> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn;\n\t}\n\tconst connectionId = getMetadataString(\n\t\tcredentials?.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (!connectionId) {\n\t\treturn;\n\t}\n\tawait revokeRemoteConnection(connectionId);\n}\n"]}

package/dist/oauth/device-identity.d.ts

@@ -0,0 +1,18 @@
+export interface DeviceIdentityStatus {
+    available: boolean;
+    device_id?: string;
+    error?: string;
+    key_algorithm?: string;
+    key_origin?: string;
+    public_key_spki?: string;
+    signature?: string;
+}
+export interface DeviceProof {
+    challenge_id: string;
+    device_id: string;
+    signature: string;
+}
+export declare function getDesktopDeviceIdentityStatus(): Promise<DeviceIdentityStatus | null>;
+export declare function buildDesktopDeviceProof(identityBaseUrl: string, purpose: "refresh" | "delegation" | "verify"): Promise<DeviceProof | null>;
+export declare function enrollDesktopDeviceIdentity(identityBaseUrl: string, accessToken: string, appVersion?: string): Promise<string | null>;
+//# sourceMappingURL=device-identity.d.ts.map

package/dist/oauth/device-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.d.ts","sourceRoot":"","sources":["../../src/oauth/device-identity.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AA6ED,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAE3F;AAuDD,wBAAsB,uBAAuB,CAC5C,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAC1C,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsB7B;AAED,wBAAsB,2BAA2B,CAChD,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+DxB"}

package/dist/oauth/device-identity.js

@@ -0,0 +1,193 @@
+import { spawn } from "node:child_process";
+import { constants, access } from "node:fs/promises";
+import { PLATFORM_HTTP_ROUTES } from "../platform/core-services.js";
+import { fetchDownstream } from "../utils/downstream-http.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+function getHelperPath() {
+    const value = process.env.MAESTRO_DEVICE_IDENTITY_HELPER?.trim();
+    if (!value) {
+        return undefined;
+    }
+    if (process.platform === "darwin") {
+        return value;
+    }
+    return process.env.NODE_ENV === "test" &&
+        process.env.MAESTRO_DEVICE_IDENTITY_ALLOW_TEST_HELPER === "1"
+        ? value
+        : undefined;
+}
+async function helperExists(helperPath) {
+    try {
+        await access(helperPath, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isAbortError(error) {
+    return error instanceof Error && error.name === "AbortError";
+}
+async function runHelper(request) {
+    const helperPath = getHelperPath();
+    if (!helperPath || !(await helperExists(helperPath))) {
+        return null;
+    }
+    return new Promise((resolve) => {
+        const child = spawn(helperPath, [], {
+            stdio: ["pipe", "pipe", "ignore"],
+            env: { ...process.env },
+        });
+        let stdout = "";
+        const timeout = setTimeout(() => {
+            child.kill("SIGKILL");
+            resolve(null);
+        }, DEFAULT_TIMEOUT_MS);
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.on("error", () => {
+            clearTimeout(timeout);
+            resolve(null);
+        });
+        child.on("close", () => {
+            clearTimeout(timeout);
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch {
+                resolve(null);
+            }
+        });
+        child.stdin.end(JSON.stringify(request));
+    });
+}
+export async function getDesktopDeviceIdentityStatus() {
+    return runHelper({ command: "status" });
+}
+async function signDeviceChallenge(challenge) {
+    const response = await runHelper({ command: "sign", challenge });
+    if (!response?.available || !response.device_id || !response.signature) {
+        return null;
+    }
+    return response;
+}
+async function createDeviceChallenge(identityBaseUrl, purpose, deviceId) {
+    let response;
+    try {
+        response = await fetchDownstream(`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.deviceChallenges}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                purpose,
+                ...(deviceId ? { device_id: deviceId } : {}),
+            }),
+        }, {
+            serviceName: "EvalOps identity service",
+            failureMode: "optional",
+            timeoutMs: DEFAULT_TIMEOUT_MS,
+            maxAttempts: 1,
+        });
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw error;
+        }
+        return null;
+    }
+    if (!response.ok) {
+        return null;
+    }
+    try {
+        return (await response.json());
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw error;
+        }
+        return null;
+    }
+}
+export async function buildDesktopDeviceProof(identityBaseUrl, purpose) {
+    const status = await getDesktopDeviceIdentityStatus();
+    if (!status?.available || !status.device_id) {
+        return null;
+    }
+    const challenge = await createDeviceChallenge(identityBaseUrl, purpose, status.device_id);
+    if (!challenge?.challenge || !challenge.challenge_id) {
+        return null;
+    }
+    const signed = await signDeviceChallenge(challenge.challenge);
+    if (!signed?.device_id || !signed.signature) {
+        return null;
+    }
+    return {
+        challenge_id: challenge.challenge_id,
+        device_id: signed.device_id,
+        signature: signed.signature,
+    };
+}
+export async function enrollDesktopDeviceIdentity(identityBaseUrl, accessToken, appVersion) {
+    const status = await getDesktopDeviceIdentityStatus();
+    if (!status?.available || !status.public_key_spki) {
+        return null;
+    }
+    const challenge = await createDeviceChallenge(identityBaseUrl, "enroll");
+    if (!challenge?.challenge || !challenge.challenge_id) {
+        return null;
+    }
+    const signed = await signDeviceChallenge(challenge.challenge);
+    if (!signed?.device_id || !signed.signature) {
+        return null;
+    }
+    let response;
+    try {
+        response = await fetchDownstream(`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.devices}`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                app_bundle_id: "com.evalops.composer",
+                app_version: appVersion,
+                attestation_kind: "none",
+                attestation_status: "unverified",
+                challenge_id: challenge.challenge_id,
+                device_id: signed.device_id,
+                key_algorithm: status.key_algorithm ?? "p256_ecdsa_sha256",
+                key_origin: status.key_origin ?? "secure_enclave",
+                platform: "macos",
+                public_key_spki: status.public_key_spki,
+                signature: signed.signature,
+            }),
+        }, {
+            serviceName: "EvalOps identity service",
+            failureMode: "optional",
+            timeoutMs: DEFAULT_TIMEOUT_MS,
+            maxAttempts: 1,
+        });
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw error;
+        }
+        return null;
+    }
+    if (!response.ok) {
+        return null;
+    }
+    let payload;
+    try {
+        payload = (await response.json());
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw error;
+        }
+        return null;
+    }
+    return payload.device?.id ?? signed.device_id;
+}
+//# sourceMappingURL=device-identity.js.map

package/dist/oauth/device-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.js","sourceRoot":"","sources":["../../src/oauth/device-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AA6BlC,SAAS,aAAa;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QACrC,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,GAAG;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,SAAS,CACvB,OAAgC;IAEhC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE;YACnC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACJ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyB,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B;IACnD,OAAO,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,mBAAmB,CACjC,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,qBAAqB,CACnC,eAAuB,EACvB,OAAe,EACf,QAAiB;IAEjB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,eAAe,CAC/B,GAAG,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EACrE;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO;gBACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;SACF,EACD;YACC,WAAW,EAAE,0BAA0B;YACvC,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,CAAC;SACd,CACD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,eAAuB,EACvB,OAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,8BAA8B,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC5C,eAAe,EACf,OAAO,EACP,MAAM,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,eAAuB,EACvB,WAAmB,EACnB,UAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,8BAA8B,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,eAAe,CAC/B,GAAG,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,EAC5D;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,aAAa,EAAE,sBAAsB;gBACrC,WAAW,EAAE,UAAU;gBACvB,gBAAgB,EAAE,MAAM;gBACxB,kBAAkB,EAAE,YAAY;gBAChC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,mBAAmB;gBAC1D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,gBAAgB;gBACjD,QAAQ,EAAE,OAAO;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAC;SACF,EACD;YACC,WAAW,EAAE,0BAA0B;YACvC,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,CAAC;SACd,CACD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;AAC/C,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { constants, access } from \"node:fs/promises\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\nexport interface DeviceIdentityStatus {\n\tavailable: boolean;\n\tdevice_id?: string;\n\terror?: string;\n\tkey_algorithm?: string;\n\tkey_origin?: string;\n\tpublic_key_spki?: string;\n\tsignature?: string;\n}\n\nexport interface DeviceProof {\n\tchallenge_id: string;\n\tdevice_id: string;\n\tsignature: string;\n}\n\ninterface DeviceChallengeResponse {\n\tchallenge?: string;\n\tchallenge_id?: string;\n\terror?: string;\n}\n\ninterface RegisterDeviceResponse {\n\tdevice?: { id?: string };\n\terror?: string;\n}\n\nfunction getHelperPath(): string | undefined {\n\tconst value = process.env.MAESTRO_DEVICE_IDENTITY_HELPER?.trim();\n\tif (!value) {\n\t\treturn undefined;\n\t}\n\tif (process.platform === \"darwin\") {\n\t\treturn value;\n\t}\n\treturn process.env.NODE_ENV === \"test\" &&\n\t\tprocess.env.MAESTRO_DEVICE_IDENTITY_ALLOW_TEST_HELPER === \"1\"\n\t\t? value\n\t\t: undefined;\n}\n\nasync function helperExists(helperPath: string): Promise<boolean> {\n\ttry {\n\t\tawait access(helperPath, constants.X_OK);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isAbortError(error: unknown): boolean {\n\treturn error instanceof Error && error.name === \"AbortError\";\n}\n\nasync function runHelper(\n\trequest: Record<string, unknown>,\n): Promise<DeviceIdentityStatus | null> {\n\tconst helperPath = getHelperPath();\n\tif (!helperPath || !(await helperExists(helperPath))) {\n\t\treturn null;\n\t}\n\treturn new Promise((resolve) => {\n\t\tconst child = spawn(helperPath, [], {\n\t\t\tstdio: [\"pipe\", \"pipe\", \"ignore\"],\n\t\t\tenv: { ...process.env },\n\t\t});\n\t\tlet stdout = \"\";\n\t\tconst timeout = setTimeout(() => {\n\t\t\tchild.kill(\"SIGKILL\");\n\t\t\tresolve(null);\n\t\t}, DEFAULT_TIMEOUT_MS);\n\t\tchild.stdout.setEncoding(\"utf8\");\n\t\tchild.stdout.on(\"data\", (chunk) => {\n\t\t\tstdout += chunk;\n\t\t});\n\t\tchild.on(\"error\", () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(null);\n\t\t});\n\t\tchild.on(\"close\", () => {\n\t\t\tclearTimeout(timeout);\n\t\t\ttry {\n\t\t\t\tresolve(JSON.parse(stdout) as DeviceIdentityStatus);\n\t\t\t} catch {\n\t\t\t\tresolve(null);\n\t\t\t}\n\t\t});\n\t\tchild.stdin.end(JSON.stringify(request));\n\t});\n}\n\nexport async function getDesktopDeviceIdentityStatus(): Promise<DeviceIdentityStatus | null> {\n\treturn runHelper({ command: \"status\" });\n}\n\nasync function signDeviceChallenge(\n\tchallenge: string,\n): Promise<DeviceIdentityStatus | null> {\n\tconst response = await runHelper({ command: \"sign\", challenge });\n\tif (!response?.available || !response.device_id || !response.signature) {\n\t\treturn null;\n\t}\n\treturn response;\n}\n\nasync function createDeviceChallenge(\n\tidentityBaseUrl: string,\n\tpurpose: string,\n\tdeviceId?: string,\n): Promise<DeviceChallengeResponse | null> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetchDownstream(\n\t\t\t`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.deviceChallenges}`,\n\t\t\t{\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tpurpose,\n\t\t\t\t\t...(deviceId ? { device_id: deviceId } : {}),\n\t\t\t\t}),\n\t\t\t},\n\t\t\t{\n\t\t\t\tserviceName: \"EvalOps identity service\",\n\t\t\t\tfailureMode: \"optional\",\n\t\t\t\ttimeoutMs: DEFAULT_TIMEOUT_MS,\n\t\t\t\tmaxAttempts: 1,\n\t\t\t},\n\t\t);\n\t} catch (error) {\n\t\tif (isAbortError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn null;\n\t}\n\tif (!response.ok) {\n\t\treturn null;\n\t}\n\ttry {\n\t\treturn (await response.json()) as DeviceChallengeResponse;\n\t} catch (error) {\n\t\tif (isAbortError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn null;\n\t}\n}\n\nexport async function buildDesktopDeviceProof(\n\tidentityBaseUrl: string,\n\tpurpose: \"refresh\" | \"delegation\" | \"verify\",\n): Promise<DeviceProof | null> {\n\tconst status = await getDesktopDeviceIdentityStatus();\n\tif (!status?.available || !status.device_id) {\n\t\treturn null;\n\t}\n\tconst challenge = await createDeviceChallenge(\n\t\tidentityBaseUrl,\n\t\tpurpose,\n\t\tstatus.device_id,\n\t);\n\tif (!challenge?.challenge || !challenge.challenge_id) {\n\t\treturn null;\n\t}\n\tconst signed = await signDeviceChallenge(challenge.challenge);\n\tif (!signed?.device_id || !signed.signature) {\n\t\treturn null;\n\t}\n\treturn {\n\t\tchallenge_id: challenge.challenge_id,\n\t\tdevice_id: signed.device_id,\n\t\tsignature: signed.signature,\n\t};\n}\n\nexport async function enrollDesktopDeviceIdentity(\n\tidentityBaseUrl: string,\n\taccessToken: string,\n\tappVersion?: string,\n): Promise<string | null> {\n\tconst status = await getDesktopDeviceIdentityStatus();\n\tif (!status?.available || !status.public_key_spki) {\n\t\treturn null;\n\t}\n\tconst challenge = await createDeviceChallenge(identityBaseUrl, \"enroll\");\n\tif (!challenge?.challenge || !challenge.challenge_id) {\n\t\treturn null;\n\t}\n\tconst signed = await signDeviceChallenge(challenge.challenge);\n\tif (!signed?.device_id || !signed.signature) {\n\t\treturn null;\n\t}\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetchDownstream(\n\t\t\t`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.devices}`,\n\t\t\t{\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tapp_bundle_id: \"com.evalops.composer\",\n\t\t\t\t\tapp_version: appVersion,\n\t\t\t\t\tattestation_kind: \"none\",\n\t\t\t\t\tattestation_status: \"unverified\",\n\t\t\t\t\tchallenge_id: challenge.challenge_id,\n\t\t\t\t\tdevice_id: signed.device_id,\n\t\t\t\t\tkey_algorithm: status.key_algorithm ?? \"p256_ecdsa_sha256\",\n\t\t\t\t\tkey_origin: status.key_origin ?? \"secure_enclave\",\n\t\t\t\t\tplatform: \"macos\",\n\t\t\t\t\tpublic_key_spki: status.public_key_spki,\n\t\t\t\t\tsignature: signed.signature,\n\t\t\t\t}),\n\t\t\t},\n\t\t\t{\n\t\t\t\tserviceName: \"EvalOps identity service\",\n\t\t\t\tfailureMode: \"optional\",\n\t\t\t\ttimeoutMs: DEFAULT_TIMEOUT_MS,\n\t\t\t\tmaxAttempts: 1,\n\t\t\t},\n\t\t);\n\t} catch (error) {\n\t\tif (isAbortError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn null;\n\t}\n\tif (!response.ok) {\n\t\treturn null;\n\t}\n\tlet payload: RegisterDeviceResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as RegisterDeviceResponse;\n\t} catch (error) {\n\t\tif (isAbortError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn null;\n\t}\n\treturn payload.device?.id ?? signed.device_id;\n}\n"]}

package/dist/oauth/evalops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evalops.d.ts","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAOA,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AA6CtB,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AA0LD,wBAAgB,iCAAiC,CAChD,MAAM,EAAE,IAAI,CACX,4BAA4B,EAC5B,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAC1C,GACA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAsDvC;AAkJD,wBAAsB,YAAY,CACjC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAqD3B;AAED,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf"}
+{"version":3,"file":"evalops.d.ts","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AAwDtB,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AAmPD,wBAAgB,iCAAiC,CAChD,MAAM,EAAE,IAAI,CACX,4BAA4B,EAC5B,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAC1C,GACA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,4BAA4B,CAAC,CA+DvC;AAsJD,wBAAsB,YAAY,CACjC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAwDf;AAED,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CA6D3B;AAED,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}