@forgezero/runtime 0.1.0

package/dist/ssh-agent.js

@@ -0,0 +1,141 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/ssh-agent.ts
+import { Socket } from "node:net";
+import { createHash, hkdfSync } from "node:crypto";
+
+class SshAgentError extends Error {
+}
+var SSH_AGENTC_REQUEST_IDENTITIES = 11;
+var SSH_AGENT_IDENTITIES_ANSWER = 12;
+var SSH_AGENTC_SIGN_REQUEST = 13;
+var SSH_AGENT_SIGN_RESPONSE = 14;
+var CUSTODY_CHALLENGE = Buffer.from("forgezero/custody/ssh-agent/v1", "utf8");
+function readString(buffer, offset) {
+  const length = buffer.readUInt32BE(offset);
+  const start = offset + 4;
+  return [buffer.subarray(start, start + length), start + length];
+}
+function writeString(value) {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(value.length);
+  return Buffer.concat([length, value]);
+}
+function frame(payload) {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(payload.length);
+  return Buffer.concat([length, payload]);
+}
+var AGENT_TIMEOUT_MS = 3000;
+async function request(socketPath, payload) {
+  return new Promise((resolve, reject) => {
+    const socket = new Socket;
+    const chunks = [];
+    let expected = null;
+    let settled = false;
+    const fail = (message) => {
+      if (settled)
+        return;
+      settled = true;
+      socket.destroy();
+      reject(new SshAgentError(message));
+    };
+    socket.setTimeout(AGENT_TIMEOUT_MS, () => fail("SSH_AGENT_TIMEOUT"));
+    socket.on("error", () => fail("SSH_AGENT_UNREACHABLE"));
+    socket.on("connect", () => socket.write(frame(payload)));
+    socket.on("data", (chunk) => {
+      chunks.push(chunk);
+      const all = Buffer.concat(chunks);
+      if (expected === null && all.length >= 4)
+        expected = all.readUInt32BE(0);
+      if (expected !== null && all.length >= expected + 4) {
+        if (settled)
+          return;
+        settled = true;
+        socket.end();
+        resolve(all.subarray(4, expected + 4));
+      }
+    });
+    socket.on("close", () => {
+      if (expected === null)
+        fail("SSH_AGENT_CLOSED_EARLY");
+    });
+    socket.connect(socketPath);
+  });
+}
+function agentSocket(explicit) {
+  const path = explicit ?? process.env.SSH_AUTH_SOCK;
+  if (!path)
+    throw new SshAgentError("SSH_AUTH_SOCK_NOT_SET");
+  return path;
+}
+async function listIdentities(socketPath) {
+  const response = await request(agentSocket(socketPath), Buffer.from([SSH_AGENTC_REQUEST_IDENTITIES]));
+  if (response[0] !== SSH_AGENT_IDENTITIES_ANSWER) {
+    throw new SshAgentError("SSH_AGENT_BAD_RESPONSE");
+  }
+  const count = response.readUInt32BE(1);
+  const identities = [];
+  let offset = 5;
+  for (let index = 0;index < count; index += 1) {
+    const [blob, afterBlob] = readString(response, offset);
+    const [comment, afterComment] = readString(response, afterBlob);
+    offset = afterComment;
+    const [type] = readString(blob, 0);
+    identities.push({
+      blob,
+      comment: comment.toString("utf8"),
+      type: type.toString("utf8"),
+      fingerprint: `SHA256:${createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`
+    });
+  }
+  return identities;
+}
+async function listCustodyIdentities(socketPath) {
+  return (await listIdentities(socketPath)).filter((id) => id.type === "ssh-ed25519");
+}
+async function sign(blob, data, socketPath) {
+  const payload = Buffer.concat([
+    Buffer.from([SSH_AGENTC_SIGN_REQUEST]),
+    writeString(blob),
+    writeString(data),
+    Buffer.alloc(4)
+  ]);
+  const response = await request(agentSocket(socketPath), payload);
+  if (response[0] !== SSH_AGENT_SIGN_RESPONSE) {
+    throw new SshAgentError("SSH_AGENT_SIGN_REFUSED");
+  }
+  const [signature] = readString(response, 1);
+  return signature;
+}
+async function deriveCustodyKey(identity, socketPath) {
+  if (identity.type !== "ssh-ed25519") {
+    throw new SshAgentError("SSH_KEY_TYPE_UNSUPPORTED");
+  }
+  const signature = await sign(identity.blob, CUSTODY_CHALLENGE, socketPath);
+  if (signature.length < 32)
+    throw new SshAgentError("SSH_AGENT_SIGNATURE_TOO_SHORT");
+  return new Uint8Array(hkdfSync("sha256", signature, identity.blob, Buffer.from("forgezero/custody/ssh-key/v1", "utf8"), 32));
+}
+async function assertDeterministic(identity, socketPath) {
+  const first = await deriveCustodyKey(identity, socketPath);
+  const second = await deriveCustodyKey(identity, socketPath);
+  if (Buffer.compare(Buffer.from(first), Buffer.from(second)) !== 0) {
+    throw new SshAgentError("SSH_AGENT_NOT_DETERMINISTIC");
+  }
+  return first;
+}
+export {
+  listIdentities,
+  listCustodyIdentities,
+  deriveCustodyKey,
+  assertDeterministic,
+  SshAgentError,
+  AGENT_TIMEOUT_MS
+};

package/dist/ssh-cert.d.ts

@@ -0,0 +1,73 @@
+export declare class SshCertError extends Error {
+    readonly code: 'BAD_KEY' | 'BAD_VALIDITY' | 'BAD_PRINCIPAL' | 'NO_PRINCIPALS';
+    constructor(code: 'BAD_KEY' | 'BAD_VALIDITY' | 'BAD_PRINCIPAL' | 'NO_PRINCIPALS', message: string);
+}
+export declare const CERT_TYPE_USER = 1;
+export declare const CERT_TYPE_HOST = 2;
+/**
+ * What a user certificate is normally allowed to do.
+ *
+ * Deliberately NOT `permit-port-forwarding` or `permit-agent-forwarding`: both
+ * turn a session into a route onward, and an expiring certificate that can open
+ * a tunnel through a bastion has given away rather more than a login.
+ */
+export declare const DEFAULT_EXTENSIONS: Record<string, string>;
+export interface CertificateRequest {
+    /** The ed25519 public key being certified, 32 bytes. */
+    publicKey: Uint8Array;
+    /** 1 for a user certificate, 2 for a host certificate. */
+    type?: number;
+    /** What appears in the sshd log. Make it identify a person or a machine. */
+    keyId: string;
+    /** Usernames (user certs) or hostnames (host certs). Never empty — see below. */
+    principals: readonly string[];
+    validAfterSec: number;
+    validBeforeSec: number;
+    serial?: bigint;
+    extensions?: Record<string, string>;
+    /** `force-command`, `source-address`. Unknown ones make sshd REFUSE the cert. */
+    criticalOptions?: Record<string, string>;
+}
+/**
+ * A signer, not a secret key.
+ *
+ * The CA key that matters lives in the vault as a DERIVED key: it is reached
+ * through a call that uses it and wipes it, and the private half never exists
+ * outside that call. A signature function is the only shape both that and a
+ * plain local key can satisfy.
+ *
+ * Taking raw secret bytes here would have forced the vault to hand them out to
+ * use them, which is the one thing derived keys exist to prevent.
+ */
+export interface CertificateAuthority {
+    publicKey: Uint8Array;
+    /** Signs the certificate body. Returns 64 bytes. */
+    sign: (message: Uint8Array) => Uint8Array;
+}
+/**
+ * A CA backed by a local secret key, for tests and for a laptop.
+ *
+ * Deliberately a separate function rather than an overload: reading
+ * `caFromSecretKey` at a call site tells you the key is in this process, which
+ * is exactly the thing worth noticing in a review.
+ */
+export declare const caFromSecretKey: (secretKey: Uint8Array) => CertificateAuthority;
+/**
+ * Sign one certificate.
+ *
+ * The validity window is required and checked. A certificate with no expiry is
+ * an `authorized_keys` line with extra steps, and the entire reason to run a CA
+ * is that access ends by itself.
+ */
+export declare function signCertificate(request: CertificateRequest, ca: CertificateAuthority): string;
+/** The CA line for `TrustedUserCAKeys`, which is the one thing a host must hold. */
+export declare const caPublicKeyLine: (publicKey: Uint8Array, comment?: string) => string;
+/** The fingerprint `ssh-keygen -L` prints for the CA. */
+export declare const caFingerprint: (publicKey: Uint8Array) => string;
+/**
+ * Is this certificate usable right now?
+ *
+ * Both bounds, because a clock that has drifted backwards makes a
+ * not-yet-valid certificate look like a broken CA rather than a wrong clock.
+ */
+export declare const isCurrentlyValid: (cert: Pick<CertificateRequest, "validAfterSec" | "validBeforeSec">, nowSec?: number) => boolean;

package/dist/ssh-cert.js

@@ -0,0 +1,111 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/ssh-cert.ts
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { toBase64Url } from "@forgezero/access/security";
+var CERT_ALGORITHM = "ssh-ed25519-cert-v01@openssh.com";
+var KEY_ALGORITHM = "ssh-ed25519";
+var ENCODER = new TextEncoder;
+
+class SshCertError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SshCertError";
+  }
+}
+var u32 = (value) => {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, false);
+  return out;
+};
+var u64 = (value) => {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, value, false);
+  return out;
+};
+var concat = (...parts) => {
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};
+var sshString = (value) => {
+  const bytes = typeof value === "string" ? ENCODER.encode(value) : value;
+  return concat(u32(bytes.length), bytes);
+};
+var sshStringList = (values) => sshString(concat(...values.map((value) => sshString(value))));
+var sshPairs = (pairs) => sshString(concat(...Object.keys(pairs).sort().map((name) => concat(sshString(name), sshString(pairs[name] === "" ? new Uint8Array(0) : sshString(pairs[name]))))));
+var base64 = (bytes) => {
+  const standard = toBase64Url(bytes).replaceAll("-", "+").replaceAll("_", "/");
+  return standard + "=".repeat((4 - standard.length % 4) % 4);
+};
+var CERT_TYPE_USER = 1;
+var CERT_TYPE_HOST = 2;
+var DEFAULT_EXTENSIONS = {
+  "permit-pty": "",
+  "permit-user-rc": ""
+};
+var caFromSecretKey = (secretKey) => ({
+  publicKey: ed25519.getPublicKey(secretKey.slice(0, 32)),
+  sign: (message) => ed25519.sign(message, secretKey.slice(0, 32))
+});
+function signCertificate(request, ca) {
+  if (request.publicKey.length !== 32) {
+    throw new SshCertError("BAD_KEY", "An ed25519 public key is 32 bytes.");
+  }
+  if (ca.publicKey.length !== 32) {
+    throw new SshCertError("BAD_KEY", "The CA's ed25519 public key is 32 bytes.");
+  }
+  if (!Number.isInteger(request.validAfterSec) || !Number.isInteger(request.validBeforeSec)) {
+    throw new SshCertError("BAD_VALIDITY", "Validity bounds are whole seconds.");
+  }
+  if (request.validBeforeSec <= request.validAfterSec) {
+    throw new SshCertError("BAD_VALIDITY", "A certificate must be valid for a positive interval.");
+  }
+  if (request.principals.length === 0) {
+    throw new SshCertError("NO_PRINCIPALS", "A certificate with no principals is valid for EVERY user. Name them.");
+  }
+  for (const principal of request.principals) {
+    if (!principal.trim() || /[\s,]/.test(principal)) {
+      throw new SshCertError("BAD_PRINCIPAL", `"${principal}" is not a usable principal.`);
+    }
+  }
+  const nonce = crypto.getRandomValues(new Uint8Array(32));
+  const body = concat(sshString(CERT_ALGORITHM), sshString(nonce), sshString(request.publicKey), u64(request.serial ?? 0n), u32(request.type ?? CERT_TYPE_USER), sshString(request.keyId), sshStringList(request.principals), u64(BigInt(request.validAfterSec)), u64(BigInt(request.validBeforeSec)), sshPairs(request.criticalOptions ?? {}), sshPairs(request.extensions ?? DEFAULT_EXTENSIONS), sshString(new Uint8Array(0)), sshString(concat(sshString(KEY_ALGORITHM), sshString(ca.publicKey))));
+  const signature = ca.sign(body);
+  if (signature.length !== 64) {
+    throw new SshCertError("BAD_KEY", "An ed25519 signature is 64 bytes.");
+  }
+  const blob = concat(body, sshString(concat(sshString(KEY_ALGORITHM), sshString(signature))));
+  return `${CERT_ALGORITHM} ${base64(blob)}`;
+}
+var caPublicKeyLine = (publicKey, comment = "") => {
+  const line = `${KEY_ALGORITHM} ${base64(concat(sshString(KEY_ALGORITHM), sshString(publicKey)))}`;
+  return comment.trim() ? `${line} ${comment.trim()}` : line;
+};
+var caFingerprint = (publicKey) => `SHA256:${base64(sha256(concat(sshString(KEY_ALGORITHM), sshString(publicKey)))).replace(/=+$/, "")}`;
+var isCurrentlyValid = (cert, nowSec = Math.floor(Date.now() / 1000)) => nowSec >= cert.validAfterSec && nowSec < cert.validBeforeSec;
+export {
+  signCertificate,
+  isCurrentlyValid,
+  caPublicKeyLine,
+  caFromSecretKey,
+  caFingerprint,
+  SshCertError,
+  DEFAULT_EXTENSIONS,
+  CERT_TYPE_USER,
+  CERT_TYPE_HOST
+};

package/dist/totp.d.ts

@@ -0,0 +1,104 @@
+/**
+ * TOTP — RFC 6238, on the HMAC that already exists.
+ *
+ * Almost none of this is new. `@forgezero/access/security` already has the
+ * HMAC, the constant-time compare and the CSPRNG; what was missing is base32
+ * (because authenticator apps read that and nothing else) and the counter
+ * window that tolerates a phone whose clock is a few seconds out.
+ *
+ * ## SHA-1, and why that is not a mistake here
+ *
+ * Every authenticator app implements SHA-1 and only some implement SHA-256, so
+ * a SHA-256 secret is one a user cannot enrol with the app they already have.
+ * The collision weaknesses in SHA-1 do not apply to HMAC — HMAC-SHA1 has no
+ * practical break — and the code is six digits from a shared secret either way.
+ * Choosing SHA-256 here would trade a real usability failure for no security
+ * gain, so the algorithm is a parameter with SHA-1 as the default.
+ *
+ * ## The window is asymmetric, deliberately
+ *
+ * One step back and one forward. Backward tolerance matters most: a user reads
+ * a code, types it, and submits a few seconds later, so the code that was
+ * current when they looked has often just expired. Forward tolerance only
+ * covers a fast clock. Widening either multiplies the codes a guesser can hit,
+ * which is why it is one step and not three.
+ *
+ * ## Replay is NOT handled here
+ *
+ * A code stays valid for its whole step, so an intercepted one works again
+ * within thirty seconds. Preventing that needs storage — the last accepted
+ * counter per user — which belongs with the session, not in a pure function.
+ * `assertNotReplayed` is provided so the caller cannot forget, and it takes the
+ * previous counter rather than owning any state.
+ */
+export declare class TotpError extends Error {
+    readonly code: 'BAD_SECRET' | 'BAD_CODE' | 'REPLAYED' | 'BAD_DIGITS' | 'OTPAUTH_MALFORMED' | 'OTPAUTH_UNSUPPORTED' | 'OTPAUTH_NO_SECRET';
+    constructor(code: 'BAD_SECRET' | 'BAD_CODE' | 'REPLAYED' | 'BAD_DIGITS' | 'OTPAUTH_MALFORMED' | 'OTPAUTH_UNSUPPORTED' | 'OTPAUTH_NO_SECRET', message: string);
+}
+export declare function toBase32(bytes: Uint8Array): string;
+export declare function fromBase32(text: string): Uint8Array;
+/**
+ * A new secret.
+ *
+ * 20 bytes — the RFC 4226 recommendation and what every authenticator expects.
+ * Longer is not stronger in any way that matters: the output is still six
+ * digits, so the search space is the code, not the key.
+ */
+export declare function generateSecret(bytes?: number): string;
+export declare const DEFAULT_STEP_SECONDS = 30;
+export declare const DEFAULT_DIGITS = 6;
+export interface TotpOptions {
+    stepSeconds?: number;
+    digits?: number;
+    algorithm?: 'SHA-1' | 'SHA-256' | 'SHA-512';
+}
+/** Which step a timestamp falls in. The counter HMAC'd to make the code. */
+export declare const counterAt: (atMs: number, stepSeconds?: number) => number;
+/** The code for one counter. */
+export declare function codeFor(secret: string, counter: number, options?: TotpOptions): Promise<string>;
+export declare const codeAt: (secret: string, atMs: number, options?: TotpOptions) => Promise<string>;
+export interface VerifyOptions extends TotpOptions {
+    /** Steps either side to accept. One, and see the note at the top. */
+    window?: number;
+    atMs?: number;
+    /**
+     * The last counter this user successfully used.
+     *
+     * Supplied by the caller, because replay defence needs storage and this is a
+     * pure function. Omitting it means replay is NOT prevented — which is a
+     * decision, and one the caller should make knowingly.
+     */
+    lastCounter?: number;
+}
+export interface VerifyResult {
+    ok: boolean;
+    /** The counter that matched. Store it as `lastCounter` for the next check. */
+    counter?: number;
+    reason?: TotpError['code'];
+}
+/**
+ * Check a code.
+ *
+ * Every candidate is compared in constant time and the loop does NOT exit
+ * early on a match — an early return leaks, through timing, which step matched,
+ * and that narrows a guess to a known offset.
+ */
+export declare function verifyCode(secret: string, code: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Throwing form, for a caller that treats a bad code as an exception. */
+export declare function assertCode(secret: string, code: string, options?: VerifyOptions): Promise<number>;
+/**
+ * The `otpauth://` URI an authenticator app scans.
+ *
+ * The issuer appears TWICE — once as a label prefix and once as a parameter —
+ * because older apps read only the label and newer ones only the parameter.
+ * Omitting either means the account shows up in somebody's app as a bare email
+ * with no indication of what it is for.
+ */
+export declare function enrolmentUri(args: {
+    secret: string;
+    account: string;
+    issuer: string;
+    options?: TotpOptions;
+}): string;
+/** Seconds until the current code expires. For a countdown on the screen. */
+export declare const secondsRemaining: (atMs?: number, stepSeconds?: number) => number;

package/dist/totp.js

@@ -0,0 +1,143 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/totp.ts
+import { timingSafeEqual } from "@forgezero/access/security";
+
+class TotpError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "TotpError";
+  }
+}
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function toBase32(bytes) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0)
+    output += ALPHABET[value << 5 - bits & 31];
+  return output;
+}
+function fromBase32(text) {
+  const cleaned = text.toUpperCase().replace(/[\s=-]/g, "");
+  if (cleaned.length === 0)
+    throw new TotpError("BAD_SECRET", "The secret is empty.");
+  let bits = 0;
+  let value = 0;
+  const bytes = [];
+  for (const character of cleaned) {
+    const index = ALPHABET.indexOf(character);
+    if (index === -1) {
+      throw new TotpError("BAD_SECRET", `"${character}" is not a base32 character.`);
+    }
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(bytes);
+}
+function generateSecret(bytes = 20) {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  return toBase32(buffer);
+}
+var DEFAULT_STEP_SECONDS = 30;
+var DEFAULT_DIGITS = 6;
+var counterAt = (atMs, stepSeconds = DEFAULT_STEP_SECONDS) => Math.floor(atMs / 1000 / stepSeconds);
+async function hmac(secret, counter, algorithm) {
+  const message = new Uint8Array(8);
+  let remaining = counter;
+  for (let index = 7;index >= 0; index -= 1) {
+    message[index] = remaining & 255;
+    remaining = Math.floor(remaining / 256);
+  }
+  const key = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: algorithm }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, message));
+}
+async function codeFor(secret, counter, options = {}) {
+  const digits = options.digits ?? DEFAULT_DIGITS;
+  if (digits < 6 || digits > 8) {
+    throw new TotpError("BAD_DIGITS", "A TOTP code is between six and eight digits.");
+  }
+  const mac = await hmac(fromBase32(secret), counter, options.algorithm ?? "SHA-1");
+  const offset = mac[mac.length - 1] & 15;
+  const binary = (mac[offset] & 127) << 24 | (mac[offset + 1] & 255) << 16 | (mac[offset + 2] & 255) << 8 | mac[offset + 3] & 255;
+  return String(binary % 10 ** digits).padStart(digits, "0");
+}
+var codeAt = (secret, atMs, options = {}) => codeFor(secret, counterAt(atMs, options.stepSeconds ?? DEFAULT_STEP_SECONDS), options);
+async function verifyCode(secret, code, options = {}) {
+  const digits = options.digits ?? DEFAULT_DIGITS;
+  const cleaned = code.replace(/\s/g, "");
+  if (!new RegExp(`^\\d{${digits}}$`).test(cleaned)) {
+    return { ok: false, reason: "BAD_CODE" };
+  }
+  const step = options.stepSeconds ?? DEFAULT_STEP_SECONDS;
+  const window = options.window ?? 1;
+  const current = counterAt(options.atMs ?? Date.now(), step);
+  let matched;
+  for (let drift = -window;drift <= window; drift += 1) {
+    const counter = current + drift;
+    const expected = await codeFor(secret, counter, options);
+    if (timingSafeEqual(expected, cleaned))
+      matched = counter;
+  }
+  if (matched === undefined)
+    return { ok: false, reason: "BAD_CODE" };
+  if (options.lastCounter !== undefined && matched <= options.lastCounter) {
+    return { ok: false, counter: matched, reason: "REPLAYED" };
+  }
+  return { ok: true, counter: matched };
+}
+async function assertCode(secret, code, options = {}) {
+  const result = await verifyCode(secret, code, options);
+  if (!result.ok) {
+    throw new TotpError(result.reason ?? "BAD_CODE", result.reason === "REPLAYED" ? "That code has already been used. Wait for the next one." : "That code is not right. Check your authenticator and try again.");
+  }
+  return result.counter;
+}
+function enrolmentUri(args) {
+  const label = `${encodeURIComponent(args.issuer)}:${encodeURIComponent(args.account)}`;
+  const parameters = new URLSearchParams({
+    secret: args.secret,
+    issuer: args.issuer,
+    algorithm: (args.options?.algorithm ?? "SHA-1").replace("-", ""),
+    digits: String(args.options?.digits ?? DEFAULT_DIGITS),
+    period: String(args.options?.stepSeconds ?? DEFAULT_STEP_SECONDS)
+  });
+  return `otpauth://totp/${label}?${parameters.toString()}`;
+}
+var secondsRemaining = (atMs = Date.now(), stepSeconds = DEFAULT_STEP_SECONDS) => stepSeconds - Math.floor(atMs / 1000) % stepSeconds;
+export {
+  verifyCode,
+  toBase32,
+  secondsRemaining,
+  generateSecret,
+  fromBase32,
+  enrolmentUri,
+  counterAt,
+  codeFor,
+  codeAt,
+  assertCode,
+  TotpError,
+  DEFAULT_STEP_SECONDS,
+  DEFAULT_DIGITS
+};