@hcu-lab.me/mcp-device 1.0.0

package/dist/device/gateway-config.js

@@ -0,0 +1,207 @@
+import { X509Certificate } from 'crypto';
+import fs from 'fs/promises';
+import { createRequire } from 'module';
+import path from 'path';
+import { ProxyAgent } from 'proxy-agent';
+import { deviceStatePaths } from './device-state.js';
+import { protectWindowsSecret, unprotectWindowsSecret } from './windows-dpapi.js';
+const require = createRequire(import.meta.url);
+const { getProxyForUrl } = require('proxy-from-env');
+const PROXY_ENV_NAMES = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY', 'http_proxy', 'https_proxy', 'no_proxy', 'all_proxy'];
+function defaultConfigPath() {
+    return deviceStatePaths().config;
+}
+function emptyConfig() {
+    return {
+        version: 1,
+        gatewayUrl: null,
+        allowedRoots: [],
+        proxy: { mode: 'direct', url: null },
+        appCaPem: null,
+        securityProtocolFloor: 1
+    };
+}
+function normalizeGatewayUrl(value) {
+    const text = String(value || '').trim();
+    if (!text)
+        return null;
+    const parsed = new URL(text);
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol))
+        throw new Error('Gateway URL must use http(s) or ws(s).');
+    return parsed.toString();
+}
+function normalizeAllowedRoots(value) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.map(item => String(item || '').trim()).filter(Boolean))];
+}
+function normalizeAppCa(value) {
+    const text = String(value || '').trim();
+    if (!text)
+        return null;
+    new X509Certificate(text);
+    return `${text}\n`;
+}
+function normalizedProxy(value) {
+    if (!value || value.mode === 'direct')
+        return { mode: 'direct', url: null };
+    if (value.mode !== 'configured')
+        throw new Error('Invalid persisted gateway proxy mode.');
+    const url = String(value.url || '').trim();
+    if (!url)
+        throw new Error('Configured gateway proxy URL is missing.');
+    const parsed = new URL(url);
+    if (!['http:', 'https:', 'socks:', 'socks4:', 'socks5:'].includes(parsed.protocol)) {
+        throw new Error('Unsupported gateway proxy URL scheme.');
+    }
+    return { mode: 'configured', url: parsed.toString() };
+}
+function normalizeFloor(value) {
+    const parsed = Math.trunc(Number(value) || 1);
+    return Math.max(1, parsed);
+}
+export class GatewayDeviceConfigStore {
+    constructor(configPath = defaultConfigPath(), options = {}) {
+        this.configPath = path.resolve(configPath);
+        this.platform = options.platform || process.platform;
+        this.protectSecret = options.protectSecret || (value => protectWindowsSecret(value, 'proxy', { platform: this.platform }));
+        this.unprotectSecret = options.unprotectSecret || (value => unprotectWindowsSecret(value, 'proxy', { platform: this.platform }));
+    }
+    async load() {
+        let parsed;
+        try {
+            parsed = JSON.parse(await fs.readFile(this.configPath, 'utf8'));
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return emptyConfig();
+            throw error;
+        }
+        if (!parsed || typeof parsed !== 'object')
+            throw new Error('Invalid gateway config record.');
+        let proxy;
+        if (parsed.proxy?.mode === 'configured' && parsed.proxy?.protected?.scheme === 'dpapi-current-user-v1') {
+            if (this.platform !== 'win32')
+                throw new Error('DPAPI-protected proxy configuration requires Windows.');
+            const restored = await this.unprotectSecret(String(parsed.proxy.protected.blob || ''));
+            proxy = normalizedProxy({ mode: 'configured', url: restored.toString('utf8') });
+        }
+        else {
+            proxy = normalizedProxy(parsed.proxy);
+        }
+        const appCaPem = normalizeAppCa(parsed.appCaPem);
+        const requestedFloor = normalizeFloor(parsed.securityProtocolFloor);
+        return {
+            version: 1,
+            gatewayUrl: normalizeGatewayUrl(parsed.gatewayUrl),
+            allowedRoots: normalizeAllowedRoots(parsed.allowedRoots),
+            proxy,
+            appCaPem,
+            securityProtocolFloor: Math.max(requestedFloor, appCaPem ? 2 : 1)
+        };
+    }
+    async update(patch) {
+        const current = await this.load();
+        const appCaPem = patch.appCaPem === undefined ? current.appCaPem : normalizeAppCa(patch.appCaPem);
+        const requestedFloor = patch.securityProtocolFloor === undefined
+            ? current.securityProtocolFloor
+            : normalizeFloor(patch.securityProtocolFloor);
+        const next = {
+            version: 1,
+            gatewayUrl: patch.gatewayUrl === undefined ? current.gatewayUrl : normalizeGatewayUrl(patch.gatewayUrl),
+            allowedRoots: patch.allowedRoots === undefined ? current.allowedRoots : normalizeAllowedRoots(patch.allowedRoots),
+            proxy: patch.proxy === undefined ? current.proxy : normalizedProxy(patch.proxy),
+            appCaPem,
+            securityProtocolFloor: Math.max(current.securityProtocolFloor, requestedFloor, appCaPem ? 2 : 1)
+        };
+        await this.persist(next);
+        return next;
+    }
+    async persist(config) {
+        let proxy = { mode: 'direct' };
+        if (config.proxy.mode === 'configured' && config.proxy.url) {
+            if (this.platform === 'win32') {
+                const blob = await this.protectSecret(Buffer.from(config.proxy.url, 'utf8'));
+                const restored = await this.unprotectSecret(blob);
+                if (restored.toString('utf8') !== config.proxy.url)
+                    throw new Error('DPAPI proxy verification failed.');
+                proxy = { mode: 'configured', protected: { scheme: 'dpapi-current-user-v1', blob } };
+            }
+            else {
+                proxy = { mode: 'configured', url: config.proxy.url };
+            }
+        }
+        const persisted = {
+            version: 1,
+            gatewayUrl: config.gatewayUrl,
+            allowedRoots: config.allowedRoots,
+            proxy,
+            appCaPem: config.appCaPem,
+            securityProtocolFloor: config.securityProtocolFloor
+        };
+        await fs.mkdir(path.dirname(this.configPath), { recursive: true });
+        const temporary = `${this.configPath}.${process.pid}.${Date.now()}.tmp`;
+        await fs.writeFile(temporary, JSON.stringify(persisted, null, 2), { mode: 0o600 });
+        await fs.rename(temporary, this.configPath);
+        try {
+            await fs.chmod(this.configPath, 0o600);
+        }
+        catch { /* Windows ACLs inherit from the profile. */ }
+    }
+}
+function proxyResolutionUrl(raw) {
+    const url = new URL(raw);
+    if (url.protocol === 'ws:')
+        url.protocol = 'http:';
+    if (url.protocol === 'wss:')
+        url.protocol = 'https:';
+    url.pathname = '/';
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+}
+export function resolveProxyDecisionFromEnvironment(gatewayUrl) {
+    const explicit = PROXY_ENV_NAMES.some(name => process.env[name] !== undefined);
+    if (!explicit)
+        return { explicit: false, proxyUrl: null };
+    const resolved = String(getProxyForUrl(proxyResolutionUrl(gatewayUrl)) || '').trim();
+    return { explicit: true, proxyUrl: resolved || null };
+}
+function parseAllowedRootsEnvironment(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('MCP_GATEWAY_ALLOWED_ROOTS must be a JSON array of absolute paths');
+    }
+    if (!Array.isArray(parsed))
+        throw new Error('MCP_GATEWAY_ALLOWED_ROOTS must be a JSON array of absolute paths');
+    return normalizeAllowedRoots(parsed);
+}
+export async function captureGatewayConfigFromEnvironment(store, options = {}) {
+    const current = await store.load();
+    const gatewayUrl = String(process.env.MCP_GATEWAY_URL || current.gatewayUrl || options.fallbackGatewayUrl || '').trim();
+    if (!gatewayUrl)
+        throw new Error('MCP_GATEWAY_URL is required for the first login or install.');
+    const patch = { gatewayUrl };
+    if (process.env.MCP_GATEWAY_ALLOWED_ROOTS !== undefined) {
+        patch.allowedRoots = parseAllowedRootsEnvironment(String(process.env.MCP_GATEWAY_ALLOWED_ROOTS || ''));
+    }
+    const proxy = resolveProxyDecisionFromEnvironment(gatewayUrl);
+    if (proxy.explicit) {
+        patch.proxy = proxy.proxyUrl
+            ? { mode: 'configured', url: proxy.proxyUrl }
+            : { mode: 'direct', url: null };
+    }
+    const appCaPath = String(process.env.MCP_GATEWAY_APP_CA_PATH || '').trim();
+    if (appCaPath)
+        patch.appCaPem = await fs.readFile(path.resolve(appCaPath), 'utf8');
+    return await store.update(patch);
+}
+export function createGatewayProxyAgent(config) {
+    const proxyUrl = config.proxy.mode === 'configured' ? String(config.proxy.url || '') : '';
+    return {
+        agent: new ProxyAgent({ getProxyForUrl: () => proxyUrl })
+    };
+}

package/dist/device/gateway-identity.d.ts

@@ -0,0 +1,35 @@
+export interface GatewayIdentityRecord {
+    deviceId: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+    enrolled: boolean;
+}
+export declare function deviceIdentityNeedsPairing(record: Pick<GatewayIdentityRecord, 'enrolled'>): boolean;
+type SecretProtect = (value: Buffer) => Promise<string>;
+type SecretUnprotect = (value: string) => Promise<Buffer>;
+export declare class GatewayDeviceIdentity {
+    readonly identityPath: string;
+    private record?;
+    private platform;
+    private protectSecret;
+    private unprotectSecret;
+    constructor(identityPath?: string, options?: {
+        platform?: NodeJS.Platform | string;
+        protectSecret?: SecretProtect;
+        unprotectSecret?: SecretUnprotect;
+    });
+    loadOrCreate(): Promise<GatewayIdentityRecord>;
+    markEnrolled(): Promise<void>;
+    signChallenge(nonce: string): Promise<string>;
+    signChallengeV2(options: {
+        mode: 'reconnect' | 'enroll' | 'pair';
+        nonce: Buffer | string;
+        exporter: Buffer | string;
+        grant?: string | null;
+    }): Promise<string>;
+    private loadPersisted;
+    private protectAndVerify;
+    private persist;
+    private persistSerialized;
+}
+export {};

package/dist/device/gateway-identity.js

@@ -0,0 +1,178 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign } from 'crypto';
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+import { deviceStatePaths } from './device-state.js';
+import { protectWindowsSecret, unprotectWindowsSecret } from './windows-dpapi.js';
+export function deviceIdentityNeedsPairing(record) {
+    return record.enrolled !== true;
+}
+function defaultIdentityPath() {
+    const secureRoot = deviceStatePaths().root;
+    const fallback = deviceStatePaths().identity;
+    const configured = String(process.env.MCP_GATEWAY_DEVICE_IDENTITY_PATH || '').trim();
+    if (!configured)
+        return fallback;
+    const resolved = path.resolve(configured);
+    if (process.platform === 'win32') {
+        const relative = path.relative(secureRoot, resolved);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            throw new Error('MCP_GATEWAY_DEVICE_IDENTITY_PATH must stay inside ~/.mcp-device on Windows');
+        }
+    }
+    return resolved;
+}
+function newDeviceId() {
+    const host = os.hostname().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 54) || 'device';
+    return `${host}-${randomUUID().slice(0, 8)}`;
+}
+function validateRecord(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Invalid gateway identity record');
+    const deviceId = String(value.deviceId || '').trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(deviceId))
+        throw new Error('Invalid persisted device ID');
+    const publicKeyPem = String(value.publicKeyPem || '');
+    const privateKeyPem = String(value.privateKeyPem || '');
+    const publicKey = createPublicKey(publicKeyPem);
+    const privateKey = createPrivateKey(privateKeyPem);
+    if (publicKey.asymmetricKeyType !== 'ed25519' || privateKey.asymmetricKeyType !== 'ed25519') {
+        throw new Error('Gateway identity must use Ed25519 keys');
+    }
+    const normalizedPublic = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+    const derivedPublic = createPublicKey(privateKey).export({ type: 'spki', format: 'pem' }).toString();
+    if (normalizedPublic !== derivedPublic)
+        throw new Error('Gateway identity private key does not match the stored public key');
+    return { deviceId, publicKeyPem: normalizedPublic, privateKeyPem, enrolled: value.enrolled === true };
+}
+function privateKeyDer(privateKeyPem) {
+    return createPrivateKey(privateKeyPem).export({ type: 'pkcs8', format: 'der' });
+}
+function privateKeyPemFromDer(value) {
+    return createPrivateKey({ key: value, type: 'pkcs8', format: 'der' }).export({ type: 'pkcs8', format: 'pem' }).toString();
+}
+export class GatewayDeviceIdentity {
+    constructor(identityPath = defaultIdentityPath(), options = {}) {
+        this.identityPath = identityPath;
+        this.platform = options.platform || process.platform;
+        this.protectSecret = options.protectSecret || (value => protectWindowsSecret(value, 'identity', { platform: this.platform }));
+        this.unprotectSecret = options.unprotectSecret || (value => unprotectWindowsSecret(value, 'identity', { platform: this.platform }));
+    }
+    async loadOrCreate() {
+        if (this.record)
+            return { ...this.record };
+        try {
+            const parsed = JSON.parse(await fs.readFile(this.identityPath, 'utf8'));
+            this.record = await this.loadPersisted(parsed);
+            return { ...this.record };
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+        }
+        const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+        this.record = validateRecord({
+            deviceId: String(process.env.MCP_DEVICE_ID || '').trim() || newDeviceId(),
+            publicKeyPem: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+            privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+            enrolled: false
+        });
+        await this.persist();
+        return { ...this.record };
+    }
+    async markEnrolled() {
+        const current = await this.loadOrCreate();
+        if (current.enrolled)
+            return;
+        this.record = { ...current, enrolled: true };
+        await this.persist();
+    }
+    async signChallenge(nonce) {
+        const current = await this.loadOrCreate();
+        const challenge = Buffer.from(`mcp-device-auth-v1\n${current.deviceId}\n${nonce}`, 'utf8');
+        return sign(null, challenge, current.privateKeyPem).toString('base64');
+    }
+    async signChallengeV2(options) {
+        const current = await this.loadOrCreate();
+        const modeByte = { reconnect: 0, enroll: 1, pair: 2 }[options.mode];
+        const nonce = Buffer.isBuffer(options.nonce) ? options.nonce : Buffer.from(String(options.nonce || ''), 'base64url');
+        const exporter = Buffer.isBuffer(options.exporter) ? options.exporter : Buffer.from(String(options.exporter || ''), 'base64url');
+        if (nonce.length !== 32)
+            throw new Error('gateway nonce must be exactly 32 bytes.');
+        if (exporter.length !== 32)
+            throw new Error('TLS exporter must be exactly 32 bytes.');
+        const deviceBytes = Buffer.from(current.deviceId, 'utf8');
+        const deviceLength = Buffer.allocUnsafe(2);
+        deviceLength.writeUInt16BE(deviceBytes.length, 0);
+        const publicKeyDer = createPublicKey(current.publicKeyPem).export({ type: 'spki', format: 'der' });
+        const grantDigest = options.mode === 'reconnect'
+            ? Buffer.alloc(32)
+            : createHash('sha256').update(String(options.grant || ''), 'utf8').digest();
+        const challenge = Buffer.concat([
+            Buffer.from('hcu-mcp-device-auth-v2\0', 'ascii'),
+            Buffer.from([2, modeByte]),
+            deviceLength,
+            deviceBytes,
+            nonce,
+            exporter,
+            createHash('sha256').update(publicKeyDer).digest(),
+            grantDigest
+        ]);
+        return sign(null, challenge, current.privateKeyPem).toString('base64');
+    }
+    async loadPersisted(value) {
+        if (value?.privateKeyPem) {
+            const legacy = validateRecord(value);
+            if (this.platform !== 'win32')
+                return legacy;
+            const blob = await this.protectAndVerify(legacy);
+            await this.persistSerialized({
+                version: 2,
+                deviceId: legacy.deviceId,
+                publicKeyPem: legacy.publicKeyPem,
+                privateKey: { scheme: 'dpapi-current-user-v1', blob },
+                enrolled: legacy.enrolled
+            });
+            return legacy;
+        }
+        if (value?.privateKey?.scheme !== 'dpapi-current-user-v1' || !value.privateKey.blob) {
+            throw new Error('Invalid gateway identity protected private key');
+        }
+        if (this.platform !== 'win32')
+            throw new Error('DPAPI-protected gateway identity requires Windows');
+        const privateKeyPem = privateKeyPemFromDer(await this.unprotectSecret(String(value.privateKey.blob)));
+        return validateRecord({ ...value, privateKeyPem });
+    }
+    async protectAndVerify(record) {
+        const blob = await this.protectSecret(privateKeyDer(record.privateKeyPem));
+        const restoredPem = privateKeyPemFromDer(await this.unprotectSecret(blob));
+        validateRecord({ ...record, privateKeyPem: restoredPem });
+        return blob;
+    }
+    async persist() {
+        if (!this.record)
+            throw new Error('Gateway identity is not initialized');
+        if (this.platform === 'win32') {
+            const blob = await this.protectAndVerify(this.record);
+            await this.persistSerialized({
+                version: 2,
+                deviceId: this.record.deviceId,
+                publicKeyPem: this.record.publicKeyPem,
+                privateKey: { scheme: 'dpapi-current-user-v1', blob },
+                enrolled: this.record.enrolled
+            });
+            return;
+        }
+        await this.persistSerialized(this.record);
+    }
+    async persistSerialized(value) {
+        await fs.mkdir(path.dirname(this.identityPath), { recursive: true });
+        const temporary = `${this.identityPath}.${process.pid}.${Date.now()}.tmp`;
+        await fs.writeFile(temporary, JSON.stringify(value, null, 2), { mode: 0o600 });
+        await fs.rename(temporary, this.identityPath);
+        try {
+            await fs.chmod(this.identityPath, 0o600);
+        }
+        catch { /* Windows ACLs are inherited from the user profile. */ }
+    }
+}

package/dist/device/gateway-pairing.d.ts

@@ -0,0 +1,25 @@
+import type { Agent } from 'http';
+import fetch from 'cross-fetch';
+import { GatewayDeviceIdentity } from './gateway-identity.js';
+type AccountStatus = {
+    connected: boolean;
+    label: string | null;
+};
+export interface GatewayPairingResult {
+    enrollmentGrant: string;
+    deviceId: string;
+    account: AccountStatus;
+}
+export interface GatewayPairingOptions {
+    gatewayUrl: string;
+    identity: GatewayDeviceIdentity;
+    deviceName?: string;
+    fetchFn?: typeof fetch;
+    proxyAgent?: Agent;
+    openBrowser?: (url: string) => Promise<unknown>;
+    renderQr?: (value: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (value: string) => void;
+}
+export declare function pairGatewayDevice(options: GatewayPairingOptions): Promise<GatewayPairingResult>;
+export {};

package/dist/device/gateway-pairing.js

@@ -0,0 +1,105 @@
+import { createHash, randomBytes } from 'crypto';
+import { createRequire } from 'module';
+import os from 'os';
+import open from 'open';
+import fetch from 'cross-fetch';
+import { gatewayHttpBase } from './gateway-url-policy.js';
+const CLIENT_ID = 'mcp-device';
+const SCOPE = 'mcp:tools';
+const require = createRequire(import.meta.url);
+function pkce() {
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+function defaultQrRenderer(value) {
+    const qr = require('qrcode-terminal');
+    qr.generate(value, { small: true }, output => process.stdout.write(`${output}\n`));
+}
+async function jsonResponse(response) {
+    let payload = null;
+    try {
+        payload = await response.json();
+    }
+    catch { /* handled below */ }
+    if (!response.ok) {
+        const code = String(payload?.error || `http_${response.status}`);
+        const error = new Error(String(payload?.error_description || code));
+        error.code = code;
+        error.status = response.status;
+        throw error;
+    }
+    return payload;
+}
+export async function pairGatewayDevice(options) {
+    const baseUrl = gatewayHttpBase(options.gatewayUrl);
+    const fetchFn = options.fetchFn || fetch;
+    const openBrowser = options.openBrowser || (url => open(url));
+    const renderQr = options.renderQr || defaultQrRenderer;
+    const sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    const log = options.log || (value => console.log(value));
+    const identity = await options.identity.loadOrCreate();
+    const verifier = pkce();
+    const deviceName = String(options.deviceName || os.hostname() || identity.deviceId).trim().slice(0, 128) || identity.deviceId;
+    const start = await jsonResponse(await fetchFn(`${baseUrl}/device/start`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        ...(options.proxyAgent ? { agent: options.proxyAgent } : {}),
+        body: JSON.stringify({
+            client_id: CLIENT_ID,
+            scope: SCOPE,
+            device_id: identity.deviceId,
+            device_name: deviceName,
+            public_key_pem: identity.publicKeyPem,
+            code_challenge: verifier.challenge,
+            code_challenge_method: 'S256'
+        })
+    }));
+    const verificationUrl = String(start.verification_uri_complete || start.verification_uri || '').trim();
+    if (!verificationUrl || !start.device_code || !start.user_code)
+        throw new Error('Gateway returned an incomplete device pairing response.');
+    log(`Gateway: ${baseUrl}`);
+    log(`Pair this device: ${verificationUrl}`);
+    log(`Code: ${start.user_code}`);
+    renderQr(verificationUrl);
+    try {
+        await openBrowser(verificationUrl);
+    }
+    catch { /* URL + QR remain usable */ }
+    const intervalMs = Math.max(1000, Math.min(30000, Number(start.interval || 2) * 1000));
+    const deadline = Date.now() + Math.max(1, Number(start.expires_in || 600)) * 1000;
+    while (Date.now() < deadline) {
+        try {
+            const payload = await jsonResponse(await fetchFn(`${baseUrl}/device/poll`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                ...(options.proxyAgent ? { agent: options.proxyAgent } : {}),
+                body: JSON.stringify({
+                    device_code: start.device_code,
+                    client_id: CLIENT_ID,
+                    code_verifier: verifier.verifier
+                })
+            }));
+            const enrollmentGrant = String(payload?.enrollment_grant || '').trim();
+            const deviceId = String(payload?.device_id || identity.deviceId).trim();
+            if (!enrollmentGrant)
+                throw new Error('Gateway approval did not return an enrollment grant.');
+            if (deviceId !== identity.deviceId)
+                throw new Error('Gateway pairing response device_id mismatch.');
+            return {
+                enrollmentGrant,
+                deviceId,
+                account: {
+                    connected: payload?.account?.connected === true,
+                    label: payload?.account?.label ? String(payload.account.label) : null
+                }
+            };
+        }
+        catch (error) {
+            if (error?.code !== 'authorization_pending')
+                throw error;
+            await sleep(intervalMs);
+        }
+    }
+    throw new Error('Device pairing code expired before approval.');
+}

package/dist/device/gateway-secure-transport.d.ts

@@ -0,0 +1,25 @@
+import tls from 'tls';
+import { Duplex } from 'stream';
+import WebSocket from 'ws';
+export declare const DEVICE_INNER_TLS_SUBPROTOCOL = "hcu-device-v2-inner-tls";
+export declare const DEVICE_MAX_MESSAGE_BYTES: number;
+export declare class WebSocketDuplex extends Duplex {
+    private ws;
+    constructor(ws: WebSocket);
+    _read(): void;
+    _write(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
+}
+export declare function createWebSocketDuplex(ws: WebSocket): WebSocketDuplex;
+export declare function createClientInnerTls(ws: WebSocket, options: {
+    ca: string | Buffer;
+    servername: string;
+}): tls.TLSSocket;
+export declare function exportDeviceAuthKeyingMaterial(socket: tls.TLSSocket, deviceId: string, mode: string): Buffer;
+export declare function encodeJsonFrame(message: any, maxMessageBytes?: number): Buffer;
+export declare function createJsonFrameParser(options: {
+    maxMessageBytes?: number;
+    onMessage: (message: any) => void;
+}): {
+    push(value: Buffer | Uint8Array): void;
+};