@muhkoo/connect 0.13.1-alpha.0 → 0.14.0-alpha.0

package/dist/browser/index.js

@@ -5327,7 +5327,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.13.1-alpha.0";
+const VERSION = "0.13.2-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -6456,13 +6456,21 @@ class HostedAuth {
         const { codeVerifier, codeChallenge } = await generatePkce();
         const state = randomState();
         this.store({ codeVerifier, state, appId: opts.appId, redirectUri: opts.redirectUri });
-        const url = `${this.deps.authBaseUrl}/authorize?` + new URLSearchParams({
+        const params = {
             app_id: opts.appId,
             redirect_uri: opts.redirectUri,
             state,
             code_challenge: codeChallenge,
             code_challenge_method: "S256",
-        }).toString();
+        };
+        // `prompt=login` forces the credential screen even when the browser is
+        // remembered. Without it, an app's own "sign out" would be undone on the
+        // very next sign-in click: single sign-on means the hosted page still
+        // knows you, so the app must be able to say "ask anyway". Named after the
+        // OIDC parameter that solves the same problem.
+        if (opts.prompt)
+            params.prompt = opts.prompt;
+        const url = `${this.deps.authBaseUrl}/authorize?` + new URLSearchParams(params).toString();
         if (opts.redirect !== false)
             this.location().assign(url);
         return url;
@@ -7260,6 +7268,25 @@ class VaultUnavailableError extends Error {
         this.cause = cause;
     }
 }
+/**
+ * A stored device pairing that the account has since revoked.
+ *
+ * Typed rather than a bare Error because the right response is specific and the
+ * wrong one is harmful: the caller must DISCARD its stored key and fall back to
+ * a password. Retrying is futile (the factor is gone from the vault), and
+ * silently re-pairing would undo the revocation that a user performed
+ * deliberately — the whole point of a revocable pairing is that withdrawing it
+ * stays withdrawn.
+ *
+ * Distinct from a wrong key, which fails to decrypt rather than failing to
+ * resolve. A machine whose access was withdrawn should be able to say so.
+ */
+class DeviceRevokedError extends Error {
+    constructor() {
+        super("This device is no longer paired — its access was revoked. Sign in again to re-pair.");
+        this.name = "DeviceRevokedError";
+    }
+}
 /**
  * ZK identity auth. One instance per {@link Client}; reads/writes the shared
  * {@link SessionState}.
@@ -7870,15 +7897,46 @@ class ZkAuth {
      * withdrawn should be able to tell you that, not just "decryption failed".
      */
     async unlockWithDevice(username, factorId, deviceKey) {
+        const seed = await this.openDeviceFactor(username, factorId, deviceKey);
+        this.deps.session.setSeed(seed);
+    }
+    /**
+     * Sign in using a key stored by {@link enrollDevice} — session AND seed.
+     *
+     * {@link unlockWithDevice} recovers only the encryption identity, which suits
+     * a CLI that already holds a session token on disk. A browser generally does
+     * not: its session expires while the device pairing is still perfectly valid,
+     * and at that point it holds the means to decrypt everything but no way to
+     * make an authenticated call. So this derives the ZK identity from the
+     * recovered seed and proves it, exactly as {@link recoverWithPhrase} does —
+     * the seed has always been sufficient to authenticate, and withholding that
+     * here just meant re-typing a password to prove something already known.
+     *
+     * This is what makes single sign-on possible without any credential at rest:
+     * the seed is never stored, only a key that opens a server-held blob, and
+     * revoking the factor ({@link revokeDevice}) severs it immediately.
+     *
+     * Throws distinguishably on a revoked pairing, so a caller can clear its
+     * stored key and fall back to a password rather than retrying forever.
+     */
+    async loginWithDevice(username, factorId, deviceKey, opts = {}) {
+        const seed = await this.openDeviceFactor(username, factorId, deviceKey);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /** Fetch and open a `device` factor. Shared by the unlock and login paths so
+     *  the two can never disagree about what a revoked pairing looks like. */
+    async openDeviceFactor(username, factorId, deviceKey) {
         const { factor } = await this.deps.auth.vaultRead(username, "device", undefined, undefined, factorId);
         if (!factor) {
-            throw new Error("This device is no longer paired — its access was revoked. Sign in again to re-pair.");
+            throw new DeviceRevokedError();
         }
         if (!factor.wrap || !factor.iv)
             throw new Error("The stored device factor is incomplete; re-pair this device.");
         const key = await wrapKeyFromBytes(fromBase64$1(deviceKey), DEVICE_WRAP_INFO);
-        const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
-        this.deps.session.setSeed(seed);
+        return unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
     }
     /** Paired machines, newest first. Metadata only — never the ciphertext. */
     async listDevices() {
@@ -15654,5 +15712,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, ReauthRequiredError, ReedSolomonCodec, Repo, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, ReauthRequiredError, ReedSolomonCodec, Repo, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map