@necessarysdk/react-native 0.0.0-stage → 0.1.5

package/lib/requestProof.js

@@ -0,0 +1,220 @@
+"use strict";
+/**
+ * Request proofs (the public guide, section 3): the installation key signs each request, so a
+ * copied session token is useless without the key; with step-up on the person approves one
+ * request with the step-up key, and with the app PIN on a request carries the backend's proof of
+ * the PIN. Also the description of the one request a scan is to approve (section 2).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestProof = exports.secureRandomBytes = exports.base64UrlNoPadding = void 0;
+exports.setSecureRandomSource = setSecureRandomSource;
+exports.freshNonce = freshNonce;
+exports.appPinProofRequest = appPinProofRequest;
+exports.stepUpProof = stepUpProof;
+exports.signRequest = signRequest;
+exports.describeOperation = describeOperation;
+const errors_1 = require("./errors");
+const bytes_1 = require("./util/bytes");
+const native_1 = require("./util/native");
+const target_1 = require("./util/target");
+var bytes_2 = require("./util/bytes");
+Object.defineProperty(exports, "base64UrlNoPadding", { enumerable: true, get: function () { return bytes_2.base64UrlNoPadding; } });
+/** Where [freshNonce] takes its bytes: the platform's secure random source, replaced in tests. */
+let secureRandomBytes = async (count) => {
+    const native = (0, native_1.storageModule)();
+    if (native === null) {
+        throw new errors_1.NativeKeyException('NATIVE_STORAGE_PLUGIN_MISSING', "The SDK's storage module is not linked into this app: rebuild the app.");
+    }
+    let encoded;
+    try {
+        encoded = await native.randomBytes(count);
+    }
+    catch (error) {
+        throw (0, native_1.nativeFailure)(error, 'The platform gave no random bytes.');
+    }
+    const bytes = (0, bytes_1.base64UrlDecode)(encoded);
+    if (bytes.length !== count) {
+        throw new errors_1.NativeKeyException('RANDOM_BYTES_SHORT', `The platform gave ${bytes.length} random bytes of ${count}.`);
+    }
+    return bytes;
+};
+exports.secureRandomBytes = secureRandomBytes;
+/** Replaces the secure random source -- for tests, which run where no phone is. */
+function setSecureRandomSource(source) {
+    exports.secureRandomBytes = source;
+}
+/** 32 random bytes from the platform's secure source. */
+function freshNonce() {
+    return (0, exports.secureRandomBytes)(32);
+}
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+/**
+ * What the installation key signed for one request -- with step-up, what the step-up key signed;
+ * with the app PIN, the backend's proof of it; for a request a scan approves, that scan's report --
+ * and the headers that carry them beside `Authorization: Bearer`.
+ */
+class RequestProof {
+    constructor(fields) {
+        this.bearerToken = fields.bearerToken;
+        this.method = fields.method;
+        this.path = fields.path;
+        this.encodedBody = fields.encodedBody;
+        this.payload = fields.payload;
+        this.signature = fields.signature;
+        this.timestamp = fields.timestamp;
+        this.nonce = fields.nonce;
+        this.stepUpPayload = fields.stepUpPayload ?? null;
+        this.stepUpSignature = fields.stepUpSignature ?? null;
+        this.appPinProof = fields.appPinProof ?? null;
+        this.integrityReport = fields.integrityReport ?? null;
+    }
+    get headers() {
+        const headers = {
+            'X-Access-Proof': this.payload,
+            'X-Access-Signature': this.signature,
+        };
+        if (this.stepUpPayload !== null)
+            headers['X-Step-Up-Proof'] = this.stepUpPayload;
+        if (this.stepUpSignature !== null)
+            headers['X-Step-Up-Signature'] = this.stepUpSignature;
+        if (this.appPinProof !== null)
+            headers['X-App-PIN-Proof'] = this.appPinProof;
+        if (this.integrityReport !== null)
+            headers['X-Integrity-Report'] = this.integrityReport;
+        return headers;
+    }
+    /** This request, unlocked by the backend's [proof] of the app PIN. */
+    withAppPinProof(proof) {
+        return this.with(proof, this.integrityReport);
+    }
+    /** This request, naming [reportId], the scan made for it alone. */
+    withIntegrityReport(reportId) {
+        return this.with(this.appPinProof, reportId);
+    }
+    with(appPinProof, integrityReport) {
+        return new RequestProof({
+            bearerToken: this.bearerToken,
+            method: this.method,
+            path: this.path,
+            encodedBody: this.encodedBody,
+            payload: this.payload,
+            signature: this.signature,
+            timestamp: this.timestamp,
+            nonce: this.nonce,
+            stepUpPayload: this.stepUpPayload,
+            stepUpSignature: this.stepUpSignature,
+            appPinProof,
+            integrityReport,
+        });
+    }
+}
+exports.RequestProof = RequestProof;
+/**
+ * What the app sends to have its backend check the app PIN for one request: the PIN, and that
+ * request as its request proof signs it -- method, path, query, the hash of the body sent and the
+ * request proof's nonce.
+ */
+function appPinProofRequest(args) {
+    const target = (0, target_1.parseTarget)(args.path);
+    return {
+        pin: args.pin,
+        request: {
+            method: args.method.toUpperCase(),
+            path: target.path,
+            query: target.query,
+            body_sha256: (0, bytes_1.sha256Hex)(args.encodedBody),
+            nonce: args.nonce,
+        },
+    };
+}
+/**
+ * The step-up proof, version 2, that the step-up key signs for one request: the base64url of its
+ * JSON, the members in this order. [nonce] is the request proof's nonce for the same request, so
+ * the approval is used up with it.
+ */
+function stepUpProof(args) {
+    const target = (0, target_1.parseTarget)(args.path);
+    return (0, bytes_1.base64UrlNoPadding)((0, bytes_1.utf8Encode)(JSON.stringify({
+        version: 2,
+        purpose: 'stepup',
+        installation_id: args.installationId,
+        access_token_sha256: (0, bytes_1.sha256Hex)(args.accessToken),
+        method: args.method.toUpperCase(),
+        path: target.path,
+        query: target.query,
+        body_sha256: (0, bytes_1.sha256Hex)(args.encodedBody),
+        factor: args.factor,
+        nonce: args.nonce,
+        timestamp: args.timestamp,
+    })));
+}
+/**
+ * Signs [method] [path] with [encodedBody] under [bearerToken]: proof version 2, which signs the
+ * query string too, exactly as sent. A GET signs an empty body. With [stepUp], the step-up key signs
+ * first -- the phone asks the person -- and the request proof after, with the same nonce, so the
+ * time the person takes does not count against the request proof's clock window.
+ * [installationId], [timestamp] and [nonce] replace what the request proof would otherwise carry,
+ * for the shared test vectors and for testing a backend's refusals.
+ */
+async function signRequest(args) {
+    const normalizedMethod = args.method.toUpperCase();
+    const body = normalizedMethod === 'GET' ? '' : args.encodedBody ?? '';
+    const nonceText = (0, bytes_1.base64UrlNoPadding)(args.nonce ?? (await freshNonce()));
+    let stepUpPayload = null;
+    let stepUpSignature = null;
+    if (args.stepUp != null) {
+        stepUpPayload = stepUpProof({
+            installationId: args.identity.installationId,
+            accessToken: args.bearerToken,
+            method: normalizedMethod,
+            path: args.path,
+            encodedBody: body,
+            factor: args.stepUp.factor,
+            nonce: nonceText,
+            timestamp: nowSeconds(),
+        });
+        stepUpSignature = await args.stepUp.sign(stepUpPayload);
+    }
+    const signedAt = args.timestamp ?? nowSeconds();
+    const target = (0, target_1.parseTarget)(args.path);
+    // The members in this order: the backend checks each against the request it received, and the
+    // shared vectors hold both sides to these bytes.
+    const proof = {
+        access_token_sha256: (0, bytes_1.sha256Hex)(args.bearerToken),
+        body_sha256: (0, bytes_1.sha256Hex)(body),
+        installation_id: args.installationId ?? args.identity.installationId,
+        method: normalizedMethod,
+        nonce: nonceText,
+        path: target.path,
+        query: target.query,
+        timestamp: signedAt,
+        version: 2,
+    };
+    // The key signs the exact JSON bytes this base64url value carries; the private key never leaves
+    // the phone's keystore.
+    const payload = (0, bytes_1.base64UrlNoPadding)((0, bytes_1.utf8Encode)(JSON.stringify(proof)));
+    return new RequestProof({
+        bearerToken: args.bearerToken,
+        method: normalizedMethod,
+        path: args.path,
+        encodedBody: body,
+        payload,
+        signature: await args.identity.signPayload(payload),
+        timestamp: signedAt,
+        nonce: nonceText,
+        stepUpPayload,
+        stepUpSignature,
+    });
+}
+/** The one request a scan is to approve, described exactly as it will be sent: what the challenge names as its `operation`. */
+function describeOperation(method, path, encodedBody) {
+    const target = (0, target_1.parseTarget)(path);
+    return {
+        method: method.toUpperCase(),
+        path: target.path,
+        query: target.query,
+        body_sha256: (0, bytes_1.sha256Hex)(encodedBody),
+    };
+}

package/lib/secureScreen.d.ts

@@ -0,0 +1,15 @@
+/** Protection of the app's window while a secret is typed. */
+/**
+ * Protects the app's window while a secret is typed. Android: no screenshots, recordings or casts
+ * of the window, other apps' windows not drawn over it (Android 12 and later), and touches that
+ * passed through another app's window dropped. iOS cannot block screenshots; it covers the window
+ * while the screen is recorded or mirrored.
+ *
+ * Calls nest: each `protect(true)` needs its `protect(false)`, and the window is put back as it
+ * was -- a window the app keeps secure itself stays secure -- when the last one ends. Other apps'
+ * overlays, which no public call reads, are shown again then. Returns what the window has now; a
+ * build without the native module answers nothing, and the entry stays usable.
+ */
+export declare class SecureScreen {
+    static protect(on: boolean): Promise<Record<string, unknown>>;
+}

package/lib/secureScreen.js

@@ -0,0 +1,32 @@
+"use strict";
+/** Protection of the app's window while a secret is typed. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureScreen = void 0;
+const native_1 = require("./util/native");
+/**
+ * Protects the app's window while a secret is typed. Android: no screenshots, recordings or casts
+ * of the window, other apps' windows not drawn over it (Android 12 and later), and touches that
+ * passed through another app's window dropped. iOS cannot block screenshots; it covers the window
+ * while the screen is recorded or mirrored.
+ *
+ * Calls nest: each `protect(true)` needs its `protect(false)`, and the window is put back as it
+ * was -- a window the app keeps secure itself stays secure -- when the last one ends. Other apps'
+ * overlays, which no public call reads, are shown again then. Returns what the window has now; a
+ * build without the native module answers nothing, and the entry stays usable.
+ */
+class SecureScreen {
+    static async protect(on) {
+        try {
+            const native = (0, native_1.secureScreenModule)();
+            if (native === null) {
+                return {};
+            }
+            const state = (await native.protect(on));
+            return state ?? {};
+        }
+        catch {
+            return {};
+        }
+    }
+}
+exports.SecureScreen = SecureScreen;

package/lib/stepUpKey.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The step-up key (the public guide, section 3): a second key that the person must unlock, the
+ * options it is made with, and its re-enrolment proof.
+ */
+import { type PublicJwk } from './installationKey';
+/**
+ * The optional step-up key as the native side reports it. [factor], [mode] and [windowSeconds]
+ * describe what the platform keystore actually enforces (read back from the key itself), which
+ * on Android 9 and 10 is a short hardware window rather than per-use.
+ */
+export declare class StepUpKeyMetadata {
+    readonly publicKey: PublicJwk;
+    readonly factor: string;
+    readonly mode: string;
+    readonly windowSeconds: number;
+    readonly securityLevel: string;
+    readonly hardwareBacked: boolean;
+    readonly created: boolean;
+    constructor(value: {
+        publicKey: PublicJwk;
+        factor: string;
+        mode: string;
+        windowSeconds: number;
+        securityLevel: string;
+        hardwareBacked: boolean;
+        created: boolean;
+    });
+    get authJson(): Record<string, unknown>;
+    get description(): string;
+    /** RFC 7638 thumbprint, the same form the server derives from the JWK. */
+    get thumbprint(): string;
+    static fromPlatform(value: Record<string, unknown>): StepUpKeyMetadata;
+}
+/** Where a backend takes a re-enrolled step-up key by default (the public guide, section 4). */
+export declare const stepUpReenrolPath = "/v1/installations/stepup-key";
+/**
+ * How the app wants its step-up key made (the public guide, section 3): [factor] `passcode` or
+ * `biometric`; [mode] `per_use`, or `windowed` with [windowSeconds] from 1. Android 9 and 10 cannot
+ * make a per-use passcode key and make a windowed one; iOS makes per-use keys only. [reenrolPath]
+ * is where the backend takes a new key (DeviceTrust.reenrolStepUp).
+ */
+export declare class StepUpOptions {
+    readonly factor: string;
+    readonly mode: string;
+    readonly windowSeconds: number;
+    readonly reenrolPath: string;
+    constructor(options?: {
+        factor?: string;
+        mode?: string;
+        windowSeconds?: number;
+        reenrolPath?: string;
+    });
+    /**
+     * A key made with other values, or already made: whether it satisfies these options -- the same
+     * factor (a backend refuses any other), and a per-use key or a window no longer than this one. A
+     * per-use key satisfies windowed options.
+     */
+    accepts(key: StepUpKeyMetadata): boolean;
+    get description(): string;
+}
+/**
+ * The proof a new step-up key signs at re-enrolment: the base64url of its JSON, the members in this
+ * order. [nonce] is the request proof's nonce of the re-enrolment request.
+ */
+export declare function stepUpReenrolProof(args: {
+    installationId: string;
+    stepUpKeyThumbprint: string;
+    nonce: string;
+    timestamp: number;
+}): string;
+/**
+ * Whether a step-up key [options] do not accept is replaced before the next registration: only
+ * where the new key can then be bound -- by a re-enrolment ([replaceMismatched]), which binds it
+ * with the person's re-authentication, or by this installation's first registration, which binds
+ * the key it is offered. A known installation's registration never binds an offered key; it only
+ * says whether it matches, so replacing the key there orphans the one the server holds: on a phone
+ * that cannot make the key the options ask for (Android 9 makes no per-use passcode key), the
+ * registration that follows every re-enrolment would replace the key the server had just bound,
+ * and step-up would stay unavailable.
+ */
+export declare function replacesStepUpKey(key: StepUpKeyMetadata, options: StepUpOptions, flags: {
+    replaceMismatched: boolean;
+    knownInstallation: boolean;
+}): boolean;
+export declare class NativeStepUpKey {
+    /** The mode the app asks for, which decides whether a windowed key first tries to sign inside an open hardware window. */
+    configuredMode: string;
+    constructor(options?: {
+        configuredMode?: string;
+    });
+    /**
+     * Returns the existing key as the keystore enforces it, or creates one with these values: an
+     * existing key is never changed, so a caller that needs other values deletes it first.
+     */
+    getOrCreateKey(args: {
+        factor: string;
+        mode: string;
+        windowSeconds: number;
+    }): Promise<StepUpKeyMetadata>;
+    /** Shows the system passcode (or biometric) prompt and completes when the person answers it. A cancelled prompt is STEPUP_CANCELLED. */
+    sign(payloadBase64Url: string, options: {
+        reason: string;
+    }): Promise<string>;
+    deleteKey(): Promise<void>;
+}

package/lib/stepUpKey.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * The step-up key (the public guide, section 3): a second key that the person must unlock, the
+ * options it is made with, and its re-enrolment proof.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeStepUpKey = exports.StepUpOptions = exports.stepUpReenrolPath = exports.StepUpKeyMetadata = void 0;
+exports.stepUpReenrolProof = stepUpReenrolProof;
+exports.replacesStepUpKey = replacesStepUpKey;
+const errors_1 = require("./errors");
+const bytes_1 = require("./util/bytes");
+const native_1 = require("./util/native");
+const installationKey_1 = require("./installationKey");
+/**
+ * The optional step-up key as the native side reports it. [factor], [mode] and [windowSeconds]
+ * describe what the platform keystore actually enforces (read back from the key itself), which
+ * on Android 9 and 10 is a short hardware window rather than per-use.
+ */
+class StepUpKeyMetadata {
+    constructor(value) {
+        this.publicKey = value.publicKey;
+        this.factor = value.factor;
+        this.mode = value.mode;
+        this.windowSeconds = value.windowSeconds;
+        this.securityLevel = value.securityLevel;
+        this.hardwareBacked = value.hardwareBacked;
+        this.created = value.created;
+    }
+    get authJson() {
+        return { factor: this.factor, mode: this.mode, window_seconds: this.windowSeconds };
+    }
+    get description() {
+        return this.mode === 'per_use'
+            ? `${this.factor}, per-use`
+            : `${this.factor}, ${this.windowSeconds}s hardware window`;
+    }
+    /** RFC 7638 thumbprint, the same form the server derives from the JWK. */
+    get thumbprint() {
+        return (0, installationKey_1.jwkThumbprint)(this.publicKey);
+    }
+    static fromPlatform(value) {
+        const rawPublicKey = value['public_key'];
+        const rawAuth = value['auth'];
+        if (!(0, native_1.isObject)(rawPublicKey) || !(0, native_1.isObject)(rawAuth)) {
+            throw new TypeError('The native step-up key provider returned no public key or auth.');
+        }
+        const publicKey = (0, installationKey_1.orderedJwk)(rawPublicKey);
+        if (publicKey['kty'] !== 'EC' ||
+            publicKey['crv'] !== 'P-256' ||
+            publicKey['alg'] !== 'ES256' ||
+            typeof publicKey['x'] !== 'string' ||
+            typeof publicKey['y'] !== 'string') {
+            throw new TypeError('The native step-up key provider did not return an EC P-256 public JWK.');
+        }
+        const factor = rawAuth['factor'];
+        const mode = rawAuth['mode'];
+        const window = rawAuth['window_seconds'];
+        if (typeof factor !== 'string' || typeof mode !== 'string' || typeof window !== 'number' || !Number.isInteger(window)) {
+            throw new TypeError('The native step-up key provider returned an invalid auth description.');
+        }
+        const securityLevel = value['security_level'];
+        return new StepUpKeyMetadata({
+            publicKey,
+            factor,
+            mode,
+            windowSeconds: window,
+            securityLevel: typeof securityLevel === 'string' ? securityLevel : 'unknown',
+            hardwareBacked: value['hardware_backed'] === true,
+            created: value['created'] === true,
+        });
+    }
+}
+exports.StepUpKeyMetadata = StepUpKeyMetadata;
+/** Where a backend takes a re-enrolled step-up key by default (the public guide, section 4). */
+exports.stepUpReenrolPath = '/v1/installations/stepup-key';
+/**
+ * How the app wants its step-up key made (the public guide, section 3): [factor] `passcode` or
+ * `biometric`; [mode] `per_use`, or `windowed` with [windowSeconds] from 1. Android 9 and 10 cannot
+ * make a per-use passcode key and make a windowed one; iOS makes per-use keys only. [reenrolPath]
+ * is where the backend takes a new key (DeviceTrust.reenrolStepUp).
+ */
+class StepUpOptions {
+    constructor(options = {}) {
+        this.factor = options.factor ?? 'passcode';
+        this.mode = options.mode ?? 'per_use';
+        this.windowSeconds = options.windowSeconds ?? 0;
+        this.reenrolPath = options.reenrolPath ?? exports.stepUpReenrolPath;
+    }
+    /**
+     * A key made with other values, or already made: whether it satisfies these options -- the same
+     * factor (a backend refuses any other), and a per-use key or a window no longer than this one. A
+     * per-use key satisfies windowed options.
+     */
+    accepts(key) {
+        return (key.factor === this.factor &&
+            (key.mode === 'per_use' || (this.mode === 'windowed' && key.windowSeconds <= this.windowSeconds)));
+    }
+    get description() {
+        return `${this.factor}, ${this.mode === 'per_use' ? 'per-use' : `${this.windowSeconds}s window`}`;
+    }
+}
+exports.StepUpOptions = StepUpOptions;
+/**
+ * The proof a new step-up key signs at re-enrolment: the base64url of its JSON, the members in this
+ * order. [nonce] is the request proof's nonce of the re-enrolment request.
+ */
+function stepUpReenrolProof(args) {
+    return (0, bytes_1.base64UrlNoPadding)((0, bytes_1.utf8Encode)(JSON.stringify({
+        version: 1,
+        purpose: 'stepup_reenrol',
+        installation_id: args.installationId,
+        stepup_key_thumbprint: args.stepUpKeyThumbprint,
+        nonce: args.nonce,
+        timestamp: args.timestamp,
+    })));
+}
+/**
+ * Whether a step-up key [options] do not accept is replaced before the next registration: only
+ * where the new key can then be bound -- by a re-enrolment ([replaceMismatched]), which binds it
+ * with the person's re-authentication, or by this installation's first registration, which binds
+ * the key it is offered. A known installation's registration never binds an offered key; it only
+ * says whether it matches, so replacing the key there orphans the one the server holds: on a phone
+ * that cannot make the key the options ask for (Android 9 makes no per-use passcode key), the
+ * registration that follows every re-enrolment would replace the key the server had just bound,
+ * and step-up would stay unavailable.
+ */
+function replacesStepUpKey(key, options, flags) {
+    return !key.created && !options.accepts(key) && (flags.replaceMismatched || !flags.knownInstallation);
+}
+const STEPUP_MODULE_MISSING = () => new errors_1.NativeKeyException('NATIVE_STEPUP_PLUGIN_MISSING', "The SDK's step-up key module is not linked into this app: rebuild the app.");
+class NativeStepUpKey {
+    constructor(options = {}) {
+        this.configuredMode = options.configuredMode ?? 'per_use';
+    }
+    /**
+     * Returns the existing key as the keystore enforces it, or creates one with these values: an
+     * existing key is never changed, so a caller that needs other values deletes it first.
+     */
+    async getOrCreateKey(args) {
+        const native = (0, native_1.stepUpKeyModule)();
+        if (native === null) {
+            throw STEPUP_MODULE_MISSING();
+        }
+        let value;
+        try {
+            value = await native.getOrCreateKey(args.factor, args.mode, args.windowSeconds);
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The native step-up key provider failed.');
+        }
+        if (!(0, native_1.isObject)(value)) {
+            throw new errors_1.NativeKeyException('EMPTY_NATIVE_RESPONSE', 'The native step-up key provider returned no key metadata.');
+        }
+        return StepUpKeyMetadata.fromPlatform(value);
+    }
+    /** Shows the system passcode (or biometric) prompt and completes when the person answers it. A cancelled prompt is STEPUP_CANCELLED. */
+    async sign(payloadBase64Url, options) {
+        const native = (0, native_1.stepUpKeyModule)();
+        if (native === null) {
+            throw STEPUP_MODULE_MISSING();
+        }
+        let signature;
+        try {
+            signature = await native.sign(payloadBase64Url, options.reason, this.configuredMode);
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The step-up key could not sign.');
+        }
+        if (typeof signature !== 'string' || signature.length === 0) {
+            throw new errors_1.NativeKeyException('EMPTY_NATIVE_SIGNATURE', 'The step-up key returned no signature.');
+        }
+        return signature;
+    }
+    async deleteKey() {
+        const native = (0, native_1.stepUpKeyModule)();
+        if (native === null) {
+            throw STEPUP_MODULE_MISSING();
+        }
+        try {
+            await native.deleteKey();
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The step-up key could not be deleted.');
+        }
+    }
+}
+exports.NativeStepUpKey = NativeStepUpKey;

package/lib/transport.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How the SDK's messages reach your backend: by default over HTTPS, under the base URL your app
+ * sets (the public guide, section 4).
+ */
+export type JsonObject = Record<string, unknown>;
+export interface SendOptions {
+    /** Sent exactly as given: it is what a request proof hashes. A GET sends no body. */
+    encodedBody?: string | null;
+    bearerToken?: string | null;
+    headers?: Record<string, string>;
+}
+/**
+ * Sends one request to your backend and answers its JSON object. A refusal is thrown as an
+ * [ApiException] with the backend's `code`, `message` and `details` (the public guide, section 4,
+ * Errors).
+ */
+export interface DeviceTrustTransport {
+    send(method: string, path: string, options?: SendOptions): Promise<JsonObject>;
+    close(): void;
+}
+/**
+ * JSON over HTTPS under [baseUrl]. A release build refuses any other scheme, so a mistyped
+ * endpoint fails loudly instead of sending tokens in the clear.
+ */
+export declare class HttpTransport implements DeviceTrustTransport {
+    readonly baseUrl: string;
+    /** How long one call may take, in milliseconds. */
+    readonly timeoutMs: number;
+    private readonly fetchImpl;
+    private readonly running;
+    private closed;
+    constructor(baseUrl: string, options?: {
+        timeoutMs?: number;
+        fetch?: typeof fetch;
+    });
+    private get base();
+    send(method: string, path: string, options?: SendOptions): Promise<JsonObject>;
+    close(): void;
+}