@parlor/auth 0.0.0-stage → 0.1.0

package/dist/devices.d.ts

@@ -0,0 +1,157 @@
+import { type DataProvider, type DeviceId, type UserId } from "@parlor/core";
+import { type ActionsOf } from "@parlor/core/registry";
+import type { DeviceKeys, Migration, PluginHost, PresenceKey } from "@parlor/server";
+import { z } from "zod";
+export type { PresenceKey } from "@parlor/server";
+export interface RegisteredDevice extends DeviceKeys {
+    readonly userId: UserId;
+    readonly createdAt: number;
+    readonly revokedAt?: number | undefined;
+}
+export interface DeviceRegistry {
+    /** A revoked device reads as undefined, so no host accepts its signatures again. */
+    get(userId: UserId, deviceId: DeviceId): Promise<RegisteredDevice | undefined>;
+}
+export declare function createDeviceRegistry(database: DataProvider): DeviceRegistry;
+export declare const DEVICES_TAG = "parlor_auth_devices";
+export declare const DEVICES_MIGRATION: Migration;
+export declare const DEVICE_LINKING_MIGRATION: Migration;
+export interface ConnectedDevice {
+    readonly id: DeviceId;
+    readonly name: string;
+    readonly platform: string;
+    readonly current: boolean;
+    readonly createdAt: string;
+    /** A linked device vouched for it; the computer pins it on its first prompt. */
+    readonly vouched: boolean;
+    /** It is showing a link code now. */
+    readonly linking: boolean;
+    /** The device whose vouch linked it last. */
+    readonly linkedBy?: string | undefined;
+}
+/** A device waiting to be linked, as the one linking it checks it against the code. */
+export interface PendingDevice {
+    readonly id: DeviceId;
+    readonly name: string;
+    readonly platform: string;
+    readonly signingKey: JsonWebKey;
+    readonly presenceKey?: PresenceKey | undefined;
+}
+export interface DeviceActionDeps {
+    readonly host: PluginHost;
+    readonly registry: DeviceRegistry;
+}
+/**
+ * A device showing a link code, found by the code (normalized) or, from its QR, by its id;
+ * only `userId`'s own device, still within its 15 minutes.
+ */
+export declare function findPendingDevice(database: DataProvider, userId: UserId, by: {
+    readonly code: string;
+} | {
+    readonly device: string;
+}): Promise<PendingDevice | undefined>;
+export declare function deviceAccountActions(deps: DeviceActionDeps): import("@parlor/core/registry").ActionRegistry<{
+    devices: import("@parlor/core").ActionDefinition<z.ZodObject<{}, z.core.$strip>, ConnectedDevice[]>;
+    deviceChallenge: import("@parlor/core").ActionDefinition<z.ZodObject<{}, z.core.$strip>, {
+        readonly challenge: string;
+    }>;
+    enrollDevice: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        name: z.ZodString;
+        platform: z.ZodString;
+        challenge: z.ZodString;
+        signing: z.ZodObject<{
+            keyId: z.ZodString;
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>;
+        presence: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            format: z.ZodLiteral<"webauthn">;
+            credentialId: z.ZodString;
+            rpId: z.ZodString;
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            attestation: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            format: z.ZodLiteral<"es256-raw">;
+            keyId: z.ZodString;
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>], "format">>;
+        proof: z.ZodObject<{
+            keyId: z.ZodString;
+            presence: z.ZodEnum<{
+                none: "none";
+                user: "user";
+            }>;
+            format: z.ZodEnum<{
+                "es256-raw": "es256-raw";
+                webauthn: "webauthn";
+            }>;
+            signature: z.ZodString;
+            authenticatorData: z.ZodOptional<z.ZodString>;
+            clientDataJSON: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, {
+        readonly id: DeviceId;
+    }>;
+    startDeviceLink: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        device: z.ZodString;
+        code: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    }, z.core.$strip>, {
+        readonly expiresAt: string;
+    }>;
+    resolveDeviceLink: import("@parlor/core").ActionDefinition<z.ZodUnion<readonly [z.ZodObject<{
+        code: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    }, z.core.$strip>, z.ZodObject<{
+        device: z.ZodString;
+    }, z.core.$strip>]>, PendingDevice>;
+    vouchDevice: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        device: z.ZodString;
+        voucher: z.ZodString;
+        app: z.ZodString;
+        commitment: z.ZodString;
+        at: z.ZodNumber;
+        signature: z.ZodObject<{
+            keyId: z.ZodString;
+            presence: z.ZodEnum<{
+                none: "none";
+                user: "user";
+            }>;
+            format: z.ZodEnum<{
+                "es256-raw": "es256-raw";
+                webauthn: "webauthn";
+            }>;
+            signature: z.ZodString;
+            authenticatorData: z.ZodOptional<z.ZodString>;
+            clientDataJSON: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, {
+        readonly id: string;
+    }>;
+    removeDevice: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        device: z.ZodString;
+        actor: z.ZodString;
+        app: z.ZodString;
+        at: z.ZodNumber;
+        signature: z.ZodObject<{
+            keyId: z.ZodString;
+            presence: z.ZodEnum<{
+                none: "none";
+                user: "user";
+            }>;
+            format: z.ZodEnum<{
+                "es256-raw": "es256-raw";
+                webauthn: "webauthn";
+            }>;
+            signature: z.ZodString;
+            authenticatorData: z.ZodOptional<z.ZodString>;
+            clientDataJSON: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, {
+        readonly id: string;
+    }>;
+    revokeDevice: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strip>, {
+        readonly id: string;
+    }>;
+}>;
+export type DeviceAccountActions = ActionsOf<ReturnType<typeof deviceAccountActions>>;
+//# sourceMappingURL=devices.d.ts.map

package/dist/devices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.d.ts","sourceRoot":"","sources":["../src/devices.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,YAAY,EAEjB,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EACV,UAAU,EAEV,SAAS,EACT,UAAU,EACV,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;CAChF;AAgBD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,cAAc,CAyB3E;AAED,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,eAAO,MAAM,iBAAiB,EAAE,SAsB/B,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,SAQtC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAChD;AA0CD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAsDD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAqBpC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB;;;4BA+BG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA0Bd,QAAQ;;;;;;4BAkEU,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA8CxB,MAAM;;;;;;;;;;;;;;;;;;;;;;qBAqEN,MAAM;;;;;qBA0CL,MAAM;;GAgB5D;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC"}

package/dist/devices.js

@@ -0,0 +1,398 @@
+import { randomBytes } from "node:crypto";
+import { decodeBase64url, enrollmentBytes } from "@parlor/capabilities/encoding";
+import { ActionError, asId, defineAction, } from "@parlor/core";
+import { createRegistry } from "@parlor/core/registry";
+import { sql } from "drizzle-orm";
+import { z } from "zod";
+import { signedIn } from "./account.js";
+import { jwkOf, rowsOf } from "./database.js";
+import { verifyEs256 } from "./es256.js";
+import { LINK_CODE_LENGTH, normalizeLinkCode, removeStatement, verifyStatement, vouchStatement, } from "./statements.js";
+const parsed = (value) => typeof value === "string" ? JSON.parse(value) : value;
+export function createDeviceRegistry(database) {
+    return {
+        async get(userId, deviceId) {
+            const [row] = rowsOf(await database.read().execute(sql `
+          select id, user_id, name, platform, signing_key, presence_key, vouches,
+            (extract(epoch from created_at) * 1000)::bigint as created_ms
+          from parlor_auth_devices
+          where id = ${deviceId} and user_id = ${userId} and revoked_at is null`));
+            if (!row)
+                return undefined;
+            const presence = parsed(row.presence_key);
+            const vouches = parsed(row.vouches) ?? [];
+            return {
+                id: asId("device", row.id),
+                userId: asId("user", row.user_id),
+                name: row.name,
+                platform: row.platform,
+                signingKey: jwkOf(row.signing_key),
+                presenceKey: presence ?? undefined,
+                ...(vouches.length > 0 ? { vouches } : {}),
+                createdAt: Number(row.created_ms),
+            };
+        },
+    };
+}
+export const DEVICES_TAG = "parlor_auth_devices";
+export const DEVICES_MIGRATION = {
+    id: "auth/0004_devices",
+    sql: `
+    create table parlor_auth_devices (
+      id text primary key,
+      user_id text not null,
+      name text not null,
+      platform text not null,
+      signing_key jsonb not null,
+      presence_key jsonb,
+      created_at timestamptz not null default now(),
+      revoked_at timestamptz
+    );
+    create index parlor_auth_devices_user on parlor_auth_devices (user_id);
+    create unique index parlor_auth_devices_signing_key on parlor_auth_devices
+      (user_id, (signing_key->>'x'), (signing_key->>'y')) where revoked_at is null;
+
+    create table parlor_auth_device_challenges (
+      challenge text primary key,
+      user_id text not null,
+      expires_at timestamptz not null
+    )`,
+};
+export const DEVICE_LINKING_MIGRATION = {
+    id: "auth/0007_device_linking",
+    sql: `
+    alter table parlor_auth_devices add column vouches jsonb not null default '[]'::jsonb;
+    alter table parlor_auth_devices add column link_code text;
+    alter table parlor_auth_devices add column link_expires_at timestamptz;
+    create index parlor_auth_devices_link_code on parlor_auth_devices (user_id, link_code)
+      where link_code is not null`,
+};
+const CHALLENGE_TTL_MS = 5 * 60_000;
+const LINK_TTL_MS = 15 * 60_000;
+const VOUCH_MAX_AGE_MS = 5 * 60_000;
+const linkCodeInput = z
+    .string()
+    .min(LINK_CODE_LENGTH)
+    .max(32)
+    .transform(normalizeLinkCode)
+    .refine((code) => /^[0-9A-HJKMNP-TV-Z]{10}$/.test(code), "Enter the 10-character code.");
+const P256 = { name: "ECDSA", namedCurve: "P-256" };
+const jwk = z.record(z.string(), z.unknown());
+const deviceSignature = z.object({
+    keyId: z.string(),
+    presence: z.enum(["none", "user"]),
+    format: z.enum(["es256-raw", "webauthn"]),
+    signature: z.string(),
+    authenticatorData: z.string().optional(),
+    clientDataJSON: z.string().optional(),
+});
+const presenceInput = z.discriminatedUnion("format", [
+    z.object({
+        format: z.literal("webauthn"),
+        credentialId: z.string().min(1).max(1024),
+        rpId: z.string().min(1).max(255),
+        publicKey: jwk,
+        attestation: z.string().min(1),
+    }),
+    z.object({
+        format: z.literal("es256-raw"),
+        keyId: z.string().min(1),
+        publicKey: jwk,
+    }),
+]);
+function databaseOf(host) {
+    if (!host.database)
+        throw new Error("Devices need a database.");
+    return host.database;
+}
+const invalid = (message) => new ActionError("invalid_input", message);
+async function pointOf(key) {
+    try {
+        const imported = await crypto.subtle.importKey("jwk", key, P256, true, [
+            "verify",
+        ]);
+        const { kty, crv, x, y } = await crypto.subtle.exportKey("jwk", imported);
+        return { kty: kty, crv: crv, x: x, y: y };
+    }
+    catch {
+        throw invalid("A device key must be an ECDSA P-256 public key.");
+    }
+}
+async function presenceOf(input) {
+    if (!input)
+        return undefined;
+    const publicKey = await pointOf(input.publicKey);
+    if (input.format === "webauthn") {
+        const { credentialId, rpId, attestation } = input;
+        return {
+            stored: { format: "webauthn", credentialId, rpId, publicKey },
+            proven: { format: "webauthn", credentialId, publicKey, attestation },
+        };
+    }
+    const key = { format: "es256-raw", keyId: input.keyId, publicKey };
+    return { stored: key, proven: key };
+}
+const isoOf = (value) => new Date(value).toISOString();
+/**
+ * A device showing a link code, found by the code (normalized) or, from its QR, by its id;
+ * only `userId`'s own device, still within its 15 minutes.
+ */
+export async function findPendingDevice(database, userId, by) {
+    const match = "code" in by
+        ? sql `link_code = ${normalizeLinkCode(by.code)}`
+        : sql `id = ${by.device} and link_code is not null`;
+    const [row] = rowsOf(await database.read().execute(sql `
+      select id, user_id, name, platform, signing_key, presence_key, vouches, 0 as created_ms
+      from parlor_auth_devices
+      where user_id = ${userId} and ${match}
+        and link_expires_at > ${new Date().toISOString()} and revoked_at is null`));
+    if (!row)
+        return undefined;
+    const presence = parsed(row.presence_key);
+    return {
+        id: asId("device", row.id),
+        name: row.name,
+        platform: row.platform,
+        signingKey: jwkOf(row.signing_key),
+        ...(presence ? { presenceKey: presence } : {}),
+    };
+}
+export function deviceAccountActions(deps) {
+    return createRegistry({
+        devices: defineAction({
+            description: "List the devices that sign this account's chat messages.",
+            input: z.object({}),
+            reads: [DEVICES_TAG],
+            run: async (_input, ctx) => {
+                const user = signedIn(ctx);
+                const rows = rowsOf(await databaseOf(deps.host).read().execute(sql `
+            select id, name, platform, created_at, jsonb_array_length(vouches) > 0 as vouched,
+              coalesce(link_expires_at > ${new Date().toISOString()}, false) as linking,
+              vouches -> -1 ->> 'voucher' as linked_by
+            from parlor_auth_devices
+            where user_id = ${user.userId} and revoked_at is null order by created_at, id`));
+                return rows.map((row) => ({
+                    id: asId("device", row.id),
+                    name: row.name,
+                    platform: row.platform,
+                    current: row.id === user.deviceId,
+                    createdAt: isoOf(row.created_at),
+                    vouched: row.vouched,
+                    linking: row.linking,
+                    ...(row.linked_by ? { linkedBy: row.linked_by } : {}),
+                }));
+            },
+        }),
+        deviceChallenge: defineAction({
+            description: "A single-use challenge for enrolling this device.",
+            input: z.object({}),
+            run: async (_input, ctx) => {
+                const user = signedIn(ctx);
+                const challenge = randomBytes(32).toString("base64url");
+                await databaseOf(deps.host).transaction(async (handle) => {
+                    const tx = handle;
+                    await tx.execute(sql `delete from parlor_auth_device_challenges where expires_at < ${new Date().toISOString()}`);
+                    await tx.execute(sql `
+            insert into parlor_auth_device_challenges (challenge, user_id, expires_at)
+            values (${challenge}, ${user.userId},
+              ${new Date(Date.now() + CHALLENGE_TTL_MS).toISOString()})`);
+                });
+                return { challenge };
+            },
+        }),
+        enrollDevice: defineAction({
+            description: "Register this device's public keys, proven by signing a challenge.",
+            input: z.object({
+                name: z.string().min(1).max(80),
+                platform: z.string().min(1).max(32),
+                challenge: z.string().min(1).max(256),
+                signing: z.object({ keyId: z.string().min(1), publicKey: jwk }),
+                presence: presenceInput.optional(),
+                proof: deviceSignature,
+            }),
+            run: async (input, ctx) => {
+                const user = signedIn(ctx);
+                const signing = await pointOf(input.signing.publicKey);
+                const presence = await presenceOf(input.presence);
+                const { proof } = input;
+                let proven = false;
+                try {
+                    proven =
+                        proof.format === "es256-raw" &&
+                            proof.presence === "none" &&
+                            (await verifyEs256(signing, decodeBase64url(proof.signature), enrollmentBytes({
+                                challenge: decodeBase64url(input.challenge),
+                                signing,
+                                presence: presence?.proven,
+                            })));
+                }
+                catch {
+                    proven = false;
+                }
+                if (!proven)
+                    throw invalid("The device could not prove it holds its keys.");
+                const enrolled = await databaseOf(deps.host).transaction(async (handle) => {
+                    const tx = handle;
+                    const consumed = rowsOf(await tx.execute(sql `
+              delete from parlor_auth_device_challenges
+              where challenge = ${input.challenge} and user_id = ${user.userId}
+                and expires_at >= ${new Date().toISOString()}
+              returning challenge`));
+                    if (consumed.length === 0)
+                        throw invalid("This challenge is unknown or expired.");
+                    const id = asId("device", randomBytes(16).toString("base64url"));
+                    const [inserted] = rowsOf(await tx.execute(sql `
+              insert into parlor_auth_devices (id, user_id, name, platform, signing_key, presence_key)
+              values (${id}, ${user.userId}, ${input.name}, ${input.platform},
+                ${JSON.stringify(signing)}::jsonb,
+                ${presence ? JSON.stringify(presence.stored) : null}::jsonb)
+              on conflict (user_id, (signing_key->>'x'), (signing_key->>'y'))
+                where revoked_at is null do nothing
+              returning id`));
+                    if (!inserted) {
+                        const [existing] = rowsOf(await tx.execute(sql `
+                select id from parlor_auth_devices
+                where user_id = ${user.userId} and revoked_at is null
+                  and signing_key->>'x' = ${signing.x} and signing_key->>'y' = ${signing.y}`));
+                        return { id: asId("device", existing.id), added: false };
+                    }
+                    return { id, added: true };
+                });
+                if (enrolled.added) {
+                    await deps.host.announce(ctx.scope, [[DEVICES_TAG, enrolled.id]]);
+                }
+                return { id: enrolled.id };
+            },
+        }),
+        startDeviceLink: defineAction({
+            description: "Show this device's link code for 15 minutes, so a linked device can find it.",
+            input: z.object({ device: z.string().min(1), code: linkCodeInput }),
+            run: async ({ device, code }, ctx) => {
+                const user = signedIn(ctx);
+                const expiresAt = new Date(Date.now() + LINK_TTL_MS).toISOString();
+                const started = rowsOf(await databaseOf(deps.host).transaction((handle) => handle.execute(sql `
+              update parlor_auth_devices set link_code = ${code}, link_expires_at = ${expiresAt}
+              where id = ${device} and user_id = ${user.userId} and revoked_at is null
+              returning id`)));
+                if (started.length === 0)
+                    throw new ActionError("not_found", `No device ${device}`);
+                return { expiresAt };
+            },
+        }),
+        resolveDeviceLink: defineAction({
+            description: "Find this account's device showing a link code, to check it and vouch for it.",
+            input: z.union([
+                z.object({ code: linkCodeInput }),
+                z.object({ device: z.string().min(1).max(64) }),
+            ]),
+            run: async (input, ctx) => {
+                const user = signedIn(ctx);
+                const found = await findPendingDevice(databaseOf(deps.host), user.userId, input);
+                if (!found) {
+                    throw new ActionError("not_found", "No device of yours shows this code. Check it, or show a new code on the device.");
+                }
+                return found;
+            },
+        }),
+        vouchDevice: defineAction({
+            description: "Vouch, with this device's presence key, that a device showing a link code is the user's.",
+            input: z.object({
+                device: z.string().min(1),
+                voucher: z.string().min(1),
+                app: z.string().url(),
+                commitment: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+                at: z.number(),
+                signature: deviceSignature,
+            }),
+            run: async (input, ctx) => {
+                const user = signedIn(ctx);
+                const voucher = await deps.registry.get(user.userId, asId("device", input.voucher));
+                if (!voucher?.presenceKey) {
+                    throw new ActionError("forbidden", "Only a linked device that can confirm it is you can link another device.");
+                }
+                const outcome = await verifyStatement({
+                    statement: vouchStatement(input.app, input.voucher, input.device, input.commitment, input.at),
+                    deviceId: voucher.id,
+                    signature: input.signature,
+                }, {
+                    deviceId: voucher.id,
+                    signingKey: voucher.signingKey,
+                    presenceKey: voucher.presenceKey,
+                }, { requirePresence: true, now: Date.now(), maxAgeMs: VOUCH_MAX_AGE_MS });
+                if (outcome !== "valid")
+                    throw invalid("This confirmation did not check out.");
+                const vouch = {
+                    voucher: voucher.id,
+                    commitment: input.commitment,
+                    at: input.at,
+                    signature: input.signature,
+                };
+                const vouched = rowsOf(await databaseOf(deps.host).transaction((handle) => handle.execute(sql `
+              update parlor_auth_devices
+              set vouches = vouches || ${JSON.stringify([vouch])}::jsonb,
+                link_code = null, link_expires_at = null
+              where id = ${input.device} and user_id = ${user.userId} and revoked_at is null
+                and link_code is not null and link_expires_at > ${new Date().toISOString()}
+              returning id`)));
+                if (vouched.length === 0) {
+                    throw new ActionError("not_found", "That device's code expired. Show a new code on it and try again.");
+                }
+                await deps.host.announce(ctx.scope, [[DEVICES_TAG, input.device]]);
+                return { id: input.device };
+            },
+        }),
+        removeDevice: defineAction({
+            description: "Remove a device, confirmed with this device's presence key; no computer accepts its signatures afterwards.",
+            input: z.object({
+                device: z.string().min(1),
+                actor: z.string().min(1),
+                app: z.string().url(),
+                at: z.number(),
+                signature: deviceSignature,
+            }),
+            run: async (input, ctx) => {
+                const user = signedIn(ctx);
+                const actor = await deps.registry.get(user.userId, asId("device", input.actor));
+                if (!actor?.presenceKey) {
+                    throw new ActionError("forbidden", "Only a linked device that can confirm it is you can remove a device.");
+                }
+                const outcome = await verifyStatement({
+                    statement: removeStatement(input.app, input.actor, input.device, input.at),
+                    deviceId: actor.id,
+                    signature: input.signature,
+                }, {
+                    deviceId: actor.id,
+                    signingKey: actor.signingKey,
+                    presenceKey: actor.presenceKey,
+                }, { requirePresence: true, now: Date.now(), maxAgeMs: VOUCH_MAX_AGE_MS });
+                if (outcome !== "valid")
+                    throw invalid("This confirmation did not check out.");
+                const removed = rowsOf(await databaseOf(deps.host).transaction((handle) => handle.execute(sql `
+              update parlor_auth_devices set revoked_at = now(), link_code = null
+              where id = ${input.device} and user_id = ${user.userId} and revoked_at is null
+              returning id`)));
+                if (removed.length === 0) {
+                    throw new ActionError("not_found", `No device ${input.device}`);
+                }
+                await deps.host.announce(ctx.scope, [[DEVICES_TAG, input.device]]);
+                return { id: input.device };
+            },
+        }),
+        revokeDevice: defineAction({
+            description: "Deprecated: use removeDevice, which a linked device confirms. Remove a device; no computer accepts its signatures afterwards.",
+            input: z.object({ id: z.string().min(1) }),
+            run: async ({ id }, ctx) => {
+                const user = signedIn(ctx);
+                const revoked = rowsOf(await databaseOf(deps.host).transaction((handle) => handle.execute(sql `
+              update parlor_auth_devices set revoked_at = now()
+              where id = ${id} and user_id = ${user.userId} and revoked_at is null
+              returning id`)));
+                if (revoked.length === 0)
+                    throw new ActionError("not_found", `No device ${id}`);
+                await deps.host.announce(ctx.scope, [[DEVICES_TAG, id]]);
+                return { id };
+            },
+        }),
+    });
+}
+//# sourceMappingURL=devices.js.map

package/dist/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../src/devices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,WAAW,EACX,IAAI,EAEJ,YAAY,GAGb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAiB,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,iBAAiB,CAAC;AA0BzB,MAAM,MAAM,GAAG,CAAI,KAAwB,EAAY,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAClB,MAAO,QAAQ,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;;;uBAIhC,QAAQ,kBAAkB,MAAM,yBAAyB,CAAC,CAC1E,CAAC;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;gBAClC,WAAW,EAAE,QAAQ,IAAI,SAAS;gBAClC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAClC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;MAmBD;CACL,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,EAAE,EAAE,0BAA0B;IAC9B,GAAG,EAAE;;;;;kCAK2B;CACjC,CAAC;AAyBF,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,CAAC,gBAAgB,CAAC;KACrB,GAAG,CAAC,EAAE,CAAC;KACP,SAAS,CAAC,iBAAiB,CAAC;KAC5B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC/C,8BAA8B,CAC/B,CAAC;AACJ,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAE7D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE9C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACnD,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,GAAG;KACf,CAAC;CACH,CAAC,CAAC;AAiBH,SAAS,UAAU,CAAC,IAAgB;IAClC,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAE/E,KAAK,UAAU,OAAO,CAAC,GAA4B;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;YACnF,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,EAAE,GAAI,EAAE,GAAG,EAAE,GAAI,EAAE,CAAC,EAAE,CAAE,EAAE,CAAC,EAAE,CAAE,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,UAAU,CACvB,KAAiD;IAEjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7D,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE;SACrE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAoB,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAsB,EACtB,MAAc,EACd,EAA2D;IAE3D,MAAM,KAAK,GACT,MAAM,IAAI,EAAE;QACV,CAAC,CAAC,GAAG,CAAA,eAAe,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAChD,CAAC,CAAC,GAAG,CAAA,QAAQ,EAAE,CAAC,MAAM,4BAA4B,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAClB,MAAO,QAAQ,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;;wBAG3B,MAAM,QAAQ,KAAK;gCACX,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,OAAO,cAAc,CAAC;QACpB,OAAO,EAAE,YAAY,CAAC;YACpB,WAAW,EAAE,0DAA0D;YACvE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,WAAW,CAAC;YACpB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAE;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,CACjB,MAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;2CAE3B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;8BAGrC,IAAI,CAAC,MAAM,iDAAiD,CAAC,CAClF,CAAC;gBACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxB,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ;oBACjC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;oBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC,CAAC;YACN,CAAC;SACF,CAAC;QACF,eAAe,EAAE,YAAY,CAAC;YAC5B,WAAW,EAAE,mDAAmD;YAChE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2C,EAAE;gBAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACxD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvD,MAAM,EAAE,GAAG,MAAkB,CAAC;oBAC9B,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,gEAAgE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAC9F,CAAC;oBACF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;sBAER,SAAS,KAAK,IAAI,CAAC,MAAM;gBAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;gBACH,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;QACF,YAAY,EAAE,YAAY,CAAC;YACzB,WAAW,EAAE,oEAAoE;YACjF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAC/D,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;gBAClC,KAAK,EAAE,eAAe;aACvB,CAAC;YACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAsC,EAAE;gBAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;gBACxB,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM;wBACJ,KAAK,CAAC,MAAM,KAAK,WAAW;4BAC5B,KAAK,CAAC,QAAQ,KAAK,MAAM;4BACzB,CAAC,MAAM,WAAW,CAChB,OAAO,EACP,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,EAChC,eAAe,CAAC;gCACd,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;gCAC3C,OAAO;gCACP,QAAQ,EAAE,QAAQ,EAAE,MAAM;6BAC3B,CAAC,CACH,CAAC,CAAC;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,KAAK,CAAC;gBACjB,CAAC;gBACD,IAAI,CAAC,MAAM;oBAAE,MAAM,OAAO,CAAC,+CAA+C,CAAC,CAAC;gBAC5E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;oBACxE,MAAM,EAAE,GAAG,MAAkB,CAAC;oBAC9B,MAAM,QAAQ,GAAG,MAAM,CACrB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;kCAEE,KAAK,CAAC,SAAS,kBAAkB,IAAI,CAAC,MAAM;oCAC1C,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;kCAC1B,CAAC,CACxB,CAAC;oBACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;wBACvB,MAAM,OAAO,CAAC,uCAAuC,CAAC,CAAC;oBACzD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;oBACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CACvB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;wBAER,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ;kBAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;kBACvB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;;;2BAGxC,CAAC,CACjB,CAAC;oBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CACvB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;kCAEA,IAAI,CAAC,MAAM;4CACD,OAAO,CAAC,CAAE,4BAA4B,OAAO,CAAC,CAAE,EAAE,CAAC,CAClF,CAAC;wBACF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;oBAC5D,CAAC;oBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC7B,CAAC;SACF,CAAC;QACF,eAAe,EAAE,YAAY,CAAC;YAC5B,WAAW,EACT,8EAA8E;YAChF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YACnE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAA2C,EAAE;gBAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAmB,CAAC,OAAO,CAAC,GAAG,CAAA;2DACe,IAAI,uBAAuB,SAAS;2BACpE,MAAM,kBAAkB,IAAI,CAAC,MAAM;2BACnC,CAAC,CACjB,CACF,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBACtB,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,aAAa,MAAM,EAAE,CAAC,CAAC;gBAC5D,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;QACF,iBAAiB,EAAE,YAAY,CAAC;YAC9B,WAAW,EACT,+EAA+E;YACjF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;gBACb,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;aAChD,CAAC;YACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;gBAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACjF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,iFAAiF,CAClF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,WAAW,EACT,0FAA0F;YAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;gBACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;gBACd,SAAS,EAAE,eAAe;aAC3B,CAAC;YACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAoC,EAAE;gBAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CACrC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAC9B,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;oBAC1B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,0EAA0E,CAC3E,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC;oBACE,SAAS,EAAE,cAAc,CACvB,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,EAAE,CACT;oBACD,QAAQ,EAAE,OAAO,CAAC,EAAE;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAkB;iBACpC,EACD;oBACE,QAAQ,EAAE,OAAO,CAAC,EAAE;oBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,EACD,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CACvE,CAAC;gBACF,IAAI,OAAO,KAAK,OAAO;oBAAE,MAAM,OAAO,CAAC,sCAAsC,CAAC,CAAC;gBAC/E,MAAM,KAAK,GAAgB;oBACzB,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAmB,CAAC,OAAO,CAAC,GAAG,CAAA;;yCAEH,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;;2BAErC,KAAK,CAAC,MAAM,kBAAkB,IAAI,CAAC,MAAM;kEACF,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;2BAC/D,CAAC,CACjB,CACF,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,kEAAkE,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9B,CAAC;SACF,CAAC;QACF,YAAY,EAAE,YAAY,CAAC;YACzB,WAAW,EACT,4GAA4G;YAC9G,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;gBACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;gBACd,SAAS,EAAE,eAAe;aAC3B,CAAC;YACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAoC,EAAE;gBAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;oBACxB,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,sEAAsE,CACvE,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC;oBACE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAkB;iBACpC,EACD;oBACE,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,EACD,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CACvE,CAAC;gBACF,IAAI,OAAO,KAAK,OAAO;oBAAE,MAAM,OAAO,CAAC,sCAAsC,CAAC,CAAC;gBAC/E,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAmB,CAAC,OAAO,CAAC,GAAG,CAAA;;2BAEjB,KAAK,CAAC,MAAM,kBAAkB,IAAI,CAAC,MAAM;2BACzC,CAAC,CACjB,CACF,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9B,CAAC;SACF,CAAC;QACF,YAAY,EAAE,YAAY,CAAC;YACzB,WAAW,EACT,+HAA+H;YACjI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAoC,EAAE;gBAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAmB,CAAC,OAAO,CAAC,GAAG,CAAA;;2BAEjB,EAAE,kBAAkB,IAAI,CAAC,MAAM;2BAC/B,CAAC,CACjB,CACF,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;gBAChF,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/es256.d.ts

@@ -0,0 +1,4 @@
+/** WebAuthn signs in ASN.1 DER; WebCrypto verifies the raw `r || s`. */
+export declare function derToRaw(der: Uint8Array): Uint8Array | undefined;
+export declare function verifyEs256(publicKey: JsonWebKey, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
+//# sourceMappingURL=es256.d.ts.map

package/dist/es256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256.d.ts","sourceRoot":"","sources":["../src/es256.ts"],"names":[],"mappings":"AAIA,wEAAwE;AACxE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CA2BhE;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/es256.js

@@ -0,0 +1,44 @@
+const P256 = { name: "ECDSA", namedCurve: "P-256" };
+const ES256 = { name: "ECDSA", hash: "SHA-256" };
+const P256_SCALAR_BYTES = 32;
+/** WebAuthn signs in ASN.1 DER; WebCrypto verifies the raw `r || s`. */
+export function derToRaw(der) {
+    let at = 0;
+    const expect = (tag) => der[at++] === tag;
+    const length = () => {
+        const first = der[at++];
+        if (first === undefined || first < 0x80)
+            return first;
+        if (first !== 0x81)
+            return undefined;
+        return der[at++];
+    };
+    const integer = () => {
+        if (!expect(0x02))
+            return undefined;
+        const size = length();
+        if (size === undefined)
+            return undefined;
+        const bytes = der.slice(at, at + size);
+        at += size;
+        const trimmed = bytes.slice(bytes.findIndex((byte) => byte !== 0));
+        if (bytes.length !== size || trimmed.length > P256_SCALAR_BYTES)
+            return undefined;
+        return trimmed;
+    };
+    if (!expect(0x30) || length() !== der.length - at)
+        return undefined;
+    const r = integer();
+    const s = integer();
+    if (!r || !s || at !== der.length)
+        return undefined;
+    const raw = new Uint8Array(2 * P256_SCALAR_BYTES);
+    raw.set(r, P256_SCALAR_BYTES - r.length);
+    raw.set(s, 2 * P256_SCALAR_BYTES - s.length);
+    return raw;
+}
+export async function verifyEs256(publicKey, signature, data) {
+    const key = await crypto.subtle.importKey("jwk", publicKey, P256, false, ["verify"]);
+    return crypto.subtle.verify(ES256, key, new Uint8Array(signature), new Uint8Array(data));
+}
+//# sourceMappingURL=es256.js.map

package/dist/es256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256.js","sourceRoot":"","sources":["../src/es256.ts"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAC7D,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC1D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CAAC,GAAe;IACtC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACvC,EAAE,IAAI,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAClF,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAqB,EACrB,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,KAAK,EACL,GAAG,EACH,IAAI,UAAU,CAAC,SAAS,CAAC,EACzB,IAAI,UAAU,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC"}

package/dist/grants.d.ts

@@ -0,0 +1,4 @@
+import { type GrantId } from "@parlor/core";
+/** One grant per user and OAuth client; re-authorizing after a revocation mints newer tokens. */
+export declare function grantIdOf(userId: string, clientId: string): GrantId;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,iGAAiG;AACjG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnE"}