@qlever-llc/trellis 0.10.3-rc.2 → 0.10.3

package/esm/npm/src/auth/device_activation.js

@@ -1,369 +0,0 @@
-import { Type } from "typebox";
-import { Value } from "typebox/value";
-import { importEd25519PrivateKeyFromSeedBase64url, importEd25519PublicKeyFromBase64url, publicKeyBase64urlFromPrivateKey, } from "./keys.js";
-import { AuthDevicesConnectInfoGetResponseSchema, WaitForDeviceActivationRequestSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
-import { buildNatsConnectSignaturePayload } from "./session_auth.js";
-const DEVICE_IDENTITY_HKDF_INFO = "trellis/device-identity/v1";
-const DEVICE_ACTIVATION_HKDF_INFO = "trellis/device-activate/v1";
-const DEVICE_QR_MAC_DOMAIN = "trellis-device-qr/v1";
-const DEVICE_CONFIRMATION_DOMAIN = "trellis-device-confirm/v1";
-const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-const DEFAULT_WAIT_POLL_INTERVAL_MS = 3_000;
-export const DeviceActivationPayloadSchema = Type.Object({
-    v: Type.Literal(1),
-    publicIdentityKey: Type.String({ minLength: 1 }),
-    nonce: Type.String({ minLength: 1 }),
-    qrMac: Type.String({ minLength: 1 }),
-});
-export const DeviceActivationWaitRequestSchema = WaitForDeviceActivationRequestSchema;
-function concatBytes(parts) {
-    const size = parts.reduce((total, part) => total + part.length, 0);
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const part of parts) {
-        bytes.set(part, offset);
-        offset += part.length;
-    }
-    return bytes;
-}
-function normalizeSecretBytes(value, name) {
-    if (typeof value === "string") {
-        const decoded = base64urlDecode(value);
-        if (decoded.length === 0)
-            throw new Error(`${name} must not be empty`);
-        return decoded;
-    }
-    if (value.length === 0)
-        throw new Error(`${name} must not be empty`);
-    return value;
-}
-async function hkdfSha256(inputKeyingMaterial, info, length) {
-    const key = await crypto.subtle.importKey("raw", toArrayBuffer(inputKeyingMaterial), "HKDF", false, ["deriveBits"]);
-    const derivedBits = await crypto.subtle.deriveBits({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: toArrayBuffer(new Uint8Array(0)),
-        info: toArrayBuffer(utf8(info)),
-    }, key, length * 8);
-    return new Uint8Array(derivedBits);
-}
-async function hmacSha256(keyBytes, data) {
-    const key = await crypto.subtle.importKey("raw", toArrayBuffer(keyBytes), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    return new Uint8Array(await crypto.subtle.sign("HMAC", key, toArrayBuffer(data)));
-}
-function crockfordEncode(bytes) {
-    let value = 0;
-    let bits = 0;
-    let output = "";
-    for (const byte of bytes) {
-        value = (value << 8) | byte;
-        bits += 8;
-        while (bits >= 5) {
-            bits -= 5;
-            output += CROCKFORD_ALPHABET[(value >>> bits) & 31] ?? "0";
-        }
-    }
-    if (bits > 0) {
-        output += CROCKFORD_ALPHABET[(value << (5 - bits)) & 31] ?? "0";
-    }
-    return output;
-}
-function normalizeCrockford(value) {
-    return value.trim().toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
-}
-async function sleep(ms, signal) {
-    if (signal?.aborted) {
-        throw signal.reason ?? new DOMException("Aborted", "AbortError");
-    }
-    await new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        function onAbort() {
-            clearTimeout(timer);
-            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
-        }
-        signal?.addEventListener("abort", onAbort, { once: true });
-    });
-}
-function retryAfterDelayMs(response) {
-    const value = response.headers.get("Retry-After");
-    if (!value)
-        return null;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0)
-        return seconds * 1_000;
-    const dateMs = Date.parse(value);
-    if (!Number.isFinite(dateMs))
-        return null;
-    return Math.max(0, dateMs - Date.now());
-}
-async function responseErrorDetail(response) {
-    const text = await response.text();
-    if (!text)
-        return null;
-    try {
-        const parsed = JSON.parse(text);
-        if (typeof parsed.reason === "string" && parsed.reason.length > 0) {
-            return parsed.reason;
-        }
-        if (typeof parsed.message === "string" && parsed.message.length > 0) {
-            return parsed.message;
-        }
-    }
-    catch {
-        // Fall through to raw text below.
-    }
-    return text;
-}
-export async function deriveDeviceIdentity(deviceRootSecret) {
-    if (deviceRootSecret.length !== 32) {
-        throw new Error(`Invalid device root secret length: ${deviceRootSecret.length} (expected 32)`);
-    }
-    const identitySeed = await hkdfSha256(deviceRootSecret, DEVICE_IDENTITY_HKDF_INFO, 32);
-    const activationKey = await hkdfSha256(deviceRootSecret, DEVICE_ACTIVATION_HKDF_INFO, 32);
-    const identitySeedBase64url = base64urlEncode(identitySeed);
-    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(identitySeedBase64url);
-    const publicIdentityKey = await publicKeyBase64urlFromPrivateKey(identityPrivateKey);
-    return {
-        identitySeed,
-        identitySeedBase64url,
-        publicIdentityKey,
-        activationKey,
-        activationKeyBase64url: base64urlEncode(activationKey),
-    };
-}
-export async function deriveDeviceQrMac(input) {
-    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
-    const mac = await hmacSha256(activationKey, concatBytes([
-        utf8(DEVICE_QR_MAC_DOMAIN),
-        utf8(input.publicIdentityKey),
-        utf8(input.nonce),
-    ]));
-    return base64urlEncode(mac.slice(0, 8));
-}
-export async function buildDeviceActivationPayload(input) {
-    const qrMac = await deriveDeviceQrMac(input);
-    return {
-        v: 1,
-        publicIdentityKey: input.publicIdentityKey,
-        nonce: input.nonce,
-        qrMac,
-    };
-}
-export function encodeDeviceActivationPayload(payload) {
-    return base64urlEncode(utf8(JSON.stringify(payload)));
-}
-export function parseDeviceActivationPayload(value) {
-    const decoded = new TextDecoder().decode(base64urlDecode(value));
-    const parsed = JSON.parse(decoded);
-    if (!Value.Check(DeviceActivationPayloadSchema, parsed)) {
-        throw new Error("Invalid device activation payload");
-    }
-    return parsed;
-}
-export async function startDeviceActivationRequest(args) {
-    const response = await fetch(new URL("/auth/devices/activate/requests", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ payload: args.payload }),
-    });
-    if (!response.ok) {
-        const detail = await responseErrorDetail(response);
-        throw new Error(`Device activation request failed: ${response.status}${detail ? ` ${detail}` : ""}`);
-    }
-    const parsed = await response.json();
-    if (typeof parsed.flowId !== "string" ||
-        typeof parsed.instanceId !== "string" ||
-        typeof parsed.deploymentId !== "string" ||
-        typeof parsed.activationUrl !== "string") {
-        throw new Error("Device activation request returned an invalid response");
-    }
-    return {
-        flowId: parsed.flowId,
-        instanceId: parsed.instanceId,
-        deploymentId: parsed.deploymentId,
-        activationUrl: parsed.activationUrl,
-    };
-}
-export async function deriveDeviceConfirmationCode(input) {
-    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
-    const mac = await hmacSha256(activationKey, concatBytes([
-        utf8(DEVICE_CONFIRMATION_DOMAIN),
-        utf8(input.publicIdentityKey),
-        utf8(input.nonce),
-    ]));
-    return crockfordEncode(mac.slice(0, 5)).slice(0, 8);
-}
-export async function verifyDeviceConfirmationCode(input) {
-    const expected = await deriveDeviceConfirmationCode(input);
-    return normalizeCrockford(expected) ===
-        normalizeCrockford(input.confirmationCode);
-}
-export function buildDeviceWaitProofInput(flowId, publicIdentityKey, nonce, iat, contractDigest) {
-    const enc = new TextEncoder();
-    const flowIdBytes = enc.encode(flowId);
-    const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
-    const nonceBytes = enc.encode(nonce);
-    const iatBytes = enc.encode(String(iat));
-    const contractDigestBytes = enc.encode(contractDigest);
-    const buf = new Uint8Array(4 + flowIdBytes.length +
-        4 + publicIdentityKeyBytes.length +
-        4 + nonceBytes.length +
-        4 + iatBytes.length +
-        4 + contractDigestBytes.length);
-    const view = new DataView(buf.buffer);
-    let offset = 0;
-    view.setUint32(offset, flowIdBytes.length);
-    offset += 4;
-    buf.set(flowIdBytes, offset);
-    offset += flowIdBytes.length;
-    view.setUint32(offset, publicIdentityKeyBytes.length);
-    offset += 4;
-    buf.set(publicIdentityKeyBytes, offset);
-    offset += publicIdentityKeyBytes.length;
-    view.setUint32(offset, nonceBytes.length);
-    offset += 4;
-    buf.set(nonceBytes, offset);
-    offset += nonceBytes.length;
-    view.setUint32(offset, iatBytes.length);
-    offset += 4;
-    buf.set(iatBytes, offset);
-    offset += iatBytes.length;
-    view.setUint32(offset, contractDigestBytes.length);
-    offset += 4;
-    buf.set(contractDigestBytes, offset);
-    return buf;
-}
-export async function signDeviceWaitRequest(args) {
-    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
-    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
-    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const proofInput = buildDeviceWaitProofInput(args.flowId, args.publicIdentityKey, args.nonce, iat, args.contractDigest);
-    const proofHash = await sha256(proofInput);
-    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, toArrayBuffer(proofHash)));
-    return {
-        flowId: args.flowId,
-        publicIdentityKey: args.publicIdentityKey,
-        nonce: args.nonce,
-        contractDigest: args.contractDigest,
-        iat,
-        sig: base64urlEncode(signature),
-    };
-}
-export async function createDeviceNatsAuthToken(args) {
-    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
-    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
-    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(utf8(`nats-connect:${buildNatsConnectSignaturePayload(iat, args.contractDigest)}`)));
-    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, digest));
-    return {
-        v: 1,
-        sessionKey: args.publicIdentityKey,
-        iat,
-        sig: base64urlEncode(signature),
-        contractDigest: args.contractDigest,
-    };
-}
-export async function waitForDeviceActivation(args) {
-    const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_WAIT_POLL_INTERVAL_MS;
-    while (true) {
-        const request = await signDeviceWaitRequest(args);
-        let response;
-        try {
-            response = await fetch(new URL("/auth/devices/activate/wait", args.trellisUrl), {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(request),
-                signal: args.signal,
-            });
-        }
-        catch (error) {
-            if (args.signal?.aborted) {
-                throw error;
-            }
-            await sleep(pollIntervalMs, args.signal);
-            continue;
-        }
-        if (!response.ok) {
-            if (response.status === 429) {
-                const retryAfterMs = retryAfterDelayMs(response);
-                await sleep(retryAfterMs === null
-                    ? pollIntervalMs
-                    : Math.max(pollIntervalMs, retryAfterMs), args.signal);
-                continue;
-            }
-            const detail = await responseErrorDetail(response);
-            throw new Error(detail
-                ? `device activation wait failed: ${response.status} ${detail}`
-                : `device activation wait failed: ${response.status}`);
-        }
-        const body = await response.json();
-        if (!Value.Check(WaitForDeviceActivationResponseSchema, body)) {
-            throw new Error("Invalid device activation wait response");
-        }
-        if (body.status === "pending") {
-            await sleep(pollIntervalMs, args.signal);
-            continue;
-        }
-        if (body.status === "rejected") {
-            throw new Error(`device activation rejected: ${body.reason ?? "unknown_reason"}`);
-        }
-        return body;
-    }
-}
-export async function getDeviceConnectInfo(args) {
-    const request = await signDeviceWaitRequest({
-        flowId: "connect-info",
-        publicIdentityKey: args.publicIdentityKey,
-        identitySeed: args.identitySeed,
-        contractDigest: args.contractDigest,
-        nonce: "connect-info",
-        iat: args.iat,
-    });
-    const payload = {
-        publicIdentityKey: request.publicIdentityKey,
-        contractDigest: args.contractDigest,
-        iat: request.iat,
-        sig: request.sig,
-    };
-    const response = await fetch(new URL("/auth/devices/connect-info", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(payload),
-    });
-    if (!response.ok) {
-        throw new Error(`device connect info failed: ${response.status}`);
-    }
-    const body = await response.json();
-    if (!Value.Check(AuthDevicesConnectInfoGetResponseSchema, body)) {
-        throw new Error("Invalid device connect info response");
-    }
-    return body;
-}
-export function createDeviceActivationClient(client) {
-    return {
-        resolveDeviceUserAuthorities(input) {
-            return client.operation.auth.deviceUserAuthoritiesResolve.input(input)
-                .start()
-                .orThrow();
-        },
-        listDeviceActivations(input) {
-            return client.rpc.auth.deviceUserAuthoritiesList(input).orThrow();
-        },
-        revokeDeviceActivation(input) {
-            return client.rpc.auth.deviceUserAuthoritiesRevoke(input)
-                .orThrow();
-        },
-        getDeviceConnectInfo(input) {
-            return client.rpc.auth.devicesConnectInfoGet(input).orThrow();
-        },
-    };
-}
-export async function verifyDeviceWaitSignature(input) {
-    const publicKey = await importEd25519PublicKeyFromBase64url(input.publicIdentityKey);
-    const proofHash = await sha256(buildDeviceWaitProofInput(input.flowId, input.publicIdentityKey, input.nonce, input.iat, input.contractDigest));
-    return await crypto.subtle.verify("Ed25519", publicKey, toArrayBuffer(base64urlDecode(input.sig)), toArrayBuffer(proofHash));
-}

package/esm/npm/src/auth/keys.d.ts

@@ -1,8 +0,0 @@
-export declare function pkcs8FromEd25519Seed(seed32: Uint8Array): Uint8Array;
-export declare function publicKeyBase64urlFromSeed(seed32: Uint8Array): string;
-export declare function signEd25519SeedDetached(seed32: Uint8Array, data: Uint8Array): Uint8Array;
-export declare function signEd25519SeedSha256(seed32: Uint8Array, data: Uint8Array): Uint8Array;
-export declare function importEd25519PrivateKeyFromSeedBase64url(seedBase64url: string): Promise<CryptoKey>;
-export declare function publicKeyBase64urlFromPrivateKey(privateKey: CryptoKey): Promise<string>;
-export declare function importEd25519PublicKeyFromBase64url(publicKeyBase64url: string): Promise<CryptoKey>;
-//# sourceMappingURL=keys.d.ts.map

package/esm/npm/src/auth/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../src/auth/keys.ts"],"names":[],"mappings":"AAwBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAUnE;AAeD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAKZ;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAepB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAcpB"}

package/esm/npm/src/auth/keys.js

@@ -1,70 +0,0 @@
-import { sha256 } from "js-sha256";
-import nacl from "tweetnacl";
-import { base64urlDecode, base64urlEncode, toArrayBuffer } from "./utils.js";
-const ED25519_PKCS8_PREFIX = Uint8Array.from([
-    0x30,
-    0x2e,
-    0x02,
-    0x01,
-    0x00,
-    0x30,
-    0x05,
-    0x06,
-    0x03,
-    0x2b,
-    0x65,
-    0x70,
-    0x04,
-    0x22,
-    0x04,
-    0x20,
-]);
-export function pkcs8FromEd25519Seed(seed32) {
-    if (seed32.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
-    }
-    const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + seed32.length);
-    pkcs8.set(ED25519_PKCS8_PREFIX, 0);
-    pkcs8.set(seed32, ED25519_PKCS8_PREFIX.length);
-    return pkcs8;
-}
-function validateEd25519Seed(seed32) {
-    if (seed32.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
-    }
-    return seed32;
-}
-function ed25519KeyPairFromSeed(seed32) {
-    return nacl.sign.keyPair.fromSeed(validateEd25519Seed(seed32));
-}
-export function publicKeyBase64urlFromSeed(seed32) {
-    return base64urlEncode(ed25519KeyPairFromSeed(seed32).publicKey);
-}
-export function signEd25519SeedDetached(seed32, data) {
-    return nacl.sign.detached(data, ed25519KeyPairFromSeed(seed32).secretKey);
-}
-export function signEd25519SeedSha256(seed32, data) {
-    return signEd25519SeedDetached(seed32, new Uint8Array(sha256.arrayBuffer(data)));
-}
-export async function importEd25519PrivateKeyFromSeedBase64url(seedBase64url) {
-    const seed = base64urlDecode(seedBase64url);
-    if (seed.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed.length} (expected 32)`);
-    }
-    const pkcs8 = pkcs8FromEd25519Seed(seed);
-    return await crypto.subtle.importKey("pkcs8", toArrayBuffer(pkcs8), { name: "Ed25519" }, true, ["sign"]);
-}
-export async function publicKeyBase64urlFromPrivateKey(privateKey) {
-    const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-    if (typeof jwk.x !== "string" || jwk.x.length === 0) {
-        throw new Error("Failed to derive Ed25519 public key (missing JWK.x)");
-    }
-    return jwk.x;
-}
-export async function importEd25519PublicKeyFromBase64url(publicKeyBase64url) {
-    const raw = base64urlDecode(publicKeyBase64url);
-    if (raw.length !== 32) {
-        throw new Error(`Invalid Ed25519 public key length: ${raw.length} (expected 32)`);
-    }
-    return await crypto.subtle.importKey("raw", toArrayBuffer(raw), { name: "Ed25519" }, true, ["verify"]);
-}

package/esm/npm/src/auth/mod.d.ts

@@ -1,19 +0,0 @@
-/**
- * @module
- *
- * Trellis server-side authentication library for session-key based authentication.
- *
- * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
- * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
- * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
- */
-export { type AuthDeviceUserAuthoritiesListInput, type AuthDeviceUserAuthoritiesListOutput, type AuthDeviceUserAuthoritiesRevokeInput, type AuthDeviceUserAuthoritiesRevokeResponse, type AuthResolveDeviceUserAuthoritiesInput, type AuthResolveDeviceUserAuthoritiesOperation, type AuthResolveDeviceUserAuthoritiesOutput, type AuthResolveDeviceUserAuthoritiesProgress, buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, type DeviceActivationPayload, type DeviceActivationTransport, type DeviceActivationWaitRequest, type DeviceIdentity, encodeDeviceActivationPayload, getDeviceConnectInfo, type GetDeviceConnectInfoInput, type GetDeviceConnectInfoOutput, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, type WaitForDeviceActivationResponse, } from "./device_activation.js";
-export { type AuthConfig, bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, type SessionKeyOptions, type SessionKeyPersistenceMode, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
-export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthCapabilitiesListResponseSchema, AuthCapabilitiesListSchema, AuthCapabilityGroupsDeleteResponseSchema, AuthCapabilityGroupsDeleteSchema, AuthCapabilityGroupsGetResponseSchema, AuthCapabilityGroupsGetSchema, AuthCapabilityGroupsListResponseSchema, AuthCapabilityGroupsListSchema, AuthCapabilityGroupsPutResponseSchema, AuthCapabilityGroupsPutSchema, type AuthDeployment, type AuthDeploymentAuthorityAcceptMigrationInput, AuthDeploymentAuthorityAcceptMigrationSchema, type AuthDeploymentAuthorityAcceptResponse, AuthDeploymentAuthorityAcceptResponseSchema, type AuthDeploymentAuthorityAcceptUpdateInput, AuthDeploymentAuthorityAcceptUpdateSchema, type AuthDeploymentAuthorityGetInput, type AuthDeploymentAuthorityGetResponse, AuthDeploymentAuthorityGetResponseSchema, AuthDeploymentAuthorityGetSchema, type AuthDeploymentAuthorityGrantOverridesListInput, type AuthDeploymentAuthorityGrantOverridesListResponse, AuthDeploymentAuthorityGrantOverridesListResponseSchema, AuthDeploymentAuthorityGrantOverridesListSchema, type AuthDeploymentAuthorityGrantOverridesPutInput, AuthDeploymentAuthorityGrantOverridesPutSchema, type AuthDeploymentAuthorityGrantOverridesRemoveInput, AuthDeploymentAuthorityGrantOverridesRemoveSchema, type AuthDeploymentAuthorityGrantOverridesResponse, AuthDeploymentAuthorityGrantOverridesResponseSchema, type AuthDeploymentAuthorityListInput, type AuthDeploymentAuthorityListResponse, AuthDeploymentAuthorityListResponseSchema, AuthDeploymentAuthorityListSchema, type AuthDeploymentAuthorityPlanInput, type AuthDeploymentAuthorityPlanResponse, AuthDeploymentAuthorityPlanResponseSchema, AuthDeploymentAuthorityPlanSchema, type AuthDeploymentAuthorityPlansGetInput, type AuthDeploymentAuthorityPlansGetResponse, AuthDeploymentAuthorityPlansGetResponseSchema, AuthDeploymentAuthorityPlansGetSchema, type AuthDeploymentAuthorityPlansListInput, type AuthDeploymentAuthorityPlansListResponse, AuthDeploymentAuthorityPlansListResponseSchema, AuthDeploymentAuthorityPlansListSchema, type AuthDeploymentAuthorityReconcileInput, type AuthDeploymentAuthorityReconcileResponse, AuthDeploymentAuthorityReconcileResponseSchema, AuthDeploymentAuthorityReconcileSchema, type AuthDeploymentAuthorityRejectInput, type AuthDeploymentAuthorityRejectResponse, AuthDeploymentAuthorityRejectResponseSchema, AuthDeploymentAuthorityRejectSchema, type AuthDeploymentKind, AuthDeploymentKindSchema, AuthDeploymentSchema, AuthDeploymentsCreateResponseSchema, AuthDeploymentsCreateSchema, AuthDeploymentsDisableResponseSchema, AuthDeploymentsDisableSchema, AuthDeploymentsEnableResponseSchema, AuthDeploymentsEnableSchema, AuthDeploymentsListResponseSchema, AuthDeploymentsListSchema, AuthDeploymentsRemoveResponseSchema, AuthDeploymentsRemoveSchema, AuthDevicesConnectInfoGetResponseSchema, AuthDevicesConnectInfoGetSchema, AuthDevicesDisableResponseSchema, AuthDevicesDisableSchema, AuthDevicesEnableResponseSchema, AuthDevicesEnableSchema, AuthDevicesListResponseSchema, AuthDevicesListSchema, AuthDevicesProvisionResponseSchema, AuthDevicesProvisionSchema, AuthDevicesRemoveResponseSchema, AuthDevicesRemoveSchema, AuthDeviceUserAuthoritiesApprovedEventSchema, AuthDeviceUserAuthoritiesListResponseSchema, AuthDeviceUserAuthoritiesListSchema, AuthDeviceUserAuthoritiesRequestedEventSchema, AuthDeviceUserAuthoritiesResolvedEventSchema, AuthDeviceUserAuthoritiesReviewRequestedEventSchema, AuthDeviceUserAuthoritiesReviewsDecideResponseSchema, AuthDeviceUserAuthoritiesReviewsDecideSchema, AuthDeviceUserAuthoritiesReviewsListResponseSchema, AuthDeviceUserAuthoritiesReviewsListSchema, AuthDeviceUserAuthoritiesRevokeResponseSchema, AuthDeviceUserAuthoritiesRevokeSchema, type AuthenticatedDevice, AuthenticatedDeviceSchema, type AuthenticatedService, type AuthenticatedUser, AuthIdentitiesListResponseSchema, AuthIdentitiesListSchema, AuthIdentityGrantsListResponseSchema, AuthIdentityGrantsListSchema, AuthIdentityGrantsRevokeResponseSchema, AuthIdentityGrantsRevokeSchema, AuthPortalsGetResponseSchema, AuthPortalsGetSchema, AuthPortalsListResponseSchema, AuthPortalsListSchema, AuthPortalsLoginSettingsGetSchema, AuthPortalsLoginSettingsResponseSchema, AuthPortalsLoginSettingsUpdateSchema, AuthPortalsRoutesPutResponseSchema, AuthPortalsRoutesPutSchema, AuthPortalsRoutesRemoveResponseSchema, AuthPortalsRoutesRemoveSchema, AuthRequestsValidateResponseSchema, AuthRequestsValidateSchema, AuthResolveDeviceUserAuthoritiesProgressSchema, AuthResolveDeviceUserAuthoritiesResponseSchema, AuthResolveDeviceUserAuthoritiesSchema, AuthServiceInstancesDisableResponseSchema, AuthServiceInstancesDisableSchema, AuthServiceInstancesEnableResponseSchema, AuthServiceInstancesEnableSchema, AuthServiceInstancesListResponseSchema, AuthServiceInstancesListSchema, AuthServiceInstancesProvisionResponseSchema, AuthServiceInstancesProvisionSchema, AuthServiceInstancesRemoveResponseSchema, AuthServiceInstancesRemoveSchema, type AuthSessionsMeResponse, AuthSessionsMeResponseSchema, AuthSessionsMeSchema, AuthUserIdentitiesListResponseSchema, AuthUserIdentitiesListSchema, AuthUserIdentitiesUnlinkResponseSchema, AuthUserIdentitiesUnlinkSchema, AuthUsersAccountFlowCreateResponseSchema, AuthUsersCreateResponseSchema, AuthUsersCreateSchema, AuthUsersGetResponseSchema, AuthUsersGetSchema, AuthUsersIdentityLinkCreateSchema, AuthUsersListResponseSchema, AuthUsersListSchema, AuthUsersPasswordChangeResponseSchema, AuthUsersPasswordChangeSchema, AuthUsersPasswordResetCreateSchema, AuthUsersUpdateResponseSchema, AuthUsersUpdateSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, type DeploymentAuthority, type DeploymentAuthorityCapability, DeploymentAuthorityCapabilitySchema, type DeploymentAuthorityGrantOverride, DeploymentAuthorityGrantOverrideSchema, type DeploymentAuthorityKind, DeploymentAuthorityKindSchema, type DeploymentAuthorityMaterialization, DeploymentAuthorityMaterializationSchema, type DeploymentAuthorityMigration, DeploymentAuthorityMigrationSchema, type DeploymentAuthorityNeed, DeploymentAuthorityNeedSchema, type DeploymentAuthorityPlan, DeploymentAuthorityPlanSchema, type DeploymentAuthorityProposal, DeploymentAuthorityProposalSchema, type DeploymentAuthorityReconciliationStatus, DeploymentAuthorityReconciliationStatusSchema, type DeploymentAuthorityResource, DeploymentAuthorityResourceKindSchema, DeploymentAuthorityResourceSchema, DeploymentAuthoritySchema, type DeploymentAuthoritySurface, DeploymentAuthoritySurfaceActionSchema, DeploymentAuthoritySurfaceKindSchema, DeploymentAuthoritySurfaceSchema, type DeploymentAuthorityUpdate, DeploymentAuthorityUpdateSchema, DeploymentPortalRouteSchema, DeploymentResourceBindingSchema, type DeviceActivationRecord, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, DeviceSchema, DigestSchema, type FlowRegistrationAvailability, FlowRegistrationAvailabilitySchema, IdentityGrantViewSchema, ImplementationOfferSchema, type LoginPortalRecord, LoginPortalRecordSchema, type LoginPortalRoute, LoginPortalRouteSchema, type LoginPortalSettings, LoginPortalSettingsSchema, type LoginPortalSummary, LoginPortalSummarySchema, OpenObjectSchema, type ParticipantKind, ParticipantKindSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, PortalFlowStateSchema, type PortalFlowUser, ServiceDeploymentSchema, ServiceInstanceSchema, UserViewSchema, WaitForDeviceActivationRequestSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-export { approvalCapabilityKeys, type ApprovalDecision, ApprovalDecisionSchema, type AuthStartFlowResponse, AuthStartFlowResponseSchema, type AuthStartRequest, AuthStartRequestSchema, type AuthStartResponse, AuthStartResponseSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ClientTransportEndpoints, ClientTransportEndpointsSchema, type ClientTransports, ClientTransportsSchema, type ContractApproval, type ContractApprovalCapability, ContractApprovalSchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, type UserParticipantKind, UserParticipantKindSchema, } from "./schemas.js";
-export { buildNatsConnectSignaturePayload, createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.js";
-export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
-export { trellisIdFromOriginId } from "./trellis_id.js";
-export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";
-//# sourceMappingURL=mod.d.ts.map

package/esm/npm/src/auth/mod.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,KAAK,qCAAqC,EAC1C,KAAK,yCAAyC,EAC9C,KAAK,sCAAsC,EAC3C,KAAK,wCAAwC,EAC7C,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,GACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,SAAS,EACT,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACrC,6BAA6B,EAC7B,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,2CAA2C,EAChD,4CAA4C,EAC5C,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,KAAK,wCAAwC,EAC7C,yCAAyC,EACzC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,8CAA8C,EACnD,KAAK,iDAAiD,EACtD,uDAAuD,EACvD,+CAA+C,EAC/C,KAAK,6CAA6C,EAClD,8CAA8C,EAC9C,KAAK,gDAAgD,EACrD,iDAAiD,EACjD,KAAK,6CAA6C,EAClD,mDAAmD,EACnD,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,mCAAmC,EACnC,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,EAC5B,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,2BAA2B,EAC3B,uCAAuC,EACvC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,kCAAkC,EAClC,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,mCAAmC,EACnC,6CAA6C,EAC7C,4CAA4C,EAC5C,mDAAmD,EACnD,oDAAoD,EACpD,4CAA4C,EAC5C,kDAAkD,EAClD,0CAA0C,EAC1C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,gCAAgC,EAChC,wBAAwB,EACxB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,iCAAiC,EACjC,sCAAsC,EACtC,oCAAoC,EACpC,kCAAkC,EAClC,0BAA0B,EAC1B,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,0BAA0B,EAC1B,8CAA8C,EAC9C,8CAA8C,EAC9C,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,iCAAiC,EACjC,2BAA2B,EAC3B,mBAAmB,EACnB,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,mCAAmC,EACnC,KAAK,gCAAgC,EACrC,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,KAAK,2BAA2B,EAChC,qCAAqC,EACrC,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,gCAAgC,EAChC,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gCAAgC,EAChC,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/esm/npm/src/auth/mod.js

@@ -1,18 +0,0 @@
-/**
- * @module
- *
- * Trellis server-side authentication library for session-key based authentication.
- *
- * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
- * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
- * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
- */
-export { buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, encodeDeviceActivationPayload, getDeviceConnectInfo, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, } from "./device_activation.js";
-export { bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
-export { buildProofInput, createProof, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthCapabilitiesListResponseSchema, AuthCapabilitiesListSchema, AuthCapabilityGroupsDeleteResponseSchema, AuthCapabilityGroupsDeleteSchema, AuthCapabilityGroupsGetResponseSchema, AuthCapabilityGroupsGetSchema, AuthCapabilityGroupsListResponseSchema, AuthCapabilityGroupsListSchema, AuthCapabilityGroupsPutResponseSchema, AuthCapabilityGroupsPutSchema, AuthDeploymentAuthorityAcceptMigrationSchema, AuthDeploymentAuthorityAcceptResponseSchema, AuthDeploymentAuthorityAcceptUpdateSchema, AuthDeploymentAuthorityGetResponseSchema, AuthDeploymentAuthorityGetSchema, AuthDeploymentAuthorityGrantOverridesListResponseSchema, AuthDeploymentAuthorityGrantOverridesListSchema, AuthDeploymentAuthorityGrantOverridesPutSchema, AuthDeploymentAuthorityGrantOverridesRemoveSchema, AuthDeploymentAuthorityGrantOverridesResponseSchema, AuthDeploymentAuthorityListResponseSchema, AuthDeploymentAuthorityListSchema, AuthDeploymentAuthorityPlanResponseSchema, AuthDeploymentAuthorityPlanSchema, AuthDeploymentAuthorityPlansGetResponseSchema, AuthDeploymentAuthorityPlansGetSchema, AuthDeploymentAuthorityPlansListResponseSchema, AuthDeploymentAuthorityPlansListSchema, AuthDeploymentAuthorityReconcileResponseSchema, AuthDeploymentAuthorityReconcileSchema, AuthDeploymentAuthorityRejectResponseSchema, AuthDeploymentAuthorityRejectSchema, AuthDeploymentKindSchema, AuthDeploymentSchema, AuthDeploymentsCreateResponseSchema, AuthDeploymentsCreateSchema, AuthDeploymentsDisableResponseSchema, AuthDeploymentsDisableSchema, AuthDeploymentsEnableResponseSchema, AuthDeploymentsEnableSchema, AuthDeploymentsListResponseSchema, AuthDeploymentsListSchema, AuthDeploymentsRemoveResponseSchema, AuthDeploymentsRemoveSchema, AuthDevicesConnectInfoGetResponseSchema, AuthDevicesConnectInfoGetSchema, AuthDevicesDisableResponseSchema, AuthDevicesDisableSchema, AuthDevicesEnableResponseSchema, AuthDevicesEnableSchema, AuthDevicesListResponseSchema, AuthDevicesListSchema, AuthDevicesProvisionResponseSchema, AuthDevicesProvisionSchema, AuthDevicesRemoveResponseSchema, AuthDevicesRemoveSchema, AuthDeviceUserAuthoritiesApprovedEventSchema, AuthDeviceUserAuthoritiesListResponseSchema, AuthDeviceUserAuthoritiesListSchema, AuthDeviceUserAuthoritiesRequestedEventSchema, AuthDeviceUserAuthoritiesResolvedEventSchema, AuthDeviceUserAuthoritiesReviewRequestedEventSchema, AuthDeviceUserAuthoritiesReviewsDecideResponseSchema, AuthDeviceUserAuthoritiesReviewsDecideSchema, AuthDeviceUserAuthoritiesReviewsListResponseSchema, AuthDeviceUserAuthoritiesReviewsListSchema, AuthDeviceUserAuthoritiesRevokeResponseSchema, AuthDeviceUserAuthoritiesRevokeSchema, AuthenticatedDeviceSchema, AuthIdentitiesListResponseSchema, AuthIdentitiesListSchema, AuthIdentityGrantsListResponseSchema, AuthIdentityGrantsListSchema, AuthIdentityGrantsRevokeResponseSchema, AuthIdentityGrantsRevokeSchema, AuthPortalsGetResponseSchema, AuthPortalsGetSchema, AuthPortalsListResponseSchema, AuthPortalsListSchema, AuthPortalsLoginSettingsGetSchema, AuthPortalsLoginSettingsResponseSchema, AuthPortalsLoginSettingsUpdateSchema, AuthPortalsRoutesPutResponseSchema, AuthPortalsRoutesPutSchema, AuthPortalsRoutesRemoveResponseSchema, AuthPortalsRoutesRemoveSchema, AuthRequestsValidateResponseSchema, AuthRequestsValidateSchema, AuthResolveDeviceUserAuthoritiesProgressSchema, AuthResolveDeviceUserAuthoritiesResponseSchema, AuthResolveDeviceUserAuthoritiesSchema, AuthServiceInstancesDisableResponseSchema, AuthServiceInstancesDisableSchema, AuthServiceInstancesEnableResponseSchema, AuthServiceInstancesEnableSchema, AuthServiceInstancesListResponseSchema, AuthServiceInstancesListSchema, AuthServiceInstancesProvisionResponseSchema, AuthServiceInstancesProvisionSchema, AuthServiceInstancesRemoveResponseSchema, AuthServiceInstancesRemoveSchema, AuthSessionsMeResponseSchema, AuthSessionsMeSchema, AuthUserIdentitiesListResponseSchema, AuthUserIdentitiesListSchema, AuthUserIdentitiesUnlinkResponseSchema, AuthUserIdentitiesUnlinkSchema, AuthUsersAccountFlowCreateResponseSchema, AuthUsersCreateResponseSchema, AuthUsersCreateSchema, AuthUsersGetResponseSchema, AuthUsersGetSchema, AuthUsersIdentityLinkCreateSchema, AuthUsersListResponseSchema, AuthUsersListSchema, AuthUsersPasswordChangeResponseSchema, AuthUsersPasswordChangeSchema, AuthUsersPasswordResetCreateSchema, AuthUsersUpdateResponseSchema, AuthUsersUpdateSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DeploymentAuthorityCapabilitySchema, DeploymentAuthorityGrantOverrideSchema, DeploymentAuthorityKindSchema, DeploymentAuthorityMaterializationSchema, DeploymentAuthorityMigrationSchema, DeploymentAuthorityNeedSchema, DeploymentAuthorityPlanSchema, DeploymentAuthorityProposalSchema, DeploymentAuthorityReconciliationStatusSchema, DeploymentAuthorityResourceKindSchema, DeploymentAuthorityResourceSchema, DeploymentAuthoritySchema, DeploymentAuthoritySurfaceActionSchema, DeploymentAuthoritySurfaceKindSchema, DeploymentAuthoritySurfaceSchema, DeploymentAuthorityUpdateSchema, DeploymentPortalRouteSchema, DeploymentResourceBindingSchema, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, DeviceSchema, DigestSchema, FlowRegistrationAvailabilitySchema, IdentityGrantViewSchema, ImplementationOfferSchema, LoginPortalRecordSchema, LoginPortalRouteSchema, LoginPortalSettingsSchema, LoginPortalSummarySchema, OpenObjectSchema, ParticipantKindSchema, PortalFlowStateSchema, ServiceDeploymentSchema, ServiceInstanceSchema, UserViewSchema, WaitForDeviceActivationRequestSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-export { approvalCapabilityKeys, ApprovalDecisionSchema, AuthStartFlowResponseSchema, AuthStartRequestSchema, AuthStartResponseSchema, BindResponseSchema, BindSuccessResponseSchema, ClientTransportEndpointsSchema, ClientTransportsSchema, ContractApprovalSchema, NatsAuthTokenV1Schema, SentinelCredsSchema, UserParticipantKindSchema, } from "./schemas.js";
-export { buildNatsConnectSignaturePayload, createAuth, } from "./session_auth.js";
-export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
-export { trellisIdFromOriginId } from "./trellis_id.js";
-export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";

package/esm/npm/src/auth/proof.d.ts

@@ -1,11 +0,0 @@
-export type ProofParams = {
-    sessionKey: string;
-    subject: string;
-    payloadHash: Uint8Array;
-    iat: number;
-    requestId: string;
-};
-export declare function buildProofInput(sessionKey: string, subject: string, payloadHash: Uint8Array, iat: number, requestId: string): Uint8Array;
-export declare function createProof(privateKey: CryptoKey, params: ProofParams): Promise<string>;
-export declare function verifyProof(publicSessionKey: string, params: ProofParams, proofBase64url: string): Promise<boolean>;
-//# sourceMappingURL=proof.d.ts.map

package/esm/npm/src/auth/proof.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../../src/auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAcF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,EACvB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,UAAU,CA4BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/esm/npm/src/auth/proof.js

@@ -1,49 +0,0 @@
-import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
-import { importEd25519PublicKeyFromBase64url } from "./keys.js";
-import { AsyncResult } from "@qlever-llc/result";
-function appendLengthPrefixed(buf, view, offset, value) {
-    view.setUint32(offset, value.length);
-    offset += 4;
-    buf.set(value, offset);
-    return offset + value.length;
-}
-export function buildProofInput(sessionKey, subject, payloadHash, iat, requestId) {
-    const sessionKeyBytes = utf8(sessionKey);
-    const subjectBytes = utf8(subject);
-    const iatBytes = utf8(String(iat));
-    const requestIdBytes = utf8(requestId);
-    const buf = new Uint8Array(4 +
-        sessionKeyBytes.length +
-        4 +
-        subjectBytes.length +
-        4 +
-        payloadHash.length +
-        4 +
-        iatBytes.length +
-        4 +
-        requestIdBytes.length);
-    const view = new DataView(buf.buffer);
-    let offset = 0;
-    offset = appendLengthPrefixed(buf, view, offset, sessionKeyBytes);
-    offset = appendLengthPrefixed(buf, view, offset, subjectBytes);
-    offset = appendLengthPrefixed(buf, view, offset, payloadHash);
-    offset = appendLengthPrefixed(buf, view, offset, iatBytes);
-    appendLengthPrefixed(buf, view, offset, requestIdBytes);
-    return buf;
-}
-export async function createProof(privateKey, params) {
-    const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash, params.iat, params.requestId);
-    const digest = await sha256(input);
-    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
-    return base64urlEncode(new Uint8Array(sig));
-}
-export async function verifyProof(publicSessionKey, params, proofBase64url) {
-    const result = await AsyncResult.try(async () => {
-        const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash, params.iat, params.requestId);
-        const digest = await sha256(input);
-        const signature = base64urlDecode(proofBase64url);
-        const pub = await importEd25519PublicKeyFromBase64url(publicSessionKey);
-        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(signature), toArrayBuffer(digest));
-    });
-    return result.unwrapOr(false);
-}