@qlever-llc/trellis 0.10.3-rc.2 → 0.10.3

package/script/npm/src/auth/device_activation.d.ts

@@ -1,146 +0,0 @@
-import type { StaticDecode } from "typebox";
-import { Type } from "typebox";
-import type { BaseError } from "@qlever-llc/result";
-import { AsyncResult } from "@qlever-llc/result";
-import type { OperationRef } from "../operations.js";
-import type { NatsAuthTokenV1 } from "./schemas.js";
-import { AuthDevicesConnectInfoGetResponseSchema, AuthDevicesConnectInfoGetSchema, AuthDeviceUserAuthoritiesListResponseSchema, AuthDeviceUserAuthoritiesListSchema, AuthDeviceUserAuthoritiesRevokeResponseSchema, AuthDeviceUserAuthoritiesRevokeSchema, AuthResolveDeviceUserAuthoritiesProgressSchema, AuthResolveDeviceUserAuthoritiesResponseSchema, AuthResolveDeviceUserAuthoritiesSchema, WaitForDeviceActivationResponseSchema } from "./protocol.js";
-export declare const DeviceActivationPayloadSchema: Type.TObject<{
-    v: Type.TLiteral<1>;
-    publicIdentityKey: Type.TString;
-    nonce: Type.TString;
-    qrMac: Type.TString;
-}>;
-export declare const DeviceActivationWaitRequestSchema: Type.TObject<{
-    flowId: Type.TString;
-    publicIdentityKey: Type.TString;
-    nonce: Type.TString;
-    contractDigest: Type.TString;
-    iat: Type.TNumber;
-    sig: Type.TString;
-}>;
-export type DeviceActivationPayload = StaticDecode<typeof DeviceActivationPayloadSchema>;
-export type DeviceActivationWaitRequest = StaticDecode<typeof DeviceActivationWaitRequestSchema>;
-export type WaitForDeviceActivationResponse = StaticDecode<typeof WaitForDeviceActivationResponseSchema>;
-export type AuthResolveDeviceUserAuthoritiesInput = StaticDecode<typeof AuthResolveDeviceUserAuthoritiesSchema>;
-export type AuthResolveDeviceUserAuthoritiesProgress = StaticDecode<typeof AuthResolveDeviceUserAuthoritiesProgressSchema>;
-export type AuthResolveDeviceUserAuthoritiesOutput = StaticDecode<typeof AuthResolveDeviceUserAuthoritiesResponseSchema>;
-export type AuthDeviceUserAuthoritiesListInput = StaticDecode<typeof AuthDeviceUserAuthoritiesListSchema>;
-export type AuthDeviceUserAuthoritiesListOutput = StaticDecode<typeof AuthDeviceUserAuthoritiesListResponseSchema>;
-export type AuthDeviceUserAuthoritiesRevokeInput = StaticDecode<typeof AuthDeviceUserAuthoritiesRevokeSchema>;
-export type AuthDeviceUserAuthoritiesRevokeResponse = StaticDecode<typeof AuthDeviceUserAuthoritiesRevokeResponseSchema>;
-export type GetDeviceConnectInfoInput = StaticDecode<typeof AuthDevicesConnectInfoGetSchema>;
-export type GetDeviceConnectInfoOutput = StaticDecode<typeof AuthDevicesConnectInfoGetResponseSchema>;
-export type DeviceIdentity = {
-    identitySeed: Uint8Array;
-    identitySeedBase64url: string;
-    publicIdentityKey: string;
-    activationKey: Uint8Array;
-    activationKeyBase64url: string;
-};
-type AuthResolveDeviceUserAuthoritiesOperationShape = {
-    subject: string;
-    input: typeof AuthResolveDeviceUserAuthoritiesSchema;
-    progress: typeof AuthResolveDeviceUserAuthoritiesProgressSchema;
-    output: typeof AuthResolveDeviceUserAuthoritiesResponseSchema;
-};
-export type AuthResolveDeviceUserAuthoritiesOperation = OperationRef<AuthResolveDeviceUserAuthoritiesOperationShape, AuthResolveDeviceUserAuthoritiesProgress, AuthResolveDeviceUserAuthoritiesOutput>;
-type RequestClient = {
-    rpc: {
-        auth: {
-            deviceUserAuthoritiesList(input: AuthDeviceUserAuthoritiesListInput): AsyncResult<AuthDeviceUserAuthoritiesListOutput, BaseError>;
-            deviceUserAuthoritiesRevoke(input: AuthDeviceUserAuthoritiesRevokeInput): AsyncResult<AuthDeviceUserAuthoritiesRevokeResponse, BaseError>;
-            devicesConnectInfoGet(input: GetDeviceConnectInfoInput): AsyncResult<GetDeviceConnectInfoOutput, BaseError>;
-        };
-    };
-};
-type ResolveDeviceUserAuthoritiesOperationClient = {
-    operation: {
-        auth: {
-            deviceUserAuthoritiesResolve: {
-                input(input: AuthResolveDeviceUserAuthoritiesInput): {
-                    start(): AsyncResult<AuthResolveDeviceUserAuthoritiesOperation, BaseError>;
-                };
-            };
-        };
-    };
-};
-export type DeviceActivationTransport = RequestClient & ResolveDeviceUserAuthoritiesOperationClient;
-export declare function deriveDeviceIdentity(deviceRootSecret: Uint8Array): Promise<DeviceIdentity>;
-export declare function deriveDeviceQrMac(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<string>;
-export declare function buildDeviceActivationPayload(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<DeviceActivationPayload>;
-export declare function encodeDeviceActivationPayload(payload: DeviceActivationPayload): string;
-export declare function parseDeviceActivationPayload(value: string): DeviceActivationPayload;
-export declare function startDeviceActivationRequest(args: {
-    trellisUrl: string;
-    payload: DeviceActivationPayload;
-}): Promise<{
-    flowId: string;
-    instanceId: string;
-    deploymentId: string;
-    activationUrl: string;
-}>;
-export declare function deriveDeviceConfirmationCode(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<string>;
-export declare function verifyDeviceConfirmationCode(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-    confirmationCode: string;
-}): Promise<boolean>;
-export declare function buildDeviceWaitProofInput(flowId: string, publicIdentityKey: string, nonce: string, iat: number, contractDigest: string): Uint8Array;
-export declare function signDeviceWaitRequest(args: {
-    flowId: string;
-    publicIdentityKey: string;
-    nonce: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    iat?: number;
-}): Promise<DeviceActivationWaitRequest>;
-export declare function createDeviceNatsAuthToken(args: {
-    publicIdentityKey: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    iat?: number;
-}): Promise<NatsAuthTokenV1 & {
-    contractDigest: string;
-}>;
-export declare function waitForDeviceActivation(args: {
-    trellisUrl: string;
-    flowId: string;
-    publicIdentityKey: string;
-    nonce: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    signal?: AbortSignal;
-    pollIntervalMs?: number;
-}): Promise<Extract<WaitForDeviceActivationResponse, {
-    status: "activated";
-}>>;
-export declare function getDeviceConnectInfo(args: {
-    trellisUrl: string;
-    publicIdentityKey: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    iat?: number;
-}): Promise<GetDeviceConnectInfoOutput>;
-export declare function createDeviceActivationClient(client: DeviceActivationTransport): {
-    resolveDeviceUserAuthorities(input: AuthResolveDeviceUserAuthoritiesInput): any;
-    listDeviceActivations(input: AuthDeviceUserAuthoritiesListInput): any;
-    revokeDeviceActivation(input: AuthDeviceUserAuthoritiesRevokeInput): any;
-    getDeviceConnectInfo(input: GetDeviceConnectInfoInput): any;
-};
-export declare function verifyDeviceWaitSignature(input: DeviceActivationWaitRequest): Promise<boolean>;
-export {};
-//# sourceMappingURL=device_activation.d.ts.map

package/script/npm/src/auth/device_activation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device_activation.d.ts","sourceRoot":"","sources":["../../../../src/auth/device_activation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,uCAAuC,EACvC,+BAA+B,EAC/B,2CAA2C,EAC3C,mCAAmC,EACnC,6CAA6C,EAC7C,qCAAqC,EACrC,8CAA8C,EAC9C,8CAA8C,EAC9C,sCAAsC,EAEtC,qCAAqC,EACtC,MAAM,eAAe,CAAC;AAiBvB,eAAO,MAAM,6BAA6B;;;;;EAKxC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;EACR,CAAC;AAEvC,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,YAAY,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,qCAAqC,GAAG,YAAY,CAC9D,OAAO,sCAAsC,CAC9C,CAAC;AACF,MAAM,MAAM,wCAAwC,GAAG,YAAY,CACjE,OAAO,8CAA8C,CACtD,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG,YAAY,CAC/D,OAAO,8CAA8C,CACtD,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,mCAAmC,CAC3C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,YAAY,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,uCAAuC,GAAG,YAAY,CAChE,OAAO,6CAA6C,CACrD,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,YAAY,CAClD,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,8CAA8C,GAAG;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,sCAAsC,CAAC;IACrD,QAAQ,EAAE,OAAO,8CAA8C,CAAC;IAChE,MAAM,EAAE,OAAO,8CAA8C,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,yCAAyC,GAAG,YAAY,CAClE,8CAA8C,EAC9C,wCAAwC,EACxC,sCAAsC,CACvC,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE;QACH,IAAI,EAAE;YACJ,yBAAyB,CACvB,KAAK,EAAE,kCAAkC,GACxC,WAAW,CAAC,mCAAmC,EAAE,SAAS,CAAC,CAAC;YAC/D,2BAA2B,CACzB,KAAK,EAAE,oCAAoC,GAC1C,WAAW,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC;YACnE,qBAAqB,CACnB,KAAK,EAAE,yBAAyB,GAC/B,WAAW,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;SACvD,CAAC;KACH,CAAC;CACH,CAAC;AAEF,KAAK,2CAA2C,GAAG;IACjD,SAAS,EAAE;QACT,IAAI,EAAE;YACJ,4BAA4B,EAAE;gBAC5B,KAAK,CACH,KAAK,EAAE,qCAAqC,GAC3C;oBACD,KAAK,IAAI,WAAW,CAClB,yCAAyC,EACzC,SAAS,CACV,CAAC;iBACH,CAAC;aACH,CAAC;SACH,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,2CAA2C,CAAC;AAyIhD,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQnC;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAOzB;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,uBAAuB,CAAC;CAClC,GAAG,OAAO,CACT;IACE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CACF,CAkCA;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,UAAU,CAoCZ;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA6BvC;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxD;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CACT,OAAO,CAAC,+BAA+B,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAClE,CAuDA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA+BtC;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,yBAAyB;wCAGK,qCAAqC;iCAK5C,kCAAkC;kCAGjC,oCAAoC;gCAItC,yBAAyB;EAIxD;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAmBlB"}

package/script/npm/src/auth/device_activation.js

@@ -1,387 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceActivationWaitRequestSchema = exports.DeviceActivationPayloadSchema = void 0;
-exports.deriveDeviceIdentity = deriveDeviceIdentity;
-exports.deriveDeviceQrMac = deriveDeviceQrMac;
-exports.buildDeviceActivationPayload = buildDeviceActivationPayload;
-exports.encodeDeviceActivationPayload = encodeDeviceActivationPayload;
-exports.parseDeviceActivationPayload = parseDeviceActivationPayload;
-exports.startDeviceActivationRequest = startDeviceActivationRequest;
-exports.deriveDeviceConfirmationCode = deriveDeviceConfirmationCode;
-exports.verifyDeviceConfirmationCode = verifyDeviceConfirmationCode;
-exports.buildDeviceWaitProofInput = buildDeviceWaitProofInput;
-exports.signDeviceWaitRequest = signDeviceWaitRequest;
-exports.createDeviceNatsAuthToken = createDeviceNatsAuthToken;
-exports.waitForDeviceActivation = waitForDeviceActivation;
-exports.getDeviceConnectInfo = getDeviceConnectInfo;
-exports.createDeviceActivationClient = createDeviceActivationClient;
-exports.verifyDeviceWaitSignature = verifyDeviceWaitSignature;
-const typebox_1 = require("typebox");
-const value_1 = require("typebox/value");
-const keys_js_1 = require("./keys.js");
-const protocol_js_1 = require("./protocol.js");
-const utils_js_1 = require("./utils.js");
-const session_auth_js_1 = require("./session_auth.js");
-const DEVICE_IDENTITY_HKDF_INFO = "trellis/device-identity/v1";
-const DEVICE_ACTIVATION_HKDF_INFO = "trellis/device-activate/v1";
-const DEVICE_QR_MAC_DOMAIN = "trellis-device-qr/v1";
-const DEVICE_CONFIRMATION_DOMAIN = "trellis-device-confirm/v1";
-const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-const DEFAULT_WAIT_POLL_INTERVAL_MS = 3_000;
-exports.DeviceActivationPayloadSchema = typebox_1.Type.Object({
-    v: typebox_1.Type.Literal(1),
-    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
-    nonce: typebox_1.Type.String({ minLength: 1 }),
-    qrMac: typebox_1.Type.String({ minLength: 1 }),
-});
-exports.DeviceActivationWaitRequestSchema = protocol_js_1.WaitForDeviceActivationRequestSchema;
-function concatBytes(parts) {
-    const size = parts.reduce((total, part) => total + part.length, 0);
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const part of parts) {
-        bytes.set(part, offset);
-        offset += part.length;
-    }
-    return bytes;
-}
-function normalizeSecretBytes(value, name) {
-    if (typeof value === "string") {
-        const decoded = (0, utils_js_1.base64urlDecode)(value);
-        if (decoded.length === 0)
-            throw new Error(`${name} must not be empty`);
-        return decoded;
-    }
-    if (value.length === 0)
-        throw new Error(`${name} must not be empty`);
-    return value;
-}
-async function hkdfSha256(inputKeyingMaterial, info, length) {
-    const key = await crypto.subtle.importKey("raw", (0, utils_js_1.toArrayBuffer)(inputKeyingMaterial), "HKDF", false, ["deriveBits"]);
-    const derivedBits = await crypto.subtle.deriveBits({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: (0, utils_js_1.toArrayBuffer)(new Uint8Array(0)),
-        info: (0, utils_js_1.toArrayBuffer)((0, utils_js_1.utf8)(info)),
-    }, key, length * 8);
-    return new Uint8Array(derivedBits);
-}
-async function hmacSha256(keyBytes, data) {
-    const key = await crypto.subtle.importKey("raw", (0, utils_js_1.toArrayBuffer)(keyBytes), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    return new Uint8Array(await crypto.subtle.sign("HMAC", key, (0, utils_js_1.toArrayBuffer)(data)));
-}
-function crockfordEncode(bytes) {
-    let value = 0;
-    let bits = 0;
-    let output = "";
-    for (const byte of bytes) {
-        value = (value << 8) | byte;
-        bits += 8;
-        while (bits >= 5) {
-            bits -= 5;
-            output += CROCKFORD_ALPHABET[(value >>> bits) & 31] ?? "0";
-        }
-    }
-    if (bits > 0) {
-        output += CROCKFORD_ALPHABET[(value << (5 - bits)) & 31] ?? "0";
-    }
-    return output;
-}
-function normalizeCrockford(value) {
-    return value.trim().toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
-}
-async function sleep(ms, signal) {
-    if (signal?.aborted) {
-        throw signal.reason ?? new DOMException("Aborted", "AbortError");
-    }
-    await new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        function onAbort() {
-            clearTimeout(timer);
-            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
-        }
-        signal?.addEventListener("abort", onAbort, { once: true });
-    });
-}
-function retryAfterDelayMs(response) {
-    const value = response.headers.get("Retry-After");
-    if (!value)
-        return null;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0)
-        return seconds * 1_000;
-    const dateMs = Date.parse(value);
-    if (!Number.isFinite(dateMs))
-        return null;
-    return Math.max(0, dateMs - Date.now());
-}
-async function responseErrorDetail(response) {
-    const text = await response.text();
-    if (!text)
-        return null;
-    try {
-        const parsed = JSON.parse(text);
-        if (typeof parsed.reason === "string" && parsed.reason.length > 0) {
-            return parsed.reason;
-        }
-        if (typeof parsed.message === "string" && parsed.message.length > 0) {
-            return parsed.message;
-        }
-    }
-    catch {
-        // Fall through to raw text below.
-    }
-    return text;
-}
-async function deriveDeviceIdentity(deviceRootSecret) {
-    if (deviceRootSecret.length !== 32) {
-        throw new Error(`Invalid device root secret length: ${deviceRootSecret.length} (expected 32)`);
-    }
-    const identitySeed = await hkdfSha256(deviceRootSecret, DEVICE_IDENTITY_HKDF_INFO, 32);
-    const activationKey = await hkdfSha256(deviceRootSecret, DEVICE_ACTIVATION_HKDF_INFO, 32);
-    const identitySeedBase64url = (0, utils_js_1.base64urlEncode)(identitySeed);
-    const identityPrivateKey = await (0, keys_js_1.importEd25519PrivateKeyFromSeedBase64url)(identitySeedBase64url);
-    const publicIdentityKey = await (0, keys_js_1.publicKeyBase64urlFromPrivateKey)(identityPrivateKey);
-    return {
-        identitySeed,
-        identitySeedBase64url,
-        publicIdentityKey,
-        activationKey,
-        activationKeyBase64url: (0, utils_js_1.base64urlEncode)(activationKey),
-    };
-}
-async function deriveDeviceQrMac(input) {
-    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
-    const mac = await hmacSha256(activationKey, concatBytes([
-        (0, utils_js_1.utf8)(DEVICE_QR_MAC_DOMAIN),
-        (0, utils_js_1.utf8)(input.publicIdentityKey),
-        (0, utils_js_1.utf8)(input.nonce),
-    ]));
-    return (0, utils_js_1.base64urlEncode)(mac.slice(0, 8));
-}
-async function buildDeviceActivationPayload(input) {
-    const qrMac = await deriveDeviceQrMac(input);
-    return {
-        v: 1,
-        publicIdentityKey: input.publicIdentityKey,
-        nonce: input.nonce,
-        qrMac,
-    };
-}
-function encodeDeviceActivationPayload(payload) {
-    return (0, utils_js_1.base64urlEncode)((0, utils_js_1.utf8)(JSON.stringify(payload)));
-}
-function parseDeviceActivationPayload(value) {
-    const decoded = new TextDecoder().decode((0, utils_js_1.base64urlDecode)(value));
-    const parsed = JSON.parse(decoded);
-    if (!value_1.Value.Check(exports.DeviceActivationPayloadSchema, parsed)) {
-        throw new Error("Invalid device activation payload");
-    }
-    return parsed;
-}
-async function startDeviceActivationRequest(args) {
-    const response = await fetch(new URL("/auth/devices/activate/requests", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ payload: args.payload }),
-    });
-    if (!response.ok) {
-        const detail = await responseErrorDetail(response);
-        throw new Error(`Device activation request failed: ${response.status}${detail ? ` ${detail}` : ""}`);
-    }
-    const parsed = await response.json();
-    if (typeof parsed.flowId !== "string" ||
-        typeof parsed.instanceId !== "string" ||
-        typeof parsed.deploymentId !== "string" ||
-        typeof parsed.activationUrl !== "string") {
-        throw new Error("Device activation request returned an invalid response");
-    }
-    return {
-        flowId: parsed.flowId,
-        instanceId: parsed.instanceId,
-        deploymentId: parsed.deploymentId,
-        activationUrl: parsed.activationUrl,
-    };
-}
-async function deriveDeviceConfirmationCode(input) {
-    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
-    const mac = await hmacSha256(activationKey, concatBytes([
-        (0, utils_js_1.utf8)(DEVICE_CONFIRMATION_DOMAIN),
-        (0, utils_js_1.utf8)(input.publicIdentityKey),
-        (0, utils_js_1.utf8)(input.nonce),
-    ]));
-    return crockfordEncode(mac.slice(0, 5)).slice(0, 8);
-}
-async function verifyDeviceConfirmationCode(input) {
-    const expected = await deriveDeviceConfirmationCode(input);
-    return normalizeCrockford(expected) ===
-        normalizeCrockford(input.confirmationCode);
-}
-function buildDeviceWaitProofInput(flowId, publicIdentityKey, nonce, iat, contractDigest) {
-    const enc = new TextEncoder();
-    const flowIdBytes = enc.encode(flowId);
-    const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
-    const nonceBytes = enc.encode(nonce);
-    const iatBytes = enc.encode(String(iat));
-    const contractDigestBytes = enc.encode(contractDigest);
-    const buf = new Uint8Array(4 + flowIdBytes.length +
-        4 + publicIdentityKeyBytes.length +
-        4 + nonceBytes.length +
-        4 + iatBytes.length +
-        4 + contractDigestBytes.length);
-    const view = new DataView(buf.buffer);
-    let offset = 0;
-    view.setUint32(offset, flowIdBytes.length);
-    offset += 4;
-    buf.set(flowIdBytes, offset);
-    offset += flowIdBytes.length;
-    view.setUint32(offset, publicIdentityKeyBytes.length);
-    offset += 4;
-    buf.set(publicIdentityKeyBytes, offset);
-    offset += publicIdentityKeyBytes.length;
-    view.setUint32(offset, nonceBytes.length);
-    offset += 4;
-    buf.set(nonceBytes, offset);
-    offset += nonceBytes.length;
-    view.setUint32(offset, iatBytes.length);
-    offset += 4;
-    buf.set(iatBytes, offset);
-    offset += iatBytes.length;
-    view.setUint32(offset, contractDigestBytes.length);
-    offset += 4;
-    buf.set(contractDigestBytes, offset);
-    return buf;
-}
-async function signDeviceWaitRequest(args) {
-    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
-    const identityPrivateKey = await (0, keys_js_1.importEd25519PrivateKeyFromSeedBase64url)((0, utils_js_1.base64urlEncode)(identitySeed));
-    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const proofInput = buildDeviceWaitProofInput(args.flowId, args.publicIdentityKey, args.nonce, iat, args.contractDigest);
-    const proofHash = await (0, utils_js_1.sha256)(proofInput);
-    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, (0, utils_js_1.toArrayBuffer)(proofHash)));
-    return {
-        flowId: args.flowId,
-        publicIdentityKey: args.publicIdentityKey,
-        nonce: args.nonce,
-        contractDigest: args.contractDigest,
-        iat,
-        sig: (0, utils_js_1.base64urlEncode)(signature),
-    };
-}
-async function createDeviceNatsAuthToken(args) {
-    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
-    const identityPrivateKey = await (0, keys_js_1.importEd25519PrivateKeyFromSeedBase64url)((0, utils_js_1.base64urlEncode)(identitySeed));
-    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const digest = await crypto.subtle.digest("SHA-256", (0, utils_js_1.toArrayBuffer)((0, utils_js_1.utf8)(`nats-connect:${(0, session_auth_js_1.buildNatsConnectSignaturePayload)(iat, args.contractDigest)}`)));
-    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, digest));
-    return {
-        v: 1,
-        sessionKey: args.publicIdentityKey,
-        iat,
-        sig: (0, utils_js_1.base64urlEncode)(signature),
-        contractDigest: args.contractDigest,
-    };
-}
-async function waitForDeviceActivation(args) {
-    const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_WAIT_POLL_INTERVAL_MS;
-    while (true) {
-        const request = await signDeviceWaitRequest(args);
-        let response;
-        try {
-            response = await fetch(new URL("/auth/devices/activate/wait", args.trellisUrl), {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(request),
-                signal: args.signal,
-            });
-        }
-        catch (error) {
-            if (args.signal?.aborted) {
-                throw error;
-            }
-            await sleep(pollIntervalMs, args.signal);
-            continue;
-        }
-        if (!response.ok) {
-            if (response.status === 429) {
-                const retryAfterMs = retryAfterDelayMs(response);
-                await sleep(retryAfterMs === null
-                    ? pollIntervalMs
-                    : Math.max(pollIntervalMs, retryAfterMs), args.signal);
-                continue;
-            }
-            const detail = await responseErrorDetail(response);
-            throw new Error(detail
-                ? `device activation wait failed: ${response.status} ${detail}`
-                : `device activation wait failed: ${response.status}`);
-        }
-        const body = await response.json();
-        if (!value_1.Value.Check(protocol_js_1.WaitForDeviceActivationResponseSchema, body)) {
-            throw new Error("Invalid device activation wait response");
-        }
-        if (body.status === "pending") {
-            await sleep(pollIntervalMs, args.signal);
-            continue;
-        }
-        if (body.status === "rejected") {
-            throw new Error(`device activation rejected: ${body.reason ?? "unknown_reason"}`);
-        }
-        return body;
-    }
-}
-async function getDeviceConnectInfo(args) {
-    const request = await signDeviceWaitRequest({
-        flowId: "connect-info",
-        publicIdentityKey: args.publicIdentityKey,
-        identitySeed: args.identitySeed,
-        contractDigest: args.contractDigest,
-        nonce: "connect-info",
-        iat: args.iat,
-    });
-    const payload = {
-        publicIdentityKey: request.publicIdentityKey,
-        contractDigest: args.contractDigest,
-        iat: request.iat,
-        sig: request.sig,
-    };
-    const response = await fetch(new URL("/auth/devices/connect-info", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(payload),
-    });
-    if (!response.ok) {
-        throw new Error(`device connect info failed: ${response.status}`);
-    }
-    const body = await response.json();
-    if (!value_1.Value.Check(protocol_js_1.AuthDevicesConnectInfoGetResponseSchema, body)) {
-        throw new Error("Invalid device connect info response");
-    }
-    return body;
-}
-function createDeviceActivationClient(client) {
-    return {
-        resolveDeviceUserAuthorities(input) {
-            return client.operation.auth.deviceUserAuthoritiesResolve.input(input)
-                .start()
-                .orThrow();
-        },
-        listDeviceActivations(input) {
-            return client.rpc.auth.deviceUserAuthoritiesList(input).orThrow();
-        },
-        revokeDeviceActivation(input) {
-            return client.rpc.auth.deviceUserAuthoritiesRevoke(input)
-                .orThrow();
-        },
-        getDeviceConnectInfo(input) {
-            return client.rpc.auth.devicesConnectInfoGet(input).orThrow();
-        },
-    };
-}
-async function verifyDeviceWaitSignature(input) {
-    const publicKey = await (0, keys_js_1.importEd25519PublicKeyFromBase64url)(input.publicIdentityKey);
-    const proofHash = await (0, utils_js_1.sha256)(buildDeviceWaitProofInput(input.flowId, input.publicIdentityKey, input.nonce, input.iat, input.contractDigest));
-    return await crypto.subtle.verify("Ed25519", publicKey, (0, utils_js_1.toArrayBuffer)((0, utils_js_1.base64urlDecode)(input.sig)), (0, utils_js_1.toArrayBuffer)(proofHash));
-}

package/script/npm/src/auth/keys.d.ts

@@ -1,8 +0,0 @@
-export declare function pkcs8FromEd25519Seed(seed32: Uint8Array): Uint8Array;
-export declare function publicKeyBase64urlFromSeed(seed32: Uint8Array): string;
-export declare function signEd25519SeedDetached(seed32: Uint8Array, data: Uint8Array): Uint8Array;
-export declare function signEd25519SeedSha256(seed32: Uint8Array, data: Uint8Array): Uint8Array;
-export declare function importEd25519PrivateKeyFromSeedBase64url(seedBase64url: string): Promise<CryptoKey>;
-export declare function publicKeyBase64urlFromPrivateKey(privateKey: CryptoKey): Promise<string>;
-export declare function importEd25519PublicKeyFromBase64url(publicKeyBase64url: string): Promise<CryptoKey>;
-//# sourceMappingURL=keys.d.ts.map

package/script/npm/src/auth/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../src/auth/keys.ts"],"names":[],"mappings":"AAwBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAUnE;AAeD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAKZ;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAepB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAcpB"}

package/script/npm/src/auth/keys.js

@@ -1,82 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pkcs8FromEd25519Seed = pkcs8FromEd25519Seed;
-exports.publicKeyBase64urlFromSeed = publicKeyBase64urlFromSeed;
-exports.signEd25519SeedDetached = signEd25519SeedDetached;
-exports.signEd25519SeedSha256 = signEd25519SeedSha256;
-exports.importEd25519PrivateKeyFromSeedBase64url = importEd25519PrivateKeyFromSeedBase64url;
-exports.publicKeyBase64urlFromPrivateKey = publicKeyBase64urlFromPrivateKey;
-exports.importEd25519PublicKeyFromBase64url = importEd25519PublicKeyFromBase64url;
-const js_sha256_1 = require("js-sha256");
-const tweetnacl_1 = __importDefault(require("tweetnacl"));
-const utils_js_1 = require("./utils.js");
-const ED25519_PKCS8_PREFIX = Uint8Array.from([
-    0x30,
-    0x2e,
-    0x02,
-    0x01,
-    0x00,
-    0x30,
-    0x05,
-    0x06,
-    0x03,
-    0x2b,
-    0x65,
-    0x70,
-    0x04,
-    0x22,
-    0x04,
-    0x20,
-]);
-function pkcs8FromEd25519Seed(seed32) {
-    if (seed32.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
-    }
-    const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + seed32.length);
-    pkcs8.set(ED25519_PKCS8_PREFIX, 0);
-    pkcs8.set(seed32, ED25519_PKCS8_PREFIX.length);
-    return pkcs8;
-}
-function validateEd25519Seed(seed32) {
-    if (seed32.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
-    }
-    return seed32;
-}
-function ed25519KeyPairFromSeed(seed32) {
-    return tweetnacl_1.default.sign.keyPair.fromSeed(validateEd25519Seed(seed32));
-}
-function publicKeyBase64urlFromSeed(seed32) {
-    return (0, utils_js_1.base64urlEncode)(ed25519KeyPairFromSeed(seed32).publicKey);
-}
-function signEd25519SeedDetached(seed32, data) {
-    return tweetnacl_1.default.sign.detached(data, ed25519KeyPairFromSeed(seed32).secretKey);
-}
-function signEd25519SeedSha256(seed32, data) {
-    return signEd25519SeedDetached(seed32, new Uint8Array(js_sha256_1.sha256.arrayBuffer(data)));
-}
-async function importEd25519PrivateKeyFromSeedBase64url(seedBase64url) {
-    const seed = (0, utils_js_1.base64urlDecode)(seedBase64url);
-    if (seed.length !== 32) {
-        throw new Error(`Invalid Ed25519 seed length: ${seed.length} (expected 32)`);
-    }
-    const pkcs8 = pkcs8FromEd25519Seed(seed);
-    return await crypto.subtle.importKey("pkcs8", (0, utils_js_1.toArrayBuffer)(pkcs8), { name: "Ed25519" }, true, ["sign"]);
-}
-async function publicKeyBase64urlFromPrivateKey(privateKey) {
-    const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-    if (typeof jwk.x !== "string" || jwk.x.length === 0) {
-        throw new Error("Failed to derive Ed25519 public key (missing JWK.x)");
-    }
-    return jwk.x;
-}
-async function importEd25519PublicKeyFromBase64url(publicKeyBase64url) {
-    const raw = (0, utils_js_1.base64urlDecode)(publicKeyBase64url);
-    if (raw.length !== 32) {
-        throw new Error(`Invalid Ed25519 public key length: ${raw.length} (expected 32)`);
-    }
-    return await crypto.subtle.importKey("raw", (0, utils_js_1.toArrayBuffer)(raw), { name: "Ed25519" }, true, ["verify"]);
-}