@qlever-llc/trellis 0.6.0 → 0.7.0-rc.2

package/README.md

@@ -3,7 +3,8 @@
 JavaScript Trellis client runtime. Provides contract-driven client helpers and runtime error types.
 
 ```typescript
-import { defineContract } from "@qlever-llc/trellis";
+import { TrellisClient } from "@qlever-llc/trellis";
+import { defineContract } from "@qlever-llc/trellis/contracts";
 import { auth } from "@qlever-llc/trellis/sdk/auth";
 
 const app = defineContract({
@@ -16,7 +17,10 @@ const app = defineContract({
   },
 });
 
-const client = app.createClient(nc, authSession, opts);
+const client = await TrellisClient.connect({
+  trellisUrl: "https://trellis.example.com",
+  contract: app,
+});
 const me = await client.requestOrThrow("Auth.Me", {});
 ```
 

package/esm/auth/device_activation.d.ts

@@ -0,0 +1,194 @@
+import type { StaticDecode } from "typebox";
+import { Type } from "typebox";
+import type { NatsAuthTokenV1 } from "./schemas.js";
+import { AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, WaitForDeviceActivationResponseSchema } from "./protocol.js";
+export declare const DeviceActivationPayloadSchema: Type.TObject<{
+    v: Type.TLiteral<1>;
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    qrMac: Type.TString;
+}>;
+export declare const DeviceActivationWaitRequestSchema: Type.TObject<{
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    contractDigest: Type.TOptional<Type.TString>;
+    iat: Type.TNumber;
+    sig: Type.TString;
+}>;
+export type DeviceActivationPayload = StaticDecode<typeof DeviceActivationPayloadSchema>;
+export type DeviceActivationWaitRequest = StaticDecode<typeof DeviceActivationWaitRequestSchema>;
+export type WaitForDeviceActivationResponse = StaticDecode<typeof WaitForDeviceActivationResponseSchema>;
+export type AuthActivateDeviceInput = StaticDecode<typeof AuthActivateDeviceSchema>;
+export type AuthActivateDeviceOutput = StaticDecode<typeof AuthActivateDeviceResponseSchema>;
+export type AuthGetDeviceActivationStatusInput = StaticDecode<typeof AuthGetDeviceActivationStatusSchema>;
+export type AuthGetDeviceActivationStatusOutput = StaticDecode<typeof AuthGetDeviceActivationStatusResponseSchema>;
+export type AuthListDeviceActivationsInput = StaticDecode<typeof AuthListDeviceActivationsSchema>;
+export type AuthListDeviceActivationsOutput = StaticDecode<typeof AuthListDeviceActivationsResponseSchema>;
+export type AuthRevokeDeviceActivationInput = StaticDecode<typeof AuthRevokeDeviceActivationSchema>;
+export type AuthRevokeDeviceActivationResponse = StaticDecode<typeof AuthRevokeDeviceActivationResponseSchema>;
+export type GetDeviceConnectInfoInput = StaticDecode<typeof AuthGetDeviceConnectInfoSchema>;
+export type GetDeviceConnectInfoOutput = StaticDecode<typeof AuthGetDeviceConnectInfoResponseSchema>;
+export type DeviceIdentity = {
+    identitySeed: Uint8Array;
+    identitySeedBase64url: string;
+    publicIdentityKey: string;
+    activationKey: Uint8Array;
+    activationKeyBase64url: string;
+};
+type DeviceActivationRpcMethod = "Auth.ActivateDevice" | "Auth.GetDeviceActivationStatus" | "Auth.ListDeviceActivations" | "Auth.RevokeDeviceActivation" | "Auth.GetDeviceConnectInfo";
+type DeviceActivationRpcInputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceInput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusInput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsInput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationInput;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoInput;
+};
+type DeviceActivationRpcOutputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceOutput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusOutput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsOutput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationResponse;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoOutput;
+};
+type RequestClient = {
+    requestOrThrow<M extends DeviceActivationRpcMethod>(method: M, input: DeviceActivationRpcInputMap[M], opts?: unknown): Promise<DeviceActivationRpcOutputMap[M]>;
+};
+export type DeviceActivationTransport = RequestClient;
+export declare function deriveDeviceIdentity(deviceRootSecret: Uint8Array): Promise<DeviceIdentity>;
+export declare function deriveDeviceQrMac(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function buildDeviceActivationPayload(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<DeviceActivationPayload>;
+export declare function encodeDeviceActivationPayload(payload: DeviceActivationPayload): string;
+export declare function parseDeviceActivationPayload(value: string): DeviceActivationPayload;
+export declare function buildDeviceActivationUrl(args: {
+    trellisUrl: string;
+    payload: DeviceActivationPayload | string;
+}): string;
+export declare function deriveDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function verifyDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+    confirmationCode: string;
+}): Promise<boolean>;
+export declare function buildDeviceWaitProofInput(publicIdentityKey: string, nonce: string, iat: number): Uint8Array;
+export declare function signDeviceWaitRequest(args: {
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest?: string;
+    iat?: number;
+}): Promise<DeviceActivationWaitRequest>;
+export declare function createDeviceNatsAuthToken(args: {
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<NatsAuthTokenV1 & {
+    contractDigest: string;
+}>;
+export declare function waitForDeviceActivation(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+}): Promise<Extract<WaitForDeviceActivationResponse, {
+    status: "activated";
+}>>;
+export declare function getDeviceConnectInfo(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<GetDeviceConnectInfoOutput>;
+export declare function createDeviceActivationClient(client: DeviceActivationTransport): {
+    activateDevice(input: AuthActivateDeviceInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    getDeviceActivationStatus(input: AuthGetDeviceActivationStatusInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    listDeviceActivations(input?: AuthListDeviceActivationsInput): Promise<{
+        activations: {
+            activatedBy?: {
+                origin: string;
+                id: string;
+            } | undefined;
+            profileId: string;
+            instanceId: string;
+            publicIdentityKey: string;
+            state: "activated" | "revoked";
+            activatedAt: string;
+            revokedAt: string | null;
+        }[];
+    }>;
+    revokeDeviceActivation(input: AuthRevokeDeviceActivationInput): Promise<{
+        success: boolean;
+    }>;
+    getDeviceConnectInfo(input: GetDeviceConnectInfoInput): Promise<{
+        status: "ready";
+        connectInfo: {
+            contractDigest: string;
+            contractId: string;
+            profileId: string;
+            instanceId: string;
+            transport: {
+                sentinel: {
+                    jwt: string;
+                    seed: string;
+                };
+                natsServers: string[];
+            };
+            auth: {
+                mode: "device_identity";
+                iatSkewSeconds: number;
+            };
+        };
+    }>;
+};
+export declare function verifyDeviceWaitSignature(input: DeviceActivationWaitRequest): Promise<boolean>;
+export {};
+//# sourceMappingURL=device_activation.d.ts.map

package/esm/auth/device_activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device_activation.d.ts","sourceRoot":"","sources":["../../src/auth/device_activation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,2CAA2C,EAC3C,mCAAmC,EACnC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACtC,MAAM,eAAe,CAAC;AAgBvB,eAAO,MAAM,6BAA6B;;;;;EAKP,CAAC;AAEpC,eAAO,MAAM,iCAAiC;;;;;;EAMX,CAAC;AAEpC,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,YAAY,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,wBAAwB,CAChC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,mCAAmC,CAC3C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,YAAY,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,YAAY,CACvD,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,wCAAwC,CAChD,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,YAAY,CAClD,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,yBAAyB,GAC1B,qBAAqB,GACrB,gCAAgC,GAChC,4BAA4B,GAC5B,6BAA6B,GAC7B,2BAA2B,CAAC;AAEhC,KAAK,2BAA2B,GAAG;IACjC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,gCAAgC,EAAE,kCAAkC,CAAC;IACrE,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,EAAE,+BAA+B,CAAC;IAC/D,2BAA2B,EAAE,yBAAyB,CAAC;CACxD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,qBAAqB,EAAE,wBAAwB,CAAC;IAChD,gCAAgC,EAAE,mCAAmC,CAAC;IACtE,4BAA4B,EAAE,+BAA+B,CAAC;IAC9D,6BAA6B,EAAE,kCAAkC,CAAC;IAClE,2BAA2B,EAAE,0BAA0B,CAAC;CACzD,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,cAAc,CAAC,CAAC,SAAS,yBAAyB,EAChD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,2BAA2B,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,aAAa,CAAC;AA6HtD,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQnC;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAOzB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAAC;CAC3C,GAAG,MAAM,CAUT;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,UAAU,CAwBZ;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA0BvC;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBxD;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CACT,OAAO,CAAC,+BAA+B,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAClE,CAoCA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA8BtC;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,yBAAyB;0BAGT,uBAAuB;;;;;;;;;;;;;;;;;qCAGZ,kCAAkC;;;;;;;;;;;;;;;;;kCAGtC,8BAA8B;;;;;;;;;;;;;;kCAG7B,+BAA+B;;;gCAGjC,yBAAyB;;;;;;;;;;;;;;;;;;;;EAIxD;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/esm/auth/{workload_activation.js → device_activation.js}

@@ -1,21 +1,21 @@
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { importEd25519PrivateKeyFromSeedBase64url, importEd25519PublicKeyFromBase64url, publicKeyBase64urlFromPrivateKey, } from "./keys.js";
-import { AuthGetWorkloadConnectInfoResponseSchema, WaitForWorkloadActivationResponseSchema, } from "./protocol.js";
-import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8 } from "./utils.js";
-const WORKLOAD_IDENTITY_HKDF_INFO = "trellis/workload-identity/v1";
-const WORKLOAD_ACTIVATION_HKDF_INFO = "trellis/workload-activate/v1";
-const WORKLOAD_QR_MAC_DOMAIN = "trellis-workload-qr/v1";
-const WORKLOAD_CONFIRMATION_DOMAIN = "trellis-workload-confirm/v1";
+import { AuthGetDeviceConnectInfoResponseSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
+import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+const DEVICE_IDENTITY_HKDF_INFO = "trellis/device-identity/v1";
+const DEVICE_ACTIVATION_HKDF_INFO = "trellis/device-activate/v1";
+const DEVICE_QR_MAC_DOMAIN = "trellis-device-qr/v1";
+const DEVICE_CONFIRMATION_DOMAIN = "trellis-device-confirm/v1";
 const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 const DEFAULT_WAIT_POLL_INTERVAL_MS = 1_000;
-export const WorkloadActivationPayloadSchema = Type.Object({
+export const DeviceActivationPayloadSchema = Type.Object({
     v: Type.Literal(1),
     publicIdentityKey: Type.String({ minLength: 1 }),
     nonce: Type.String({ minLength: 1 }),
     qrMac: Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-export const WorkloadActivationWaitRequestSchema = Type.Object({
+export const DeviceActivationWaitRequestSchema = Type.Object({
     publicIdentityKey: Type.String({ minLength: 1 }),
     nonce: Type.String({ minLength: 1 }),
     contractDigest: Type.Optional(Type.String({ minLength: 1 })),
@@ -78,8 +78,9 @@ function normalizeCrockford(value) {
     return value.trim().toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
 }
 async function sleep(ms, signal) {
-    if (signal?.aborted)
+    if (signal?.aborted) {
         throw signal.reason ?? new DOMException("Aborted", "AbortError");
+    }
     await new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
             signal?.removeEventListener("abort", onAbort);
@@ -92,12 +93,30 @@ async function sleep(ms, signal) {
         signal?.addEventListener("abort", onAbort, { once: true });
     });
 }
-export async function deriveWorkloadIdentity(workloadRootSecret) {
-    if (workloadRootSecret.length !== 32) {
-        throw new Error(`Invalid workload root secret length: ${workloadRootSecret.length} (expected 32)`);
+async function responseErrorDetail(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.reason === "string" && parsed.reason.length > 0) {
+            return parsed.reason;
+        }
+        if (typeof parsed.message === "string" && parsed.message.length > 0) {
+            return parsed.message;
+        }
+    }
+    catch {
+        // Fall through to raw text below.
+    }
+    return text;
+}
+export async function deriveDeviceIdentity(deviceRootSecret) {
+    if (deviceRootSecret.length !== 32) {
+        throw new Error(`Invalid device root secret length: ${deviceRootSecret.length} (expected 32)`);
     }
-    const identitySeed = await hkdfSha256(workloadRootSecret, WORKLOAD_IDENTITY_HKDF_INFO, 32);
-    const activationKey = await hkdfSha256(workloadRootSecret, WORKLOAD_ACTIVATION_HKDF_INFO, 32);
+    const identitySeed = await hkdfSha256(deviceRootSecret, DEVICE_IDENTITY_HKDF_INFO, 32);
+    const activationKey = await hkdfSha256(deviceRootSecret, DEVICE_ACTIVATION_HKDF_INFO, 32);
     const identitySeedBase64url = base64urlEncode(identitySeed);
     const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(identitySeedBase64url);
     const publicIdentityKey = await publicKeyBase64urlFromPrivateKey(identityPrivateKey);
@@ -109,17 +128,17 @@ export async function deriveWorkloadIdentity(workloadRootSecret) {
         activationKeyBase64url: base64urlEncode(activationKey),
     };
 }
-export async function deriveWorkloadQrMac(input) {
+export async function deriveDeviceQrMac(input) {
     const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
     const mac = await hmacSha256(activationKey, concatBytes([
-        utf8(WORKLOAD_QR_MAC_DOMAIN),
+        utf8(DEVICE_QR_MAC_DOMAIN),
         utf8(input.publicIdentityKey),
         utf8(input.nonce),
     ]));
     return base64urlEncode(mac.slice(0, 8));
 }
-export async function buildWorkloadActivationPayload(input) {
-    const qrMac = await deriveWorkloadQrMac(input);
+export async function buildDeviceActivationPayload(input) {
+    const qrMac = await deriveDeviceQrMac(input);
     return {
         v: 1,
         publicIdentityKey: input.publicIdentityKey,
@@ -127,37 +146,40 @@ export async function buildWorkloadActivationPayload(input) {
         qrMac,
     };
 }
-export function encodeWorkloadActivationPayload(payload) {
+export function encodeDeviceActivationPayload(payload) {
     return base64urlEncode(utf8(JSON.stringify(payload)));
 }
-export function parseWorkloadActivationPayload(value) {
+export function parseDeviceActivationPayload(value) {
     const decoded = new TextDecoder().decode(base64urlDecode(value));
     const parsed = JSON.parse(decoded);
-    if (!Value.Check(WorkloadActivationPayloadSchema, parsed)) {
-        throw new Error("Invalid workload activation payload");
+    if (!Value.Check(DeviceActivationPayloadSchema, parsed)) {
+        throw new Error("Invalid device activation payload");
     }
     return parsed;
 }
-export function buildWorkloadActivationUrl(args) {
+export function buildDeviceActivationUrl(args) {
     const baseUrl = new URL(args.trellisUrl);
-    baseUrl.pathname = "/auth/workloads/activate";
-    baseUrl.searchParams.set("payload", typeof args.payload === "string" ? args.payload : encodeWorkloadActivationPayload(args.payload));
+    baseUrl.pathname = "/auth/devices/activate";
+    baseUrl.searchParams.set("payload", typeof args.payload === "string"
+        ? args.payload
+        : encodeDeviceActivationPayload(args.payload));
     return baseUrl.toString();
 }
-export async function deriveWorkloadConfirmationCode(input) {
+export async function deriveDeviceConfirmationCode(input) {
     const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
     const mac = await hmacSha256(activationKey, concatBytes([
-        utf8(WORKLOAD_CONFIRMATION_DOMAIN),
+        utf8(DEVICE_CONFIRMATION_DOMAIN),
         utf8(input.publicIdentityKey),
         utf8(input.nonce),
     ]));
     return crockfordEncode(mac.slice(0, 5)).slice(0, 8);
 }
-export async function verifyWorkloadConfirmationCode(input) {
-    const expected = await deriveWorkloadConfirmationCode(input);
-    return normalizeCrockford(expected) === normalizeCrockford(input.confirmationCode);
+export async function verifyDeviceConfirmationCode(input) {
+    const expected = await deriveDeviceConfirmationCode(input);
+    return normalizeCrockford(expected) ===
+        normalizeCrockford(input.confirmationCode);
 }
-export function buildWorkloadWaitProofInput(publicIdentityKey, nonce, iat) {
+export function buildDeviceWaitProofInput(publicIdentityKey, nonce, iat) {
     const enc = new TextEncoder();
     const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
     const nonceBytes = enc.encode(nonce);
@@ -180,11 +202,11 @@ export function buildWorkloadWaitProofInput(publicIdentityKey, nonce, iat) {
     buf.set(iatBytes, offset);
     return buf;
 }
-export async function signWorkloadWaitRequest(args) {
+export async function signDeviceWaitRequest(args) {
     const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
     const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
     const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const proofInput = buildWorkloadWaitProofInput(args.publicIdentityKey, args.nonce, iat);
+    const proofInput = buildDeviceWaitProofInput(args.publicIdentityKey, args.nonce, iat);
     const proofHash = await sha256(proofInput);
     const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, toArrayBuffer(proofHash)));
     return {
@@ -195,7 +217,7 @@ export async function signWorkloadWaitRequest(args) {
         sig: base64urlEncode(signature),
     };
 }
-export async function createWorkloadNatsAuthToken(args) {
+export async function createDeviceNatsAuthToken(args) {
     const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
     const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
     const iat = args.iat ?? Math.floor(Date.now() / 1_000);
@@ -209,35 +231,38 @@ export async function createWorkloadNatsAuthToken(args) {
         contractDigest: args.contractDigest,
     };
 }
-export async function waitForWorkloadActivation(args) {
+export async function waitForDeviceActivation(args) {
     const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_WAIT_POLL_INTERVAL_MS;
     while (true) {
-        const request = await signWorkloadWaitRequest(args);
-        const response = await fetch(new URL("/auth/workloads/activate/wait", args.trellisUrl), {
+        const request = await signDeviceWaitRequest(args);
+        const response = await fetch(new URL("/auth/devices/activate/wait", args.trellisUrl), {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(request),
             signal: args.signal,
         });
         if (!response.ok) {
-            throw new Error(`workload activation wait failed: ${response.status}`);
+            const detail = await responseErrorDetail(response);
+            throw new Error(detail
+                ? `device activation wait failed: ${response.status} ${detail}`
+                : `device activation wait failed: ${response.status}`);
         }
         const body = await response.json();
-        if (!Value.Check(WaitForWorkloadActivationResponseSchema, body)) {
-            throw new Error("Invalid workload activation wait response");
+        if (!Value.Check(WaitForDeviceActivationResponseSchema, body)) {
+            throw new Error("Invalid device activation wait response");
         }
         if (body.status === "pending") {
             await sleep(pollIntervalMs, args.signal);
             continue;
         }
         if (body.status === "rejected") {
-            throw new Error(`workload activation rejected: ${body.reason ?? "unknown_reason"}`);
+            throw new Error(`device activation rejected: ${body.reason ?? "unknown_reason"}`);
         }
         return body;
     }
 }
-export async function getWorkloadConnectInfo(args) {
-    const request = await signWorkloadWaitRequest({
+export async function getDeviceConnectInfo(args) {
+    const request = await signDeviceWaitRequest({
         publicIdentityKey: args.publicIdentityKey,
         identitySeed: args.identitySeed,
         contractDigest: args.contractDigest,
@@ -250,41 +275,41 @@ export async function getWorkloadConnectInfo(args) {
         iat: request.iat,
         sig: request.sig,
     };
-    const response = await fetch(new URL("/auth/workloads/connect-info", args.trellisUrl), {
+    const response = await fetch(new URL("/auth/devices/connect-info", args.trellisUrl), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(payload),
     });
     if (!response.ok) {
-        throw new Error(`workload connect info failed: ${response.status}`);
+        throw new Error(`device connect info failed: ${response.status}`);
     }
     const body = await response.json();
-    if (!Value.Check(AuthGetWorkloadConnectInfoResponseSchema, body)) {
-        throw new Error("Invalid workload connect info response");
+    if (!Value.Check(AuthGetDeviceConnectInfoResponseSchema, body)) {
+        throw new Error("Invalid device connect info response");
     }
     return body;
 }
-export function createWorkloadActivationClient(client) {
+export function createDeviceActivationClient(client) {
     return {
-        activateWorkload(input) {
-            return client.requestOrThrow("Auth.ActivateWorkload", input);
+        activateDevice(input) {
+            return client.requestOrThrow("Auth.ActivateDevice", input);
         },
-        getWorkloadActivationStatus(input) {
-            return client.requestOrThrow("Auth.GetWorkloadActivationStatus", input);
+        getDeviceActivationStatus(input) {
+            return client.requestOrThrow("Auth.GetDeviceActivationStatus", input);
         },
-        listWorkloadActivations(input = {}) {
-            return client.requestOrThrow("Auth.ListWorkloadActivations", input);
+        listDeviceActivations(input = {}) {
+            return client.requestOrThrow("Auth.ListDeviceActivations", input);
         },
-        revokeWorkloadActivation(input) {
-            return client.requestOrThrow("Auth.RevokeWorkloadActivation", input);
+        revokeDeviceActivation(input) {
+            return client.requestOrThrow("Auth.RevokeDeviceActivation", input);
         },
-        getWorkloadConnectInfo(input) {
-            return client.requestOrThrow("Auth.GetWorkloadConnectInfo", input);
+        getDeviceConnectInfo(input) {
+            return client.requestOrThrow("Auth.GetDeviceConnectInfo", input);
         },
     };
 }
-export async function verifyWorkloadWaitSignature(input) {
+export async function verifyDeviceWaitSignature(input) {
     const publicKey = await importEd25519PublicKeyFromBase64url(input.publicIdentityKey);
-    const proofHash = await sha256(buildWorkloadWaitProofInput(input.publicIdentityKey, input.nonce, input.iat));
+    const proofHash = await sha256(buildDeviceWaitProofInput(input.publicIdentityKey, input.nonce, input.iat));
     return await crypto.subtle.verify("Ed25519", publicKey, toArrayBuffer(base64urlDecode(input.sig)), toArrayBuffer(proofHash));
 }

package/esm/auth/mod.d.ts

@@ -7,10 +7,10 @@
  * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
  * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
  */
-export { buildWorkloadActivationPayload, buildWorkloadActivationUrl, buildWorkloadWaitProofInput, createWorkloadNatsAuthToken, createWorkloadActivationClient, deriveWorkloadConfirmationCode, deriveWorkloadIdentity, deriveWorkloadQrMac, encodeWorkloadActivationPayload, getWorkloadConnectInfo, parseWorkloadActivationPayload, signWorkloadWaitRequest, verifyWorkloadConfirmationCode, verifyWorkloadWaitSignature, waitForWorkloadActivation, type AuthActivateWorkloadInput, type AuthActivateWorkloadOutput, type AuthListWorkloadActivationsInput, type AuthListWorkloadActivationsOutput, type AuthRevokeWorkloadActivationInput, type AuthRevokeWorkloadActivationResponse, type GetWorkloadConnectInfoInput, type GetWorkloadConnectInfoOutput, type WaitForWorkloadActivationResponse, type WorkloadActivationPayload, type WorkloadActivationTransport, type WorkloadActivationWaitRequest, type WorkloadIdentity, } from "./workload_activation.js";
+export { type AuthActivateDeviceInput, type AuthActivateDeviceOutput, type AuthGetDeviceActivationStatusInput, type AuthGetDeviceActivationStatusOutput, type AuthListDeviceActivationsInput, type AuthListDeviceActivationsOutput, type AuthRevokeDeviceActivationInput, type AuthRevokeDeviceActivationResponse, buildDeviceActivationPayload, buildDeviceActivationUrl, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, encodeDeviceActivationPayload, getDeviceConnectInfo, type GetDeviceConnectInfoInput, type GetDeviceConnectInfoOutput, parseDeviceActivationPayload, signDeviceWaitRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, type DeviceActivationPayload, type DeviceActivationWaitRequest, type WaitForDeviceActivationResponse, type DeviceActivationTransport, type DeviceIdentity, } from "./device_activation.js";
 export { type AuthConfig, bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, signBytes, submitPortalApproval, } from "./browser.js";
 export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthActivateWorkloadResponseSchema, AuthActivateWorkloadSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthClearWorkloadPortalSelectionResponseSchema, AuthClearWorkloadPortalSelectionSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateWorkloadProfileResponseSchema, AuthCreateWorkloadProfileSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, type PortalFlowUser, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthDisableWorkloadInstanceResponseSchema, AuthDisableWorkloadInstanceSchema, AuthDisableWorkloadProfileResponseSchema, AuthDisableWorkloadProfileSchema, AuthGetWorkloadConnectInfoResponseSchema, AuthGetWorkloadConnectInfoSchema, AuthGetWorkloadPortalDefaultResponseSchema, AuthGetWorkloadPortalDefaultSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListWorkloadPortalSelectionsResponseSchema, AuthListWorkloadPortalSelectionsSchema, AuthListWorkloadActivationReviewsResponseSchema, AuthListWorkloadActivationReviewsSchema, AuthListWorkloadActivationsResponseSchema, AuthListWorkloadActivationsSchema, AuthGetWorkloadActivationStatusResponseSchema, AuthGetWorkloadActivationStatusSchema, AuthListWorkloadInstancesResponseSchema, AuthListWorkloadInstancesSchema, AuthListWorkloadProfilesResponseSchema, AuthListWorkloadProfilesSchema, AuthProvisionWorkloadInstanceResponseSchema, AuthProvisionWorkloadInstanceSchema, AuthDecideWorkloadActivationReviewResponseSchema, AuthDecideWorkloadActivationReviewSchema, AuthWorkloadActivationReviewRequestedEventSchema, AuthRevokeWorkloadActivationResponseSchema, AuthRevokeWorkloadActivationSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetWorkloadPortalDefaultResponseSchema, AuthSetWorkloadPortalDefaultSchema, AuthSetWorkloadPortalSelectionResponseSchema, AuthSetWorkloadPortalSelectionSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, type AuthMeResponse, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, type AuthenticatedService, type AuthenticatedUser, type AuthenticatedWorkload, AuthenticatedWorkloadSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalSchema, PortalFlowStateSchema, ServiceViewSchema, UserViewSchema, WaitForWorkloadActivationResponseSchema, WorkloadActivationReviewSchema, WorkloadPortalDefaultSchema, WorkloadPortalSelectionSchema, WorkloadActivationRecordSchema, type WorkloadActivationRecord, WorkloadConnectInfoSchema, WorkloadProfileSchema, WorkloadSchema, } from "./protocol.js";
+export { ApprovalRecordViewSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceProfileResponseSchema, AuthCreateDeviceProfileSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisableDeviceProfileResponseSchema, AuthDisableDeviceProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, type AuthenticatedDevice, AuthenticatedDeviceSchema, type AuthenticatedService, type AuthenticatedUser, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListDeviceProfilesResponseSchema, AuthListDeviceProfilesSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, type AuthMeResponse, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, type DeviceActivationRecord, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, type DevicePortalDefault, DevicePortalDefaultSchema, type DevicePortalSelection, DevicePortalSelectionSchema, DeviceProfileSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, type InstanceGrantPolicy, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, PortalFlowStateSchema, type PortalFlowUser, PortalSchema, ServiceViewSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
 export { type ApprovalDecision, ApprovalDecisionSchema, type BindRequest, BindRequestSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ContractApproval, ContractApprovalSchema, type LoginQuery, LoginQuerySchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, } from "./schemas.js";
 export { createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.js";
 export { trellisIdFromOriginId } from "./trellis_id.js";

package/esm/auth/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EACzC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,EACtC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,SAAS,EACT,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,0BAA0B,EAC1B,2CAA2C,EAC3C,mCAAmC,EACnC,8CAA8C,EAC9C,sCAAsC,EACtC,8BAA8B,EAC9B,sBAAsB,EACtB,uCAAuC,EACvC,+BAA+B,EAC/B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,+BAA+B,EAC/B,uBAAuB,EACvB,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,wCAAwC,EACxC,gCAAgC,EAChC,0CAA0C,EAC1C,kCAAkC,EAClC,2CAA2C,EAC3C,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACpB,8CAA8C,EAC9C,sCAAsC,EACtC,+CAA+C,EAC/C,uCAAuC,EACvC,yCAAyC,EACzC,iCAAiC,EACjC,6CAA6C,EAC7C,qCAAqC,EACrC,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,2CAA2C,EAC3C,mCAAmC,EACpC,gDAAgD,EAChD,wCAAwC,EACxC,gDAAgD,EAChD,0CAA0C,EACzC,kCAAkC,EACnC,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,0CAA0C,EAC1C,kCAAkC,EAClC,4CAA4C,EAC5C,oCAAoC,EACpC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,wCAAwC,EACxC,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACb,uCAAuC,EACxC,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,WAAW,EAChB,iBAAiB,EACjB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,SAAS,EACT,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,4CAA4C,EAC5C,oCAAoC,EACpC,2CAA2C,EAC3C,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,sBAAsB,EACtB,8CAA8C,EAC9C,sCAAsC,EACtC,8CAA8C,EAC9C,uCAAuC,EACvC,+BAA+B,EAC/B,4CAA4C,EAC5C,oCAAoC,EACpC,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,2CAA2C,EAC3C,mCAAmC,EACnC,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,6CAA6C,EAC7C,qCAAqC,EACrC,uCAAuC,EACvC,+BAA+B,EAC/B,qCAAqC,EACrC,6BAA6B,EAC7B,2CAA2C,EAC3C,mCAAmC,EACnC,4CAA4C,EAC5C,oCAAoC,EACpC,oCAAoC,EACpC,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,2CAA2C,EAC3C,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,EAChC,wBAAwB,EACxB,wCAAwC,EACxC,gCAAgC,EAChC,wCAAwC,EACxC,gCAAgC,EAChC,0CAA0C,EAC1C,kCAAkC,EAClC,2CAA2C,EAC3C,mCAAmC,EACnC,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,4BAA4B,EAC5B,oBAAoB,EACpB,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,WAAW,EAChB,iBAAiB,EACjB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/esm/auth/mod.js

@@ -7,10 +7,10 @@
  * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
  * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
  */
-export { buildWorkloadActivationPayload, buildWorkloadActivationUrl, buildWorkloadWaitProofInput, createWorkloadNatsAuthToken, createWorkloadActivationClient, deriveWorkloadConfirmationCode, deriveWorkloadIdentity, deriveWorkloadQrMac, encodeWorkloadActivationPayload, getWorkloadConnectInfo, parseWorkloadActivationPayload, signWorkloadWaitRequest, verifyWorkloadConfirmationCode, verifyWorkloadWaitSignature, waitForWorkloadActivation, } from "./workload_activation.js";
+export { buildDeviceActivationPayload, buildDeviceActivationUrl, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, encodeDeviceActivationPayload, getDeviceConnectInfo, parseDeviceActivationPayload, signDeviceWaitRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, } from "./device_activation.js";
 export { bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, submitPortalApproval, } from "./browser.js";
 export { buildProofInput, createProof, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthActivateWorkloadResponseSchema, AuthActivateWorkloadSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthClearWorkloadPortalSelectionResponseSchema, AuthClearWorkloadPortalSelectionSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateWorkloadProfileResponseSchema, AuthCreateWorkloadProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthDisableWorkloadInstanceResponseSchema, AuthDisableWorkloadInstanceSchema, AuthDisableWorkloadProfileResponseSchema, AuthDisableWorkloadProfileSchema, AuthGetWorkloadConnectInfoResponseSchema, AuthGetWorkloadConnectInfoSchema, AuthGetWorkloadPortalDefaultResponseSchema, AuthGetWorkloadPortalDefaultSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListWorkloadPortalSelectionsResponseSchema, AuthListWorkloadPortalSelectionsSchema, AuthListWorkloadActivationReviewsResponseSchema, AuthListWorkloadActivationReviewsSchema, AuthListWorkloadActivationsResponseSchema, AuthListWorkloadActivationsSchema, AuthGetWorkloadActivationStatusResponseSchema, AuthGetWorkloadActivationStatusSchema, AuthListWorkloadInstancesResponseSchema, AuthListWorkloadInstancesSchema, AuthListWorkloadProfilesResponseSchema, AuthListWorkloadProfilesSchema, AuthProvisionWorkloadInstanceResponseSchema, AuthProvisionWorkloadInstanceSchema, AuthDecideWorkloadActivationReviewResponseSchema, AuthDecideWorkloadActivationReviewSchema, AuthWorkloadActivationReviewRequestedEventSchema, AuthRevokeWorkloadActivationResponseSchema, AuthRevokeWorkloadActivationSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetWorkloadPortalDefaultResponseSchema, AuthSetWorkloadPortalDefaultSchema, AuthSetWorkloadPortalSelectionResponseSchema, AuthSetWorkloadPortalSelectionSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, AuthenticatedWorkloadSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalSchema, PortalFlowStateSchema, ServiceViewSchema, UserViewSchema, WaitForWorkloadActivationResponseSchema, WorkloadActivationReviewSchema, WorkloadPortalDefaultSchema, WorkloadPortalSelectionSchema, WorkloadActivationRecordSchema, WorkloadConnectInfoSchema, WorkloadProfileSchema, WorkloadSchema, } from "./protocol.js";
+export { ApprovalRecordViewSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceProfileResponseSchema, AuthCreateDeviceProfileSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisableDeviceProfileResponseSchema, AuthDisableDeviceProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthenticatedDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListDeviceProfilesResponseSchema, AuthListDeviceProfilesSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DevicePortalDefaultSchema, DevicePortalSelectionSchema, DeviceProfileSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalFlowStateSchema, PortalSchema, ServiceViewSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
 export { ApprovalDecisionSchema, BindRequestSchema, BindResponseSchema, BindSuccessResponseSchema, ContractApprovalSchema, LoginQuerySchema, NatsAuthTokenV1Schema, SentinelCredsSchema, } from "./schemas.js";
 export { createAuth, } from "./session_auth.js";
 export { trellisIdFromOriginId } from "./trellis_id.js";