@qlever-llc/trellis 0.7.0 → 0.8.0-rc.3

package/esm/auth/device_activation.js

@@ -3,12 +3,13 @@ import { Value } from "typebox/value";
 import { importEd25519PrivateKeyFromSeedBase64url, importEd25519PublicKeyFromBase64url, publicKeyBase64urlFromPrivateKey, } from "./keys.js";
 import { AuthGetDeviceConnectInfoResponseSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
 import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+import { buildNatsConnectSignaturePayload } from "./session_auth.js";
 const DEVICE_IDENTITY_HKDF_INFO = "trellis/device-identity/v1";
 const DEVICE_ACTIVATION_HKDF_INFO = "trellis/device-activate/v1";
 const DEVICE_QR_MAC_DOMAIN = "trellis-device-qr/v1";
 const DEVICE_CONFIRMATION_DOMAIN = "trellis-device-confirm/v1";
 const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-const DEFAULT_WAIT_POLL_INTERVAL_MS = 1_000;
+const DEFAULT_WAIT_POLL_INTERVAL_MS = 3_000;
 export const DeviceActivationPayloadSchema = Type.Object({
     v: Type.Literal(1),
     publicIdentityKey: Type.String({ minLength: 1 }),
@@ -93,6 +94,18 @@ async function sleep(ms, signal) {
         signal?.addEventListener("abort", onAbort, { once: true });
     });
 }
+function retryAfterDelayMs(response) {
+    const value = response.headers.get("Retry-After");
+    if (!value)
+        return null;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return seconds * 1_000;
+    const dateMs = Date.parse(value);
+    if (!Number.isFinite(dateMs))
+        return null;
+    return Math.max(0, dateMs - Date.now());
+}
 async function responseErrorDetail(response) {
     const text = await response.text();
     if (!text)
@@ -168,14 +181,16 @@ export async function startDeviceActivationRequest(args) {
         throw new Error(`Device activation request failed: ${response.status}${detail ? ` ${detail}` : ""}`);
     }
     const parsed = await response.json();
-    if (typeof parsed.flowId !== "string" || typeof parsed.instanceId !== "string" ||
-        typeof parsed.profileId !== "string" || typeof parsed.activationUrl !== "string") {
+    if (typeof parsed.flowId !== "string" ||
+        typeof parsed.instanceId !== "string" ||
+        typeof parsed.deploymentId !== "string" ||
+        typeof parsed.activationUrl !== "string") {
         throw new Error("Device activation request returned an invalid response");
     }
     return {
         flowId: parsed.flowId,
         instanceId: parsed.instanceId,
-        profileId: parsed.profileId,
+        deploymentId: parsed.deploymentId,
         activationUrl: parsed.activationUrl,
     };
 }
@@ -193,14 +208,16 @@ export async function verifyDeviceConfirmationCode(input) {
     return normalizeCrockford(expected) ===
         normalizeCrockford(input.confirmationCode);
 }
-export function buildDeviceWaitProofInput(publicIdentityKey, nonce, iat) {
+export function buildDeviceWaitProofInput(publicIdentityKey, nonce, iat, contractDigest) {
     const enc = new TextEncoder();
     const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
     const nonceBytes = enc.encode(nonce);
     const iatBytes = enc.encode(String(iat));
+    const contractDigestBytes = enc.encode(contractDigest ?? "");
     const buf = new Uint8Array(4 + publicIdentityKeyBytes.length +
         4 + nonceBytes.length +
-        4 + iatBytes.length);
+        4 + iatBytes.length +
+        4 + contractDigestBytes.length);
     const view = new DataView(buf.buffer);
     let offset = 0;
     view.setUint32(offset, publicIdentityKeyBytes.length);
@@ -214,13 +231,17 @@ export function buildDeviceWaitProofInput(publicIdentityKey, nonce, iat) {
     view.setUint32(offset, iatBytes.length);
     offset += 4;
     buf.set(iatBytes, offset);
+    offset += iatBytes.length;
+    view.setUint32(offset, contractDigestBytes.length);
+    offset += 4;
+    buf.set(contractDigestBytes, offset);
     return buf;
 }
 export async function signDeviceWaitRequest(args) {
     const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
     const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
     const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const proofInput = buildDeviceWaitProofInput(args.publicIdentityKey, args.nonce, iat);
+    const proofInput = buildDeviceWaitProofInput(args.publicIdentityKey, args.nonce, iat, args.contractDigest);
     const proofHash = await sha256(proofInput);
     const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, toArrayBuffer(proofHash)));
     return {
@@ -235,7 +256,7 @@ export async function createDeviceNatsAuthToken(args) {
     const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
     const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
     const iat = args.iat ?? Math.floor(Date.now() / 1_000);
-    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(utf8(`nats-connect:${iat}`)));
+    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(utf8(`nats-connect:${buildNatsConnectSignaturePayload(iat, args.contractDigest)}`)));
     const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, digest));
     return {
         v: 1,
@@ -266,6 +287,13 @@ export async function waitForDeviceActivation(args) {
             continue;
         }
         if (!response.ok) {
+            if (response.status === 429) {
+                const retryAfterMs = retryAfterDelayMs(response);
+                await sleep(retryAfterMs === null
+                    ? pollIntervalMs
+                    : Math.max(pollIntervalMs, retryAfterMs), args.signal);
+                continue;
+            }
             const detail = await responseErrorDetail(response);
             throw new Error(detail
                 ? `device activation wait failed: ${response.status} ${detail}`
@@ -316,24 +344,22 @@ export async function getDeviceConnectInfo(args) {
 export function createDeviceActivationClient(client) {
     return {
         activateDevice(input) {
-            return client.requestOrThrow("Auth.ActivateDevice", input);
-        },
-        getDeviceActivationStatus(input) {
-            return client.requestOrThrow("Auth.GetDeviceActivationStatus", input);
+            return client.operation("Auth.ActivateDevice").input(input).start()
+                .orThrow();
         },
         listDeviceActivations(input = {}) {
-            return client.requestOrThrow("Auth.ListDeviceActivations", input);
+            return client.request("Auth.ListDeviceActivations", input).orThrow();
         },
         revokeDeviceActivation(input) {
-            return client.requestOrThrow("Auth.RevokeDeviceActivation", input);
+            return client.request("Auth.RevokeDeviceActivation", input).orThrow();
         },
         getDeviceConnectInfo(input) {
-            return client.requestOrThrow("Auth.GetDeviceConnectInfo", input);
+            return client.request("Auth.GetDeviceConnectInfo", input).orThrow();
         },
     };
 }
 export async function verifyDeviceWaitSignature(input) {
     const publicKey = await importEd25519PublicKeyFromBase64url(input.publicIdentityKey);
-    const proofHash = await sha256(buildDeviceWaitProofInput(input.publicIdentityKey, input.nonce, input.iat));
+    const proofHash = await sha256(buildDeviceWaitProofInput(input.publicIdentityKey, input.nonce, input.iat, input.contractDigest));
     return await crypto.subtle.verify("Ed25519", publicKey, toArrayBuffer(base64urlDecode(input.sig)), toArrayBuffer(proofHash));
 }

package/esm/auth/keys.d.ts

@@ -1,4 +1,7 @@
 export declare function pkcs8FromEd25519Seed(seed32: Uint8Array): Uint8Array;
+export declare function publicKeyBase64urlFromSeed(seed32: Uint8Array): string;
+export declare function signEd25519SeedDetached(seed32: Uint8Array, data: Uint8Array): Uint8Array;
+export declare function signEd25519SeedSha256(seed32: Uint8Array, data: Uint8Array): Uint8Array;
 export declare function importEd25519PrivateKeyFromSeedBase64url(seedBase64url: string): Promise<CryptoKey>;
 export declare function publicKeyBase64urlFromPrivateKey(privateKey: CryptoKey): Promise<string>;
 export declare function importEd25519PublicKeyFromBase64url(publicKeyBase64url: string): Promise<CryptoKey>;

package/esm/auth/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/auth/keys.ts"],"names":[],"mappings":"AAqBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAQnE;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAapB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAYpB"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../auth/keys.ts"],"names":[],"mappings":"AAwBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAUnE;AAeD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,UAAU,CAKZ;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAepB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAcpB"}

package/esm/auth/keys.js

@@ -1,4 +1,6 @@
-import { base64urlDecode, toArrayBuffer } from "./utils.js";
+import { sha256 } from "js-sha256";
+import nacl from "tweetnacl";
+import { base64urlDecode, base64urlEncode, toArrayBuffer } from "./utils.js";
 const ED25519_PKCS8_PREFIX = Uint8Array.from([
     0x30,
     0x2e,
@@ -26,6 +28,24 @@ export function pkcs8FromEd25519Seed(seed32) {
     pkcs8.set(seed32, ED25519_PKCS8_PREFIX.length);
     return pkcs8;
 }
+function validateEd25519Seed(seed32) {
+    if (seed32.length !== 32) {
+        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
+    }
+    return seed32;
+}
+function ed25519KeyPairFromSeed(seed32) {
+    return nacl.sign.keyPair.fromSeed(validateEd25519Seed(seed32));
+}
+export function publicKeyBase64urlFromSeed(seed32) {
+    return base64urlEncode(ed25519KeyPairFromSeed(seed32).publicKey);
+}
+export function signEd25519SeedDetached(seed32, data) {
+    return nacl.sign.detached(data, ed25519KeyPairFromSeed(seed32).secretKey);
+}
+export function signEd25519SeedSha256(seed32, data) {
+    return signEd25519SeedDetached(seed32, new Uint8Array(sha256.arrayBuffer(data)));
+}
 export async function importEd25519PrivateKeyFromSeedBase64url(seedBase64url) {
     const seed = base64urlDecode(seedBase64url);
     if (seed.length !== 32) {

package/esm/auth/mod.d.ts

@@ -7,12 +7,13 @@
  * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
  * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
  */
-export { type AuthActivateDeviceInput, type AuthActivateDeviceOutput, type AuthGetDeviceActivationStatusInput, type AuthGetDeviceActivationStatusOutput, type AuthListDeviceActivationsInput, type AuthListDeviceActivationsOutput, type AuthRevokeDeviceActivationInput, type AuthRevokeDeviceActivationResponse, buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, type DeviceActivationPayload, type DeviceActivationTransport, type DeviceActivationWaitRequest, type DeviceIdentity, encodeDeviceActivationPayload, getDeviceConnectInfo, type GetDeviceConnectInfoInput, type GetDeviceConnectInfoOutput, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, type WaitForDeviceActivationResponse, } from "./device_activation.js";
-export { type AuthConfig, bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
-export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthApplyDeviceProfileContractResponseSchema, AuthApplyDeviceProfileContractSchema, AuthApplyServiceProfileContractResponseSchema, AuthApplyServiceProfileContractSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceProfileResponseSchema, AuthCreateDeviceProfileSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateServiceProfileResponseSchema, AuthCreateServiceProfileSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableDeviceProfileResponseSchema, AuthDisableDeviceProfileSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthDisableServiceInstanceResponseSchema, AuthDisableServiceInstanceSchema, AuthDisableServiceProfileResponseSchema, AuthDisableServiceProfileSchema, AuthEnableDeviceInstanceResponseSchema, AuthEnableDeviceInstanceSchema, AuthEnableDeviceProfileResponseSchema, AuthEnableDeviceProfileSchema, AuthEnableServiceInstanceResponseSchema, AuthEnableServiceInstanceSchema, AuthEnableServiceProfileResponseSchema, AuthEnableServiceProfileSchema, type AuthenticatedDevice, AuthenticatedDeviceSchema, type AuthenticatedService, type AuthenticatedUser, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListDeviceProfilesResponseSchema, AuthListDeviceProfilesSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServiceInstancesResponseSchema, AuthListServiceInstancesSchema, AuthListServiceProfilesResponseSchema, AuthListServiceProfilesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, type AuthMeResponse, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthProvisionServiceInstanceResponseSchema, AuthProvisionServiceInstanceSchema, AuthRemoveDeviceInstanceResponseSchema, AuthRemoveDeviceInstanceSchema, AuthRemoveDeviceProfileResponseSchema, AuthRemoveDeviceProfileSchema, AuthRemoveServiceInstanceResponseSchema, AuthRemoveServiceInstanceSchema, AuthRemoveServiceProfileResponseSchema, AuthRemoveServiceProfileSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthUnapplyDeviceProfileContractResponseSchema, AuthUnapplyDeviceProfileContractSchema, AuthUnapplyServiceProfileContractResponseSchema, AuthUnapplyServiceProfileContractSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, type DeviceActivationRecord, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, type DevicePortalDefault, DevicePortalDefaultSchema, type DevicePortalSelection, DevicePortalSelectionSchema, DeviceProfileSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, type InstanceGrantPolicy, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, PortalFlowStateSchema, type PortalFlowUser, PortalSchema, ServiceInstanceSchema, ServiceProfileSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-export { type ApprovalDecision, ApprovalDecisionSchema, type AuthStartFlowResponse, AuthStartFlowResponseSchema, type AuthStartRequest, AuthStartRequestSchema, type AuthStartResponse, AuthStartResponseSchema, type BindRequest, BindRequestSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ClientTransportEndpoints, ClientTransportEndpointsSchema, type ClientTransports, ClientTransportsSchema, type ContractApproval, ContractApprovalSchema, type LoginQuery, LoginQuerySchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, } from "./schemas.js";
-export { createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.js";
-export { trellisIdFromOriginId } from "./trellis_id.js";
-export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";
+export { type AuthActivateDeviceInput, type AuthActivateDeviceOperation, type AuthActivateDeviceOutput, type AuthActivateDeviceProgress, type AuthListDeviceActivationsInput, type AuthListDeviceActivationsOutput, type AuthRevokeDeviceActivationInput, type AuthRevokeDeviceActivationResponse, buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, type DeviceActivationPayload, type DeviceActivationTransport, type DeviceActivationWaitRequest, type DeviceIdentity, encodeDeviceActivationPayload, getDeviceConnectInfo, type GetDeviceConnectInfoInput, type GetDeviceConnectInfoOutput, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, type WaitForDeviceActivationResponse, } from "./device_activation.ts";
+export { type AuthConfig, bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.ts";
+export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.ts";
+export { ApprovalRecordViewSchema, AuthActivateDeviceProgressSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthApplyDeviceDeploymentContractResponseSchema, AuthApplyDeviceDeploymentContractSchema, AuthApplyServiceDeploymentContractResponseSchema, AuthApplyServiceDeploymentContractSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceDeploymentResponseSchema, AuthCreateDeviceDeploymentSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateServiceDeploymentResponseSchema, AuthCreateServiceDeploymentSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivatedEventSchema, AuthDeviceActivationApprovedEventSchema, AuthDeviceActivationRequestedEventSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceDeploymentResponseSchema, AuthDisableDeviceDeploymentSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisablePortalProfileResponseSchema, AuthDisablePortalProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthDisableServiceDeploymentResponseSchema, AuthDisableServiceDeploymentSchema, AuthDisableServiceInstanceResponseSchema, AuthDisableServiceInstanceSchema, AuthEnableDeviceDeploymentResponseSchema, AuthEnableDeviceDeploymentSchema, AuthEnableDeviceInstanceResponseSchema, AuthEnableDeviceInstanceSchema, AuthEnableServiceDeploymentResponseSchema, AuthEnableServiceDeploymentSchema, AuthEnableServiceInstanceResponseSchema, AuthEnableServiceInstanceSchema, type AuthenticatedDevice, AuthenticatedDeviceSchema, type AuthenticatedService, type AuthenticatedUser, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceDeploymentsResponseSchema, AuthListDeviceDeploymentsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalProfilesResponseSchema, AuthListPortalProfilesSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServiceDeploymentsResponseSchema, AuthListServiceDeploymentsSchema, AuthListServiceInstancesResponseSchema, AuthListServiceInstancesSchema, AuthListUserGrantsResponseSchema, AuthListUserGrantsSchema, AuthListUsersResponseSchema, AuthListUsersSchema, type AuthMeResponse, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthProvisionServiceInstanceResponseSchema, AuthProvisionServiceInstanceSchema, AuthRemoveDeviceDeploymentResponseSchema, AuthRemoveDeviceDeploymentSchema, AuthRemoveDeviceInstanceResponseSchema, AuthRemoveDeviceInstanceSchema, AuthRemoveServiceDeploymentResponseSchema, AuthRemoveServiceDeploymentSchema, AuthRemoveServiceInstanceResponseSchema, AuthRemoveServiceInstanceSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthRevokeUserGrantResponseSchema, AuthRevokeUserGrantSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetPortalProfileResponseSchema, AuthSetPortalProfileSchema, AuthUnapplyDeviceDeploymentContractResponseSchema, AuthUnapplyDeviceDeploymentContractSchema, AuthUnapplyServiceDeploymentContractResponseSchema, AuthUnapplyServiceDeploymentContractSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, type DeviceActivationRecord, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, type DevicePortalDefault, DevicePortalDefaultSchema, type DevicePortalSelection, DevicePortalSelectionSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, type InstanceGrantPolicy, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, type ParticipantKind, ParticipantKindSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, PortalFlowStateSchema, type PortalFlowUser, type PortalProfile, PortalProfileSchema, PortalSchema, ServiceDeploymentSchema, ServiceInstanceSchema, UserGrantViewSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.ts";
+export { type ApprovalDecision, ApprovalDecisionSchema, type AuthStartFlowResponse, AuthStartFlowResponseSchema, type AuthStartRequest, AuthStartRequestSchema, type AuthStartResponse, AuthStartResponseSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ClientTransportEndpoints, ClientTransportEndpointsSchema, type ClientTransports, ClientTransportsSchema, type ContractApproval, ContractApprovalSchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, type UserParticipantKind, UserParticipantKindSchema, } from "./schemas.ts";
+export { buildNatsConnectSignaturePayload, createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.ts";
+export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.ts";
+export { trellisIdFromOriginId } from "./trellis_id.ts";
+export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.ts";
 //# sourceMappingURL=mod.d.ts.map

package/esm/auth/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,GACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,SAAS,EACT,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,4CAA4C,EAC5C,oCAAoC,EACpC,6CAA6C,EAC7C,qCAAqC,EACrC,4CAA4C,EAC5C,oCAAoC,EACpC,2CAA2C,EAC3C,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,sBAAsB,EACtB,sCAAsC,EACtC,8BAA8B,EAC9B,8CAA8C,EAC9C,sCAAsC,EACtC,8CAA8C,EAC9C,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,4CAA4C,EAC5C,oCAAoC,EACpC,+BAA+B,EAC/B,uBAAuB,EACvB,wCAAwC,EACxC,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,2CAA2C,EAC3C,mCAAmC,EACnC,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,uBAAuB,EACvB,6CAA6C,EAC7C,qCAAqC,EACrC,uCAAuC,EACvC,+BAA+B,EAC/B,qCAAqC,EACrC,6BAA6B,EAC7B,4CAA4C,EAC5C,oCAAoC,EACpC,oCAAoC,EACpC,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,2CAA2C,EAC3C,mCAAmC,EACnC,2CAA2C,EAC3C,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,yCAAyC,EACzC,iCAAiC,EACjC,0CAA0C,EAC1C,kCAAkC,EAClC,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,EACxB,wCAAwC,EACxC,gCAAgC,EAChC,wCAAwC,EACxC,gCAAgC,EAChC,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,8CAA8C,EAC9C,sCAAsC,EACtC,+CAA+C,EAC/C,uCAAuC,EACvC,4BAA4B,EAC5B,oBAAoB,EACpB,2CAA2C,EAC3C,mCAAmC,EACnC,iCAAiC,EACjC,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,WAAW,EAChB,iBAAiB,EACjB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,GACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,SAAS,EACT,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,gCAAgC,EAChC,wBAAwB,EACxB,+CAA+C,EAC/C,uCAAuC,EACvC,gDAAgD,EAChD,wCAAwC,EACxC,4CAA4C,EAC5C,oCAAoC,EACpC,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EACxC,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,yCAAyC,EACzC,iCAAiC,EACjC,8CAA8C,EAC9C,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,wCAAwC,EACxC,8CAA8C,EAC9C,yCAAyC,EACzC,iCAAiC,EACjC,uCAAuC,EACvC,+BAA+B,EAC/B,4CAA4C,EAC5C,oCAAoC,EACpC,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,uBAAuB,EACvB,0CAA0C,EAC1C,kCAAkC,EAClC,wCAAwC,EACxC,gCAAgC,EAChC,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,yCAAyC,EACzC,iCAAiC,EACjC,uCAAuC,EACvC,+BAA+B,EAC/B,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,uBAAuB,EACvB,6CAA6C,EAC7C,qCAAqC,EACrC,uCAAuC,EACvC,+BAA+B,EAC/B,uCAAuC,EACvC,+BAA+B,EAC/B,qCAAqC,EACrC,6BAA6B,EAC7B,4CAA4C,EAC5C,oCAAoC,EACpC,wCAAwC,EACxC,gCAAgC,EAChC,2CAA2C,EAC3C,mCAAmC,EACnC,2CAA2C,EAC3C,mCAAmC,EACnC,oCAAoC,EACpC,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,yCAAyC,EACzC,iCAAiC,EACjC,0CAA0C,EAC1C,kCAAkC,EAClC,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,yCAAyC,EACzC,iCAAiC,EACjC,uCAAuC,EACvC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,yBAAyB,EACzB,wCAAwC,EACxC,gCAAgC,EAChC,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,iDAAiD,EACjD,yCAAyC,EACzC,kDAAkD,EAClD,0CAA0C,EAC1C,4BAA4B,EAC5B,oBAAoB,EACpB,2CAA2C,EAC3C,mCAAmC,EACnC,iCAAiC,EACjC,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,mBAAmB,EACnB,YAAY,EACZ,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gCAAgC,EAChC,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/esm/auth/mod.js

@@ -8,10 +8,11 @@
  * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
  */
 export { buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, encodeDeviceActivationPayload, getDeviceConnectInfo, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, } from "./device_activation.js";
-export { bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
+export { bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
 export { buildProofInput, createProof, verifyProof, } from "./proof.js";
-export { ApprovalRecordViewSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthApplyDeviceProfileContractResponseSchema, AuthApplyDeviceProfileContractSchema, AuthApplyServiceProfileContractResponseSchema, AuthApplyServiceProfileContractSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceProfileResponseSchema, AuthCreateDeviceProfileSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateServiceProfileResponseSchema, AuthCreateServiceProfileSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableDeviceProfileResponseSchema, AuthDisableDeviceProfileSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthDisableServiceInstanceResponseSchema, AuthDisableServiceInstanceSchema, AuthDisableServiceProfileResponseSchema, AuthDisableServiceProfileSchema, AuthEnableDeviceInstanceResponseSchema, AuthEnableDeviceInstanceSchema, AuthEnableDeviceProfileResponseSchema, AuthEnableDeviceProfileSchema, AuthEnableServiceInstanceResponseSchema, AuthEnableServiceInstanceSchema, AuthEnableServiceProfileResponseSchema, AuthEnableServiceProfileSchema, AuthenticatedDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListDeviceProfilesResponseSchema, AuthListDeviceProfilesSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServiceInstancesResponseSchema, AuthListServiceInstancesSchema, AuthListServiceProfilesResponseSchema, AuthListServiceProfilesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthProvisionServiceInstanceResponseSchema, AuthProvisionServiceInstanceSchema, AuthRemoveDeviceInstanceResponseSchema, AuthRemoveDeviceInstanceSchema, AuthRemoveDeviceProfileResponseSchema, AuthRemoveDeviceProfileSchema, AuthRemoveServiceInstanceResponseSchema, AuthRemoveServiceInstanceSchema, AuthRemoveServiceProfileResponseSchema, AuthRemoveServiceProfileSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthUnapplyDeviceProfileContractResponseSchema, AuthUnapplyDeviceProfileContractSchema, AuthUnapplyServiceProfileContractResponseSchema, AuthUnapplyServiceProfileContractSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DevicePortalDefaultSchema, DevicePortalSelectionSchema, DeviceProfileSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalFlowStateSchema, PortalSchema, ServiceInstanceSchema, ServiceProfileSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-export { ApprovalDecisionSchema, AuthStartFlowResponseSchema, AuthStartRequestSchema, AuthStartResponseSchema, BindRequestSchema, BindResponseSchema, BindSuccessResponseSchema, ClientTransportEndpointsSchema, ClientTransportsSchema, ContractApprovalSchema, LoginQuerySchema, NatsAuthTokenV1Schema, SentinelCredsSchema, } from "./schemas.js";
-export { createAuth, } from "./session_auth.js";
+export { ApprovalRecordViewSchema, AuthActivateDeviceProgressSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthApplyDeviceDeploymentContractResponseSchema, AuthApplyDeviceDeploymentContractSchema, AuthApplyServiceDeploymentContractResponseSchema, AuthApplyServiceDeploymentContractSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceDeploymentResponseSchema, AuthCreateDeviceDeploymentSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateServiceDeploymentResponseSchema, AuthCreateServiceDeploymentSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivatedEventSchema, AuthDeviceActivationApprovedEventSchema, AuthDeviceActivationRequestedEventSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceDeploymentResponseSchema, AuthDisableDeviceDeploymentSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisablePortalProfileResponseSchema, AuthDisablePortalProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthDisableServiceDeploymentResponseSchema, AuthDisableServiceDeploymentSchema, AuthDisableServiceInstanceResponseSchema, AuthDisableServiceInstanceSchema, AuthEnableDeviceDeploymentResponseSchema, AuthEnableDeviceDeploymentSchema, AuthEnableDeviceInstanceResponseSchema, AuthEnableDeviceInstanceSchema, AuthEnableServiceDeploymentResponseSchema, AuthEnableServiceDeploymentSchema, AuthEnableServiceInstanceResponseSchema, AuthEnableServiceInstanceSchema, AuthenticatedDeviceSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceDeploymentsResponseSchema, AuthListDeviceDeploymentsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalProfilesResponseSchema, AuthListPortalProfilesSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServiceDeploymentsResponseSchema, AuthListServiceDeploymentsSchema, AuthListServiceInstancesResponseSchema, AuthListServiceInstancesSchema, AuthListUserGrantsResponseSchema, AuthListUserGrantsSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthProvisionServiceInstanceResponseSchema, AuthProvisionServiceInstanceSchema, AuthRemoveDeviceDeploymentResponseSchema, AuthRemoveDeviceDeploymentSchema, AuthRemoveDeviceInstanceResponseSchema, AuthRemoveDeviceInstanceSchema, AuthRemoveServiceDeploymentResponseSchema, AuthRemoveServiceDeploymentSchema, AuthRemoveServiceInstanceResponseSchema, AuthRemoveServiceInstanceSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthRevokeUserGrantResponseSchema, AuthRevokeUserGrantSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetPortalProfileResponseSchema, AuthSetPortalProfileSchema, AuthUnapplyDeviceDeploymentContractResponseSchema, AuthUnapplyDeviceDeploymentContractSchema, AuthUnapplyServiceDeploymentContractResponseSchema, AuthUnapplyServiceDeploymentContractSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, DevicePortalDefaultSchema, DevicePortalSelectionSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, ParticipantKindSchema, PortalFlowStateSchema, PortalProfileSchema, PortalSchema, ServiceDeploymentSchema, ServiceInstanceSchema, UserGrantViewSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
+export { ApprovalDecisionSchema, AuthStartFlowResponseSchema, AuthStartRequestSchema, AuthStartResponseSchema, BindResponseSchema, BindSuccessResponseSchema, ClientTransportEndpointsSchema, ClientTransportsSchema, ContractApprovalSchema, NatsAuthTokenV1Schema, SentinelCredsSchema, UserParticipantKindSchema, } from "./schemas.js";
+export { buildNatsConnectSignaturePayload, createAuth, } from "./session_auth.js";
+export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
 export { trellisIdFromOriginId } from "./trellis_id.js";
 export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";

package/esm/auth/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,GACtB,UAAU,CA8BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,GACtB,UAAU,CA8BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}