@rudderhq/identity-core 0.6.6-canary.2

package/dist/email.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Canonicalizes an email only after an upstream provider has proved ownership.
+ *
+ * Rudder deliberately does not implement provider-specific dot or plus aliases:
+ * those rules are not universal and would merge distinct mailboxes.
+ */
+export declare function normalizeVerifiedEmail(value: string): string;
+export declare function maskEmail(value: string): string;
+//# sourceMappingURL=email.d.ts.map

package/dist/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../src/email.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C"}

package/dist/email.js

@@ -0,0 +1,27 @@
+const MAX_EMAIL_LENGTH = 254;
+/**
+ * Canonicalizes an email only after an upstream provider has proved ownership.
+ *
+ * Rudder deliberately does not implement provider-specific dot or plus aliases:
+ * those rules are not universal and would merge distinct mailboxes.
+ */
+export function normalizeVerifiedEmail(value) {
+    const normalized = value.normalize("NFKC").trim().toLowerCase();
+    if (normalized.length === 0 ||
+        normalized.length > MAX_EMAIL_LENGTH ||
+        /[\u0000-\u001f\u007f]/u.test(normalized)) {
+        throw new Error("Invalid verified email");
+    }
+    const at = normalized.lastIndexOf("@");
+    if (at <= 0 || at === normalized.length - 1 || normalized.indexOf("@") !== at) {
+        throw new Error("Invalid verified email");
+    }
+    return normalized;
+}
+export function maskEmail(value) {
+    const normalized = normalizeVerifiedEmail(value);
+    const [local, domain] = normalized.split("@");
+    const visible = local.slice(0, Math.min(2, local.length));
+    return `${visible}${local.length > 2 ? "•••" : "•"}@${domain}`;
+}
+//# sourceMappingURL=email.js.map

package/dist/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../src/email.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,MAAM,GAAG,gBAAgB;QACpC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;AACjE,CAAC"}

package/dist/email.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email.test.d.ts.map

package/dist/email.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.test.d.ts","sourceRoot":"","sources":["../src/email.test.ts"],"names":[],"mappings":""}

package/dist/email.test.js

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { maskEmail, normalizeVerifiedEmail } from "./email.js";
+describe("normalizeVerifiedEmail", () => {
+    it("normalizes case, whitespace, and Unicode width", () => {
+        expect(normalizeVerifiedEmail("  Alice＠Example.COM ")).toBe("alice@example.com");
+    });
+    it("does not apply provider-specific alias rules", () => {
+        expect(normalizeVerifiedEmail("alice+work@gmail.com")).toBe("alice+work@gmail.com");
+    });
+    it("rejects malformed addresses and controls", () => {
+        expect(() => normalizeVerifiedEmail("alice")).toThrow("Invalid verified email");
+        expect(() => normalizeVerifiedEmail("a@example.com\n")).not.toThrow();
+        expect(() => normalizeVerifiedEmail("a\nb@example.com")).toThrow("Invalid verified email");
+    });
+});
+describe("maskEmail", () => {
+    it("preserves enough context without exposing the full local part", () => {
+        expect(maskEmail("alice@example.com")).toBe("al•••@example.com");
+    });
+});
+//# sourceMappingURL=email.test.js.map

package/dist/email.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.test.js","sourceRoot":"","sources":["../src/email.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE/D,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./email.js";
+export * from "./offline-grant.js";
+export * from "./release-policy.js";
+export * from "./secrets.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from "./email.js";
+export * from "./offline-grant.js";
+export * from "./release-policy.js";
+export * from "./secrets.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC"}

package/dist/offline-grant.d.ts

@@ -0,0 +1,92 @@
+import { KeyObject } from "node:crypto";
+export declare const MAX_OFFLINE_GRANT_LIFETIME_MS: number;
+export type OfflineGrantClaims = {
+    version: 1;
+    issuer: string;
+    accountId: string;
+    deviceId: string;
+    installationId: string;
+    audience: "rudder-local-board";
+    publicKeyThumbprint: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+    trustedTimeMs: number;
+    signOutEpoch: number;
+    jti: string;
+};
+export type OfflineGrantProof = {
+    payload: {
+        version: 1;
+        grantHash: string;
+        method: string;
+        path: string;
+        bodyHash: string;
+        nonce: string;
+        issuedAtMs: number;
+    };
+    signature: string;
+};
+export declare function generateOfflineDeviceKeyPair(): {
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+    thumbprint: string;
+};
+export declare function offlineDevicePublicKeyThumbprint(publicKey: KeyObject | string | Buffer): string;
+export declare function issueOfflineGrant(input: {
+    signingPrivateKey: KeyObject | string | Buffer;
+    keyId: string;
+    issuer: string;
+    accountId: string;
+    deviceId: string;
+    installationId: string;
+    publicKeyThumbprint: string;
+    nowMs: number;
+    expiresAtMs?: number;
+    trustedTimeMs: number;
+    signOutEpoch: number;
+    jti: string;
+}): string;
+export declare function verifyOfflineGrant(input: {
+    grant: string;
+    identityPublicKey: KeyObject | string | Buffer;
+    expectedKeyId: string;
+    expectedIssuer: string;
+    expectedInstallationId: string;
+    expectedDeviceId?: string;
+    expectedAccountId?: string;
+    nowMs: number;
+    lastTrustedTimeMs: number;
+    localSignOutEpoch: number;
+}): OfflineGrantClaims;
+export declare function createOfflineGrantProof(input: {
+    grant: string;
+    devicePrivateKey: KeyObject | string | Buffer;
+    method: string;
+    path: string;
+    bodyHash: string;
+    nonce: string;
+    issuedAtMs: number;
+}): OfflineGrantProof;
+export declare function verifyOfflineGrantAndProof(input: {
+    grant: string;
+    proof: OfflineGrantProof;
+    identityPublicKey: KeyObject | string | Buffer;
+    expectedKeyId: string;
+    devicePublicKey: KeyObject | string | Buffer;
+    expectedIssuer: string;
+    expectedInstallationId: string;
+    expectedDeviceId?: string;
+    expectedAccountId?: string;
+    expectedMethod: string;
+    expectedPath: string;
+    expectedBodyHash: string;
+    nowMs: number;
+    lastTrustedTimeMs: number;
+    localSignOutEpoch: number;
+    consumeNonce(nonce: string): boolean;
+}): {
+    claims: OfflineGrantClaims;
+    nextTrustedTimeMs: number;
+};
+export declare function offlineRequestBodyHash(body: Buffer | string): string;
+//# sourceMappingURL=offline-grant.d.ts.map

package/dist/offline-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-grant.d.ts","sourceRoot":"","sources":["../src/offline-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,SAAS,EAGV,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,6BAA6B,QAA2B,CAAC;AAWtE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmEF,wBAAgB,4BAA4B,IAAI;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAGlH;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAM/F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,iBAAiB,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,CA4CT;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GAAG,kBAAkB,CAqDrB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,iBAAiB,CAgBpB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,iBAAiB,CAAC;IACzB,iBAAiB,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC,GAAG;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAkC5D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEpE"}

package/dist/offline-grant.js

@@ -0,0 +1,217 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, KeyObject, sign, verify, } from "node:crypto";
+export const MAX_OFFLINE_GRANT_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+const CLOCK_ROLLBACK_TOLERANCE_MS = 5 * 60 * 1000;
+const PROOF_CLOCK_SKEW_MS = 5 * 60 * 1000;
+const MAX_TOKEN_BYTES = 32 * 1024;
+function base64url(value) {
+    return Buffer.from(value).toString("base64url");
+}
+function decodeBase64url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error("invalid_encoding");
+    return Buffer.from(value, "base64url");
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+}
+function requirePrivateKey(value) {
+    return value instanceof KeyObject ? value : createPrivateKey(value);
+}
+function requirePublicKey(value) {
+    return value instanceof KeyObject ? value : createPublicKey(value);
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+function assertSafeString(value, label, max = 512) {
+    if (typeof value !== "string" || value.length === 0 || value.length > max) {
+        throw new Error(`invalid_${label}`);
+    }
+}
+function assertNonce(value) {
+    if (typeof value !== "string"
+        || value.length < 16
+        || value.length > 256
+        || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error("invalid_nonce");
+}
+function parseClaims(value) {
+    if (!value || typeof value !== "object")
+        throw new Error("invalid_offline_grant");
+    const claims = value;
+    if (claims.version !== 1
+        || claims.audience !== "rudder-local-board"
+        || !Number.isSafeInteger(claims.issuedAtMs)
+        || !Number.isSafeInteger(claims.expiresAtMs)
+        || !Number.isSafeInteger(claims.trustedTimeMs)
+        || !Number.isSafeInteger(claims.signOutEpoch)
+        || Number(claims.signOutEpoch) < 0)
+        throw new Error("invalid_offline_grant");
+    assertSafeString(claims.issuer, "issuer");
+    assertSafeString(claims.accountId, "account_id");
+    assertSafeString(claims.deviceId, "device_id");
+    assertSafeString(claims.installationId, "installation_id");
+    assertSafeString(claims.publicKeyThumbprint, "public_key_thumbprint");
+    assertSafeString(claims.jti, "jti");
+    return claims;
+}
+export function generateOfflineDeviceKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    return { privateKey, publicKey, thumbprint: offlineDevicePublicKeyThumbprint(publicKey) };
+}
+export function offlineDevicePublicKeyThumbprint(publicKey) {
+    const jwk = requirePublicKey(publicKey).export({ format: "jwk" });
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string") {
+        throw new Error("Offline device keys must use Ed25519");
+    }
+    return sha256(stableJson({ crv: jwk.crv, kty: jwk.kty, x: jwk.x }));
+}
+export function issueOfflineGrant(input) {
+    const expiresAtMs = input.expiresAtMs ?? input.nowMs + MAX_OFFLINE_GRANT_LIFETIME_MS;
+    if (!Number.isSafeInteger(input.nowMs)
+        || !Number.isSafeInteger(expiresAtMs)
+        || expiresAtMs <= input.nowMs
+        || expiresAtMs - input.nowMs > MAX_OFFLINE_GRANT_LIFETIME_MS
+        || !Number.isSafeInteger(input.trustedTimeMs)
+        || input.trustedTimeMs > input.nowMs
+        || !Number.isSafeInteger(input.signOutEpoch)
+        || input.signOutEpoch < 0)
+        throw new Error("invalid_offline_grant_lifetime");
+    for (const [label, value] of [
+        ["key_id", input.keyId],
+        ["issuer", input.issuer],
+        ["account_id", input.accountId],
+        ["device_id", input.deviceId],
+        ["installation_id", input.installationId],
+        ["public_key_thumbprint", input.publicKeyThumbprint],
+        ["jti", input.jti],
+    ])
+        assertSafeString(value, label);
+    const header = {
+        alg: "EdDSA",
+        typ: "rudder-offline-grant+jwt",
+        kid: input.keyId,
+    };
+    const claims = {
+        version: 1,
+        issuer: input.issuer,
+        accountId: input.accountId,
+        deviceId: input.deviceId,
+        installationId: input.installationId,
+        audience: "rudder-local-board",
+        publicKeyThumbprint: input.publicKeyThumbprint,
+        issuedAtMs: input.nowMs,
+        expiresAtMs,
+        trustedTimeMs: input.trustedTimeMs,
+        signOutEpoch: input.signOutEpoch,
+        jti: input.jti,
+    };
+    const signingInput = `${base64url(stableJson(header))}.${base64url(stableJson(claims))}`;
+    const signature = sign(null, Buffer.from(signingInput), requirePrivateKey(input.signingPrivateKey));
+    return `${signingInput}.${base64url(signature)}`;
+}
+export function verifyOfflineGrant(input) {
+    if (!Number.isSafeInteger(input.nowMs)
+        || !Number.isSafeInteger(input.lastTrustedTimeMs)
+        || !Number.isSafeInteger(input.localSignOutEpoch)
+        || input.localSignOutEpoch < 0)
+        throw new Error("invalid_offline_verification_state");
+    if (Buffer.byteLength(input.grant, "utf8") > MAX_TOKEN_BYTES)
+        throw new Error("invalid_offline_grant");
+    const parts = input.grant.split(".");
+    if (parts.length !== 3)
+        throw new Error("invalid_offline_grant");
+    let headerValue;
+    let claimsValue;
+    try {
+        headerValue = JSON.parse(decodeBase64url(parts[0]).toString("utf8"));
+        claimsValue = JSON.parse(decodeBase64url(parts[1]).toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid_offline_grant");
+    }
+    const header = headerValue;
+    if (header.alg !== "EdDSA"
+        || header.typ !== "rudder-offline-grant+jwt"
+        || header.kid !== input.expectedKeyId)
+        throw new Error("invalid_offline_grant_header");
+    const signatureValid = verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), requirePublicKey(input.identityPublicKey), decodeBase64url(parts[2]));
+    if (!signatureValid)
+        throw new Error("invalid_offline_grant_signature");
+    const claims = parseClaims(claimsValue);
+    if (claims.issuer !== input.expectedIssuer
+        || claims.installationId !== input.expectedInstallationId
+        || (input.expectedDeviceId !== undefined && claims.deviceId !== input.expectedDeviceId)
+        || (input.expectedAccountId !== undefined && claims.accountId !== input.expectedAccountId))
+        throw new Error("offline_grant_binding_mismatch");
+    if (claims.expiresAtMs <= claims.issuedAtMs
+        || claims.expiresAtMs - claims.issuedAtMs > MAX_OFFLINE_GRANT_LIFETIME_MS)
+        throw new Error("offline_grant_expired");
+    if (input.nowMs + CLOCK_ROLLBACK_TOLERANCE_MS
+        < Math.max(claims.trustedTimeMs, input.lastTrustedTimeMs))
+        throw new Error("offline_clock_rollback");
+    if (input.nowMs < claims.issuedAtMs - PROOF_CLOCK_SKEW_MS
+        || input.nowMs >= claims.expiresAtMs)
+        throw new Error("offline_grant_expired");
+    if (input.localSignOutEpoch > claims.signOutEpoch)
+        throw new Error("offline_grant_signed_out");
+    return claims;
+}
+export function createOfflineGrantProof(input) {
+    assertSafeString(input.method, "method", 16);
+    assertSafeString(input.path, "path", 2048);
+    assertSafeString(input.bodyHash, "body_hash", 128);
+    assertNonce(input.nonce);
+    const payload = {
+        version: 1,
+        grantHash: sha256(input.grant),
+        method: input.method.toUpperCase(),
+        path: input.path,
+        bodyHash: input.bodyHash,
+        nonce: input.nonce,
+        issuedAtMs: input.issuedAtMs,
+    };
+    const signature = sign(null, Buffer.from(stableJson(payload)), requirePrivateKey(input.devicePrivateKey));
+    return { payload, signature: base64url(signature) };
+}
+export function verifyOfflineGrantAndProof(input) {
+    const claims = verifyOfflineGrant(input);
+    if (offlineDevicePublicKeyThumbprint(input.devicePublicKey) !== claims.publicKeyThumbprint) {
+        throw new Error("offline_device_key_mismatch");
+    }
+    const proof = input.proof;
+    if (!proof
+        || proof.payload?.version !== 1
+        || proof.payload.grantHash !== sha256(input.grant)
+        || proof.payload.method !== input.expectedMethod.toUpperCase()
+        || proof.payload.path !== input.expectedPath
+        || proof.payload.bodyHash !== input.expectedBodyHash
+        || !Number.isSafeInteger(proof.payload.issuedAtMs)
+        || Math.abs(input.nowMs - proof.payload.issuedAtMs) > PROOF_CLOCK_SKEW_MS)
+        throw new Error("invalid_offline_proof");
+    assertNonce(proof.payload.nonce);
+    let signature;
+    try {
+        signature = decodeBase64url(proof.signature);
+    }
+    catch {
+        throw new Error("invalid_offline_proof");
+    }
+    if (!verify(null, Buffer.from(stableJson(proof.payload)), requirePublicKey(input.devicePublicKey), signature))
+        throw new Error("invalid_offline_proof_signature");
+    if (!input.consumeNonce(proof.payload.nonce))
+        throw new Error("offline_proof_replay");
+    return {
+        claims,
+        nextTrustedTimeMs: Math.max(input.nowMs, input.lastTrustedTimeMs, claims.trustedTimeMs),
+    };
+}
+export function offlineRequestBodyHash(body) {
+    return sha256(body);
+}
+//# sourceMappingURL=offline-grant.js.map

package/dist/offline-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-grant.js","sourceRoot":"","sources":["../src/offline-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,IAAI,EACJ,MAAM,GACP,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtE,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAoClC,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkC;IAC3D,OAAO,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkC;IAC1D,OAAO,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,GAAG;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,OAAO,KAAK,KAAK,QAAQ;WACtB,KAAK,CAAC,MAAM,GAAG,EAAE;WACjB,KAAK,CAAC,MAAM,GAAG,GAAG;WAClB,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;WACjB,MAAM,CAAC,QAAQ,KAAK,oBAAoB;WACxC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;WACxC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;WACzC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;WAC3C,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;WAC1C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/C,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC3D,gBAAgB,CAAC,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;IACtE,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,MAA4B,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gCAAgC,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,SAAsC;IACrF,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAajC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,GAAG,6BAA6B,CAAC;IACrF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;WAClC,WAAW,IAAI,KAAK,CAAC,KAAK;WAC1B,WAAW,GAAG,KAAK,CAAC,KAAK,GAAG,6BAA6B;WACzD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;WAC1C,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK;WACjC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;WACzC,KAAK,CAAC,YAAY,GAAG,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC;QACzC,CAAC,uBAAuB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACpD,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;KACV;QAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAuB;QACjC,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,0BAA0B;QAC/B,GAAG,EAAE,KAAK,CAAC,KAAK;KACjB,CAAC;IACF,MAAM,MAAM,GAAuB;QACjC,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,oBAAoB;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,WAAW;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpG,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAWlC;IACC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAC9C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAC9C,KAAK,CAAC,iBAAiB,GAAG,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,WAAoB,CAAC;IACzB,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,WAA0C,CAAC;IAC1D,IACE,MAAM,CAAC,GAAG,KAAK,OAAO;WACnB,MAAM,CAAC,GAAG,KAAK,0BAA0B;WACzC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,CAC3B,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACzC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1B,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,IACE,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;WACnC,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;WACtD,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB,CAAC;WACpF,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,IACE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU;WACpC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,GAAG,6BAA6B;QACzE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,IACE,KAAK,CAAC,KAAK,GAAG,2BAA2B;UACvC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,iBAAiB,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IACE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,GAAG,mBAAmB;WAClD,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAQvC;IACC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACnD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAiC;QAC5C,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1G,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAiB1C;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,gCAAgC,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IACE,CAAC,KAAK;WACH,KAAK,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC;WAC5B,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;WAC/C,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;WAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY;WACzC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB;WACjD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;WAC/C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,mBAAmB;QACzE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,MAAM,CACT,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EACtC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,EACvC,SAAS,CACV;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtF,OAAO;QACL,MAAM;QACN,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAqB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/offline-grant.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=offline-grant.test.d.ts.map

package/dist/offline-grant.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-grant.test.d.ts","sourceRoot":"","sources":["../src/offline-grant.test.ts"],"names":[],"mappings":""}

package/dist/offline-grant.test.js

@@ -0,0 +1,146 @@
+import { generateKeyPairSync } from "node:crypto";
+import { describe, expect, it } from "vitest";
+import { createOfflineGrantProof, generateOfflineDeviceKeyPair, issueOfflineGrant, MAX_OFFLINE_GRANT_LIFETIME_MS, offlineRequestBodyHash, verifyOfflineGrantAndProof, } from "./offline-grant.js";
+const nowMs = Date.parse("2026-07-29T00:00:00.000Z");
+function fixture() {
+    const identityKeys = generateKeyPairSync("ed25519");
+    const deviceKeys = generateOfflineDeviceKeyPair();
+    const grant = issueOfflineGrant({
+        signingPrivateKey: identityKeys.privateKey,
+        keyId: "identity-key-1",
+        issuer: "https://accounts.rudderhq.dev",
+        accountId: "account-1",
+        deviceId: "device-1",
+        installationId: "default",
+        publicKeyThumbprint: deviceKeys.thumbprint,
+        nowMs,
+        trustedTimeMs: nowMs,
+        signOutEpoch: 3,
+        jti: "grant-1",
+    });
+    const bodyHash = offlineRequestBodyHash('{"intent":"open-local-board"}');
+    const proof = createOfflineGrantProof({
+        grant,
+        devicePrivateKey: deviceKeys.privateKey,
+        method: "POST",
+        path: "/api/auth/offline",
+        bodyHash,
+        nonce: "server-challenge-1",
+        issuedAtMs: nowMs + 1_000,
+    });
+    return { identityKeys, deviceKeys, grant, proof, bodyHash };
+}
+function verifyFixture(value, overrides = {}) {
+    const usedNonces = new Set();
+    return verifyOfflineGrantAndProof({
+        grant: value.grant,
+        proof: value.proof,
+        identityPublicKey: value.identityKeys.publicKey,
+        expectedKeyId: "identity-key-1",
+        devicePublicKey: value.deviceKeys.publicKey,
+        expectedIssuer: "https://accounts.rudderhq.dev",
+        expectedInstallationId: "default",
+        expectedDeviceId: "device-1",
+        expectedAccountId: "account-1",
+        expectedMethod: "POST",
+        expectedPath: "/api/auth/offline",
+        expectedBodyHash: value.bodyHash,
+        nowMs: nowMs + 1_000,
+        lastTrustedTimeMs: nowMs,
+        localSignOutEpoch: 3,
+        consumeNonce: (nonce) => {
+            if (usedNonces.has(nonce))
+                return false;
+            usedNonces.add(nonce);
+            return true;
+        },
+        ...overrides,
+    });
+}
+describe("Local offline grant proof of possession", () => {
+    it("verifies an installation-bound grant and advances trusted time", () => {
+        const value = fixture();
+        const result = verifyFixture(value);
+        expect(result.claims).toMatchObject({
+            accountId: "account-1",
+            deviceId: "device-1",
+            installationId: "default",
+            audience: "rudder-local-board",
+            signOutEpoch: 3,
+        });
+        expect(result.nextTrustedTimeMs).toBe(nowMs + 1_000);
+    });
+    it("rejects a copied grant without the bound device private key", () => {
+        const value = fixture();
+        const attacker = generateOfflineDeviceKeyPair();
+        const attackerProof = createOfflineGrantProof({
+            grant: value.grant,
+            devicePrivateKey: attacker.privateKey,
+            method: "POST",
+            path: "/api/auth/offline",
+            bodyHash: value.bodyHash,
+            nonce: "attacker-challenge",
+            issuedAtMs: nowMs + 1_000,
+        });
+        expect(() => verifyFixture(value, {
+            proof: attackerProof,
+            devicePublicKey: attacker.publicKey,
+        })).toThrow("device_key_mismatch");
+    });
+    it("rejects nonce replay after one valid proof", () => {
+        const value = fixture();
+        let consumed = false;
+        const options = {
+            consumeNonce: () => {
+                if (consumed)
+                    return false;
+                consumed = true;
+                return true;
+            },
+        };
+        expect(() => verifyFixture(value, options)).not.toThrow();
+        expect(() => verifyFixture(value, options)).toThrow("proof_replay");
+    });
+    it("rejects clock rollback, expiry, installation mismatch, and local sign-out", () => {
+        const value = fixture();
+        expect(() => verifyFixture(value, {
+            nowMs: nowMs - 6 * 60 * 1000,
+            lastTrustedTimeMs: nowMs,
+        })).toThrow("clock_rollback");
+        expect(() => verifyFixture(value, {
+            nowMs: nowMs + MAX_OFFLINE_GRANT_LIFETIME_MS,
+            proof: createOfflineGrantProof({
+                grant: value.grant,
+                devicePrivateKey: value.deviceKeys.privateKey,
+                method: "POST",
+                path: "/api/auth/offline",
+                bodyHash: value.bodyHash,
+                nonce: "expiry-challenge",
+                issuedAtMs: nowMs + MAX_OFFLINE_GRANT_LIFETIME_MS,
+            }),
+        })).toThrow("grant_expired");
+        expect(() => verifyFixture(value, { expectedInstallationId: "restored-copy" }))
+            .toThrow("binding_mismatch");
+        expect(() => verifyFixture(value, { localSignOutEpoch: 4 }))
+            .toThrow("signed_out");
+    });
+    it("will not issue a grant longer than 30 days", () => {
+        const identityKeys = generateKeyPairSync("ed25519");
+        const deviceKeys = generateOfflineDeviceKeyPair();
+        expect(() => issueOfflineGrant({
+            signingPrivateKey: identityKeys.privateKey,
+            keyId: "identity-key-1",
+            issuer: "https://accounts.rudderhq.dev",
+            accountId: "account-1",
+            deviceId: "device-1",
+            installationId: "default",
+            publicKeyThumbprint: deviceKeys.thumbprint,
+            nowMs,
+            expiresAtMs: nowMs + MAX_OFFLINE_GRANT_LIFETIME_MS + 1,
+            trustedTimeMs: nowMs,
+            signOutEpoch: 0,
+            jti: "grant-too-long",
+        })).toThrow("lifetime");
+    });
+});
+//# sourceMappingURL=offline-grant.test.js.map

package/dist/offline-grant.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-grant.test.js","sourceRoot":"","sources":["../src/offline-grant.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAErD,SAAS,OAAO;IACd,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,4BAA4B,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,iBAAiB,EAAE,YAAY,CAAC,UAAU;QAC1C,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,WAAW;QACtB,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,SAAS;QACzB,mBAAmB,EAAE,UAAU,CAAC,UAAU;QAC1C,KAAK;QACL,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,CAAC;QACf,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,+BAA+B,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACpC,KAAK;QACL,gBAAgB,EAAE,UAAU,CAAC,UAAU;QACvC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,QAAQ;QACR,KAAK,EAAE,oBAAoB;QAC3B,UAAU,EAAE,KAAK,GAAG,KAAK;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CACpB,KAAiC,EACjC,YAAuE,EAAE;IAEzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,OAAO,0BAA0B,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QAC/C,aAAa,EAAE,gBAAgB;QAC/B,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;QAC3C,cAAc,EAAE,+BAA+B;QAC/C,sBAAsB,EAAE,SAAS;QACjC,gBAAgB,EAAE,UAAU;QAC5B,iBAAiB,EAAE,WAAW;QAC9B,cAAc,EAAE,MAAM;QACtB,YAAY,EAAE,mBAAmB;QACjC,gBAAgB,EAAE,KAAK,CAAC,QAAQ;QAChC,KAAK,EAAE,KAAK,GAAG,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;YACtB,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAClC,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,UAAU;YACpB,cAAc,EAAE,SAAS;YACzB,QAAQ,EAAE,oBAAoB;YAC9B,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,uBAAuB,CAAC;YAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,gBAAgB,EAAE,QAAQ,CAAC,UAAU;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,oBAAoB;YAC3B,UAAU,EAAE,KAAK,GAAG,KAAK;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;YAChC,KAAK,EAAE,aAAa;YACpB,eAAe,EAAE,QAAQ,CAAC,SAAS;SACpC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG;YACd,YAAY,EAAE,GAAG,EAAE;gBACjB,IAAI,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC3B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;YAChC,KAAK,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;YAChC,KAAK,EAAE,KAAK,GAAG,6BAA6B;YAC5C,KAAK,EAAE,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBAC7C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,kBAAkB;gBACzB,UAAU,EAAE,KAAK,GAAG,6BAA6B;aAClD,CAAC;SACH,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC,CAAC;aAC5E,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;aACzD,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;YAC7B,iBAAiB,EAAE,YAAY,CAAC,UAAU;YAC1C,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,UAAU;YACpB,cAAc,EAAE,SAAS;YACzB,mBAAmB,EAAE,UAAU,CAAC,UAAU;YAC1C,KAAK;YACL,WAAW,EAAE,KAAK,GAAG,6BAA6B,GAAG,CAAC;YACtD,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,CAAC;YACf,GAAG,EAAE,gBAAgB;SACtB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/release-policy.d.ts

@@ -0,0 +1,9 @@
+export type IdentityReleaseChannel = "development" | "test" | "preview" | "production";
+export type IdentityReleasePolicy = {
+    channel: IdentityReleaseChannel;
+    issuer: string;
+    allowCapturedMail: boolean;
+    allowTestClients: boolean;
+};
+export declare function assertIdentityReleasePolicy(policy: IdentityReleasePolicy): void;
+//# sourceMappingURL=release-policy.d.ts.map

package/dist/release-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-policy.d.ts","sourceRoot":"","sources":["../src/release-policy.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAEvF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,sBAAsB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CA8B/E"}

package/dist/release-policy.js

@@ -0,0 +1,29 @@
+export function assertIdentityReleasePolicy(policy) {
+    const issuer = new URL(policy.issuer);
+    if (policy.channel === "production" || policy.channel === "preview") {
+        const releaseName = policy.channel === "production" ? "Production" : "Preview";
+        if (issuer.protocol !== "https:")
+            throw new Error(`${releaseName} Identity issuer must use HTTPS`);
+        if (policy.allowCapturedMail)
+            throw new Error(`${releaseName} Identity cannot use captured mail`);
+        if (policy.allowTestClients)
+            throw new Error(`${releaseName} Identity cannot accept test clients`);
+        if (issuer.username ||
+            issuer.password ||
+            issuer.pathname !== "/" ||
+            issuer.search ||
+            issuer.hash) {
+            throw new Error(`${releaseName} Identity issuer must be an origin`);
+        }
+    }
+    if (policy.channel === "production" &&
+        issuer.origin !== "https://accounts.rudderhq.dev") {
+        throw new Error("Production Identity issuer must be https://accounts.rudderhq.dev");
+    }
+    if ((policy.channel === "development" || policy.channel === "test") &&
+        issuer.protocol !== "https:" &&
+        !["127.0.0.1", "::1", "localhost"].includes(issuer.hostname)) {
+        throw new Error("Non-HTTPS Identity issuer must be loopback");
+    }
+}
+//# sourceMappingURL=release-policy.js.map

package/dist/release-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-policy.js","sourceRoot":"","sources":["../src/release-policy.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,2BAA2B,CAAC,MAA6B;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,iCAAiC,CAAC,CAAC;QACnG,IAAI,MAAM,CAAC,iBAAiB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,oCAAoC,CAAC,CAAC;QAClG,IAAI,MAAM,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,sCAAsC,CAAC,CAAC;QACnG,IACE,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ,KAAK,GAAG;YACvB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,IAAI,EACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,OAAO,KAAK,YAAY;QAC/B,MAAM,CAAC,MAAM,KAAK,+BAA+B,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC;QAC/D,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/release-policy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=release-policy.test.d.ts.map

package/dist/release-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-policy.test.d.ts","sourceRoot":"","sources":["../src/release-policy.test.ts"],"names":[],"mappings":""}

package/dist/release-policy.test.js

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import { assertIdentityReleasePolicy } from "./release-policy.js";
+describe("assertIdentityReleasePolicy", () => {
+    it("rejects production test capabilities", () => {
+        expect(() => assertIdentityReleasePolicy({
+            channel: "production",
+            issuer: "https://accounts.rudderhq.dev",
+            allowCapturedMail: true,
+            allowTestClients: false,
+        })).toThrow("captured mail");
+    });
+    it("allows isolated local development", () => {
+        expect(() => assertIdentityReleasePolicy({
+            channel: "development",
+            issuer: "http://127.0.0.1:3200",
+            allowCapturedMail: true,
+            allowTestClients: true,
+        })).not.toThrow();
+    });
+    it("fails preview closed for capture mail and test clients", () => {
+        for (const policy of [
+            { allowCapturedMail: true, allowTestClients: false },
+            { allowCapturedMail: false, allowTestClients: true },
+        ]) {
+            expect(() => assertIdentityReleasePolicy({
+                channel: "preview",
+                issuer: "https://preview-identity.rudderhq.dev",
+                ...policy,
+            })).toThrow();
+        }
+    });
+    it("rejects development capture on a non-loopback HTTP issuer", () => {
+        expect(() => assertIdentityReleasePolicy({
+            channel: "development",
+            issuer: "http://identity.internal",
+            allowCapturedMail: true,
+            allowTestClients: true,
+        })).toThrow("loopback");
+    });
+    it("requires an origin-only canonical production issuer", () => {
+        for (const issuer of [
+            "https://accounts.rudderhq.dev/account",
+            "https://user@accounts.rudderhq.dev",
+            "https://accounts.rudderhq.dev?preview=true",
+            "https://identity.rudderhq.dev",
+        ]) {
+            expect(() => assertIdentityReleasePolicy({
+                channel: "production",
+                issuer,
+                allowCapturedMail: false,
+                allowTestClients: false,
+            })).toThrow();
+        }
+        expect(() => assertIdentityReleasePolicy({
+            channel: "production",
+            issuer: "https://accounts.rudderhq.dev",
+            allowCapturedMail: false,
+            allowTestClients: false,
+        })).not.toThrow();
+    });
+});
+//# sourceMappingURL=release-policy.test.js.map

package/dist/release-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-policy.test.js","sourceRoot":"","sources":["../src/release-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;YAC1B,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,+BAA+B;YACvC,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CACH,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;YAC1B,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,uBAAuB;YAC/B,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CACH,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,KAAK,MAAM,MAAM,IAAI;YACnB,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE;YACpD,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE;SACrD,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;gBAC1B,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,uCAAuC;gBAC/C,GAAG,MAAM;aACV,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;YAC1B,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,0BAA0B;YAClC,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CACH,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,KAAK,MAAM,MAAM,IAAI;YACnB,uCAAuC;YACvC,oCAAoC;YACpC,4CAA4C;YAC5C,+BAA+B;SAChC,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;gBAC1B,OAAO,EAAE,YAAY;gBACrB,MAAM;gBACN,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CACV,2BAA2B,CAAC;YAC1B,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,+BAA+B;YACvC,iBAAiB,EAAE,KAAK;YACxB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CACH,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,4 @@
+export declare function hashOpaqueSecret(value: string): string;
+export declare function opaqueSecretMatches(value: string, expectedHash: string): boolean;
+export declare function redactSensitiveText(value: string): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzD"}

package/dist/secrets.js

@@ -0,0 +1,16 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+export function hashOpaqueSecret(value) {
+    return createHash("sha256").update(value, "utf8").digest("base64url");
+}
+export function opaqueSecretMatches(value, expectedHash) {
+    const actual = Buffer.from(hashOpaqueSecret(value));
+    const expected = Buffer.from(expectedHash);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export function redactSensitiveText(value) {
+    return value
+        .replace(/\b\d{6}\b/gu, "[REDACTED_OTP]")
+        .replace(/(bearer\s+)[^\s]+/giu, "$1[REDACTED]")
+        .replace(/((?:^|[?&\s])(?:token|code|secret)=)[^&\s]+/giu, "$1[REDACTED]");
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,YAAoB;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC;SACxC,OAAO,CAAC,sBAAsB,EAAE,cAAc,CAAC;SAC/C,OAAO,CAAC,gDAAgD,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC"}

package/dist/secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../src/secrets.test.ts"],"names":[],"mappings":""}

package/dist/secrets.test.js

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { hashOpaqueSecret, opaqueSecretMatches, redactSensitiveText } from "./secrets.js";
+describe("opaque secret helpers", () => {
+    it("hashes deterministically and compares safely", () => {
+        const hash = hashOpaqueSecret("refresh-secret");
+        expect(hash).not.toContain("refresh-secret");
+        expect(opaqueSecretMatches("refresh-secret", hash)).toBe(true);
+        expect(opaqueSecretMatches("wrong", hash)).toBe(false);
+    });
+    it("redacts OTPs and URL or bearer credentials", () => {
+        expect(redactSensitiveText("OTP 123456 bearer abc? token=secret")).toBe("OTP [REDACTED_OTP] bearer [REDACTED] token=[REDACTED]");
+        expect(redactSensitiveText("/callback?code=secret&state=ok")).toBe("/callback?code=[REDACTED]&state=ok");
+    });
+});
+//# sourceMappingURL=secrets.test.js.map

package/dist/secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.js","sourceRoot":"","sources":["../src/secrets.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE1F,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,mBAAmB,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI,CACrE,uDAAuD,CACxD,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAChE,oCAAoC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@rudderhq/identity-core",
+  "version": "0.6.6-canary.2",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://github.com/Undertone0809/rudder",
+  "bugs": {
+    "url": "https://github.com/Undertone0809/rudder/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Undertone0809/rudder",
+    "directory": "packages/identity-core"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "exports": {
+      ".": {
+        "types": "./dist/index.d.ts",
+        "import": "./dist/index.js"
+      }
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "vitest run --config vitest.config.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^24.12.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts"
+}