@serviceme/devtools-shared 2.0.2 → 2.0.3

package/dist/index.d.mts

@@ -1098,11 +1098,11 @@ export interface CopilotCustomizationViewPayload {
  * server (verifier).
  *
  * Single source of truth for the `x-ms-device-*` header names and the
- * HMAC-SHA-256 request-signature algorithm. Previously the same
- * constants + function were copy-pasted in three places
- * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
- * server `lib/auth/device-signature-guard.ts`) and kept in sync by
- * comments alone. Server and extension now import from here.
+ * request-signature algorithms. Previously the same constants +
+ * functions were copy-pasted in three places (extension
+ * `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+ * `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+ * alone. Server and extension now import from here.
  *
  * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
  * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1117,7 +1117,15 @@ export declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+export declare const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 export interface DeviceRequestSignatureParams {
   method: string;
   path: string;
@@ -1126,8 +1134,12 @@ export interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
- * Output is lowercase hex SHA-256.
+ * Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+ * Output is lowercase hex.
+ *
+ * Retained for backward compatibility with fielded extensions that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  *
  * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
  * `node:crypto` so this module stays importable from the webview (the
@@ -1135,6 +1147,30 @@ export interface DeviceRequestSignatureParams {
  * the vite/rollup build).
  */
 export declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+export interface DeviceRequestSignatureV2Params {
+  method: string;
+  /** Full request path INCLUDING the query string (e.g.
+   * `/api/v1/tools/rtk/download?version=1.2.0&target=darwin-arm64`).
+   * v2 signs the query so GET parameters cannot be substituted or
+   * replayed independently of the signed basis. */
+  path: string;
+  timestamp: number;
+  /** One-time value; the server tracks seen nonces per device and
+   * rejects replays within the timestamp window. */
+  nonce: string;
+  body: string;
+  secret: string;
+}
+/**
+ * v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+ * device secret. Output is lowercase hex.
+ *
+ * The client MUST build the exact query string it will send before
+ * signing — the server verifies against the raw `request.url` search,
+ * so the signed string and the wire URL have to match byte-for-byte.
+ */
+export declare function createDeviceRequestSignatureV2(params: DeviceRequestSignatureV2Params): string;
 //#endregion
 //#region src/git-utils.d.ts
 /**

package/dist/index.d.ts

@@ -1098,11 +1098,11 @@ export interface CopilotCustomizationViewPayload {
  * server (verifier).
  *
  * Single source of truth for the `x-ms-device-*` header names and the
- * HMAC-SHA-256 request-signature algorithm. Previously the same
- * constants + function were copy-pasted in three places
- * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
- * server `lib/auth/device-signature-guard.ts`) and kept in sync by
- * comments alone. Server and extension now import from here.
+ * request-signature algorithms. Previously the same constants +
+ * functions were copy-pasted in three places (extension
+ * `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+ * `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+ * alone. Server and extension now import from here.
  *
  * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
  * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1117,7 +1117,15 @@ export declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+export declare const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 export interface DeviceRequestSignatureParams {
   method: string;
   path: string;
@@ -1126,8 +1134,12 @@ export interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
- * Output is lowercase hex SHA-256.
+ * Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+ * Output is lowercase hex.
+ *
+ * Retained for backward compatibility with fielded extensions that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  *
  * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
  * `node:crypto` so this module stays importable from the webview (the
@@ -1135,6 +1147,30 @@ export interface DeviceRequestSignatureParams {
  * the vite/rollup build).
  */
 export declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+export interface DeviceRequestSignatureV2Params {
+  method: string;
+  /** Full request path INCLUDING the query string (e.g.
+   * `/api/v1/tools/rtk/download?version=1.2.0&target=darwin-arm64`).
+   * v2 signs the query so GET parameters cannot be substituted or
+   * replayed independently of the signed basis. */
+  path: string;
+  timestamp: number;
+  /** One-time value; the server tracks seen nonces per device and
+   * rejects replays within the timestamp window. */
+  nonce: string;
+  body: string;
+  secret: string;
+}
+/**
+ * v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+ * device secret. Output is lowercase hex.
+ *
+ * The client MUST build the exact query string it will send before
+ * signing — the server verifies against the raw `request.url` search,
+ * so the signed string and the wire URL have to match byte-for-byte.
+ */
+export declare function createDeviceRequestSignatureV2(params: DeviceRequestSignatureV2Params): string;
 //#endregion
 //#region src/git-utils.d.ts
 /**

package/dist/index.js

@@ -1728,11 +1728,11 @@ sha224.hmac = createNodeHmacMethod("sha224");
 * server (verifier).
 *
 * Single source of truth for the `x-ms-device-*` header names and the
-* HMAC-SHA-256 request-signature algorithm. Previously the same
-* constants + function were copy-pasted in three places
-* (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
-* server `lib/auth/device-signature-guard.ts`) and kept in sync by
-* comments alone. Server and extension now import from here.
+* request-signature algorithms. Previously the same constants +
+* functions were copy-pasted in three places (extension
+* `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+* `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+* alone. Server and extension now import from here.
 *
 * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
 * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1746,11 +1746,23 @@ const DeviceAuthHeaders = {
 	deviceSecret: "x-ms-device-secret",
 	signature: "x-ms-device-signature",
 	timestamp: "x-ms-device-timestamp",
-	secretVersion: "x-ms-device-secret-version"
+	secretVersion: "x-ms-device-secret-version",
+	/** v2 only — algorithm self-declaration so the server can verify
+	* both schemes during the legacy-client rollout window. */
+	sigAlg: "x-ms-device-sig-alg",
+	/** v2 only — one-time value folded into the signature basis and
+	* checked against a server-side replay cache. */
+	nonce: "x-ms-device-nonce"
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 /**
-* Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
-* Output is lowercase hex SHA-256.
+* Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+* (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+* Output is lowercase hex.
+*
+* Retained for backward compatibility with fielded extensions that
+* predate v2; new code should use `createDeviceRequestSignatureV2`.
 *
 * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
 * `node:crypto` so this module stays importable from the webview (the
@@ -1767,6 +1779,26 @@ function createDeviceRequestSignature(params) {
 	].join("\n");
 	return sha256(basis);
 }
+/**
+* v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+* (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+* device secret. Output is lowercase hex.
+*
+* The client MUST build the exact query string it will send before
+* signing — the server verifies against the raw `request.url` search,
+* so the signed string and the wire URL have to match byte-for-byte.
+*/
+function createDeviceRequestSignatureV2(params) {
+	const basis = [
+		params.method.toUpperCase(),
+		params.path,
+		String(params.timestamp),
+		params.nonce,
+		params.body,
+		params.secret
+	].join("\n");
+	return sha256.hmac(params.secret, basis);
+}
 //#endregion
 //#region src/git-utils.ts
 /**
@@ -2358,6 +2390,7 @@ exports.BUILTIN_PROVIDER_PRESETS = BUILTIN_PROVIDER_PRESETS;
 exports.ByomSettingsResponse = ByomSettingsResponse;
 exports.CERTIFICATE_BUNDLE_FORMATS = CERTIFICATE_BUNDLE_FORMATS;
 exports.CachedServerUrlResponse = CachedServerUrlResponse;
+exports.DEVICE_SIG_ALG_V2 = DEVICE_SIG_ALG_V2;
 exports.DeviceAuthHeaders = DeviceAuthHeaders;
 exports.GIT_REMOTE_HOST_ALIASES = GIT_REMOTE_HOST_ALIASES;
 exports.GetByomSettings = GetByomSettings;
@@ -2388,6 +2421,7 @@ exports.buildPresetModel = buildPresetModel;
 exports.checkGitHubOrgMembership = checkGitHubOrgMembership;
 exports.createConsoleLogger = createConsoleLogger;
 exports.createDeviceRequestSignature = createDeviceRequestSignature;
+exports.createDeviceRequestSignatureV2 = createDeviceRequestSignatureV2;
 exports.currencyForBaseUrl = currencyForBaseUrl;
 exports.effectiveAdapterType = effectiveAdapterType;
 exports.fetchGitHubUser = fetchGitHubUser;

package/dist/index.mjs

@@ -1727,11 +1727,11 @@ sha224.hmac = createNodeHmacMethod("sha224");
 * server (verifier).
 *
 * Single source of truth for the `x-ms-device-*` header names and the
-* HMAC-SHA-256 request-signature algorithm. Previously the same
-* constants + function were copy-pasted in three places
-* (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
-* server `lib/auth/device-signature-guard.ts`) and kept in sync by
-* comments alone. Server and extension now import from here.
+* request-signature algorithms. Previously the same constants +
+* functions were copy-pasted in three places (extension
+* `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+* `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+* alone. Server and extension now import from here.
 *
 * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
 * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1745,11 +1745,23 @@ const DeviceAuthHeaders = {
 	deviceSecret: "x-ms-device-secret",
 	signature: "x-ms-device-signature",
 	timestamp: "x-ms-device-timestamp",
-	secretVersion: "x-ms-device-secret-version"
+	secretVersion: "x-ms-device-secret-version",
+	/** v2 only — algorithm self-declaration so the server can verify
+	* both schemes during the legacy-client rollout window. */
+	sigAlg: "x-ms-device-sig-alg",
+	/** v2 only — one-time value folded into the signature basis and
+	* checked against a server-side replay cache. */
+	nonce: "x-ms-device-nonce"
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 /**
-* Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
-* Output is lowercase hex SHA-256.
+* Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+* (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+* Output is lowercase hex.
+*
+* Retained for backward compatibility with fielded extensions that
+* predate v2; new code should use `createDeviceRequestSignatureV2`.
 *
 * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
 * `node:crypto` so this module stays importable from the webview (the
@@ -1766,6 +1778,26 @@ function createDeviceRequestSignature(params) {
 	].join("\n");
 	return sha256(basis);
 }
+/**
+* v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+* (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+* device secret. Output is lowercase hex.
+*
+* The client MUST build the exact query string it will send before
+* signing — the server verifies against the raw `request.url` search,
+* so the signed string and the wire URL have to match byte-for-byte.
+*/
+function createDeviceRequestSignatureV2(params) {
+	const basis = [
+		params.method.toUpperCase(),
+		params.path,
+		String(params.timestamp),
+		params.nonce,
+		params.body,
+		params.secret
+	].join("\n");
+	return sha256.hmac(params.secret, basis);
+}
 //#endregion
 //#region src/git-utils.ts
 /**
@@ -2353,4 +2385,4 @@ function safeJson(text, fallback) {
 	}
 }
 //#endregion
-export { BUILTIN_PROVIDER_PRESETS, ByomSettingsResponse, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, DeviceAuthHeaders, GIT_REMOTE_HOST_ALIASES, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, LISTABLE_PRESET_MODELS, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, ServerProxyStateResponse, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, UpdateUtilityModels, UtilityModelsResponse, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, isWholePackageInstall, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, registrationIdFromPackageId, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { BUILTIN_PROVIDER_PRESETS, ByomSettingsResponse, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, DEVICE_SIG_ALG_V2, DeviceAuthHeaders, GIT_REMOTE_HOST_ALIASES, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, LISTABLE_PRESET_MODELS, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, ServerProxyStateResponse, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, UpdateUtilityModels, UtilityModelsResponse, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, createDeviceRequestSignatureV2, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, isWholePackageInstall, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, registrationIdFromPackageId, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serviceme/devtools-shared",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Shared webview↔extension message contracts and cross-package data models used by SERVICEME.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {