@serviceme/devtools-shared 2.0.2 → 2.0.4

package/dist/index.d.mts

@@ -1098,11 +1098,11 @@ export interface CopilotCustomizationViewPayload {
  * server (verifier).
  *
  * Single source of truth for the `x-ms-device-*` header names and the
- * HMAC-SHA-256 request-signature algorithm. Previously the same
- * constants + function were copy-pasted in three places
- * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
- * server `lib/auth/device-signature-guard.ts`) and kept in sync by
- * comments alone. Server and extension now import from here.
+ * request-signature algorithms. Previously the same constants +
+ * functions were copy-pasted in three places (extension
+ * `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+ * `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+ * alone. Server and extension now import from here.
  *
  * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
  * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1117,7 +1117,15 @@ export declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+export declare const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 export interface DeviceRequestSignatureParams {
   method: string;
   path: string;
@@ -1126,8 +1134,12 @@ export interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
- * Output is lowercase hex SHA-256.
+ * Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+ * Output is lowercase hex.
+ *
+ * Retained for backward compatibility with fielded extensions that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  *
  * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
  * `node:crypto` so this module stays importable from the webview (the
@@ -1135,6 +1147,30 @@ export interface DeviceRequestSignatureParams {
  * the vite/rollup build).
  */
 export declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+export interface DeviceRequestSignatureV2Params {
+  method: string;
+  /** Full request path INCLUDING the query string (e.g.
+   * `/api/v1/tools/rtk/download?version=1.2.0&target=darwin-arm64`).
+   * v2 signs the query so GET parameters cannot be substituted or
+   * replayed independently of the signed basis. */
+  path: string;
+  timestamp: number;
+  /** One-time value; the server tracks seen nonces per device and
+   * rejects replays within the timestamp window. */
+  nonce: string;
+  body: string;
+  secret: string;
+}
+/**
+ * v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+ * device secret. Output is lowercase hex.
+ *
+ * The client MUST build the exact query string it will send before
+ * signing — the server verifies against the raw `request.url` search,
+ * so the signed string and the wire URL have to match byte-for-byte.
+ */
+export declare function createDeviceRequestSignatureV2(params: DeviceRequestSignatureV2Params): string;
 //#endregion
 //#region src/git-utils.d.ts
 /**
@@ -1700,13 +1736,7 @@ export declare enum WebviewMessageType {
   UpdateCopilotLegacyPreview = "updateCopilotLegacyPreview",
   GetUtilityModels = "getUtilityModels",
   UtilityModelsResponse = "utilityModelsResponse",
-  UpdateUtilityModels = "updateUtilityModels",
-  GetServerProxyState = "getServerProxyState",
-  ServerProxyStateResponse = "serverProxyStateResponse",
-  SetServerProxyEnabled = "setServerProxyEnabled",
-  SetServerProxyAllowOverride = "setServerProxyAllowOverride",
-  GetCachedServerUrl = "getCachedServerUrl",
-  CachedServerUrlResponse = "cachedServerUrlResponse"
+  UpdateUtilityModels = "updateUtilityModels"
 }
 /**
  * Top-level const aliases for the BYO Utility Models message-type
@@ -1728,92 +1758,6 @@ export declare const UpdateUtilityModels: "updateUtilityModels";
 export declare const SetCacheControlEnabled: "setCacheControlEnabled";
 export declare const GetByomSettings: "getByomSettings";
 export declare const ByomSettingsResponse: "byomSettingsResponse";
-export declare const GetServerProxyState: "getServerProxyState";
-export declare const ServerProxyStateResponse: "serverProxyStateResponse";
-export declare const SetServerProxyEnabled: "setServerProxyEnabled";
-export declare const SetServerProxyAllowOverride: "setServerProxyAllowOverride";
-export declare const GetCachedServerUrl: "getCachedServerUrl";
-export declare const CachedServerUrlResponse: "cachedServerUrlResponse";
-/**
- * Snapshot of the r7 server-proxy toggle (HTTP CONNECT through intranet
- * Server). Mirrors `IProxyConfigService`'s `ProxyState` shape so the
- * webview can render the same fields without a reshape.
- *
- * Returned by `GetServerProxyState` and broadcast as
- * `ServerProxyStateResponse` so the ProvidersTab's ServerProxyToggle
- * component can paint at the persisted state on mount.
- *
- * See `apps/extension/src/services/proxy/ProxyConfigService.ts` for
- * the authoritative source of truth.
- */
-export type ServerProxySupportMode = "off" | "on" | "fallback" | "override";
-export interface ServerProxySnapshot {
-  httpProxy: string | undefined;
-  httpProxyStrictSSL: boolean;
-  httpProxySupport: ServerProxySupportMode;
-  /** Self-flag at serverProxy.enabled; computed by the extension handler. */
-  enabled: boolean;
-  /**
-   * rev.21 — opt-in to bypass the `proxySupport === "override"`
-   * guard. Power users (e.g. corp environments that WANT all
-   * extensions including GitHub Copilot Chat to route through the
-   * corp tunnel) tick the "Allow under proxySupport=override"
-   * checkbox in the Webview; this flag is persisted to
-   * `~/.serviceme/server-proxy.json` alongside `enabled`.
-   */
-  allowOverride: boolean;
-  /** Last server URL we toggled ON with. Used for re-toggling and UI hint. */
-  lastServerUrl?: string;
-}
-/**
- * Payload for `SetServerProxyEnabled`. The extension handler is the
- * sole owner of `http.proxy` writes — the webview only sends the
- * desired state + (optional) target scope. Server URL is normally read
- * from the snapshot the webview already received via
- * `ServerProxyStateResponse`; if missing, the handler rejects with
- * `serverProxy.error.missingServerUrl`.
- *
- * `serverUrl` is an OVERRIDE: when supplied, the handler uses it
- * instead of the snapshot's `http.proxy` for the `enable` write
- * path. The Webview's "Use Cached Base URL" affordance relies on this
- * so the cached `ServerConnectionService.getBaseUrl()` value gets
- * applied as `http.proxy` even when `http.proxy` is currently empty.
- * Still subject to the `proxySupport !== "override"` server-side gate.
- */
-export interface ServerProxyTogglePayload {
-  enabled: boolean;
-  /** Optional — defaults to Workspace. */
-  target?: "workspace" | "global";
-  /**
-   * Optional — override the snapshot's `http.proxy` for the write.
-   * Only honoured when `enabled === true`; ignored on disable so the
-   * existing "only clear our own write" semantics stay intact.
-   */
-  serverUrl?: string;
-}
-/**
- * rev.21 — payload for `SetServerProxyAllowOverride`. Toggles the
- * `serverProxy.allowOverride` self-flag in `~/.serviceme/server-proxy.json`.
- * Persisted across VS Code restarts; defaults to `false` so users
- * must explicitly opt-in to the `override` mode bypass.
- */
-export interface ServerProxyAllowOverridePayload {
-  allowOverride: boolean;
-}
-/**
- * Reply to `GetCachedServerUrl`. Carries the cached base URL resolved
- * by `ServerConnectionService` (probe + cache of `SERVER_URL_CANDIDATES`)
- * and the same `proxySupport` snapshot for the UI to gate the
- * "Apply" button.
- *
- * `baseUrl: null` means the candidate probe has not yet resolved a
- * reachable Server — the Webview should hide the "Apply cached base
- * URL" affordance rather than offer a no-op button.
- */
-export interface CachedServerUrlSnapshot {
-  baseUrl: string | null;
-  httpProxySupport: ServerProxySupportMode;
-}
 /**
  * Where the three `msDevTools.utilityModels.*` settings (and their
  * derived `chat.*` mirrors) are persisted.

package/dist/index.d.ts

@@ -1098,11 +1098,11 @@ export interface CopilotCustomizationViewPayload {
  * server (verifier).
  *
  * Single source of truth for the `x-ms-device-*` header names and the
- * HMAC-SHA-256 request-signature algorithm. Previously the same
- * constants + function were copy-pasted in three places
- * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
- * server `lib/auth/device-signature-guard.ts`) and kept in sync by
- * comments alone. Server and extension now import from here.
+ * request-signature algorithms. Previously the same constants +
+ * functions were copy-pasted in three places (extension
+ * `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+ * `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+ * alone. Server and extension now import from here.
  *
  * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
  * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1117,7 +1117,15 @@ export declare const DeviceAuthHeaders: {
   readonly signature: "x-ms-device-signature";
   readonly timestamp: "x-ms-device-timestamp";
   readonly secretVersion: "x-ms-device-secret-version";
+  /** v2 only — algorithm self-declaration so the server can verify
+   * both schemes during the legacy-client rollout window. */
+  readonly sigAlg: "x-ms-device-sig-alg";
+  /** v2 only — one-time value folded into the signature basis and
+   * checked against a server-side replay cache. */
+  readonly nonce: "x-ms-device-nonce";
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+export declare const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 export interface DeviceRequestSignatureParams {
   method: string;
   path: string;
@@ -1126,8 +1134,12 @@ export interface DeviceRequestSignatureParams {
   secret: string;
 }
 /**
- * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
- * Output is lowercase hex SHA-256.
+ * Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+ * Output is lowercase hex.
+ *
+ * Retained for backward compatibility with fielded extensions that
+ * predate v2; new code should use `createDeviceRequestSignatureV2`.
  *
  * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
  * `node:crypto` so this module stays importable from the webview (the
@@ -1135,6 +1147,30 @@ export interface DeviceRequestSignatureParams {
  * the vite/rollup build).
  */
 export declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+export interface DeviceRequestSignatureV2Params {
+  method: string;
+  /** Full request path INCLUDING the query string (e.g.
+   * `/api/v1/tools/rtk/download?version=1.2.0&target=darwin-arm64`).
+   * v2 signs the query so GET parameters cannot be substituted or
+   * replayed independently of the signed basis. */
+  path: string;
+  timestamp: number;
+  /** One-time value; the server tracks seen nonces per device and
+   * rejects replays within the timestamp window. */
+  nonce: string;
+  body: string;
+  secret: string;
+}
+/**
+ * v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+ * (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+ * device secret. Output is lowercase hex.
+ *
+ * The client MUST build the exact query string it will send before
+ * signing — the server verifies against the raw `request.url` search,
+ * so the signed string and the wire URL have to match byte-for-byte.
+ */
+export declare function createDeviceRequestSignatureV2(params: DeviceRequestSignatureV2Params): string;
 //#endregion
 //#region src/git-utils.d.ts
 /**
@@ -1700,13 +1736,7 @@ export declare enum WebviewMessageType {
   UpdateCopilotLegacyPreview = "updateCopilotLegacyPreview",
   GetUtilityModels = "getUtilityModels",
   UtilityModelsResponse = "utilityModelsResponse",
-  UpdateUtilityModels = "updateUtilityModels",
-  GetServerProxyState = "getServerProxyState",
-  ServerProxyStateResponse = "serverProxyStateResponse",
-  SetServerProxyEnabled = "setServerProxyEnabled",
-  SetServerProxyAllowOverride = "setServerProxyAllowOverride",
-  GetCachedServerUrl = "getCachedServerUrl",
-  CachedServerUrlResponse = "cachedServerUrlResponse"
+  UpdateUtilityModels = "updateUtilityModels"
 }
 /**
  * Top-level const aliases for the BYO Utility Models message-type
@@ -1728,92 +1758,6 @@ export declare const UpdateUtilityModels: "updateUtilityModels";
 export declare const SetCacheControlEnabled: "setCacheControlEnabled";
 export declare const GetByomSettings: "getByomSettings";
 export declare const ByomSettingsResponse: "byomSettingsResponse";
-export declare const GetServerProxyState: "getServerProxyState";
-export declare const ServerProxyStateResponse: "serverProxyStateResponse";
-export declare const SetServerProxyEnabled: "setServerProxyEnabled";
-export declare const SetServerProxyAllowOverride: "setServerProxyAllowOverride";
-export declare const GetCachedServerUrl: "getCachedServerUrl";
-export declare const CachedServerUrlResponse: "cachedServerUrlResponse";
-/**
- * Snapshot of the r7 server-proxy toggle (HTTP CONNECT through intranet
- * Server). Mirrors `IProxyConfigService`'s `ProxyState` shape so the
- * webview can render the same fields without a reshape.
- *
- * Returned by `GetServerProxyState` and broadcast as
- * `ServerProxyStateResponse` so the ProvidersTab's ServerProxyToggle
- * component can paint at the persisted state on mount.
- *
- * See `apps/extension/src/services/proxy/ProxyConfigService.ts` for
- * the authoritative source of truth.
- */
-export type ServerProxySupportMode = "off" | "on" | "fallback" | "override";
-export interface ServerProxySnapshot {
-  httpProxy: string | undefined;
-  httpProxyStrictSSL: boolean;
-  httpProxySupport: ServerProxySupportMode;
-  /** Self-flag at serverProxy.enabled; computed by the extension handler. */
-  enabled: boolean;
-  /**
-   * rev.21 — opt-in to bypass the `proxySupport === "override"`
-   * guard. Power users (e.g. corp environments that WANT all
-   * extensions including GitHub Copilot Chat to route through the
-   * corp tunnel) tick the "Allow under proxySupport=override"
-   * checkbox in the Webview; this flag is persisted to
-   * `~/.serviceme/server-proxy.json` alongside `enabled`.
-   */
-  allowOverride: boolean;
-  /** Last server URL we toggled ON with. Used for re-toggling and UI hint. */
-  lastServerUrl?: string;
-}
-/**
- * Payload for `SetServerProxyEnabled`. The extension handler is the
- * sole owner of `http.proxy` writes — the webview only sends the
- * desired state + (optional) target scope. Server URL is normally read
- * from the snapshot the webview already received via
- * `ServerProxyStateResponse`; if missing, the handler rejects with
- * `serverProxy.error.missingServerUrl`.
- *
- * `serverUrl` is an OVERRIDE: when supplied, the handler uses it
- * instead of the snapshot's `http.proxy` for the `enable` write
- * path. The Webview's "Use Cached Base URL" affordance relies on this
- * so the cached `ServerConnectionService.getBaseUrl()` value gets
- * applied as `http.proxy` even when `http.proxy` is currently empty.
- * Still subject to the `proxySupport !== "override"` server-side gate.
- */
-export interface ServerProxyTogglePayload {
-  enabled: boolean;
-  /** Optional — defaults to Workspace. */
-  target?: "workspace" | "global";
-  /**
-   * Optional — override the snapshot's `http.proxy` for the write.
-   * Only honoured when `enabled === true`; ignored on disable so the
-   * existing "only clear our own write" semantics stay intact.
-   */
-  serverUrl?: string;
-}
-/**
- * rev.21 — payload for `SetServerProxyAllowOverride`. Toggles the
- * `serverProxy.allowOverride` self-flag in `~/.serviceme/server-proxy.json`.
- * Persisted across VS Code restarts; defaults to `false` so users
- * must explicitly opt-in to the `override` mode bypass.
- */
-export interface ServerProxyAllowOverridePayload {
-  allowOverride: boolean;
-}
-/**
- * Reply to `GetCachedServerUrl`. Carries the cached base URL resolved
- * by `ServerConnectionService` (probe + cache of `SERVER_URL_CANDIDATES`)
- * and the same `proxySupport` snapshot for the UI to gate the
- * "Apply" button.
- *
- * `baseUrl: null` means the candidate probe has not yet resolved a
- * reachable Server — the Webview should hide the "Apply cached base
- * URL" affordance rather than offer a no-op button.
- */
-export interface CachedServerUrlSnapshot {
-  baseUrl: string | null;
-  httpProxySupport: ServerProxySupportMode;
-}
 /**
  * Where the three `msDevTools.utilityModels.*` settings (and their
  * derived `chat.*` mirrors) are persisted.

package/dist/index.js

@@ -1728,11 +1728,11 @@ sha224.hmac = createNodeHmacMethod("sha224");
 * server (verifier).
 *
 * Single source of truth for the `x-ms-device-*` header names and the
-* HMAC-SHA-256 request-signature algorithm. Previously the same
-* constants + function were copy-pasted in three places
-* (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
-* server `lib/auth/device-signature-guard.ts`) and kept in sync by
-* comments alone. Server and extension now import from here.
+* request-signature algorithms. Previously the same constants +
+* functions were copy-pasted in three places (extension
+* `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+* `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+* alone. Server and extension now import from here.
 *
 * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
 * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1746,11 +1746,23 @@ const DeviceAuthHeaders = {
 	deviceSecret: "x-ms-device-secret",
 	signature: "x-ms-device-signature",
 	timestamp: "x-ms-device-timestamp",
-	secretVersion: "x-ms-device-secret-version"
+	secretVersion: "x-ms-device-secret-version",
+	/** v2 only — algorithm self-declaration so the server can verify
+	* both schemes during the legacy-client rollout window. */
+	sigAlg: "x-ms-device-sig-alg",
+	/** v2 only — one-time value folded into the signature basis and
+	* checked against a server-side replay cache. */
+	nonce: "x-ms-device-nonce"
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 /**
-* Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
-* Output is lowercase hex SHA-256.
+* Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+* (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+* Output is lowercase hex.
+*
+* Retained for backward compatibility with fielded extensions that
+* predate v2; new code should use `createDeviceRequestSignatureV2`.
 *
 * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
 * `node:crypto` so this module stays importable from the webview (the
@@ -1767,6 +1779,26 @@ function createDeviceRequestSignature(params) {
 	].join("\n");
 	return sha256(basis);
 }
+/**
+* v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+* (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+* device secret. Output is lowercase hex.
+*
+* The client MUST build the exact query string it will send before
+* signing — the server verifies against the raw `request.url` search,
+* so the signed string and the wire URL have to match byte-for-byte.
+*/
+function createDeviceRequestSignatureV2(params) {
+	const basis = [
+		params.method.toUpperCase(),
+		params.path,
+		String(params.timestamp),
+		params.nonce,
+		params.body,
+		params.secret
+	].join("\n");
+	return sha256.hmac(params.secret, basis);
+}
 //#endregion
 //#region src/git-utils.ts
 /**
@@ -2263,12 +2295,6 @@ let WebviewMessageType = /* @__PURE__ */ function(WebviewMessageType) {
 	WebviewMessageType["GetUtilityModels"] = "getUtilityModels";
 	WebviewMessageType["UtilityModelsResponse"] = "utilityModelsResponse";
 	WebviewMessageType["UpdateUtilityModels"] = "updateUtilityModels";
-	WebviewMessageType["GetServerProxyState"] = "getServerProxyState";
-	WebviewMessageType["ServerProxyStateResponse"] = "serverProxyStateResponse";
-	WebviewMessageType["SetServerProxyEnabled"] = "setServerProxyEnabled";
-	WebviewMessageType["SetServerProxyAllowOverride"] = "setServerProxyAllowOverride";
-	WebviewMessageType["GetCachedServerUrl"] = "getCachedServerUrl";
-	WebviewMessageType["CachedServerUrlResponse"] = "cachedServerUrlResponse";
 	return WebviewMessageType;
 }({});
 /**
@@ -2291,12 +2317,6 @@ const UpdateUtilityModels = "updateUtilityModels";
 const SetCacheControlEnabled = "setCacheControlEnabled";
 const GetByomSettings = "getByomSettings";
 const ByomSettingsResponse = "byomSettingsResponse";
-const GetServerProxyState = "getServerProxyState";
-const ServerProxyStateResponse = "serverProxyStateResponse";
-const SetServerProxyEnabled = "setServerProxyEnabled";
-const SetServerProxyAllowOverride = "setServerProxyAllowOverride";
-const GetCachedServerUrl = "getCachedServerUrl";
-const CachedServerUrlResponse = "cachedServerUrlResponse";
 //#endregion
 //#region src/utils/safe-cast.ts
 /**
@@ -2357,12 +2377,10 @@ function safeJson(text, fallback) {
 exports.BUILTIN_PROVIDER_PRESETS = BUILTIN_PROVIDER_PRESETS;
 exports.ByomSettingsResponse = ByomSettingsResponse;
 exports.CERTIFICATE_BUNDLE_FORMATS = CERTIFICATE_BUNDLE_FORMATS;
-exports.CachedServerUrlResponse = CachedServerUrlResponse;
+exports.DEVICE_SIG_ALG_V2 = DEVICE_SIG_ALG_V2;
 exports.DeviceAuthHeaders = DeviceAuthHeaders;
 exports.GIT_REMOTE_HOST_ALIASES = GIT_REMOTE_HOST_ALIASES;
 exports.GetByomSettings = GetByomSettings;
-exports.GetCachedServerUrl = GetCachedServerUrl;
-exports.GetServerProxyState = GetServerProxyState;
 exports.GetUtilityModels = GetUtilityModels;
 exports.LISTABLE_PRESET_MODELS = LISTABLE_PRESET_MODELS;
 exports.LogLevel = LogLevel;
@@ -2374,10 +2392,7 @@ exports.NAMESPACE_ALIAS_FAMILY = NAMESPACE_ALIAS_FAMILY;
 exports.PRESET_MODEL_FAMILIES = PRESET_MODEL_FAMILIES;
 exports.PROVIDER_BASE_URL_PRESETS = PROVIDER_BASE_URL_PRESETS;
 exports.PROVIDER_CACHE_CONTROL_METADATA = PROVIDER_CACHE_CONTROL_METADATA;
-exports.ServerProxyStateResponse = ServerProxyStateResponse;
 exports.SetCacheControlEnabled = SetCacheControlEnabled;
-exports.SetServerProxyAllowOverride = SetServerProxyAllowOverride;
-exports.SetServerProxyEnabled = SetServerProxyEnabled;
 exports.UpdateUtilityModels = UpdateUtilityModels;
 exports.UtilityModelsResponse = UtilityModelsResponse;
 exports.WebviewMessageType = WebviewMessageType;
@@ -2388,6 +2403,7 @@ exports.buildPresetModel = buildPresetModel;
 exports.checkGitHubOrgMembership = checkGitHubOrgMembership;
 exports.createConsoleLogger = createConsoleLogger;
 exports.createDeviceRequestSignature = createDeviceRequestSignature;
+exports.createDeviceRequestSignatureV2 = createDeviceRequestSignatureV2;
 exports.currencyForBaseUrl = currencyForBaseUrl;
 exports.effectiveAdapterType = effectiveAdapterType;
 exports.fetchGitHubUser = fetchGitHubUser;

package/dist/index.mjs

@@ -1727,11 +1727,11 @@ sha224.hmac = createNodeHmacMethod("sha224");
 * server (verifier).
 *
 * Single source of truth for the `x-ms-device-*` header names and the
-* HMAC-SHA-256 request-signature algorithm. Previously the same
-* constants + function were copy-pasted in three places
-* (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
-* server `lib/auth/device-signature-guard.ts`) and kept in sync by
-* comments alone. Server and extension now import from here.
+* request-signature algorithms. Previously the same constants +
+* functions were copy-pasted in three places (extension
+* `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`, server
+* `lib/auth/device-signature-guard.ts`) and kept in sync by comments
+* alone. Server and extension now import from here.
 *
 * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
 * copy — ADL-003 forbids core → shared (and shared → core) so the core
@@ -1745,11 +1745,23 @@ const DeviceAuthHeaders = {
 	deviceSecret: "x-ms-device-secret",
 	signature: "x-ms-device-signature",
 	timestamp: "x-ms-device-timestamp",
-	secretVersion: "x-ms-device-secret-version"
+	secretVersion: "x-ms-device-secret-version",
+	/** v2 only — algorithm self-declaration so the server can verify
+	* both schemes during the legacy-client rollout window. */
+	sigAlg: "x-ms-device-sig-alg",
+	/** v2 only — one-time value folded into the signature basis and
+	* checked against a server-side replay cache. */
+	nonce: "x-ms-device-nonce"
 };
+/** v2 signature algorithm identifier carried in `x-ms-device-sig-alg`. */
+const DEVICE_SIG_ALG_V2 = "hmac-sha256-v2";
 /**
-* Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
-* Output is lowercase hex SHA-256.
+* Legacy (v1) basis: `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET`
+* (LF-joined, NOT JSON), hashed with a secret-suffix SHA-256.
+* Output is lowercase hex.
+*
+* Retained for backward compatibility with fielded extensions that
+* predate v2; new code should use `createDeviceRequestSignatureV2`.
 *
 * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
 * `node:crypto` so this module stays importable from the webview (the
@@ -1766,6 +1778,26 @@ function createDeviceRequestSignature(params) {
 	].join("\n");
 	return sha256(basis);
 }
+/**
+* v2 basis: `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nBODY\nSECRET`
+* (LF-joined, NOT JSON), MACed with real HMAC-SHA-256 keyed by the
+* device secret. Output is lowercase hex.
+*
+* The client MUST build the exact query string it will send before
+* signing — the server verifies against the raw `request.url` search,
+* so the signed string and the wire URL have to match byte-for-byte.
+*/
+function createDeviceRequestSignatureV2(params) {
+	const basis = [
+		params.method.toUpperCase(),
+		params.path,
+		String(params.timestamp),
+		params.nonce,
+		params.body,
+		params.secret
+	].join("\n");
+	return sha256.hmac(params.secret, basis);
+}
 //#endregion
 //#region src/git-utils.ts
 /**
@@ -2262,12 +2294,6 @@ let WebviewMessageType = /* @__PURE__ */ function(WebviewMessageType) {
 	WebviewMessageType["GetUtilityModels"] = "getUtilityModels";
 	WebviewMessageType["UtilityModelsResponse"] = "utilityModelsResponse";
 	WebviewMessageType["UpdateUtilityModels"] = "updateUtilityModels";
-	WebviewMessageType["GetServerProxyState"] = "getServerProxyState";
-	WebviewMessageType["ServerProxyStateResponse"] = "serverProxyStateResponse";
-	WebviewMessageType["SetServerProxyEnabled"] = "setServerProxyEnabled";
-	WebviewMessageType["SetServerProxyAllowOverride"] = "setServerProxyAllowOverride";
-	WebviewMessageType["GetCachedServerUrl"] = "getCachedServerUrl";
-	WebviewMessageType["CachedServerUrlResponse"] = "cachedServerUrlResponse";
 	return WebviewMessageType;
 }({});
 /**
@@ -2290,12 +2316,6 @@ const UpdateUtilityModels = "updateUtilityModels";
 const SetCacheControlEnabled = "setCacheControlEnabled";
 const GetByomSettings = "getByomSettings";
 const ByomSettingsResponse = "byomSettingsResponse";
-const GetServerProxyState = "getServerProxyState";
-const ServerProxyStateResponse = "serverProxyStateResponse";
-const SetServerProxyEnabled = "setServerProxyEnabled";
-const SetServerProxyAllowOverride = "setServerProxyAllowOverride";
-const GetCachedServerUrl = "getCachedServerUrl";
-const CachedServerUrlResponse = "cachedServerUrlResponse";
 //#endregion
 //#region src/utils/safe-cast.ts
 /**
@@ -2353,4 +2373,4 @@ function safeJson(text, fallback) {
 	}
 }
 //#endregion
-export { BUILTIN_PROVIDER_PRESETS, ByomSettingsResponse, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, DeviceAuthHeaders, GIT_REMOTE_HOST_ALIASES, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, LISTABLE_PRESET_MODELS, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, ServerProxyStateResponse, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, UpdateUtilityModels, UtilityModelsResponse, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, isWholePackageInstall, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, registrationIdFromPackageId, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { BUILTIN_PROVIDER_PRESETS, ByomSettingsResponse, CERTIFICATE_BUNDLE_FORMATS, DEVICE_SIG_ALG_V2, DeviceAuthHeaders, GIT_REMOTE_HOST_ALIASES, GetByomSettings, GetUtilityModels, LISTABLE_PRESET_MODELS, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, SetCacheControlEnabled, UpdateUtilityModels, UtilityModelsResponse, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, createDeviceRequestSignatureV2, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, isWholePackageInstall, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, registrationIdFromPackageId, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serviceme/devtools-shared",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Shared webview↔extension message contracts and cross-package data models used by SERVICEME.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {