@teincfood/core 0.9.26 → 0.10.0

package/dist/adapters/auth.d.ts

@@ -11,6 +11,8 @@ export declare const useAuthStore: {
         user: AuthUser | null;
     };
 };
+export declare function setLocalSessionActive(active: boolean): void;
+export declare function isLocalSessionActive(): boolean;
 export declare function subscribeAuth(listener: () => void): () => void;
 export declare function setAuthProvider(fn: () => string | null): void;
 export declare function setAuthRefreshProvider(fn: () => string | null): void;
@@ -18,6 +20,8 @@ export declare function setAuthTokensProvider(fn: (at: string, rt: string) => vo
 export declare function setAuthClearProvider(fn: () => void): void;
 export declare function getAuthToken(): string | null;
 export declare function getRefreshToken(): string | null;
+/** True when either a cloud token or an offline member session exists. */
+export declare function hasSession(): boolean;
 export declare function setAuthTokens(at: string, rt: string): void;
 export declare function clearAuth(): void;
 export declare function notifyAuthChanged(): void;

package/dist/adapters/auth.js

@@ -12,6 +12,17 @@ let getAccessToken = null;
 let getRefresh = null;
 let setTokens = null;
 let clearFn = null;
+// Offline member sessions have no cloud access token but are still valid local
+// sessions. Cloud HTTP calls must still require a real token; local commands,
+// LAN mesh startup and the outbox use `hasSession()`.
+let localSessionActive = false;
+export function setLocalSessionActive(active) {
+    localSessionActive = active;
+    notifyAuth();
+}
+export function isLocalSessionActive() {
+    return localSessionActive;
+}
 const authListeners = new Set();
 export function subscribeAuth(listener) {
     authListeners.add(listener);
@@ -38,12 +49,18 @@ export function getAuthToken() {
 export function getRefreshToken() {
     return getRefresh ? getRefresh() : null;
 }
+/** True when either a cloud token or an offline member session exists. */
+export function hasSession() {
+    return localSessionActive || !!getAuthToken();
+}
 export function setAuthTokens(at, rt) {
+    localSessionActive = false;
     if (setTokens)
         setTokens(at, rt);
     notifyAuth();
 }
 export function clearAuth() {
+    localSessionActive = false;
     if (clearFn)
         clearFn();
     notifyAuth();

package/dist/auth/session.d.ts

@@ -57,6 +57,12 @@ export interface SessionTokens {
  */
 export declare const SKIP_AUTH_RETRY = "x-teinc-skip-auth-retry";
 export declare function hasAuthRetrySkip(config: unknown): boolean;
+/**
+ * Host apps register a device-license exchange here. It lets an offline
+ * terminal recover from an expired/rotated refresh token without asking the
+ * member to sign in again.
+ */
+export declare function setOfflineSessionRecoveryProvider(provider: (() => Promise<SessionTokens | null>) | null): void;
 export declare function refreshSession(): Promise<SessionTokens | null>;
 /**
  * Run fn; on access-expired, refresh once (single-flight) and retry once.

package/dist/auth/session.js

@@ -16,7 +16,7 @@
  * the backend rotates refresh tokens — two concurrent refreshes with the
  * same token revoke each other and 401 the session.
  */
-import { clearAuth, getRefreshToken, setAuthTokens, } from "../adapters/auth";
+import { clearAuth, getRefreshToken, isLocalSessionActive, setAuthTokens, } from "../adapters/auth";
 import { getHttpClient } from "../adapters/http";
 import { syncLogger } from "../utils/sync-logger";
 /** Access token expired — recoverable via one refresh + retry. */
@@ -99,6 +99,25 @@ export function hasAuthRetrySkip(config) {
     }
 }
 let inflight = null;
+let offlineRecovery = null;
+/**
+ * Host apps register a device-license exchange here. It lets an offline
+ * terminal recover from an expired/rotated refresh token without asking the
+ * member to sign in again.
+ */
+export function setOfflineSessionRecoveryProvider(provider) {
+    offlineRecovery = provider;
+}
+async function tryOfflineRecovery() {
+    if (!offlineRecovery)
+        return null;
+    try {
+        return await offlineRecovery();
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Single-flight refresh. Returns fresh tokens (stored via provider) or
  * null. Calls clearAuth() (→ host logout) when the backend reports the
@@ -109,7 +128,11 @@ async function doRefresh() {
     try {
         const rt = getRefreshToken();
         if (!rt) {
-            clearAuth();
+            const recovered = await tryOfflineRecovery();
+            if (recovered)
+                return recovered;
+            if (!isLocalSessionActive())
+                clearAuth();
             return null;
         }
         const http = getHttpClient();
@@ -129,6 +152,9 @@ async function doRefresh() {
     catch (e) {
         const failure = extractAuthFailure(e);
         if (isSessionDead(failure)) {
+            const recovered = await tryOfflineRecovery();
+            if (recovered)
+                return recovered;
             syncLogger.warn("Session", "Refresh token expired — logging out", {
                 code: failure.code,
             });

package/dist/index.d.ts

@@ -122,7 +122,7 @@ export * from "./local-node/service";
 export { setLocalNodeState } from "./adapters/local-node";
 export * from "./adapters/services";
 export * from "./adapters/devices";
-export { setAuthProvider, getAuthToken, setAuthRefreshProvider, getRefreshToken, setAuthTokensProvider, setAuthTokens, setAuthClearProvider, clearAuth } from "./adapters/auth";
+export { setAuthProvider, getAuthToken, setAuthRefreshProvider, getRefreshToken, setAuthTokensProvider, setAuthTokens, setAuthClearProvider, clearAuth, hasSession, setLocalSessionActive, isLocalSessionActive, } from "./adapters/auth";
 export { imageCacheService } from "./adapters/image-cache";
 export * from "./adapters/business";
 export * from "./adapters/pending-orders";
@@ -155,7 +155,10 @@ export { performFullSync } from "./sync/full-sync";
 export { stopHealthProbe, probeCloudHealth } from "./sync/health-probe";
 export { notifyAuthChanged, subscribeAuth } from "./adapters/auth";
 export { isAuthenticated, hasActiveBusiness, canBusinessSync, setOfflineSyncEnabled, isOfflineSyncEnabled } from "./sync/sync-guard";
-export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, } from "./auth/session";
+export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, setOfflineSessionRecoveryProvider, } from "./auth/session";
+export * from "./offline/license";
+export * from "./offline/store";
+export * from "./offline/service";
 export type { AuthFailure, SessionTokens } from "./auth/session";
 export { getCachedImagePath, ensureImageCacheDir, getCachedImageInfo, cacheRemoteImage, cacheImageBatch, clearImageCache, pruneImageCache, resolveImageSource, stableCacheUrl } from "./image-cache/service";
 import { type SqliteDriver } from "./adapters/sqlite";

package/dist/index.js

@@ -125,7 +125,7 @@ export * from "./local-node/service";
 export { setLocalNodeState } from "./adapters/local-node";
 export * from "./adapters/services";
 export * from "./adapters/devices";
-export { setAuthProvider, getAuthToken, setAuthRefreshProvider, getRefreshToken, setAuthTokensProvider, setAuthTokens, setAuthClearProvider, clearAuth } from "./adapters/auth";
+export { setAuthProvider, getAuthToken, setAuthRefreshProvider, getRefreshToken, setAuthTokensProvider, setAuthTokens, setAuthClearProvider, clearAuth, hasSession, setLocalSessionActive, isLocalSessionActive, } from "./adapters/auth";
 export { imageCacheService } from "./adapters/image-cache";
 export * from "./adapters/business";
 export * from "./adapters/pending-orders";
@@ -170,7 +170,11 @@ export { stopHealthProbe, probeCloudHealth } from "./sync/health-probe";
 export { notifyAuthChanged, subscribeAuth } from "./adapters/auth";
 export { isAuthenticated, hasActiveBusiness, canBusinessSync, setOfflineSyncEnabled, isOfflineSyncEnabled } from "./sync/sync-guard";
 // ── Session lifecycle (access-expired → refresh → refresh-expired → logout)
-export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, } from "./auth/session";
+export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, setOfflineSessionRecoveryProvider, } from "./auth/session";
+// ── Offline device license + member unlock ──
+export * from "./offline/license";
+export * from "./offline/store";
+export * from "./offline/service";
 // ── Image cache (durable) ──
 export { getCachedImagePath, ensureImageCacheDir, getCachedImageInfo, cacheRemoteImage, cacheImageBatch, clearImageCache, pruneImageCache, resolveImageSource, stableCacheUrl } from "./image-cache/service";
 // ── Init helper ──

package/dist/local-node/adapters.d.ts

@@ -79,6 +79,7 @@ export interface LocalNodeDeps {
     getAuth: () => {
         user: unknown | null;
         accessToken: string | null;
+        localSession?: boolean;
     };
     discovery: DiscoveryAdapter;
     transport: TransportAdapter;

package/dist/local-node/service.js

@@ -82,7 +82,7 @@ class LocalNodeServiceCore {
             return;
         const auth = deps.getAuth();
         const business = deps.getBusiness();
-        if (!auth.user || !auth.accessToken || !business) {
+        if (!auth.user || (!auth.accessToken && !auth.localSession) || !business) {
             if (this.mode !== "idle")
                 await this.runShutdown();
             syncLogger.info("LocalNodeService", "Local Node idle (no active business)", {});

package/dist/offline/license.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Offline device license — Ed25519 verification and evaluation.
+ *
+ * The backend signs a device-bound license once the terminal is activated
+ * online. The app verifies it locally with the cached public key and uses the
+ * monotonic entitlement clock for expiry, so changing the device wall-clock
+ * cannot extend offline access.
+ */
+export declare const OFFLINE_LICENSE_VERSION = "v1";
+export interface OfflineLicenseFeatures {
+    [key: string]: unknown;
+}
+export interface OfflineLicensePayload {
+    v: number;
+    license_id: string;
+    business_id: string;
+    device_id: string;
+    device_number: string;
+    member_id: string;
+    features: OfflineLicenseFeatures;
+    business_type?: string | null;
+    subscription_status?: string | null;
+    current_period_end?: string | null;
+    grace_until?: string | null;
+    server_time: string;
+    issued_at: string;
+    expires_at: string;
+    max_offline_days: number;
+}
+export type OfflineLicenseState = "active" | "expired" | "invalid" | "unverified";
+export interface OfflineLicenseEvaluation {
+    state: OfflineLicenseState;
+    valid: boolean;
+    entitled: boolean;
+    mustReconnect: boolean;
+    payload: OfflineLicensePayload | null;
+    serverNowMs: number;
+    reason: string;
+}
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(value: string): Uint8Array;
+export declare function textBytes(value: string): Uint8Array;
+export declare function textFromBytes(value: Uint8Array): string;
+export declare function splitLicense(token: string): {
+    version: string;
+    keyId: string;
+    payloadBytes: Uint8Array;
+    signature: Uint8Array;
+} | null;
+export declare function decodeLicensePayload(token: string): OfflineLicensePayload | null;
+/**
+ * Verify a license token against the public key cached at activation.
+ * An optional business id prevents a valid license for one tenant being
+ * replayed into another tenant on the same device.
+ */
+export declare function verifyOfflineLicense(token: string, publicKeyB64: string, expectedBusinessId?: string): Promise<OfflineLicensePayload | null>;
+/** Evaluate a verified license using the server-anchored monotonic clock. */
+export declare function evaluateOfflineLicense(payload: OfflineLicensePayload | null): Promise<OfflineLicenseEvaluation>;
+export declare function loadAndVerifyOfflineLicense(args: {
+    token: string | null;
+    publicKey: string | null;
+    businessId?: string;
+}): Promise<{
+    payload: OfflineLicensePayload | null;
+    evaluation: OfflineLicenseEvaluation;
+}>;
+/** Canonical message the device signs for `/auth/offline/exchange`. */
+export declare function canonicalDeviceChallenge(args: {
+    deviceId: string;
+    licenseId: string;
+    memberId: string;
+    nonce: string;
+    timestamp: string;
+}): string;
+export declare function signDeviceChallenge(privateKey: Uint8Array, message: string): Promise<string>;
+export declare function generateOfflineDeviceKeypair(randomBytes: (length: number) => Uint8Array): Promise<{
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+    publicKeyB64: string;
+}>;
+export declare function newOfflineNonce(randomBytes: (length: number) => Uint8Array): string;
+/** Remove the per-business offline fields from an entitlement-shaped map. */
+export declare function licenseFeatures(payload: OfflineLicensePayload | null): Record<string, unknown> | null;
+export declare const OFFLINE_LICENSE_MAX_DAYS = 30;
+export declare const OFFLINE_LICENSE_DAY_MS: number;

package/dist/offline/license.js

@@ -0,0 +1,221 @@
+/**
+ * Offline device license — Ed25519 verification and evaluation.
+ *
+ * The backend signs a device-bound license once the terminal is activated
+ * online. The app verifies it locally with the cached public key and uses the
+ * monotonic entitlement clock for expiry, so changing the device wall-clock
+ * cannot extend offline access.
+ */
+import { sha512 } from "@noble/hashes/sha512";
+import * as ed from "@noble/ed25519";
+import { anchorServerTime, getServerNowMs } from "../reference/entitlement-clock";
+// `@noble/ed25519` needs a SHA-512 implementation for Ed25519. Hermes has no
+// native Ed25519, so use the audited pure-JS hash.
+ed.etc.sha512Async = async (message) => sha512(message);
+export const OFFLINE_LICENSE_VERSION = "v1";
+const DAY_MS = 24 * 60 * 60 * 1000;
+const B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+export function base64UrlEncode(bytes) {
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const a = bytes[i];
+        const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        const trio = (a << 16) | (b << 8) | c;
+        out += B64_ALPHABET[(trio >> 18) & 63];
+        out += B64_ALPHABET[(trio >> 12) & 63];
+        if (i + 1 < bytes.length)
+            out += B64_ALPHABET[(trio >> 6) & 63];
+        if (i + 2 < bytes.length)
+            out += B64_ALPHABET[trio & 63];
+    }
+    return out;
+}
+export function base64UrlDecode(value) {
+    const clean = value.replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+    const out = [];
+    let buffer = 0;
+    let bits = 0;
+    for (let i = 0; i < clean.length; i++) {
+        const index = B64_ALPHABET.indexOf(clean[i]);
+        if (index < 0)
+            throw new Error("Invalid base64url");
+        buffer = (buffer << 6) | index;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out.push((buffer >> bits) & 0xff);
+        }
+    }
+    return new Uint8Array(out);
+}
+export function textBytes(value) {
+    return new TextEncoder().encode(value);
+}
+export function textFromBytes(value) {
+    let out = "";
+    let i = 0;
+    while (i < value.length) {
+        const first = value[i++];
+        if (first < 0x80) {
+            out += String.fromCharCode(first);
+        }
+        else if (first < 0xe0) {
+            out += String.fromCharCode(((first & 0x1f) << 6) | (value[i++] & 0x3f));
+        }
+        else if (first < 0xf0) {
+            out += String.fromCharCode(((first & 0x0f) << 12) | ((value[i++] & 0x3f) << 6) | (value[i++] & 0x3f));
+        }
+        else {
+            const cp = ((first & 0x07) << 18) |
+                ((value[i++] & 0x3f) << 12) |
+                ((value[i++] & 0x3f) << 6) |
+                (value[i++] & 0x3f);
+            out += String.fromCodePoint(cp);
+        }
+    }
+    return out;
+}
+export function splitLicense(token) {
+    const parts = token.split(".");
+    if (parts.length !== 4 || parts[0] !== OFFLINE_LICENSE_VERSION)
+        return null;
+    try {
+        return {
+            version: parts[0],
+            keyId: parts[1],
+            payloadBytes: base64UrlDecode(parts[2]),
+            signature: base64UrlDecode(parts[3]),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function decodeLicensePayload(token) {
+    const split = splitLicense(token);
+    if (!split)
+        return null;
+    try {
+        const parsed = JSON.parse(textFromBytes(split.payloadBytes));
+        if (!parsed?.license_id || !parsed?.business_id || !parsed?.device_id)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verify a license token against the public key cached at activation.
+ * An optional business id prevents a valid license for one tenant being
+ * replayed into another tenant on the same device.
+ */
+export async function verifyOfflineLicense(token, publicKeyB64, expectedBusinessId) {
+    const split = splitLicense(token);
+    if (!split)
+        return null;
+    try {
+        const publicKey = base64UrlDecode(publicKeyB64);
+        if (publicKey.length !== 32)
+            return null;
+        const ok = await ed.verifyAsync(split.signature, split.payloadBytes, publicKey);
+        if (!ok)
+            return null;
+        const payload = decodeLicensePayload(token);
+        if (!payload)
+            return null;
+        if (expectedBusinessId && payload.business_id !== expectedBusinessId)
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+/** Evaluate a verified license using the server-anchored monotonic clock. */
+export async function evaluateOfflineLicense(payload) {
+    if (!payload) {
+        return {
+            state: "invalid",
+            valid: false,
+            entitled: false,
+            mustReconnect: true,
+            payload: null,
+            serverNowMs: await getServerNowMs(),
+            reason: "Offline license is missing or invalid",
+        };
+    }
+    await anchorServerTime(payload.server_time);
+    const serverNowMs = await getServerNowMs();
+    const expiresMs = Date.parse(payload.expires_at);
+    const graceMs = payload.grace_until ? Date.parse(payload.grace_until) : NaN;
+    if (!Number.isFinite(expiresMs)) {
+        return {
+            state: "invalid",
+            valid: false,
+            entitled: false,
+            mustReconnect: true,
+            payload,
+            serverNowMs,
+            reason: "Offline license has no valid expiry",
+        };
+    }
+    if (serverNowMs <= expiresMs || (Number.isFinite(graceMs) && serverNowMs <= graceMs)) {
+        return {
+            state: "active",
+            valid: true,
+            entitled: true,
+            mustReconnect: false,
+            payload,
+            serverNowMs,
+            reason: "Offline license is valid",
+        };
+    }
+    return {
+        state: "expired",
+        valid: true,
+        entitled: false,
+        mustReconnect: true,
+        payload,
+        serverNowMs,
+        reason: `Offline license expired — reconnect to renew (max ${payload.max_offline_days} days)`,
+    };
+}
+export async function loadAndVerifyOfflineLicense(args) {
+    if (!args.token || !args.publicKey) {
+        return {
+            payload: null,
+            evaluation: await evaluateOfflineLicense(null),
+        };
+    }
+    const payload = await verifyOfflineLicense(args.token, args.publicKey, args.businessId);
+    return {
+        payload,
+        evaluation: await evaluateOfflineLicense(payload),
+    };
+}
+/** Canonical message the device signs for `/auth/offline/exchange`. */
+export function canonicalDeviceChallenge(args) {
+    return [args.deviceId, args.licenseId, args.memberId, args.nonce, args.timestamp].join("|");
+}
+export async function signDeviceChallenge(privateKey, message) {
+    const signature = await ed.signAsync(textBytes(message), privateKey);
+    return base64UrlEncode(signature);
+}
+export async function generateOfflineDeviceKeypair(randomBytes) {
+    const privateKey = randomBytes(32);
+    if (privateKey.length !== 32)
+        throw new Error("randomBytes must return 32 bytes");
+    const publicKey = await ed.getPublicKeyAsync(privateKey);
+    return { privateKey, publicKey, publicKeyB64: base64UrlEncode(publicKey) };
+}
+export function newOfflineNonce(randomBytes) {
+    return base64UrlEncode(randomBytes(16));
+}
+/** Remove the per-business offline fields from an entitlement-shaped map. */
+export function licenseFeatures(payload) {
+    return payload?.features ?? null;
+}
+export const OFFLINE_LICENSE_MAX_DAYS = 30;
+export const OFFLINE_LICENSE_DAY_MS = DAY_MS;

package/dist/offline/service.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Offline device activation, license refresh and token exchange.
+ *
+ * One backend call activates a terminal while online. After that the app can
+ * verify the signed license, unlock enrolled members locally, and only needs
+ * the network to exchange the device challenge for fresh session tokens.
+ */
+import { evaluateOfflineLicense, type OfflineLicenseEvaluation, type OfflineLicensePayload } from "./license";
+import { type OfflineMemberCredential } from "./store";
+export interface OfflineActivationResult {
+    license: string;
+    public_key: string;
+    key_id: string;
+    license_payload: OfflineLicensePayload;
+    algorithm?: string;
+    device: Record<string, unknown>;
+    /** Verified decoded payload (client-side convenience). */
+    payload: OfflineLicensePayload;
+}
+export interface OfflineExchangeResult {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    license: string;
+    license_payload: OfflineLicensePayload;
+    public_key: string;
+    key_id: string;
+}
+export interface OfflineSessionState {
+    hasDevice: boolean;
+    license: OfflineLicensePayload | null;
+    evaluation: OfflineLicenseEvaluation;
+    publicKey: string | null;
+    keyId: string | null;
+    members: OfflineMemberCredential[];
+}
+export declare function setOfflineRandomBytesProvider(provider: ((length: number) => Uint8Array) | null): void;
+/**
+ * First-time activation. Generates the device keypair, registers the public
+ * key, stores the signed license and enrolls the current member's PIN.
+ */
+export declare function activateOfflineDevice(args: {
+    businessId: string;
+    member: {
+        userId: string;
+        fullName: string;
+        email?: string | null;
+        role: string;
+        capabilities: string[];
+    };
+    pin: string;
+    appInstanceId?: string;
+    platform?: string;
+}): Promise<OfflineActivationResult>;
+/** Refresh the signed license while online using the normal access token. */
+export declare function refreshOfflineLicense(businessId: string): Promise<OfflineActivationResult>;
+/**
+ * Reconnect path: sign a fresh nonce with the device key and exchange the
+ * license for access/refresh tokens. Works even when the old refresh token
+ * expired while the terminal was offline.
+ */
+export declare function exchangeOfflineSession(args: {
+    businessId: string;
+    memberId: string;
+    deviceId?: string;
+}): Promise<OfflineExchangeResult>;
+/** Read local license/member state without touching the network. */
+export declare function getOfflineSessionState(businessId?: string): Promise<OfflineSessionState>;
+export declare function verifyOfflineLogin(userId: string, pin: string): Promise<OfflineMemberCredential | null>;
+export declare function enrollMemberOnDevice(args: {
+    businessId: string;
+    deviceId?: string;
+    userId: string;
+}): Promise<void>;
+export declare function revokeMemberOnDevice(args: {
+    businessId: string;
+    deviceId?: string;
+    userId: string;
+}): Promise<void>;
+/** Owner action: revoke the terminal and wipe all local offline credentials. */
+export declare function removeOfflineDevice(businessId: string, reason?: string): Promise<void>;
+export declare function getStoredOfflineLicensePayload(): Promise<OfflineLicensePayload | null>;
+export declare function evaluateStoredOfflineLicense(businessId?: string): Promise<OfflineLicenseEvaluation>;
+export { evaluateOfflineLicense };

package/dist/offline/service.js

@@ -0,0 +1,210 @@
+/**
+ * Offline device activation, license refresh and token exchange.
+ *
+ * One backend call activates a terminal while online. After that the app can
+ * verify the signed license, unlock enrolled members locally, and only needs
+ * the network to exchange the device challenge for fresh session tokens.
+ */
+import { getAppInstanceIdAsync } from "../adapters/devices";
+import { getHttpClient } from "../adapters/http";
+import { getAuthToken } from "../adapters/auth";
+import { syncLogger } from "../utils/sync-logger";
+import { base64UrlDecode, base64UrlEncode, canonicalDeviceChallenge, decodeLicensePayload, evaluateOfflineLicense, generateOfflineDeviceKeypair, loadAndVerifyOfflineLicense, newOfflineNonce, signDeviceChallenge, verifyOfflineLicense, } from "./license";
+import { clearOfflineDevice, createOfflineMemberCredential, getDevicePrivateKey, getOfflineMember, getStoredLicense, getStoredLicenseKeyId, getStoredLicensePublicKey, listOfflineMembers, markOfflineMemberLogin, removeOfflineMember, saveDevicePrivateKey, saveStoredLicense, saveStoredLicenseKeyId, saveStoredLicensePublicKey, verifyOfflineMemberPin, } from "./store";
+let randomBytesProvider = null;
+export function setOfflineRandomBytesProvider(provider) {
+    randomBytesProvider = provider;
+}
+function randomBytes(length) {
+    if (randomBytesProvider)
+        return randomBytesProvider(length);
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj?.getRandomValues) {
+        return cryptoObj.getRandomValues(new Uint8Array(length));
+    }
+    throw new Error("No secure random source available. Call setOfflineRandomBytesProvider().");
+}
+async function getPrivateKeyBytes() {
+    const encoded = await getDevicePrivateKey();
+    if (!encoded)
+        return null;
+    try {
+        const raw = base64UrlDecode(encoded);
+        return raw.length === 32 ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * First-time activation. Generates the device keypair, registers the public
+ * key, stores the signed license and enrolls the current member's PIN.
+ */
+export async function activateOfflineDevice(args) {
+    if (!getAuthToken())
+        throw new Error("Sign in online before activating this device");
+    const deviceId = args.appInstanceId ?? (await getAppInstanceIdAsync());
+    const keypair = await generateOfflineDeviceKeypair(randomBytes);
+    const response = await getHttpClient().post(`/businesses/${args.businessId}/devices/${encodeURIComponent(deviceId)}/activate`, {
+        device_public_key: keypair.publicKeyB64,
+        app_instance_id: deviceId,
+        platform: args.platform ?? "unknown",
+    });
+    const data = response.data.data;
+    if (!data?.license || !data.public_key) {
+        throw new Error("Device activation returned no offline license");
+    }
+    const verified = await verifyOfflineLicense(data.license, data.public_key, args.businessId);
+    if (!verified)
+        throw new Error("Activation returned an invalid offline license");
+    await saveDevicePrivateKey(base64UrlEncode(keypair.privateKey));
+    await saveStoredLicense(data.license);
+    await saveStoredLicensePublicKey(data.public_key);
+    await saveStoredLicenseKeyId(data.key_id);
+    await createOfflineMemberCredential({
+        userId: args.member.userId,
+        fullName: args.member.fullName,
+        email: args.member.email,
+        role: args.member.role,
+        capabilities: args.member.capabilities,
+        pin: args.pin,
+    });
+    // Best-effort: activation already enrolls the current member, but this makes
+    // the intent explicit and is idempotent.
+    await enrollMemberOnDevice({
+        businessId: args.businessId,
+        deviceId,
+        userId: args.member.userId,
+    }).catch((error) => {
+        syncLogger.warn("OfflineAuth", "Member enrollment call failed", {
+            error: String(error),
+        });
+    });
+    return { ...data, payload: verified };
+}
+/** Refresh the signed license while online using the normal access token. */
+export async function refreshOfflineLicense(businessId) {
+    const deviceId = await getAppInstanceIdAsync();
+    const response = await getHttpClient().post(`/businesses/${businessId}/devices/${encodeURIComponent(deviceId)}/license/refresh`);
+    const data = response.data.data;
+    if (!data?.license || !data.public_key) {
+        throw new Error("License refresh returned no license");
+    }
+    const verified = await verifyOfflineLicense(data.license, data.public_key, businessId);
+    if (!verified)
+        throw new Error("License refresh returned an invalid license");
+    await saveStoredLicense(data.license);
+    await saveStoredLicensePublicKey(data.public_key);
+    await saveStoredLicenseKeyId(data.key_id);
+    return { ...data, payload: verified };
+}
+/**
+ * Reconnect path: sign a fresh nonce with the device key and exchange the
+ * license for access/refresh tokens. Works even when the old refresh token
+ * expired while the terminal was offline.
+ */
+export async function exchangeOfflineSession(args) {
+    const token = await getStoredLicense();
+    const publicKey = await getStoredLicensePublicKey();
+    const privateKey = await getPrivateKeyBytes();
+    if (!token || !publicKey || !privateKey) {
+        throw new Error("This device has no offline license");
+    }
+    const payload = await verifyOfflineLicense(token, publicKey, args.businessId);
+    if (!payload)
+        throw new Error("Stored offline license is invalid");
+    const deviceId = args.deviceId ?? (await getAppInstanceIdAsync());
+    const nonce = newOfflineNonce(randomBytes);
+    const timestamp = new Date().toISOString();
+    const message = canonicalDeviceChallenge({
+        deviceId,
+        licenseId: payload.license_id,
+        memberId: args.memberId,
+        nonce,
+        timestamp,
+    });
+    const signature = await signDeviceChallenge(privateKey, message);
+    const response = await getHttpClient().post("/auth/offline/exchange", {
+        license: token,
+        device_uuid: deviceId,
+        member_id: args.memberId,
+        nonce,
+        timestamp,
+        signature,
+    });
+    const data = response.data.data;
+    if (!data?.access_token || !data?.license) {
+        throw new Error("Offline exchange returned no tokens");
+    }
+    const refreshed = await verifyOfflineLicense(data.license, data.public_key, args.businessId);
+    if (!refreshed)
+        throw new Error("Offline exchange returned an invalid license");
+    await saveStoredLicense(data.license);
+    await saveStoredLicensePublicKey(data.public_key);
+    await saveStoredLicenseKeyId(data.key_id);
+    await markOfflineMemberLogin(args.memberId);
+    return { ...data, license_payload: refreshed };
+}
+/** Read local license/member state without touching the network. */
+export async function getOfflineSessionState(businessId) {
+    const [token, publicKey, keyId, members] = await Promise.all([
+        getStoredLicense(),
+        getStoredLicensePublicKey(),
+        getStoredLicenseKeyId(),
+        listOfflineMembers(),
+    ]);
+    const { payload, evaluation } = await loadAndVerifyOfflineLicense({
+        token,
+        publicKey,
+        businessId,
+    });
+    return {
+        hasDevice: Boolean(token && publicKey),
+        license: payload,
+        evaluation,
+        publicKey,
+        keyId,
+        members,
+    };
+}
+export async function verifyOfflineLogin(userId, pin) {
+    const member = await getOfflineMember(userId);
+    if (!member)
+        return null;
+    const ok = await verifyOfflineMemberPin(userId, pin);
+    if (!ok)
+        return null;
+    await markOfflineMemberLogin(userId);
+    return member;
+}
+export async function enrollMemberOnDevice(args) {
+    const deviceId = args.deviceId ?? (await getAppInstanceIdAsync());
+    await getHttpClient().post(`/businesses/${args.businessId}/devices/${encodeURIComponent(deviceId)}/members/${encodeURIComponent(args.userId)}/enroll`);
+}
+export async function revokeMemberOnDevice(args) {
+    const deviceId = args.deviceId ?? (await getAppInstanceIdAsync());
+    await getHttpClient().delete(`/businesses/${args.businessId}/devices/${encodeURIComponent(deviceId)}/members/${encodeURIComponent(args.userId)}`);
+    await removeOfflineMember(args.userId);
+}
+/** Owner action: revoke the terminal and wipe all local offline credentials. */
+export async function removeOfflineDevice(businessId, reason) {
+    const deviceId = await getAppInstanceIdAsync();
+    try {
+        await getHttpClient().post(`/businesses/${businessId}/devices/${encodeURIComponent(deviceId)}/revoke`, { reason: reason ?? "removed_from_device" });
+    }
+    catch (error) {
+        syncLogger.warn("OfflineAuth", "Device revoke call failed; clearing locally", {
+            error: String(error),
+        });
+    }
+    await clearOfflineDevice();
+}
+export async function getStoredOfflineLicensePayload() {
+    const token = await getStoredLicense();
+    return token ? decodeLicensePayload(token) : null;
+}
+export async function evaluateStoredOfflineLicense(businessId) {
+    const state = await getOfflineSessionState(businessId);
+    return state.evaluation;
+}
+export { evaluateOfflineLicense };

package/dist/offline/store.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Offline license + member credential storage.
+ *
+ * The device private key must live in host secure storage (Keychain /
+ * Keystore / Tauri stronghold). The signed license, public key and member
+ * directory are non-secret and live in the shared KV store.
+ *
+ * Member PINs are stored as slow salted hashes. We never store the member's
+ * server password or its hash.
+ */
+export declare const OFFLINE_STORAGE_KEYS: {
+    readonly LICENSE: "offline:license";
+    readonly PUBLIC_KEY: "offline:license:public_key";
+    readonly KEY_ID: "offline:license:key_id";
+    readonly MEMBERS: "offline:members";
+    readonly DEVICE_PRIVATE_KEY: "offline:device:private_key";
+};
+export interface OfflineSecureStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+export declare function setOfflineSecureStorage(storage: OfflineSecureStorage | null): void;
+export declare function getDevicePrivateKey(): Promise<string | null>;
+export declare function saveDevicePrivateKey(privateKeyB64: string): Promise<void>;
+export declare function removeDevicePrivateKey(): Promise<void>;
+export declare function getStoredLicense(): Promise<string | null>;
+export declare function saveStoredLicense(token: string): Promise<void>;
+export declare function getStoredLicensePublicKey(): Promise<string | null>;
+export declare function saveStoredLicensePublicKey(publicKey: string): Promise<void>;
+export declare function getStoredLicenseKeyId(): Promise<string | null>;
+export declare function saveStoredLicenseKeyId(keyId: string): Promise<void>;
+export interface OfflineMemberCredential {
+    user_id: string;
+    full_name: string;
+    email?: string | null;
+    role: string;
+    capabilities: string[];
+    pin_salt: string;
+    pin_hash: string;
+    enrolled_at: string;
+    last_login_at?: string | null;
+}
+export declare function listOfflineMembers(): Promise<OfflineMemberCredential[]>;
+export declare function getOfflineMember(userId: string): Promise<OfflineMemberCredential | null>;
+export declare function saveOfflineMember(member: OfflineMemberCredential): Promise<void>;
+export declare function removeOfflineMember(userId: string): Promise<void>;
+export declare function markOfflineMemberLogin(userId: string): Promise<void>;
+export declare function clearOfflineDevice(): Promise<void>;
+export declare function createOfflineMemberCredential(args: {
+    userId: string;
+    fullName: string;
+    email?: string | null;
+    role: string;
+    capabilities: string[];
+    pin: string;
+}): Promise<OfflineMemberCredential>;
+export declare function verifyOfflineMemberPin(userId: string, pin: string): Promise<boolean>;

package/dist/offline/store.js

@@ -0,0 +1,138 @@
+/**
+ * Offline license + member credential storage.
+ *
+ * The device private key must live in host secure storage (Keychain /
+ * Keystore / Tauri stronghold). The signed license, public key and member
+ * directory are non-secret and live in the shared KV store.
+ *
+ * Member PINs are stored as slow salted hashes. We never store the member's
+ * server password or its hash.
+ */
+import { getItem, removeItem, setItem } from "../adapters/kv";
+import { sha256Hex } from "../reference/entitlement-crypto";
+export const OFFLINE_STORAGE_KEYS = {
+    LICENSE: "offline:license",
+    PUBLIC_KEY: "offline:license:public_key",
+    KEY_ID: "offline:license:key_id",
+    MEMBERS: "offline:members",
+    DEVICE_PRIVATE_KEY: "offline:device:private_key",
+};
+let secureStorage = null;
+export function setOfflineSecureStorage(storage) {
+    secureStorage = storage;
+}
+function secure() {
+    if (!secureStorage) {
+        throw new Error("Offline secure storage is not configured. Call setOfflineSecureStorage() at boot.");
+    }
+    return secureStorage;
+}
+export async function getDevicePrivateKey() {
+    return secure().getItem(OFFLINE_STORAGE_KEYS.DEVICE_PRIVATE_KEY);
+}
+export async function saveDevicePrivateKey(privateKeyB64) {
+    await secure().setItem(OFFLINE_STORAGE_KEYS.DEVICE_PRIVATE_KEY, privateKeyB64);
+}
+export async function removeDevicePrivateKey() {
+    await secure().removeItem(OFFLINE_STORAGE_KEYS.DEVICE_PRIVATE_KEY);
+}
+export async function getStoredLicense() {
+    return getItem(OFFLINE_STORAGE_KEYS.LICENSE);
+}
+export async function saveStoredLicense(token) {
+    await setItem(OFFLINE_STORAGE_KEYS.LICENSE, token);
+}
+export async function getStoredLicensePublicKey() {
+    return getItem(OFFLINE_STORAGE_KEYS.PUBLIC_KEY);
+}
+export async function saveStoredLicensePublicKey(publicKey) {
+    await setItem(OFFLINE_STORAGE_KEYS.PUBLIC_KEY, publicKey);
+}
+export async function getStoredLicenseKeyId() {
+    return getItem(OFFLINE_STORAGE_KEYS.KEY_ID);
+}
+export async function saveStoredLicenseKeyId(keyId) {
+    await setItem(OFFLINE_STORAGE_KEYS.KEY_ID, keyId);
+}
+export async function listOfflineMembers() {
+    return (await getItem(OFFLINE_STORAGE_KEYS.MEMBERS)) ?? [];
+}
+export async function getOfflineMember(userId) {
+    const members = await listOfflineMembers();
+    return members.find((member) => member.user_id === userId) ?? null;
+}
+export async function saveOfflineMember(member) {
+    const members = await listOfflineMembers();
+    const next = members.filter((existing) => existing.user_id !== member.user_id);
+    next.push(member);
+    await setItem(OFFLINE_STORAGE_KEYS.MEMBERS, next);
+}
+export async function removeOfflineMember(userId) {
+    const members = await listOfflineMembers();
+    await setItem(OFFLINE_STORAGE_KEYS.MEMBERS, members.filter((member) => member.user_id !== userId));
+}
+export async function markOfflineMemberLogin(userId) {
+    const member = await getOfflineMember(userId);
+    if (!member)
+        return;
+    await saveOfflineMember({ ...member, last_login_at: new Date().toISOString() });
+}
+export async function clearOfflineDevice() {
+    await Promise.all([
+        removeItem(OFFLINE_STORAGE_KEYS.LICENSE),
+        removeItem(OFFLINE_STORAGE_KEYS.PUBLIC_KEY),
+        removeItem(OFFLINE_STORAGE_KEYS.KEY_ID),
+        removeItem(OFFLINE_STORAGE_KEYS.MEMBERS),
+        removeDevicePrivateKey().catch(() => undefined),
+    ]);
+}
+const PIN_ROUNDS = 20000;
+function randomHex(length) {
+    const alphabet = "0123456789abcdef";
+    let out = "";
+    for (let i = 0; i < length; i++) {
+        out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    }
+    return out;
+}
+async function hashPin(pin, salt) {
+    let digest = `${salt}:${pin}`;
+    for (let i = 0; i < PIN_ROUNDS; i++) {
+        digest = await sha256Hex(`${digest}:${salt}:${i}`);
+    }
+    return digest;
+}
+export async function createOfflineMemberCredential(args) {
+    if (!/^\d{6}$/.test(args.pin)) {
+        throw new Error("Offline PIN must be exactly 6 digits");
+    }
+    const salt = randomHex(32);
+    const member = {
+        user_id: args.userId,
+        full_name: args.fullName,
+        email: args.email ?? null,
+        role: args.role,
+        capabilities: args.capabilities,
+        pin_salt: salt,
+        pin_hash: await hashPin(args.pin, salt),
+        enrolled_at: new Date().toISOString(),
+        last_login_at: null,
+    };
+    await saveOfflineMember(member);
+    return member;
+}
+export async function verifyOfflineMemberPin(userId, pin) {
+    const member = await getOfflineMember(userId);
+    if (!member)
+        return false;
+    if (!/^\d{6}$/.test(pin))
+        return false;
+    const candidate = await hashPin(pin, member.pin_salt);
+    if (candidate.length !== member.pin_hash.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < candidate.length; i++) {
+        diff |= candidate.charCodeAt(i) ^ member.pin_hash.charCodeAt(i);
+    }
+    return diff === 0;
+}

package/dist/sync/sync-guard.js

@@ -7,7 +7,7 @@
  * the user has logged in and a business is selected. User-scoped queries
  * (invitations, fleet) gate on auth only.
  */
-import { getAuthToken } from "../adapters/auth";
+import { hasSession } from "../adapters/auth";
 import { getActiveBusiness } from "../adapters/business";
 // Offline machinery (reference sync, drains, pulls, leases) runs for the
 // seller role only. Fleet managers and riders are fully online: the app
@@ -21,7 +21,7 @@ export function isOfflineSyncEnabled() {
     return offlineSyncEnabled;
 }
 export function isAuthenticated() {
-    return !!getAuthToken();
+    return hasSession();
 }
 export function hasActiveBusiness() {
     return !!getActiveBusiness()?.id;
@@ -36,5 +36,5 @@ export function canBusinessSync(businessId) {
     if (!offlineSyncEnabled)
         return false;
     const bid = businessId ?? getActiveBusiness()?.id;
-    return !!bid && !!getAuthToken();
+    return !!bid && hasSession();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.9.26",
+  "version": "0.10.0",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",
@@ -70,6 +70,8 @@
     "access": "public"
   },
   "dependencies": {
+    "@noble/ed25519": "^2.3.0",
+    "@noble/hashes": "^1.8.0",
     "@tanstack/query-async-storage-persister": "^5.102.8"
   }
 }