anyray-connect 0.11.162 → 0.11.165

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/README.md +6 -11
  2. package/dist/index.js +322 -330
  3. package/native/macos/Package.swift +34 -0
  4. package/native/macos/Sources/AnyrayDeviceProofCLI/main.swift +77 -0
  5. package/native/macos/Sources/AnyrayDeviceProofCore/base64URL.swift +34 -0
  6. package/native/macos/Sources/AnyrayDeviceProofCore/deviceProofClaims.swift +58 -0
  7. package/native/macos/Sources/AnyrayDeviceProofCore/deviceProofError.swift +58 -0
  8. package/native/macos/Sources/AnyrayDeviceProofCore/managedPreferences.swift +129 -0
  9. package/native/macos/Sources/AnyrayDeviceProofCore/p256PublicKey.swift +31 -0
  10. package/native/macos/Sources/AnyrayDeviceProofCore/proofOutput.swift +77 -0
  11. package/native/macos/Sources/AnyrayDeviceProofCore/proofRequest.swift +58 -0
  12. package/native/macos/Sources/AnyrayDeviceProofCore/signingChallenge.swift +150 -0
  13. package/native/macos/Sources/AnyrayDeviceProofMacOS/managedPreferencesReader.swift +122 -0
  14. package/native/macos/Sources/AnyrayDeviceProofMacOS/securityBootstrapSigner.swift +94 -0
  15. package/native/macos/Sources/AnyrayDeviceProofMacOS/securityDeviceIdentity.swift +185 -0
  16. package/native/macos/Tests/AnyrayDeviceProofCoreTests/deviceProofCoreTests.swift +440 -0
  17. package/native/macos/Tests/AnyrayDeviceProofMacOSTests/managedPreferencesReaderTests.swift +166 -0
  18. package/native/macos/Tests/AnyrayDeviceProofMacOSTests/securityDeviceIdentityTests.swift +91 -0
  19. package/package.json +2 -1
package/README.md CHANGED
@@ -35,17 +35,12 @@ attribution. The key lands in owner-only local state and the supported tool
35
35
  credential stores; it is never printed in full. Tools talk directly to a current
36
36
  gateway. A separate scheduled heartbeat signs a fresh, purpose-bound device
37
37
  proof and extends that same raw key before expiry, so running tools do not need a
38
- credential rewrite or a local traffic proxy. The heartbeat never returns a
39
- replacement key.
40
-
41
- Existing refresh-enabled Connect profiles migrate automatically after an
42
- update: the upgraded scheduled refresh first proves the current key, switches
43
- any managed loopback tools to the direct gateway, commits the stable-heartbeat
44
- profile, and only then removes the old proxy. Profiles already routing directly
45
- need no tool rewrite. Partial migrations keep the proxy installed and retry
46
- without rotating the key. If the gateway is still on an older version, Connect
47
- leaves the existing renewal lane unchanged. A later gateway rollback is
48
- detected by the missing heartbeat route and restores the rotating proxy lane.
38
+ credential rewrite. The heartbeat never returns a replacement key.
39
+
40
+ Existing refresh-enabled Connect profiles continue routing directly after an
41
+ update. If the heartbeat route is unavailable, Connect reports a gateway
42
+ version or routing problem without treating the enrollment certificate as
43
+ invalid.
49
44
 
50
45
  A dry run never consumes an enrollment link or writes configuration; without an
51
46
  existing key it reports the selected installs that would be configured after