dominus-sdk-nodejs-dev 1.2.4

package/dist/lib/client.js

@@ -0,0 +1,425 @@
+/**
+ * Core HTTP Client for Dominus SDK
+ *
+ * Handles JWT management, base64 encoding/decoding, retries, and circuit breaker.
+ */
+import { BASE_URL, resolveToken } from './config.js';
+import { DominusError, AuthenticationError, raiseForStatus, ConnectionError, TimeoutError, } from './errors.js';
+// Constants
+const MAX_RETRIES = 3;
+const REQUEST_TIMEOUT = 30000; // 30 seconds
+// State
+let cachedJwt = null;
+let validated = false;
+// Circuit breaker state
+let circuitState = 'closed';
+let failureCount = 0;
+let lastFailureTime = 0;
+const CIRCUIT_THRESHOLD = 5;
+const CIRCUIT_TIMEOUT = 30000; // 30 seconds
+/**
+ * Base64 encode a JSON object to string
+ */
+function b64Encode(data) {
+    const json = JSON.stringify(data);
+    return Buffer.from(json).toString('base64');
+}
+/**
+ * Base64 decode a string to JSON object
+ */
+function b64Decode(encoded) {
+    const decoded = Buffer.from(encoded, 'base64').toString('utf-8');
+    return JSON.parse(decoded);
+}
+/**
+ * Decode JWT payload without verification (for exp checks only)
+ */
+function decodeJwtPayload(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid JWT format');
+    }
+    // Base64url decode
+    let payload = parts[1];
+    payload = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const padding = 4 - (payload.length % 4);
+    if (padding !== 4) {
+        payload += '='.repeat(padding);
+    }
+    const decoded = Buffer.from(payload, 'base64').toString('utf-8');
+    return JSON.parse(decoded);
+}
+/**
+ * Calculate exponential backoff with jitter
+ */
+function backoffWithJitter(attempt, baseDelay = 1000, maxDelay = 15000) {
+    const delay = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
+    const jitter = delay * 0.5 * Math.random();
+    return delay + jitter;
+}
+/**
+ * Check if circuit breaker allows execution
+ */
+function canExecute() {
+    if (circuitState === 'closed')
+        return true;
+    if (circuitState === 'open') {
+        if (Date.now() - lastFailureTime > CIRCUIT_TIMEOUT) {
+            circuitState = 'half-open';
+            return true;
+        }
+        return false;
+    }
+    // half-open
+    return true;
+}
+/**
+ * Record success for circuit breaker
+ */
+function recordSuccess() {
+    failureCount = 0;
+    circuitState = 'closed';
+}
+/**
+ * Record failure for circuit breaker
+ */
+function recordFailure() {
+    failureCount++;
+    lastFailureTime = Date.now();
+    if (failureCount >= CIRCUIT_THRESHOLD) {
+        circuitState = 'open';
+    }
+}
+/**
+ * Get service JWT by calling /api/warden/mint with PSK
+ * Retries on 401/5xx with exponential backoff (orchestrator cold start handling)
+ */
+async function getServiceJwt(pskToken) {
+    if (!canExecute()) {
+        throw new AuthenticationError('Circuit breaker OPEN - too many recent failures. Will retry after recovery timeout.');
+    }
+    const headers = {
+        Authorization: `Bearer ${pskToken}`,
+        'Content-Type': 'text/plain',
+    };
+    const body = b64Encode({ method: 'auth.self', params: {} });
+    // Retry loop for JWT minting (handles orchestrator cold start)
+    const JWT_MINT_RETRIES = 3;
+    let lastError = null;
+    for (let attempt = 0; attempt < JWT_MINT_RETRIES; attempt++) {
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT);
+            const response = await fetch(`${BASE_URL}/api/warden/mint`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                // Retry on 401 (cold start - services not ready) or 5xx (server errors)
+                if ((response.status === 401 || response.status >= 500) &&
+                    attempt < JWT_MINT_RETRIES - 1) {
+                    const delay = backoffWithJitter(attempt, 2000, 10000);
+                    console.log(`[Dominus] JWT mint returned ${response.status}, retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${JWT_MINT_RETRIES})`);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                    continue;
+                }
+                recordFailure();
+                throw new AuthenticationError(`Auth failed with status ${response.status}`);
+            }
+            const text = await response.text();
+            const result = b64Decode(text);
+            if (!result.success) {
+                recordFailure();
+                throw new AuthenticationError(result.error || 'Unknown auth error');
+            }
+            const jwt = result.data?.access_token || result.data?.token;
+            if (!jwt) {
+                recordFailure();
+                throw new AuthenticationError('No JWT token in auth response');
+            }
+            recordSuccess();
+            return jwt;
+        }
+        catch (error) {
+            if (error instanceof DominusError) {
+                lastError = error;
+                // Don't retry DominusErrors that aren't retryable
+                if (!(error instanceof AuthenticationError)) {
+                    throw error;
+                }
+                // For AuthenticationError, we've already handled retries above
+                throw error;
+            }
+            lastError =
+                error instanceof Error ? error : new Error(String(error));
+            if (error instanceof Error && error.name === 'AbortError') {
+                // Timeout - retry if attempts remain
+                if (attempt < JWT_MINT_RETRIES - 1) {
+                    const delay = backoffWithJitter(attempt, 2000, 10000);
+                    console.log(`[Dominus] JWT mint timed out, retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${JWT_MINT_RETRIES})`);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                    continue;
+                }
+                recordFailure();
+                throw new TimeoutError('JWT request timed out');
+            }
+            // Network error - retry if attempts remain
+            if (attempt < JWT_MINT_RETRIES - 1) {
+                const delay = backoffWithJitter(attempt, 2000, 10000);
+                console.log(`[Dominus] JWT mint failed (${error}), retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${JWT_MINT_RETRIES})`);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+                continue;
+            }
+            recordFailure();
+            throw new ConnectionError(`Failed to get JWT: ${error}`);
+        }
+    }
+    // Should not reach here, but just in case
+    recordFailure();
+    throw lastError || new ConnectionError('Failed to get JWT after retries');
+}
+/**
+ * Ensure we have a valid JWT, fetching and caching if needed
+ */
+async function ensureValidJwt(pskToken) {
+    // Check cached JWT
+    if (cachedJwt) {
+        try {
+            const payload = decodeJwtPayload(cachedJwt);
+            const exp = payload.exp || 0;
+            const currentTime = Math.floor(Date.now() / 1000);
+            // Refresh if <60 seconds remain
+            if (exp - currentTime > 60) {
+                return cachedJwt;
+            }
+        }
+        catch {
+            // If decode fails, fetch new JWT
+        }
+    }
+    // Fetch new JWT
+    const jwt = await getServiceJwt(pskToken);
+    cachedJwt = jwt;
+    return jwt;
+}
+/**
+ * Verify token format is valid (basic check, not server verification)
+ * Actual token validation happens when we call /api/warden/mint
+ */
+function verifyTokenFormat(token) {
+    // PSK tokens are 64-character hex strings
+    if (!token || token.length < 32) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Health check with retry for cold starts
+ */
+async function healthCheck() {
+    const HEALTH_TIMEOUT = 15000; // 15 seconds for cold start tolerance
+    const HEALTH_RETRIES = 2;
+    for (let attempt = 0; attempt < HEALTH_RETRIES; attempt++) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), HEALTH_TIMEOUT);
+        const start = Date.now();
+        try {
+            const response = await fetch(`${BASE_URL}/api/health`, {
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            const latency = Date.now() - start;
+            if (!response.ok) {
+                // Retry on server errors
+                if (response.status >= 500 && attempt < HEALTH_RETRIES - 1) {
+                    await new Promise((resolve) => setTimeout(resolve, 2000));
+                    continue;
+                }
+                return {
+                    status: 'unhealthy',
+                    error: `HTTP ${response.status}`,
+                    latency_ms: latency,
+                };
+            }
+            const data = (await response.json());
+            return {
+                status: data.status || 'healthy',
+                latency_ms: latency,
+                ...data,
+            };
+        }
+        catch (error) {
+            clearTimeout(timeoutId);
+            // Retry on timeout/network errors
+            if (attempt < HEALTH_RETRIES - 1) {
+                console.log(`[Dominus] Health check failed (${error}), retrying...`);
+                await new Promise((resolve) => setTimeout(resolve, 2000));
+                continue;
+            }
+            return {
+                status: 'unhealthy',
+                error: String(error),
+            };
+        }
+    }
+    return { status: 'unhealthy', error: 'Health check failed after retries' };
+}
+/**
+ * Main Dominus client class
+ */
+export class DominusClient {
+    token;
+    baseUrl;
+    constructor(hardcodedToken) {
+        this.token = resolveToken(hardcodedToken);
+        this.baseUrl = BASE_URL;
+    }
+    /**
+     * Validate token on first use
+     */
+    async validate() {
+        if (validated)
+            return;
+        if (!this.token) {
+            throw new AuthenticationError('DOMINUS_TOKEN not found.\n\n' +
+                'Set the environment variable:\n  export DOMINUS_TOKEN=your_token\n\n' +
+                'Or in production, set it via your deployment platform.');
+        }
+        // Basic token format check
+        if (!verifyTokenFormat(this.token)) {
+            throw new AuthenticationError('Invalid token format');
+        }
+        // Health check to warm up the server
+        const health = await healthCheck();
+        if (health.status !== 'healthy' && health.status !== 'ok') {
+            throw new DominusError(`Services unhealthy: ${JSON.stringify(health)}`);
+        }
+        validated = true;
+    }
+    /**
+     * Make an authenticated request to the orchestrator
+     *
+     * @param options - Request options including endpoint, method, body, and optional userToken
+     * @param options.userToken - If provided, uses this JWT instead of the service token.
+     *                            Use this for user-authenticated requests (e.g., /api/portal/auth/me)
+     */
+    async request(options) {
+        const { endpoint, method = 'POST', body = {}, userToken } = options;
+        let jwt;
+        if (userToken) {
+            // Use the provided user JWT directly (no validation needed - orchestrator validates it)
+            jwt = userToken;
+        }
+        else {
+            // Use service token flow
+            await this.validate();
+            jwt = await ensureValidJwt(this.token);
+        }
+        // Prepare request
+        const headers = {
+            Authorization: `Bearer ${jwt}`,
+            'Content-Type': 'text/plain',
+        };
+        const encodedBody = b64Encode(body);
+        // Retry loop
+        for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+            try {
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT);
+                let response;
+                if (method === 'GET') {
+                    // For GET requests, we don't send body
+                    response = await fetch(`${this.baseUrl}${endpoint}`, {
+                        method: 'GET',
+                        headers: {
+                            Authorization: `Bearer ${jwt}`,
+                        },
+                        signal: controller.signal,
+                    });
+                }
+                else {
+                    response = await fetch(`${this.baseUrl}${endpoint}`, {
+                        method,
+                        headers,
+                        body: encodedBody,
+                        signal: controller.signal,
+                    });
+                }
+                clearTimeout(timeoutId);
+                if (!response.ok) {
+                    // Try to decode error response
+                    let errorMessage = `HTTP ${response.status}`;
+                    let errorDetails = {};
+                    try {
+                        const errorText = await response.text();
+                        const decoded = b64Decode(errorText);
+                        errorMessage =
+                            decoded.error ||
+                                decoded.detail ||
+                                errorMessage;
+                        errorDetails = decoded;
+                    }
+                    catch {
+                        // Use default error message
+                    }
+                    // Don't retry 4xx errors
+                    if (response.status >= 400 && response.status < 500) {
+                        raiseForStatus(response.status, errorMessage, errorDetails, endpoint);
+                    }
+                    // Retry 5xx errors
+                    if (attempt === MAX_RETRIES - 1) {
+                        raiseForStatus(response.status, errorMessage, errorDetails, endpoint);
+                    }
+                    const delay = backoffWithJitter(attempt);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                    continue;
+                }
+                // Decode successful response
+                const text = await response.text();
+                const result = b64Decode(text);
+                // Handle wrapped response format
+                if ('success' in result && result.success === false) {
+                    throw new DominusError(result.error || 'Unknown error', undefined, undefined, endpoint);
+                }
+                // Return data field if present, otherwise the whole result
+                if ('data' in result && result.data !== undefined) {
+                    return result.data;
+                }
+                return result;
+            }
+            catch (error) {
+                if (error instanceof DominusError)
+                    throw error;
+                if (error instanceof Error && error.name === 'AbortError') {
+                    if (attempt === MAX_RETRIES - 1) {
+                        throw new TimeoutError('Request timed out', undefined, undefined, endpoint);
+                    }
+                }
+                if (attempt === MAX_RETRIES - 1) {
+                    throw new ConnectionError(`Request failed after ${MAX_RETRIES} retries: ${error}`, undefined, undefined, endpoint);
+                }
+                const delay = backoffWithJitter(attempt);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+        throw new ConnectionError(`Request failed after ${MAX_RETRIES} retries`, undefined, undefined, endpoint);
+    }
+    /**
+     * Health check endpoint
+     */
+    async healthCheck() {
+        return healthCheck();
+    }
+}
+// Export singleton factory
+let clientInstance = null;
+export function getClient(hardcodedToken) {
+    if (!clientInstance) {
+        clientInstance = new DominusClient(hardcodedToken);
+    }
+    return clientInstance;
+}
+//# sourceMappingURL=client.js.map

package/dist/lib/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AAgBrB,YAAY;AACZ,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,aAAa;AAE5C,QAAQ;AACR,IAAI,SAAS,GAAkB,IAAI,CAAC;AACpC,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,wBAAwB;AACxB,IAAI,YAAY,GAAoC,QAAQ,CAAC;AAC7D,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,aAAa;AAE5C;;GAEG;AACH,SAAS,SAAS,CAAC,IAA6B;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,OAAe,EACf,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG,KAAK;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,OAAO,KAAK,GAAG,MAAM,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,IAAI,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,eAAe,EAAE,CAAC;YACnD,YAAY,GAAG,WAAW,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,YAAY;IACZ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAG,QAAQ,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,YAAY,EAAE,CAAC;IACf,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACtC,YAAY,GAAG,MAAM,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAC3B,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,QAAQ,EAAE;QACnC,cAAc,EAAE,YAAY;KAC7B,CAAC;IAEF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,+DAA+D;IAC/D,MAAM,gBAAgB,GAAG,CAAC,CAAC;IAC3B,IAAI,SAAS,GAAiB,IAAI,CAAC;IAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;YAExE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,kBAAkB,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,SAAS,CAAC,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,wEAAwE;gBACxE,IACE,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;oBACnD,OAAO,GAAG,gBAAgB,GAAG,CAAC,EAC9B,CAAC;oBACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBACtD,OAAO,CAAC,GAAG,CACT,+BAA+B,QAAQ,CAAC,MAAM,iBAAiB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,OAAO,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAClI,CAAC;oBACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,QAAQ,CAAC,MAAM,EAAE,CAC7C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAI5B,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,aAAa,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC;YACtE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;YAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,aAAa,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YAED,aAAa,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,SAAS,GAAG,KAAK,CAAC;gBAClB,kDAAkD;gBAClD,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC,EAAE,CAAC;oBAC5C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,+DAA+D;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YAED,SAAS;gBACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAE5D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,qCAAqC;gBACrC,IAAI,OAAO,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBACtD,OAAO,CAAC,GAAG,CACT,6CAA6C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,OAAO,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAChH,CAAC;oBACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;YAClD,CAAC;YAED,2CAA2C;YAC3C,IAAI,OAAO,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,OAAO,GAAG,CAAC,IAAI,gBAAgB,GAAG,CACxH,CAAC;gBACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,aAAa,EAAE,CAAC;IAChB,MAAM,SAAS,IAAI,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,mBAAmB;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAElD,gCAAgC;YAChC,IAAI,GAAG,GAAG,WAAW,GAAG,EAAE,EAAE,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,GAAG,GAAG,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,0CAA0C;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,sCAAsC;IACpE,MAAM,cAAc,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,aAAa,EAAE;gBACrD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,yBAAyB;gBACzB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC1D,SAAS;gBACX,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBAChC,UAAU,EAAE,OAAO;iBACpB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAChE,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;gBAChC,UAAU,EAAE,OAAO;gBACnB,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,SAAS,CAAC,CAAC;YAExB,kCAAkC;YAClC,IAAI,OAAO,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,kCAAkC,KAAK,gBAAgB,CAAC,CAAC;gBACrE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,KAAK,CAAgB;IACrB,OAAO,CAAS;IAExB,YAAY,cAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ;QACpB,IAAI,SAAS;YAAE,OAAO;QAEtB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B;gBAC5B,sEAAsE;gBACtE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,YAAY,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAc,OAAuB;QAChD,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAEpE,IAAI,GAAW,CAAC;QAEhB,IAAI,SAAS,EAAE,CAAC;YACd,wFAAwF;YACxF,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,yBAAyB;YACzB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;QAC1C,CAAC;QAED,kBAAkB;QAClB,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,cAAc,EAAE,YAAY;SAC7B,CAAC;QAEF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAEpC,aAAa;QACb,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;gBAExE,IAAI,QAAkB,CAAC;gBAEvB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,uCAAuC;oBACvC,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE;wBACnD,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,GAAG,EAAE;yBAC/B;wBACD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE;wBACnD,MAAM;wBACN,OAAO;wBACP,IAAI,EAAE,WAAW;wBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAED,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,+BAA+B;oBAC/B,IAAI,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7C,IAAI,YAAY,GAA4B,EAAE,CAAC;oBAE/C,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACxC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAA4B,CAAC;wBAChE,YAAY;4BACT,OAAO,CAAC,KAAgB;gCACxB,OAAO,CAAC,MAAiB;gCAC1B,YAAY,CAAC;wBACf,YAAY,GAAG,OAAO,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;oBAED,yBAAyB;oBACzB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;wBACpD,cAAc,CACZ,QAAQ,CAAC,MAAM,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,CACT,CAAC;oBACJ,CAAC;oBAED,mBAAmB;oBACnB,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;wBAChC,cAAc,CACZ,QAAQ,CAAC,MAAM,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,CACT,CAAC;oBACJ,CAAC;oBAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;oBACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBAED,6BAA6B;gBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAIxB,CAAC;gBAEN,iCAAiC;gBACjC,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;oBACpD,MAAM,IAAI,YAAY,CACpB,MAAM,CAAC,KAAK,IAAI,eAAe,EAC/B,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;gBACJ,CAAC;gBAED,2DAA2D;gBAC3D,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAClD,OAAO,MAAM,CAAC,IAAI,CAAC;gBACrB,CAAC;gBAED,OAAO,MAAW,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,YAAY;oBAAE,MAAM,KAAK,CAAC;gBAE/C,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC1D,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,eAAe,CACvB,wBAAwB,WAAW,aAAa,KAAK,EAAE,EACvD,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,eAAe,CACvB,wBAAwB,WAAW,UAAU,EAC7C,SAAS,EACT,SAAS,EACT,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;CACF;AAED,2BAA2B;AAC3B,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,MAAM,UAAU,SAAS,CAAC,cAAuB;IAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/lib/config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Dominus Orchestrator Configuration
+ *
+ * Single backend URL for all services. The SDK targets dominus-orchestrator
+ * which consolidates all service functionality.
+ */
+export declare const BASE_URL = "https://dominus-orchestrator-production-775398158805.us-east4.run.app";
+/**
+ * Get the dominus-orchestrator base URL.
+ */
+export declare function getBaseUrl(): string;
+/**
+ * Resolve authentication token.
+ *
+ * Priority:
+ * 1. Environment variable: DOMINUS_TOKEN
+ * 2. Hardcoded fallback (if provided)
+ */
+export declare function resolveToken(hardcodedToken?: string): string | null;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,eAAO,MAAM,QAAQ,0EAA0E,CAAC;AAEhG;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASnE"}

package/dist/lib/config.js

@@ -0,0 +1,32 @@
+/**
+ * Dominus Orchestrator Configuration
+ *
+ * Single backend URL for all services. The SDK targets dominus-orchestrator
+ * which consolidates all service functionality.
+ */
+// Dominus Orchestrator Production URL
+export const BASE_URL = 'https://dominus-orchestrator-production-775398158805.us-east4.run.app';
+/**
+ * Get the dominus-orchestrator base URL.
+ */
+export function getBaseUrl() {
+    return BASE_URL;
+}
+/**
+ * Resolve authentication token.
+ *
+ * Priority:
+ * 1. Environment variable: DOMINUS_TOKEN
+ * 2. Hardcoded fallback (if provided)
+ */
+export function resolveToken(hardcodedToken) {
+    const token = process.env.DOMINUS_TOKEN;
+    if (token) {
+        return token;
+    }
+    if (hardcodedToken) {
+        return hardcodedToken;
+    }
+    return null;
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sCAAsC;AACtC,MAAM,CAAC,MAAM,QAAQ,GAAG,uEAAuE,CAAC;AAEhG;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,cAAuB;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/crypto.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Cryptographic helpers for password and PSK hashing.
+ *
+ * All hashing is done client-side (in SDK) before sending to Orchestrator.
+ * This ensures passwords/PSKs are never transmitted in plaintext.
+ */
+/**
+ * Hash a password using bcrypt.
+ *
+ * @param password - Raw password string
+ * @returns Bcrypt hash string (includes salt)
+ */
+export declare function hashPassword(password: string): string;
+/**
+ * Verify a password against a bcrypt hash locally.
+ *
+ * This is primarily for testing. In production, verification
+ * happens via the orchestrator's verify endpoints.
+ *
+ * @param password - Raw password to verify
+ * @param passwordHash - Bcrypt hash to compare against
+ * @returns True if password matches hash
+ */
+export declare function verifyPasswordLocal(password: string, passwordHash: string): boolean;
+/**
+ * Hash a PSK (Pre-Shared Key) using bcrypt.
+ *
+ * @param psk - Raw PSK string
+ * @returns Bcrypt hash string (includes salt)
+ */
+export declare function hashPsk(psk: string): string;
+/**
+ * Verify a PSK against a bcrypt hash locally.
+ *
+ * This is primarily for testing. In production, verification
+ * happens via the orchestrator's verify endpoints.
+ *
+ * @param psk - Raw PSK to verify
+ * @param pskHash - Bcrypt hash to compare against
+ * @returns True if PSK matches hash
+ */
+export declare function verifyPskLocal(psk: string, pskHash: string): boolean;
+/**
+ * Generate a random PSK locally.
+ *
+ * Note: In production, prefer using the orchestrator's PSK generation
+ * for centralized PSK management. This is a fallback.
+ *
+ * @param length - Length of PSK to generate (default: 32)
+ * @returns Random PSK string
+ */
+export declare function generatePskLocal(length?: number): string;
+/**
+ * Hash a token using SHA-256.
+ *
+ * Used for refresh tokens where we need fast comparison
+ * and don't need the security properties of bcrypt.
+ *
+ * @param token - Raw token string
+ * @returns SHA-256 hex digest
+ */
+export declare function hashToken(token: string): string;
+/**
+ * Generate a random token string.
+ *
+ * @param length - Length of token to generate (default: 64)
+ * @returns Random URL-safe token string
+ */
+export declare function generateToken(length?: number): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,SAAK,GAAG,MAAM,CAQpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,SAAK,GAAG,MAAM,CAEjD"}

package/dist/lib/crypto.js

@@ -0,0 +1,95 @@
+/**
+ * Cryptographic helpers for password and PSK hashing.
+ *
+ * All hashing is done client-side (in SDK) before sending to Orchestrator.
+ * This ensures passwords/PSKs are never transmitted in plaintext.
+ */
+import bcrypt from 'bcryptjs';
+import crypto from 'crypto';
+const BCRYPT_ROUNDS = 12;
+/**
+ * Hash a password using bcrypt.
+ *
+ * @param password - Raw password string
+ * @returns Bcrypt hash string (includes salt)
+ */
+export function hashPassword(password) {
+    const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS);
+    return bcrypt.hashSync(password, salt);
+}
+/**
+ * Verify a password against a bcrypt hash locally.
+ *
+ * This is primarily for testing. In production, verification
+ * happens via the orchestrator's verify endpoints.
+ *
+ * @param password - Raw password to verify
+ * @param passwordHash - Bcrypt hash to compare against
+ * @returns True if password matches hash
+ */
+export function verifyPasswordLocal(password, passwordHash) {
+    return bcrypt.compareSync(password, passwordHash);
+}
+/**
+ * Hash a PSK (Pre-Shared Key) using bcrypt.
+ *
+ * @param psk - Raw PSK string
+ * @returns Bcrypt hash string (includes salt)
+ */
+export function hashPsk(psk) {
+    const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS);
+    return bcrypt.hashSync(psk, salt);
+}
+/**
+ * Verify a PSK against a bcrypt hash locally.
+ *
+ * This is primarily for testing. In production, verification
+ * happens via the orchestrator's verify endpoints.
+ *
+ * @param psk - Raw PSK to verify
+ * @param pskHash - Bcrypt hash to compare against
+ * @returns True if PSK matches hash
+ */
+export function verifyPskLocal(psk, pskHash) {
+    return bcrypt.compareSync(psk, pskHash);
+}
+/**
+ * Generate a random PSK locally.
+ *
+ * Note: In production, prefer using the orchestrator's PSK generation
+ * for centralized PSK management. This is a fallback.
+ *
+ * @param length - Length of PSK to generate (default: 32)
+ * @returns Random PSK string
+ */
+export function generatePskLocal(length = 32) {
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*';
+    let result = '';
+    const randomBytes = crypto.randomBytes(length);
+    for (let i = 0; i < length; i++) {
+        result += alphabet[randomBytes[i] % alphabet.length];
+    }
+    return result;
+}
+/**
+ * Hash a token using SHA-256.
+ *
+ * Used for refresh tokens where we need fast comparison
+ * and don't need the security properties of bcrypt.
+ *
+ * @param token - Raw token string
+ * @returns SHA-256 hex digest
+ */
+export function hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+/**
+ * Generate a random token string.
+ *
+ * @param length - Length of token to generate (default: 64)
+ * @returns Random URL-safe token string
+ */
+export function generateToken(length = 64) {
+    return crypto.randomBytes(length).toString('base64url');
+}
+//# sourceMappingURL=crypto.js.map