qumra-pos-auth 0.1.0

package/dist/index.cjs

@@ -0,0 +1,706 @@
+'use strict';
+
+var argon2 = require('@noble/hashes/argon2');
+var utils = require('@noble/hashes/utils');
+var ed25519 = require('@noble/curves/ed25519');
+
+// src/crypto/NoblePinHasher.ts
+
+// src/crypto/base64.ts
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function encode(bytes, alphabet) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = b0 << 16 | b1 << 8 | b2;
+    out += alphabet[triple >> 18 & 63];
+    out += alphabet[triple >> 12 & 63];
+    if (i + 1 < bytes.length) out += alphabet[triple >> 6 & 63];
+    if (i + 2 < bytes.length) out += alphabet[triple & 63];
+  }
+  return out;
+}
+function decode(str, alphabet) {
+  const lookup = new Int16Array(128).fill(-1);
+  for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;
+  const clean = str.replace(/[=\s]/g, "");
+  const out = new Uint8Array(Math.floor(clean.length * 6 / 8));
+  let bits = 0;
+  let value = 0;
+  let o = 0;
+  for (let i = 0; i < clean.length; i++) {
+    const c = clean.charCodeAt(i);
+    const idx = c < 128 ? lookup[c] : -1;
+    if (idx < 0) throw new Error("base64: \u062D\u0631\u0641 \u063A\u064A\u0631 \u0635\u0627\u0644\u062D");
+    value = value << 6 | idx;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = value >> bits & 255;
+    }
+  }
+  return out;
+}
+var b64 = {
+  encode: (b) => encode(b, STD),
+  decode: (s) => decode(s, STD)
+};
+var b64url = {
+  encode: (b) => encode(b, URL),
+  decode: (s) => decode(s, URL)
+};
+
+// src/crypto/NoblePinHasher.ts
+var DEFAULT_ARGON2_PARAMS = {
+  t: 3,
+  m: 64 * 1024,
+  p: 1,
+  dkLen: 32
+};
+var V = 19;
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var NoblePinHasher = class {
+  params;
+  constructor(params = DEFAULT_ARGON2_PARAMS) {
+    this.params = params;
+  }
+  async hash(pin) {
+    const salt = utils.randomBytes(16);
+    const { t, m, p, dkLen } = this.params;
+    const out = await argon2.argon2idAsync(utils.utf8ToBytes(pin), salt, { t, m, p, dkLen });
+    return `$argon2id$v=${V}$m=${m},t=${t},p=${p}$${b64.encode(salt)}$${b64.encode(out)}`;
+  }
+  async verify(pin, encoded) {
+    const parsed = parsePhc(encoded);
+    if (!parsed) return false;
+    const out = await argon2.argon2idAsync(utils.utf8ToBytes(pin), parsed.salt, {
+      t: parsed.t,
+      m: parsed.m,
+      p: parsed.p,
+      dkLen: parsed.hash.length
+    });
+    return constantTimeEqual(out, parsed.hash);
+  }
+};
+function parsePhc(encoded) {
+  const parts = encoded.split("$");
+  if (parts.length !== 6) return null;
+  if (parts[1] !== "argon2id") return null;
+  const paramStr = parts[3];
+  const saltStr = parts[4];
+  const hashStr = parts[5];
+  if (paramStr === void 0 || saltStr === void 0 || hashStr === void 0) {
+    return null;
+  }
+  const params = /* @__PURE__ */ new Map();
+  for (const kv of paramStr.split(",")) {
+    const [k, v] = kv.split("=");
+    if (k === void 0 || v === void 0) return null;
+    const n = Number(v);
+    if (!Number.isFinite(n)) return null;
+    params.set(k, n);
+  }
+  const m = params.get("m");
+  const t = params.get("t");
+  const p = params.get("p");
+  if (m === void 0 || t === void 0 || p === void 0) return null;
+  try {
+    return { m, t, p, salt: b64.decode(saltStr), hash: b64.decode(hashStr) };
+  } catch {
+    return null;
+  }
+}
+var NobleSignatureVerifier = class {
+  async verify(message, signature, publicKey) {
+    try {
+      return ed25519.ed25519.verify(signature, message, publicKey);
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/errors.ts
+var AuthNetworkError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "AuthNetworkError";
+  }
+};
+var AuthRejectedError = class extends Error {
+  /** كود السيرفر لو متاح (invalid_grant, invalid_credentials …). */
+  code;
+  constructor(message, code, cause) {
+    super(message, { cause });
+    this.name = "AuthRejectedError";
+    this.code = code;
+  }
+};
+
+// src/time.ts
+var systemClock = () => Date.now();
+var SECOND = 1e3;
+var MINUTE = 60 * SECOND;
+var HOUR = 60 * MINUTE;
+var DAY = 24 * HOUR;
+
+// src/token/TokenManager.ts
+var TokenManager = class {
+  vault;
+  api;
+  now;
+  skewMs;
+  onServerContact;
+  /** single-flight: كل النداءات المتزامنة بتشارك نفس عملية الـ refresh. */
+  inflight = null;
+  /**
+   * نسخة في الذاكرة من آخر توكنات معروفة. الغرض الوحيد: peekValidToken المتزامن
+   * — لأن SyncEngine.getAuthToken متزامن بينما الـ vault async. بتتحدّث مع كل
+   * تحميل/حفظ للتوكنات، ودورة الـ refresh الخلفية بتحافظ عليها دافية.
+   */
+  cached = null;
+  constructor(opts) {
+    this.vault = opts.vault;
+    this.api = opts.api;
+    this.now = opts.now ?? systemClock;
+    this.skewMs = opts.skewMs ?? 30 * SECOND;
+    this.onServerContact = opts.onServerContact;
+  }
+  /** تسجيل دخول أونلاين. بيرمي AuthRejectedError/AuthNetworkError زي الـ api. */
+  async login(input) {
+    const resp = await this.api.login(input);
+    const tokens = this.toTokens(resp);
+    await this.vault.saveTokens(tokens);
+    this.cached = tokens;
+    await this.onServerContact?.(this.now());
+    return tokens;
+  }
+  /** خروج: إبطال best-effort على السيرفر ثم مسح التوكنات المحلية. */
+  async logout() {
+    const tokens = await this.vault.loadTokens();
+    if (tokens && this.api.revoke) {
+      try {
+        await this.api.revoke(tokens.refreshToken);
+      } catch {
+      }
+    }
+    await this.vault.saveTokens(null);
+    this.cached = null;
+  }
+  async getTokens() {
+    const tokens = await this.vault.loadTokens();
+    this.cached = tokens;
+    return tokens;
+  }
+  /** يملأ الكاش من الـ vault مرة (عند الإقلاع) — علشان peek يشتغل قبل أي نداء. */
+  async primeCache() {
+    this.cached = await this.vault.loadTokens();
+  }
+  /**
+   * توكن access صالح متزامن من الكاش — من غير أي I/O أو refresh. ده اللي بيتوصّل
+   * لـ SyncEngine.getAuthToken. بيرجّع null لو مفيش كاش أو الكاش منتهي؛ دورة الـ
+   * refresh الخلفية (getValidToken) هي اللي بتجدّد الكاش.
+   */
+  peekValidToken() {
+    if (!this.cached) return null;
+    return this.isAccessValid(this.cached) ? this.cached.accessToken : null;
+  }
+  /**
+   * التوكن الصالح للـ SyncEngine. مابيرميش: أي فشل → null (= pause).
+   */
+  async getValidToken() {
+    const outcome = await this.ensureFresh();
+    switch (outcome.status) {
+      case "valid":
+      case "refreshed":
+        return outcome.tokens.accessToken;
+      default:
+        return null;
+    }
+  }
+  /**
+   * يضمن توكن access صالح: يرجّعه لو صالح، أو يعمل refresh دوّار single-flight.
+   * مابيرميش — بيرجّع RefreshOutcome. AuthService بيستخدمه لتحديث حالة الوصول.
+   */
+  async ensureFresh() {
+    const tokens = await this.vault.loadTokens();
+    this.cached = tokens;
+    if (!tokens) return { status: "signed-out" };
+    if (this.isAccessValid(tokens)) return { status: "valid", tokens };
+    if (!this.isRefreshValid(tokens)) return { status: "network" };
+    return this.refreshOnce();
+  }
+  isAccessValid(tokens) {
+    return this.now() < tokens.accessExpiresAt - this.skewMs;
+  }
+  isRefreshValid(tokens) {
+    return this.now() < tokens.refreshExpiresAt;
+  }
+  /** refresh single-flight: نداء واحد بس بيطير حتى لو اتنادى من كذا مكان. */
+  refreshOnce() {
+    if (this.inflight) return this.inflight;
+    this.inflight = this.doRefresh().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  async doRefresh() {
+    const current = await this.vault.loadTokens();
+    if (!current) return { status: "signed-out" };
+    if (this.isAccessValid(current)) return { status: "valid", tokens: current };
+    try {
+      const resp = await this.api.refresh(current.refreshToken);
+      const next = this.toTokens(resp);
+      await this.vault.saveTokens(next);
+      this.cached = next;
+      await this.onServerContact?.(this.now());
+      return { status: "refreshed", tokens: next };
+    } catch (err) {
+      if (err instanceof AuthRejectedError) {
+        await this.vault.saveTokens(null);
+        this.cached = null;
+        return { status: "rejected" };
+      }
+      if (err instanceof AuthNetworkError) {
+        return { status: "network" };
+      }
+      return { status: "network" };
+    }
+  }
+  toTokens(resp) {
+    const at = this.now();
+    return {
+      accessToken: resp.accessToken,
+      refreshToken: resp.refreshToken,
+      accessExpiresAt: at + resp.expiresInSec * SECOND,
+      refreshExpiresAt: at + resp.refreshExpiresInSec * SECOND,
+      tokenType: resp.tokenType ?? "Bearer"
+    };
+  }
+};
+
+// src/pin/PinManager.ts
+var PinManager = class {
+  directory;
+  hasher;
+  now;
+  maxAttempts;
+  lockoutMs;
+  attempts = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.directory = opts.directory;
+    this.hasher = opts.hasher;
+    this.now = opts.now ?? systemClock;
+    this.maxAttempts = opts.maxAttempts ?? 5;
+    this.lockoutMs = opts.lockoutMs ?? MINUTE;
+  }
+  /** قائمة الكاشيرية للعرض (من غير الـ hashes). */
+  async listCashiers() {
+    const rows = await this.directory.listCashiers();
+    return rows.map((c) => ({ id: c.id, name: c.name, active: c.active }));
+  }
+  /**
+   * يتحقق من PIN كاشير معيّن. النجاح بيصفّر عدّاد محاولاته؛ الفشل بيزوّده ويقفل
+   * مؤقتاً عند الوصول للحد.
+   */
+  async verify(cashierId, pin) {
+    const now = this.now();
+    const state = this.attempts.get(cashierId);
+    if (state && state.lockedUntil > now) {
+      return {
+        ok: false,
+        reason: "locked",
+        retryAfterMs: state.lockedUntil - now
+      };
+    }
+    const cashier = await this.findCashier(cashierId);
+    if (!cashier) return { ok: false, reason: "unknown-cashier" };
+    if (!cashier.active) return { ok: false, reason: "inactive" };
+    const valid = await this.hasher.verify(pin, cashier.pinHash);
+    if (valid) {
+      this.attempts.delete(cashierId);
+      return {
+        ok: true,
+        cashier: { cashierId: cashier.id, name: cashier.name, since: now }
+      };
+    }
+    return this.registerFailure(cashierId, now);
+  }
+  /** يفكّ القفل يدوياً (مثلاً المدير سمح). */
+  reset(cashierId) {
+    this.attempts.delete(cashierId);
+  }
+  registerFailure(cashierId, now) {
+    const prev = this.attempts.get(cashierId);
+    const count = (prev?.count ?? 0) + 1;
+    if (count >= this.maxAttempts) {
+      const lockedUntil = now + this.lockoutMs;
+      this.attempts.set(cashierId, { count: 0, lockedUntil });
+      return { ok: false, reason: "locked", retryAfterMs: this.lockoutMs };
+    }
+    this.attempts.set(cashierId, { count, lockedUntil: 0 });
+    return {
+      ok: false,
+      reason: "bad-pin",
+      attemptsLeft: this.maxAttempts - count
+    };
+  }
+  async findCashier(id) {
+    const rows = await this.directory.listCashiers();
+    return rows.find((c) => c.id === id);
+  }
+};
+
+// src/activation/ActivationManager.ts
+var ActivationManager = class {
+  vault;
+  verifier;
+  publicKey;
+  now;
+  deviceId;
+  constructor(opts) {
+    this.vault = opts.vault;
+    this.verifier = opts.verifier;
+    this.publicKey = opts.publicKey;
+    this.now = opts.now ?? systemClock;
+    this.deviceId = opts.deviceId;
+  }
+  /**
+   * يتحقق من مفتاح تفعيل ويخزّنه لو صالح. الترتيب: صيغة → توقيع → الجهاز → الانتهاء.
+   * التوقيع بيتفحص قبل أي حاجة تانية علشان مانثقش في أي claim قبل التأكد إنه من قمرة.
+   */
+  async activate(activationKey) {
+    const parsed = this.parse(activationKey);
+    if (!parsed) return { ok: false, reason: "malformed" };
+    const okSig = await this.verifier.verify(
+      parsed.signedBytes,
+      parsed.signature,
+      this.publicKey
+    );
+    if (!okSig) return { ok: false, reason: "bad-signature" };
+    const claims = parsed.claims;
+    if (this.deviceId !== void 0 && claims.deviceId !== this.deviceId) {
+      return { ok: false, reason: "wrong-device" };
+    }
+    const now = this.now();
+    const graceMs = claims.graceMs ?? 0;
+    if (now >= claims.expiresAt + graceMs) {
+      return { ok: false, reason: "expired" };
+    }
+    const stored = {
+      claims,
+      key: activationKey,
+      verifiedAt: now
+    };
+    await this.vault.saveActivation(stored);
+    return { ok: true, claims };
+  }
+  async getActivation() {
+    return this.vault.loadActivation();
+  }
+  /**
+   * يعيد التحقق من المفتاح المخزّن (توقيع + جهاز) ويحدّث verifiedAt. بيُستدعى عند
+   * الإقلاع علشان نتأكد إن المفتاح المخزّن لسه سليم ومش متلاعب فيه.
+   */
+  async revalidateStored() {
+    const stored = await this.vault.loadActivation();
+    if (!stored) return null;
+    return this.activate(stored.key);
+  }
+  async clear() {
+    await this.vault.saveActivation(null);
+  }
+  parse(key) {
+    const dot = key.indexOf(".");
+    if (dot <= 0 || dot === key.length - 1) return null;
+    const payloadB64 = key.slice(0, dot);
+    const sigB64 = key.slice(dot + 1);
+    let claims;
+    let signature;
+    try {
+      const json = new TextDecoder().decode(b64url.decode(payloadB64));
+      claims = JSON.parse(json);
+      signature = b64url.decode(sigB64);
+    } catch {
+      return null;
+    }
+    if (!isValidClaims(claims)) return null;
+    const signedBytes = new TextEncoder().encode(payloadB64);
+    return { claims, signedBytes, signature };
+  }
+};
+function isValidClaims(c) {
+  if (typeof c !== "object" || c === null) return false;
+  const o = c;
+  return typeof o.merchantId === "string" && typeof o.deviceId === "string" && typeof o.issuedAt === "number" && typeof o.expiresAt === "number";
+}
+
+// src/policy.ts
+var DEFAULT_ACCESS_POLICY = {
+  maxOfflineMs: 30 * DAY,
+  graceMs: 3 * DAY
+};
+
+// src/service/AuthService.ts
+var EMPTY_META = {
+  lastServerContactAt: null,
+  activatedOnlineAt: null
+};
+var AuthService = class {
+  vault;
+  now;
+  policy;
+  tokens;
+  pins;
+  activation;
+  listeners = /* @__PURE__ */ new Set();
+  status = {
+    mode: "unactivated",
+    access: "locked",
+    tokenValid: false,
+    cashier: null,
+    graceEndsAt: null,
+    lockedReason: LOCK_REASON_UNACTIVATED,
+    lastServerContactAt: null,
+    activation: null
+  };
+  constructor(opts) {
+    this.vault = opts.vault;
+    this.tokens = opts.tokenManager;
+    this.pins = opts.pinManager;
+    this.activation = opts.activationManager;
+    this.policy = opts.policy ?? DEFAULT_ACCESS_POLICY;
+    this.now = opts.now ?? systemClock;
+  }
+  // -------------------------------------------------------------------------
+  // إقلاع + إعادة تقييم
+  // -------------------------------------------------------------------------
+  /** الإقلاع: يملأ كاش التوكن، يعيد التحقق من مفتاح التفعيل المخزّن، ثم يحسب الحالة. */
+  async init() {
+    await this.tokens.primeCache();
+    const check = await this.activation.revalidateStored();
+    if (check && !check.ok && (check.reason === "bad-signature" || check.reason === "wrong-device")) {
+      await this.activation.clear();
+    }
+    return this.reevaluate();
+  }
+  /**
+   * يحاول تحديث التوكن (لو النت رجع) ثم يعيد حساب الحالة. التطبيق بينادي ده دورياً
+   * وبعد أي reconnect. مابيرميش.
+   */
+  async refresh() {
+    await this.tokens.ensureFresh();
+    return this.reevaluate();
+  }
+  getStatus() {
+    return this.status;
+  }
+  /** هل مسموح ببيع جديد دلوقتي؟ (locked = لأ). */
+  canSell() {
+    return this.status.access !== "locked";
+  }
+  onStatusChange(cb) {
+    this.listeners.add(cb);
+    cb(this.status);
+    return () => this.listeners.delete(cb);
+  }
+  // -------------------------------------------------------------------------
+  // الجهاز/التاجر
+  // -------------------------------------------------------------------------
+  /** تسجيل دخول أونلاين. بيرمي زي الـ api (rejected/network). */
+  async onlineLogin(input) {
+    await this.tokens.login(input);
+    return this.reevaluate();
+  }
+  /** إدخال مفتاح تفعيل أوفلاين. */
+  async activateOffline(activationKey) {
+    const result = await this.activation.activate(activationKey);
+    await this.reevaluate();
+    return result;
+  }
+  /** خروج التاجر: يمسح التوكنات وجلسة الكاشير (مش البيانات، مش التفعيل). */
+  async logout() {
+    await this.tokens.logout();
+    await this.vault.saveSession(null);
+    return this.reevaluate();
+  }
+  /** callback الوحيد للـ SyncEngine (async). null = pause. */
+  getValidToken() {
+    return this.tokens.getValidToken();
+  }
+  /**
+   * نسخة متزامنة للـ SyncEngine (getAuthToken بتاعه متزامن). بترجّع آخر توكن صالح
+   * من الكاش من غير I/O؛ refresh()/getValidToken الدورية هي اللي بتدفّي الكاش.
+   */
+  getAccessTokenSync() {
+    return this.tokens.peekValidToken();
+  }
+  /** يُمرَّر للـ TokenManager: يسجّل آخر اتصال ناجح بالسيرفر ويعلّم التفعيل الأونلاين. */
+  async recordServerContact(at) {
+    const meta = await this.vault.loadMeta() ?? EMPTY_META;
+    await this.vault.saveMeta({
+      lastServerContactAt: at,
+      activatedOnlineAt: meta.activatedOnlineAt ?? at
+    });
+  }
+  // -------------------------------------------------------------------------
+  // الكاشير (PIN)
+  // -------------------------------------------------------------------------
+  async listCashiers() {
+    return this.pins.listCashiers();
+  }
+  async cashierLogin(cashierId, pin) {
+    const result = await this.pins.verify(cashierId, pin);
+    if (result.ok) {
+      await this.vault.saveSession(result.cashier);
+      await this.reevaluate();
+    }
+    return result;
+  }
+  async cashierLogout() {
+    await this.vault.saveSession(null);
+    await this.reevaluate();
+  }
+  // -------------------------------------------------------------------------
+  // حساب الحالة
+  // -------------------------------------------------------------------------
+  async reevaluate() {
+    const next = await this.computeStatus();
+    const changed = JSON.stringify(next) !== JSON.stringify(this.status);
+    this.status = next;
+    if (changed) {
+      for (const cb of this.listeners) cb(next);
+    }
+    return next;
+  }
+  async computeStatus() {
+    const [tokens, session, activation, metaRaw] = await Promise.all([
+      this.vault.loadTokens(),
+      this.vault.loadSession(),
+      this.vault.loadActivation(),
+      this.vault.loadMeta()
+    ]);
+    const meta = metaRaw ?? EMPTY_META;
+    const now = this.now();
+    const tokenValid = tokens ? this.tokens.isAccessValid(tokens) : false;
+    const mode = deriveMode(tokenValid, meta, activation);
+    const access = computeAccess(mode, now, meta, activation, this.policy);
+    return {
+      mode,
+      access: access.state,
+      tokenValid,
+      cashier: session,
+      graceEndsAt: access.graceEndsAt,
+      lockedReason: access.lockedReason,
+      lastServerContactAt: meta.lastServerContactAt,
+      activation
+    };
+  }
+};
+var LOCK_REASON_UNACTIVATED = "\u0627\u0644\u062C\u0647\u0627\u0632 \u063A\u064A\u0631 \u0645\u0641\u0639\u0651\u0644 \u2014 \u0633\u062C\u0651\u0644 \u0627\u0644\u062F\u062E\u0648\u0644 \u0623\u0648\u0646\u0644\u0627\u064A\u0646 \u0623\u0648 \u0623\u062F\u062E\u0644 \u0645\u0641\u062A\u0627\u062D \u062A\u0641\u0639\u064A\u0644";
+var LOCK_REASON_OFFLINE_TOO_LONG = "\u0627\u0644\u062C\u0647\u0627\u0632 \u0623\u0648\u0641\u0644\u0627\u064A\u0646 \u0645\u0646 \u0645\u062F\u0629 \u0637\u0648\u064A\u0644\u0629 \u2014 \u0644\u0627\u0632\u0645 \u064A\u062A\u0635\u0644 \u0628\u0627\u0644\u0633\u064A\u0631\u0641\u0631 \u0644\u062A\u062C\u062F\u064A\u062F \u0627\u0644\u062C\u0644\u0633\u0629";
+var LOCK_REASON_ACTIVATION_EXPIRED = "\u0627\u0646\u062A\u0647\u062A \u0635\u0644\u0627\u062D\u064A\u0629 \u0645\u0641\u062A\u0627\u062D \u0627\u0644\u062A\u0641\u0639\u064A\u0644";
+function deriveMode(tokenValid, meta, activation) {
+  if (tokenValid) return "online";
+  if (meta.activatedOnlineAt != null) return "offline-degraded";
+  if (activation != null) return "offline-activated";
+  return "unactivated";
+}
+function computeAccess(mode, now, meta, activation, policy) {
+  if (mode === "online") {
+    return { state: "active", graceEndsAt: null, lockedReason: null };
+  }
+  if (mode === "unactivated") {
+    return { state: "locked", graceEndsAt: null, lockedReason: LOCK_REASON_UNACTIVATED };
+  }
+  let allowanceEnd;
+  let graceMs;
+  let expiredReason;
+  if (mode === "offline-activated" && activation) {
+    allowanceEnd = activation.claims.expiresAt;
+    graceMs = activation.claims.graceMs ?? policy.graceMs;
+    expiredReason = LOCK_REASON_ACTIVATION_EXPIRED;
+  } else {
+    const anchor = meta.lastServerContactAt ?? meta.activatedOnlineAt ?? now;
+    allowanceEnd = anchor + policy.maxOfflineMs;
+    graceMs = policy.graceMs;
+    expiredReason = LOCK_REASON_OFFLINE_TOO_LONG;
+  }
+  if (now < allowanceEnd) {
+    return { state: "active", graceEndsAt: null, lockedReason: null };
+  }
+  const lockAt = allowanceEnd + graceMs;
+  if (now < lockAt) {
+    return { state: "grace", graceEndsAt: lockAt, lockedReason: null };
+  }
+  return { state: "locked", graceEndsAt: null, lockedReason: expiredReason };
+}
+
+// src/createAuth.ts
+function createAuth(opts) {
+  const now = opts.now ?? systemClock;
+  const hasher = opts.hasher ?? new NoblePinHasher();
+  const verifier = opts.verifier ?? new NobleSignatureVerifier();
+  let service;
+  const tokens = new TokenManager({
+    vault: opts.vault,
+    api: opts.api,
+    now,
+    skewMs: opts.skewMs,
+    onServerContact: (at) => service.recordServerContact(at)
+  });
+  const pins = new PinManager({
+    directory: opts.directory,
+    hasher,
+    now,
+    maxAttempts: opts.maxPinAttempts,
+    lockoutMs: opts.pinLockoutMs
+  });
+  const activation = new ActivationManager({
+    vault: opts.vault,
+    verifier,
+    publicKey: opts.activationPublicKey,
+    now,
+    deviceId: opts.deviceId
+  });
+  service = new AuthService({
+    vault: opts.vault,
+    tokenManager: tokens,
+    pinManager: pins,
+    activationManager: activation,
+    policy: opts.policy,
+    now
+  });
+  return {
+    service,
+    tokens,
+    pins,
+    activation,
+    getValidToken: () => service.getValidToken(),
+    getAccessTokenSync: () => service.getAccessTokenSync()
+  };
+}
+
+exports.ActivationManager = ActivationManager;
+exports.AuthNetworkError = AuthNetworkError;
+exports.AuthRejectedError = AuthRejectedError;
+exports.AuthService = AuthService;
+exports.DAY = DAY;
+exports.DEFAULT_ACCESS_POLICY = DEFAULT_ACCESS_POLICY;
+exports.HOUR = HOUR;
+exports.MINUTE = MINUTE;
+exports.PinManager = PinManager;
+exports.SECOND = SECOND;
+exports.TokenManager = TokenManager;
+exports.createAuth = createAuth;
+exports.systemClock = systemClock;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map