tesla-fleet-api 0.3.0 → 0.5.0

package/dist/signing/energy.mjs

@@ -0,0 +1,120 @@
+import { validate_island_mode } from "../energyisland.mjs";
+import { uint32BE } from "./crypto.mjs";
+import { rsaPublicDerPkcs1 } from "./keys.mjs";
+import { MessageEnvelope } from "@teslemetry/tesla-protocol/energy_device/transport";
+import crypto from "node:crypto";
+import { AuthorizedClientType } from "@teslemetry/tesla-protocol/energy_device/authorization_types";
+import { Domain, RoutableMessage, SignatureType, Tag } from "@teslemetry/tesla-protocol/energy_device/signed_message";
+// src/signing/energy.ts
+/** The cloud round trip needs more than the 12 s LAN TTL; 30 s worked live through `device_command`. */
+const ENERGY_SIGNATURE_TTL_SECONDS = 30;
+/** ts-proto's value for an enum input it does not recognise. */
+const UNRECOGNIZED_ENUM = -1;
+/** Encode one tag-length-value entry. */
+function tlv(tag, value) {
+	return Buffer.concat([Buffer.from([tag, value.length]), value]);
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A proto field name in the camelCase form ts-proto generates. */
+function camelCase(name) {
+	return name.replace(/_([a-z0-9])/g, (_, character) => character.toUpperCase());
+}
+/** Convert every key from Python's proto field names; ts-proto's `fromJSON` reads camelCase only. */
+function camelCaseKeys(value) {
+	if (Array.isArray(value)) return value.map(camelCaseKeys);
+	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([key, item]) => [camelCase(key), camelCaseKeys(item)]));
+	return value;
+}
+/**
+* Reject input `fromJSON` dropped or could not read, as Python's `ParseDict`
+* does: otherwise a mistyped field would be signed and sent without it.
+*/
+function assertParsed(input, parsed, path) {
+	if (Array.isArray(input) && Array.isArray(parsed)) input.forEach((item, index) => assertParsed(item, parsed[index], `${path}[${index}]`));
+	else if (isPlainObject(input) && isPlainObject(parsed) && !(parsed instanceof Date) && !ArrayBuffer.isView(parsed)) for (const [key, item] of Object.entries(input)) {
+		if (!(key in parsed)) throw new TypeError(`Unknown energy device command field ${path}.${key}`);
+		assertParsed(item, parsed[key], `${path}.${key}`);
+	}
+	else if (parsed instanceof Date && Number.isNaN(parsed.getTime()) || parsed === UNRECOGNIZED_ENUM && input !== UNRECOGNIZED_ENUM) throw new TypeError(`Invalid value for energy device command field ${path}`);
+}
+/**
+* Builds RSA-signed `RoutableMessage` bytes for one energy device key.
+*
+* The key must be an RSA key registered on the gateway with
+* `add_authorized_client` and in state `VERIFIED`. An ECC key cannot sign this
+* scheme: the `SignatureData` oneof has only `rsa_data`.
+*/
+var EnergyDeviceSigner = class {
+	/** The signer's public key, PKCS#1 DER. */
+	publicKeyDer;
+	/** Seconds a signed message stays valid. */
+	ttl;
+	#privateKey;
+	/**
+	* @param privateKey The RSA private key.
+	* @param ttl Seconds a signed message stays valid. `V1rTransport` passes 12.
+	* @throws TypeError for anything but an RSA private key.
+	*/
+	constructor(privateKey, ttl = 30) {
+		if (privateKey?.type !== "private" || privateKey.asymmetricKeyType !== "rsa") throw new TypeError("Energy device signing requires an RSA private key");
+		this.#privateKey = privateKey;
+		this.publicKeyDer = rsaPublicDerPkcs1(privateKey);
+		this.ttl = ttl;
+	}
+	/**
+	* Serialize a cloud `MessageEnvelope` addressed to `din`.
+	*
+	* `category`, `command` and `params` are the snake_case proto field names
+	* the unsigned `grpc_command` sends, so every command can be signed without
+	* per-command code. `delivery_channel` stays unset, as in the envelope
+	* proven on the cloud path.
+	* @throws TypeError for a field the message does not have, or an island mode that is not 1 or 6.
+	*/
+	static envelope(din, category, command, params) {
+		if (category === "teg" && command === "set_island_mode_request") validate_island_mode(params?.mode, params?.force);
+		const input = camelCaseKeys({ [category]: { [command]: params ?? {} } });
+		const envelope = MessageEnvelope.fromJSON(input);
+		assertParsed(input, envelope, "message");
+		envelope.sender = { authorizedClient: AuthorizedClientType.AUTHORIZED_CLIENT_TYPE_CUSTOMER_MOBILE_APP };
+		envelope.recipient = { din };
+		return MessageEnvelope.encode(envelope).finish();
+	}
+	/**
+	* Wrap `envelope` in a signed `RoutableMessage` and serialize it.
+	*
+	* RSA-4096 blocks for milliseconds, so this signs on the thread pool.
+	* @param envelope The serialized `MessageEnvelope`.
+	* @param din The gateway DIN the envelope and the request target.
+	* @param options `now` (in seconds) and `messageUuid` exist for test vectors.
+	*/
+	async sign(envelope, din, options = {}) {
+		if (din.length > 255 || /\P{ASCII}/u.test(din)) throw new TypeError("A gateway DIN must be at most 255 ASCII characters");
+		const expiresAt = Math.ceil(options.now ?? Date.now() / 1e3) + this.ttl;
+		const signedData = Buffer.concat([
+			tlv(Tag.TAG_SIGNATURE_TYPE, Buffer.from([SignatureType.SIGNATURE_TYPE_RSA])),
+			tlv(Tag.TAG_DOMAIN, Buffer.from([Domain.DOMAIN_ENERGY_DEVICE])),
+			tlv(Tag.TAG_PERSONALIZATION, Buffer.from(din, "ascii")),
+			tlv(Tag.TAG_EXPIRES_AT, uint32BE(expiresAt)),
+			Buffer.from([Tag.TAG_END]),
+			envelope
+		]);
+		const signature = await new Promise((resolve, reject) => {
+			crypto.sign("sha512", signedData, this.#privateKey, (error, result) => error ? reject(error) : resolve(result));
+		});
+		return RoutableMessage.encode(RoutableMessage.create({
+			toDestination: { domain: Domain.DOMAIN_ENERGY_DEVICE },
+			protobufMessageAsBytes: envelope,
+			signatureData: {
+				signerIdentity: { publicKey: this.publicKeyDer },
+				rsaData: {
+					expiresAt,
+					signature
+				}
+			},
+			uuid: options.messageUuid ?? crypto.randomBytes(16)
+		})).finish();
+	}
+};
+export { ENERGY_SIGNATURE_TTL_SECONDS, EnergyDeviceSigner };

package/dist/signing/jws.cjs

@@ -0,0 +1,229 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_crypto = require("./crypto.cjs");
+let crypto = require("crypto");
+crypto = require_runtime.__toESM(crypto, 1);
+// src/signing/jws.ts
+/**
+* Tesla.SS256: Schnorr signatures over P-256 and the compact JWS that carries
+* them, ported from `python-tesla-fleet-api`'s `tesla/jws.py`.
+*
+* Tesla signs messages for fleet-wide or offline delivery, such as a Fleet
+* Telemetry configuration, with Schnorr/P-256/SHA-256 (RFC 8235) using the EC
+* key the partner registered for signed commands, wrapped in a compact JWS with
+* `"alg": "Tesla.SS256"`. The scheme is Tesla's Go SDK's
+* (`teslamotors/vehicle-command`, `internal/schnorr`,
+* `internal/authentication/jwt.go`), and `test/jws.test.ts` checks it against
+* vectors that code produced.
+*
+* A signature is 96 bytes `V_x || V_y || r`, where `V = vG` is the public nonce
+* and `r = v - a*c (mod n)` for private key `a` and challenge `c`. The nonce `v`
+* is deterministic (RFC 6979 over SHA-256 of the message), so signing the same
+* message with the same key is reproducible. There is deliberately no low-`s`
+* normalisation: that is an ECDSA malleability fix, not part of this scheme, and
+* applying it would produce signatures Tesla rejects.
+*/
+var jws_exports = /* @__PURE__ */ require_runtime.__exportAll({
+	ALGORITHM: () => ALGORITHM,
+	G: () => G,
+	N: () => N,
+	P: () => P,
+	SCALAR_LENGTH: () => 32,
+	SIGNATURE_LENGTH: () => 96,
+	TELEMETRY_AUDIENCE: () => TELEMETRY_AUDIENCE,
+	deterministicNonce: () => deterministicNonce,
+	encodePoint: () => encodePoint,
+	public_key_bytes: () => public_key_bytes,
+	sign: () => sign,
+	sign_fleet_telemetry_config: () => sign_fleet_telemetry_config,
+	sign_jws: () => sign_jws,
+	verify: () => verify
+});
+const ALGORITHM = "Tesla.SS256";
+const TELEMETRY_AUDIENCE = "com.tesla.fleet.TelemetryClient";
+/** The 65-byte uncompressed public point for a raw P-256 private key. */
+function public_key_bytes(privateKey) {
+	return require_crypto.publicKeyFor(Buffer.from(privateKey));
+}
+const P = 115792089210356248762697446949407573530086143415290314195533631308867097853951n;
+const N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+const G = [48439561293906451759052585252797914202762949526041747995844080717082404635286n, 36134250956749795798585127919587881956611106672985015071877198253568414405109n];
+function toBigInt(bytes) {
+	return bytes.length === 0 ? 0n : BigInt(`0x${Buffer.from(bytes).toString("hex")}`);
+}
+function scalarBytes(value) {
+	return Buffer.from(value.toString(16).padStart(64, "0"), "hex");
+}
+/** `a mod m`, in `[0, m)` whatever the sign of `a`. */
+function mod(a, m) {
+	const remainder = a % m;
+	return remainder < 0n ? remainder + m : remainder;
+}
+/** The inverse of `a` modulo the prime `m`, by the extended Euclidean algorithm. */
+function inverse(a, m) {
+	let [r0, r1] = [mod(a, m), m];
+	let [s0, s1] = [1n, 0n];
+	while (r1 !== 0n) {
+		const quotient = r0 / r1;
+		[r0, r1] = [r1, r0 - quotient * r1];
+		[s0, s1] = [s1, s0 - quotient * s1];
+	}
+	return mod(s0, m);
+}
+/** Uncompressed SEC1 encoding: `0x04 || X || Y`. */
+function encodePoint(point) {
+	return Buffer.concat([
+		Buffer.from([4]),
+		scalarBytes(point[0]),
+		scalarBytes(point[1])
+	]);
+}
+function lengthValue(buffer) {
+	const length = Buffer.alloc(4);
+	length.writeUInt32BE(buffer.length, 0);
+	return Buffer.concat([length, buffer]);
+}
+/** SHA-256 over the length-prefixed generator, public nonce, signer key and message. */
+function challenge(publicNonce, publicKey, message) {
+	return toBigInt(crypto.default.createHash("sha256").update(lengthValue(encodePoint(G))).update(lengthValue(publicNonce)).update(lengthValue(publicKey)).update(lengthValue(message)).digest());
+}
+function hmac(key, ...data) {
+	const mac = crypto.default.createHmac("sha256", key);
+	for (const part of data) mac.update(part);
+	return mac.digest();
+}
+/** RFC 6979 section 3.2 nonce, specialised to P-256 with SHA-256 (hlen = qlen). */
+function deterministicNonce(scalar, messageHash) {
+	const h1 = scalarBytes(toBigInt(messageHash) % N);
+	const zero = Buffer.from([0]);
+	const one = Buffer.from([1]);
+	let k = Buffer.alloc(32, 0);
+	let v = Buffer.alloc(32, 1);
+	k = hmac(k, v, zero, scalar, h1);
+	v = hmac(k, v);
+	k = hmac(k, v, one, scalar, h1);
+	v = hmac(k, v);
+	while (true) {
+		v = hmac(k, v);
+		const candidate = toBigInt(v);
+		if (candidate > 0n && candidate < 115792089210356248762697446949407573529996955224135760342422259061068512044369n) return v;
+		k = hmac(k, v, zero);
+		v = hmac(k, v);
+	}
+}
+/**
+* The 96-byte Tesla.SS256 Schnorr signature of `message`.
+*
+* The nonce point goes through OpenSSL, so only the public result of multiplying
+* a secret scalar is ever visible; the arithmetic on `r` is the one place a
+* secret meets `BigInt`, as it meets Python's `int`.
+* @param privateKey Raw 32-byte P-256 scalar.
+*/
+function sign(privateKey, message) {
+	if (privateKey.length !== 32) throw new Error("Tesla.SS256 requires a P-256 (SECP256R1) key.");
+	const key = Buffer.from(privateKey);
+	const nonce = deterministicNonce(key, crypto.default.createHash("sha256").update(message).digest());
+	const publicNonce = require_crypto.publicKeyFor(nonce);
+	const c = challenge(publicNonce, require_crypto.publicKeyFor(key), message);
+	const r = mod(toBigInt(nonce) - toBigInt(key) * c, N);
+	return Buffer.concat([publicNonce.subarray(1), scalarBytes(r)]);
+}
+function add(p, q) {
+	if (p === null) return q;
+	if (q === null) return p;
+	let slope;
+	if (p[0] === q[0]) {
+		if (mod(p[1] + q[1], 115792089210356248762697446949407573530086143415290314195533631308867097853951n) === 0n) return null;
+		slope = mod((3n * p[0] * p[0] - 3n) * inverse(2n * p[1], P), P);
+	} else slope = mod((q[1] - p[1]) * inverse(q[0] - p[0], P), P);
+	const x = mod(slope * slope - p[0] - q[0], P);
+	return [x, mod(slope * (p[0] - x) - p[1], P)];
+}
+function multiply(k, point) {
+	let result = null;
+	let addend = point;
+	for (let remaining = k; remaining > 0n; remaining >>= 1n) {
+		if (remaining & 1n) result = add(result, addend);
+		addend = add(addend, addend);
+	}
+	return result;
+}
+function decodePublicKey(publicKey) {
+	if (publicKey.length !== 65) return null;
+	try {
+		crypto.default.ECDH.convertKey(publicKey, "prime256v1");
+	} catch {
+		return null;
+	}
+	return [toBigInt(publicKey.subarray(1, 33)), toBigInt(publicKey.subarray(33))];
+}
+/**
+* Check a Tesla.SS256 signature against a 65-byte uncompressed public key.
+*
+* Verification uses only public values, so the plain `BigInt` point arithmetic
+* here is not a side-channel concern.
+*/
+function verify(publicKey, message, signature) {
+	if (signature.length !== 96) return false;
+	const point = decodePublicKey(publicKey);
+	if (point === null) return false;
+	const nonceBytes = Buffer.from(signature.subarray(0, 64));
+	const r = toBigInt(signature.subarray(64));
+	const expected = add(multiply(challenge(Buffer.concat([Buffer.from([4]), nonceBytes]), publicKey, message), point), multiply(r, G));
+	return expected !== null && encodePoint(expected).subarray(1).equals(nonceBytes);
+}
+function base64Url(data) {
+	return Buffer.from(data).toString("base64url");
+}
+/**
+* Sorted, compact, ASCII-only JSON: the bytes Python's
+* `json.dumps(value, sort_keys=True, separators=(",", ":"))` produces. The sort
+* happens here rather than on a new object, whose integer-like keys JavaScript
+* would reorder.
+*/
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item ?? null)).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${canonicalJson(key)}:${canonicalJson(item)}`).join(",")}}`;
+	return JSON.stringify(value).replace(/[\u007f-￿]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* A compact Tesla.SS256 JWS over `claims`.
+*
+* Like the Go SDK, `iss` is set to the standard (padded) base64 of the signer's
+* uncompressed public key and `aud` to `audience`, overwriting any caller-supplied
+* values.
+* @param privateKey Raw 32-byte P-256 scalar.
+*/
+function sign_jws(privateKey, claims, audience) {
+	const payload = {
+		...claims,
+		iss: require_crypto.publicKeyFor(Buffer.from(privateKey)).toString("base64"),
+		aud: audience
+	};
+	const signingInput = `${base64Url(canonicalJson({
+		alg: ALGORITHM,
+		typ: "JWT"
+	}))}.${base64Url(canonicalJson(payload))}`;
+	return `${signingInput}.${base64Url(sign(privateKey, Buffer.from(signingInput)))}`;
+}
+/** The JWS token `fleet_telemetry_config_jws` expects for `config`. */
+function sign_fleet_telemetry_config(privateKey, config) {
+	return sign_jws(privateKey, config, TELEMETRY_AUDIENCE);
+}
+exports.ALGORITHM = ALGORITHM;
+exports.G = G;
+exports.N = N;
+exports.P = P;
+exports.TELEMETRY_AUDIENCE = TELEMETRY_AUDIENCE;
+exports.deterministicNonce = deterministicNonce;
+exports.encodePoint = encodePoint;
+Object.defineProperty(exports, "jws_exports", {
+	enumerable: true,
+	get: function() {
+		return jws_exports;
+	}
+});
+exports.public_key_bytes = public_key_bytes;
+exports.sign = sign;
+exports.sign_fleet_telemetry_config = sign_fleet_telemetry_config;
+exports.sign_jws = sign_jws;
+exports.verify = verify;

package/dist/signing/jws.d.cts

@@ -0,0 +1,45 @@
+declare namespace jws_d_exports {
+  export { ALGORITHM, G, N, P, SCALAR_LENGTH, SIGNATURE_LENGTH, TELEMETRY_AUDIENCE, deterministicNonce, encodePoint, public_key_bytes, sign, sign_fleet_telemetry_config, sign_jws, verify };
+}
+export declare const ALGORITHM = "Tesla.SS256";
+export declare const TELEMETRY_AUDIENCE = "com.tesla.fleet.TelemetryClient";
+export declare const SCALAR_LENGTH = 32;
+export declare const SIGNATURE_LENGTH: number;
+/** The 65-byte uncompressed public point for a raw P-256 private key. */
+export declare function public_key_bytes(privateKey: Uint8Array): Buffer;
+type AffinePoint = readonly [x: bigint, y: bigint];
+export declare const P = 115792089210356248762697446949407573530086143415290314195533631308867097853951n;
+export declare const N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+export declare const G: AffinePoint;
+/** Uncompressed SEC1 encoding: `0x04 || X || Y`. */
+export declare function encodePoint(point: AffinePoint): Buffer;
+/** RFC 6979 section 3.2 nonce, specialised to P-256 with SHA-256 (hlen = qlen). */
+export declare function deterministicNonce(scalar: Uint8Array, messageHash: Uint8Array): Buffer;
+/**
+ * The 96-byte Tesla.SS256 Schnorr signature of `message`.
+ *
+ * The nonce point goes through OpenSSL, so only the public result of multiplying
+ * a secret scalar is ever visible; the arithmetic on `r` is the one place a
+ * secret meets `BigInt`, as it meets Python's `int`.
+ * @param privateKey Raw 32-byte P-256 scalar.
+ */
+export declare function sign(privateKey: Uint8Array, message: Uint8Array): Buffer;
+/**
+ * Check a Tesla.SS256 signature against a 65-byte uncompressed public key.
+ *
+ * Verification uses only public values, so the plain `BigInt` point arithmetic
+ * here is not a side-channel concern.
+ */
+export declare function verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * A compact Tesla.SS256 JWS over `claims`.
+ *
+ * Like the Go SDK, `iss` is set to the standard (padded) base64 of the signer's
+ * uncompressed public key and `aud` to `audience`, overwriting any caller-supplied
+ * values.
+ * @param privateKey Raw 32-byte P-256 scalar.
+ */
+export declare function sign_jws(privateKey: Uint8Array, claims: Readonly<Record<string, unknown>>, audience: string): string;
+/** The JWS token `fleet_telemetry_config_jws` expects for `config`. */
+export declare function sign_fleet_telemetry_config(privateKey: Uint8Array, config: Readonly<Record<string, unknown>>): string;
+export { jws_d_exports };

package/dist/signing/jws.d.mts

@@ -0,0 +1,45 @@
+declare namespace jws_d_exports {
+  export { ALGORITHM, G, N, P, SCALAR_LENGTH, SIGNATURE_LENGTH, TELEMETRY_AUDIENCE, deterministicNonce, encodePoint, public_key_bytes, sign, sign_fleet_telemetry_config, sign_jws, verify };
+}
+export declare const ALGORITHM = "Tesla.SS256";
+export declare const TELEMETRY_AUDIENCE = "com.tesla.fleet.TelemetryClient";
+export declare const SCALAR_LENGTH = 32;
+export declare const SIGNATURE_LENGTH: number;
+/** The 65-byte uncompressed public point for a raw P-256 private key. */
+export declare function public_key_bytes(privateKey: Uint8Array): Buffer;
+type AffinePoint = readonly [x: bigint, y: bigint];
+export declare const P = 115792089210356248762697446949407573530086143415290314195533631308867097853951n;
+export declare const N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+export declare const G: AffinePoint;
+/** Uncompressed SEC1 encoding: `0x04 || X || Y`. */
+export declare function encodePoint(point: AffinePoint): Buffer;
+/** RFC 6979 section 3.2 nonce, specialised to P-256 with SHA-256 (hlen = qlen). */
+export declare function deterministicNonce(scalar: Uint8Array, messageHash: Uint8Array): Buffer;
+/**
+ * The 96-byte Tesla.SS256 Schnorr signature of `message`.
+ *
+ * The nonce point goes through OpenSSL, so only the public result of multiplying
+ * a secret scalar is ever visible; the arithmetic on `r` is the one place a
+ * secret meets `BigInt`, as it meets Python's `int`.
+ * @param privateKey Raw 32-byte P-256 scalar.
+ */
+export declare function sign(privateKey: Uint8Array, message: Uint8Array): Buffer;
+/**
+ * Check a Tesla.SS256 signature against a 65-byte uncompressed public key.
+ *
+ * Verification uses only public values, so the plain `BigInt` point arithmetic
+ * here is not a side-channel concern.
+ */
+export declare function verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * A compact Tesla.SS256 JWS over `claims`.
+ *
+ * Like the Go SDK, `iss` is set to the standard (padded) base64 of the signer's
+ * uncompressed public key and `aud` to `audience`, overwriting any caller-supplied
+ * values.
+ * @param privateKey Raw 32-byte P-256 scalar.
+ */
+export declare function sign_jws(privateKey: Uint8Array, claims: Readonly<Record<string, unknown>>, audience: string): string;
+/** The JWS token `fleet_telemetry_config_jws` expects for `config`. */
+export declare function sign_fleet_telemetry_config(privateKey: Uint8Array, config: Readonly<Record<string, unknown>>): string;
+export { jws_d_exports };

package/dist/signing/jws.mjs

@@ -0,0 +1,211 @@
+import { __exportAll } from "../_virtual/_rolldown/runtime.mjs";
+import { publicKeyFor } from "./crypto.mjs";
+import crypto from "crypto";
+// src/signing/jws.ts
+/**
+* Tesla.SS256: Schnorr signatures over P-256 and the compact JWS that carries
+* them, ported from `python-tesla-fleet-api`'s `tesla/jws.py`.
+*
+* Tesla signs messages for fleet-wide or offline delivery, such as a Fleet
+* Telemetry configuration, with Schnorr/P-256/SHA-256 (RFC 8235) using the EC
+* key the partner registered for signed commands, wrapped in a compact JWS with
+* `"alg": "Tesla.SS256"`. The scheme is Tesla's Go SDK's
+* (`teslamotors/vehicle-command`, `internal/schnorr`,
+* `internal/authentication/jwt.go`), and `test/jws.test.ts` checks it against
+* vectors that code produced.
+*
+* A signature is 96 bytes `V_x || V_y || r`, where `V = vG` is the public nonce
+* and `r = v - a*c (mod n)` for private key `a` and challenge `c`. The nonce `v`
+* is deterministic (RFC 6979 over SHA-256 of the message), so signing the same
+* message with the same key is reproducible. There is deliberately no low-`s`
+* normalisation: that is an ECDSA malleability fix, not part of this scheme, and
+* applying it would produce signatures Tesla rejects.
+*/
+var jws_exports = /* @__PURE__ */ __exportAll({
+	ALGORITHM: () => ALGORITHM,
+	G: () => G,
+	N: () => N,
+	P: () => P,
+	SCALAR_LENGTH: () => 32,
+	SIGNATURE_LENGTH: () => 96,
+	TELEMETRY_AUDIENCE: () => TELEMETRY_AUDIENCE,
+	deterministicNonce: () => deterministicNonce,
+	encodePoint: () => encodePoint,
+	public_key_bytes: () => public_key_bytes,
+	sign: () => sign,
+	sign_fleet_telemetry_config: () => sign_fleet_telemetry_config,
+	sign_jws: () => sign_jws,
+	verify: () => verify
+});
+const ALGORITHM = "Tesla.SS256";
+const TELEMETRY_AUDIENCE = "com.tesla.fleet.TelemetryClient";
+/** The 65-byte uncompressed public point for a raw P-256 private key. */
+function public_key_bytes(privateKey) {
+	return publicKeyFor(Buffer.from(privateKey));
+}
+const P = 115792089210356248762697446949407573530086143415290314195533631308867097853951n;
+const N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+const G = [48439561293906451759052585252797914202762949526041747995844080717082404635286n, 36134250956749795798585127919587881956611106672985015071877198253568414405109n];
+function toBigInt(bytes) {
+	return bytes.length === 0 ? 0n : BigInt(`0x${Buffer.from(bytes).toString("hex")}`);
+}
+function scalarBytes(value) {
+	return Buffer.from(value.toString(16).padStart(64, "0"), "hex");
+}
+/** `a mod m`, in `[0, m)` whatever the sign of `a`. */
+function mod(a, m) {
+	const remainder = a % m;
+	return remainder < 0n ? remainder + m : remainder;
+}
+/** The inverse of `a` modulo the prime `m`, by the extended Euclidean algorithm. */
+function inverse(a, m) {
+	let [r0, r1] = [mod(a, m), m];
+	let [s0, s1] = [1n, 0n];
+	while (r1 !== 0n) {
+		const quotient = r0 / r1;
+		[r0, r1] = [r1, r0 - quotient * r1];
+		[s0, s1] = [s1, s0 - quotient * s1];
+	}
+	return mod(s0, m);
+}
+/** Uncompressed SEC1 encoding: `0x04 || X || Y`. */
+function encodePoint(point) {
+	return Buffer.concat([
+		Buffer.from([4]),
+		scalarBytes(point[0]),
+		scalarBytes(point[1])
+	]);
+}
+function lengthValue(buffer) {
+	const length = Buffer.alloc(4);
+	length.writeUInt32BE(buffer.length, 0);
+	return Buffer.concat([length, buffer]);
+}
+/** SHA-256 over the length-prefixed generator, public nonce, signer key and message. */
+function challenge(publicNonce, publicKey, message) {
+	return toBigInt(crypto.createHash("sha256").update(lengthValue(encodePoint(G))).update(lengthValue(publicNonce)).update(lengthValue(publicKey)).update(lengthValue(message)).digest());
+}
+function hmac(key, ...data) {
+	const mac = crypto.createHmac("sha256", key);
+	for (const part of data) mac.update(part);
+	return mac.digest();
+}
+/** RFC 6979 section 3.2 nonce, specialised to P-256 with SHA-256 (hlen = qlen). */
+function deterministicNonce(scalar, messageHash) {
+	const h1 = scalarBytes(toBigInt(messageHash) % N);
+	const zero = Buffer.from([0]);
+	const one = Buffer.from([1]);
+	let k = Buffer.alloc(32, 0);
+	let v = Buffer.alloc(32, 1);
+	k = hmac(k, v, zero, scalar, h1);
+	v = hmac(k, v);
+	k = hmac(k, v, one, scalar, h1);
+	v = hmac(k, v);
+	while (true) {
+		v = hmac(k, v);
+		const candidate = toBigInt(v);
+		if (candidate > 0n && candidate < 115792089210356248762697446949407573529996955224135760342422259061068512044369n) return v;
+		k = hmac(k, v, zero);
+		v = hmac(k, v);
+	}
+}
+/**
+* The 96-byte Tesla.SS256 Schnorr signature of `message`.
+*
+* The nonce point goes through OpenSSL, so only the public result of multiplying
+* a secret scalar is ever visible; the arithmetic on `r` is the one place a
+* secret meets `BigInt`, as it meets Python's `int`.
+* @param privateKey Raw 32-byte P-256 scalar.
+*/
+function sign(privateKey, message) {
+	if (privateKey.length !== 32) throw new Error("Tesla.SS256 requires a P-256 (SECP256R1) key.");
+	const key = Buffer.from(privateKey);
+	const nonce = deterministicNonce(key, crypto.createHash("sha256").update(message).digest());
+	const publicNonce = publicKeyFor(nonce);
+	const c = challenge(publicNonce, publicKeyFor(key), message);
+	const r = mod(toBigInt(nonce) - toBigInt(key) * c, N);
+	return Buffer.concat([publicNonce.subarray(1), scalarBytes(r)]);
+}
+function add(p, q) {
+	if (p === null) return q;
+	if (q === null) return p;
+	let slope;
+	if (p[0] === q[0]) {
+		if (mod(p[1] + q[1], 115792089210356248762697446949407573530086143415290314195533631308867097853951n) === 0n) return null;
+		slope = mod((3n * p[0] * p[0] - 3n) * inverse(2n * p[1], P), P);
+	} else slope = mod((q[1] - p[1]) * inverse(q[0] - p[0], P), P);
+	const x = mod(slope * slope - p[0] - q[0], P);
+	return [x, mod(slope * (p[0] - x) - p[1], P)];
+}
+function multiply(k, point) {
+	let result = null;
+	let addend = point;
+	for (let remaining = k; remaining > 0n; remaining >>= 1n) {
+		if (remaining & 1n) result = add(result, addend);
+		addend = add(addend, addend);
+	}
+	return result;
+}
+function decodePublicKey(publicKey) {
+	if (publicKey.length !== 65) return null;
+	try {
+		crypto.ECDH.convertKey(publicKey, "prime256v1");
+	} catch {
+		return null;
+	}
+	return [toBigInt(publicKey.subarray(1, 33)), toBigInt(publicKey.subarray(33))];
+}
+/**
+* Check a Tesla.SS256 signature against a 65-byte uncompressed public key.
+*
+* Verification uses only public values, so the plain `BigInt` point arithmetic
+* here is not a side-channel concern.
+*/
+function verify(publicKey, message, signature) {
+	if (signature.length !== 96) return false;
+	const point = decodePublicKey(publicKey);
+	if (point === null) return false;
+	const nonceBytes = Buffer.from(signature.subarray(0, 64));
+	const r = toBigInt(signature.subarray(64));
+	const expected = add(multiply(challenge(Buffer.concat([Buffer.from([4]), nonceBytes]), publicKey, message), point), multiply(r, G));
+	return expected !== null && encodePoint(expected).subarray(1).equals(nonceBytes);
+}
+function base64Url(data) {
+	return Buffer.from(data).toString("base64url");
+}
+/**
+* Sorted, compact, ASCII-only JSON: the bytes Python's
+* `json.dumps(value, sort_keys=True, separators=(",", ":"))` produces. The sort
+* happens here rather than on a new object, whose integer-like keys JavaScript
+* would reorder.
+*/
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item ?? null)).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${canonicalJson(key)}:${canonicalJson(item)}`).join(",")}}`;
+	return JSON.stringify(value).replace(/[\u007f-￿]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* A compact Tesla.SS256 JWS over `claims`.
+*
+* Like the Go SDK, `iss` is set to the standard (padded) base64 of the signer's
+* uncompressed public key and `aud` to `audience`, overwriting any caller-supplied
+* values.
+* @param privateKey Raw 32-byte P-256 scalar.
+*/
+function sign_jws(privateKey, claims, audience) {
+	const payload = {
+		...claims,
+		iss: publicKeyFor(Buffer.from(privateKey)).toString("base64"),
+		aud: audience
+	};
+	const signingInput = `${base64Url(canonicalJson({
+		alg: ALGORITHM,
+		typ: "JWT"
+	}))}.${base64Url(canonicalJson(payload))}`;
+	return `${signingInput}.${base64Url(sign(privateKey, Buffer.from(signingInput)))}`;
+}
+/** The JWS token `fleet_telemetry_config_jws` expects for `config`. */
+function sign_fleet_telemetry_config(privateKey, config) {
+	return sign_jws(privateKey, config, TELEMETRY_AUDIENCE);
+}
+export { ALGORITHM, G, N, P, TELEMETRY_AUDIENCE, deterministicNonce, encodePoint, jws_exports, public_key_bytes, sign, sign_fleet_telemetry_config, sign_jws, verify };