openclaw/dist/device-identity-CKtmS8Us.mjs

Multi-channel AI gateway with extensible messaging integrations

import { n as pathMayExistSync } from "./path-existence-B679BE7y.mjs";
import { c as normalizeEd25519PublicKeyBase64Url, d as verifyEd25519Signature } from "./ed25519-signature-DxLj6ug0.mjs";
import { a as readStoredDeviceIdentity, c as resolveDeviceIdentityStore, i as insertStoredDeviceIdentityIfAbsent, n as assertNoPendingLegacyIdentity, o as readStoredDeviceIdentityReadOnly, r as generateStoredDeviceIdentity } from "./device-identity-store-BO1tgcFb.mjs";
import crypto from "node:crypto";
//#region src/infra/device-identity.ts
function toDeviceIdentity(stored) {
	return {
		deviceId: stored.deviceId,
		publicKeyPem: stored.publicKeyPem,
		privateKeyPem: stored.privateKeyPem
	};
}
/** Load a valid canonical identity or atomically create its SQLite row. */
function loadOrCreateDeviceIdentity(options = {}) {
	const resolved = resolveDeviceIdentityStore(options);
	const resolvedOptions = {
		...options,
		path: resolved.databasePath,
		identityKey: resolved.identityKey
	};
	const existing = pathMayExistSync(resolved.databasePath) ? readStoredDeviceIdentity(resolvedOptions) : null;
	if (existing) return toDeviceIdentity(existing);
	assertNoPendingLegacyIdentity(resolvedOptions);
	const candidate = generateStoredDeviceIdentity();
	return toDeviceIdentity(insertStoredDeviceIdentityIfAbsent(candidate, resolvedOptions));
}
/** Load a valid persisted identity without creating or mutating SQLite state. */
function loadDeviceIdentityIfPresent(options = {}) {
	const stored = readStoredDeviceIdentityReadOnly(options);
	if (stored) return toDeviceIdentity(stored);
	assertNoPendingLegacyIdentity(options);
	return null;
}
/** Derive the stable device id from PEM or raw base64/base64url public key material. */
function deriveDeviceIdFromPublicKey(publicKey) {
	try {
		const normalized = normalizeEd25519PublicKeyBase64Url(publicKey);
		if (!normalized) return null;
		const raw = Buffer.from(normalized, "base64url");
		return crypto.createHash("sha256").update(raw).digest("hex");
	} catch {
		return null;
	}
}
/** Verify a UTF-8 payload signature against PEM or raw base64/base64url public key material. */
function verifyDeviceSignature(publicKey, payload, signatureBase64Url) {
	return verifyEd25519Signature({
		publicKey,
		payload,
		signatureBase64Url
	});
}
//#endregion
export { verifyDeviceSignature as i, loadDeviceIdentityIfPresent as n, loadOrCreateDeviceIdentity as r, deriveDeviceIdFromPublicKey as t };