@agentdocumentformat/cli 0.7.8 → 0.8.0

package/dist/chunks/chunk-LKFHERRV.mjs

@@ -0,0 +1,145 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/utils/file-ref.ts
+var file_ref_exports = {};
+__export(file_ref_exports, {
+  adfFileUrl: () => adfFileUrl,
+  applyFileRefChanges: () => applyFileRefChanges,
+  attachmentMetadata: () => attachmentMetadata,
+  attachmentText: () => attachmentText,
+  attachmentsOf: () => attachmentsOf,
+  deletedFilePlaceholder: () => deletedFilePlaceholder,
+  displayAttachment: () => displayAttachment,
+  fileRefKind: () => fileRefKind,
+  fileRefName: () => fileRefName,
+  fileRefText: () => fileRefText,
+  isAudioInputMime: () => isAudioInputMime,
+  isFileRefBlock: () => isFileRefBlock,
+  isVideoInputMime: () => isVideoInputMime,
+  isVisionMime: () => isVisionMime,
+  mediaKindOfMime: () => mediaKindOfMime,
+  splitLegacyUploads: () => splitLegacyUploads
+});
+var VISION_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]), AUDIO_INPUT_MIMES = /* @__PURE__ */ new Set([
+  "audio/wav",
+  "audio/mpeg",
+  "audio/mp3",
+  "audio/aiff",
+  "audio/aac",
+  "audio/ogg",
+  "audio/flac",
+  "audio/x-m4a",
+  "audio/webm"
+]), VIDEO_INPUT_MIMES = /* @__PURE__ */ new Set(["video/mp4", "video/mpeg", "video/quicktime", "video/webm"]);
+function isVisionMime(mime) {
+  return !!mime && VISION_MIMES.has(mime);
+}
+function isAudioInputMime(mime) {
+  return !!mime && AUDIO_INPUT_MIMES.has(mime);
+}
+function isVideoInputMime(mime) {
+  return !!mime && VIDEO_INPUT_MIMES.has(mime);
+}
+function mediaKindOfMime(mime) {
+  if (isVisionMime(mime)) return "image";
+  if (isAudioInputMime(mime)) return "audio";
+  if (isVideoInputMime(mime)) return "video";
+}
+function isFileRefBlock(block) {
+  return block.type === "file_ref" && !!block.file_ref && typeof block.file_ref.path == "string";
+}
+function fileRefKind(ref) {
+  return mediaKindOfMime(ref.mime_type);
+}
+function fileRefName(ref) {
+  let segments = ref.path.split("/");
+  return segments[segments.length - 1] || ref.path;
+}
+function deletedFilePlaceholder(ref) {
+  return `[deleted: ${fileRefName(ref)}]`;
+}
+function adfFileUrl(path) {
+  return `adf-file://${path.split("/").map(encodeURIComponent).join("/")}`;
+}
+function displayAttachment(ref) {
+  let kind = fileRefKind(ref);
+  return {
+    path: ref.path,
+    name: fileRefName(ref),
+    mime_type: ref.mime_type,
+    ...kind ? { kind } : {},
+    ...ref.deleted ? { deleted: !0 } : {}
+  };
+}
+function attachmentsOf(blocks) {
+  let out = [];
+  for (let block of blocks) isFileRefBlock(block) && out.push(displayAttachment(block.file_ref));
+  return out;
+}
+function attachmentMetadata(content, previews = []) {
+  let attachments = attachmentsOf(content);
+  if (!(attachments.length === 0 && previews.length === 0))
+    return { ...previews.length > 0 ? { imagePreviewUrls: previews } : {}, ...attachments.length > 0 ? { attachments } : {} };
+}
+function attachmentText(a) {
+  return a.deleted ? deletedFilePlaceholder(a) : `[${a.kind ?? "file"}: ${a.name}]`;
+}
+var LEGACY_UPLOAD_LINE = /^\[Uploaded file: .+ \(([^,()]+), [^()]+\)\. Use fs_read with path "(.+)" to inspect it\.\]$/;
+function splitLegacyUploads(text) {
+  if (!text.includes("[Uploaded file: ")) return { text, attachments: [] };
+  let attachments = [], kept = [];
+  for (let line of text.split(`
+`)) {
+    let match = LEGACY_UPLOAD_LINE.exec(line.trim());
+    if (!match) {
+      kept.push(line);
+      continue;
+    }
+    let kind = mediaKindOfMime(match[1]);
+    attachments.push({ path: match[2], name: fileRefName({ path: match[2] }), mime_type: match[1], ...kind ? { kind } : {} });
+  }
+  return { text: kept.join(`
+`).trim(), attachments };
+}
+function fileRefText(ref) {
+  return ref.deleted ? deletedFilePlaceholder(ref) : `[${fileRefKind(ref) ?? "file"}: ${ref.path}]`;
+}
+function applyFileRefChanges(blocks, changes) {
+  let out = null;
+  for (let i = 0; i < blocks.length; i++) {
+    let block = blocks[i];
+    if (!isFileRefBlock(block) || block.file_ref.deleted) continue;
+    let ref = block.file_ref;
+    for (let change of changes) {
+      if (ref.deleted) break;
+      change.op === "rename" && ref.path === change.from ? ref = { ...ref, path: change.to } : change.op === "delete" && ref.path === change.path && (ref = { ...ref, deleted: !0 });
+    }
+    ref !== block.file_ref && (out ??= blocks.slice(), out[i] = { ...block, file_ref: ref });
+  }
+  return out ?? blocks;
+}
+
+export {
+  isVisionMime,
+  isAudioInputMime,
+  isVideoInputMime,
+  mediaKindOfMime,
+  isFileRefBlock,
+  fileRefKind,
+  fileRefName,
+  deletedFilePlaceholder,
+  displayAttachment,
+  attachmentsOf,
+  splitLegacyUploads,
+  fileRefText,
+  applyFileRefChanges,
+  file_ref_exports
+};

package/dist/chunks/chunk-LTX74NU6.mjs

@@ -0,0 +1,29 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/main/utils/secret-file.ts
+import { execFileSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+import { userInfo } from "node:os";
+function restrictToCurrentUserWindows(path, run = (file, args) => {
+  execFileSync(file, args, { windowsHide: !0, stdio: ["ignore", "ignore", "pipe"] });
+}) {
+  let user = process.env.USERDOMAIN && process.env.USERNAME ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : userInfo().username;
+  run("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`]);
+}
+function protectSecretFile(path, opts = {}) {
+  try {
+    return (opts.platform ?? process.platform) === "win32" ? restrictToCurrentUserWindows(path, opts.run) : chmodSync(path, 384), !0;
+  } catch (err) {
+    return console.warn(`[SecretFile] Could not restrict ${path} to the current user: ${err instanceof Error ? err.message : String(err)}`), !1;
+  }
+}
+
+export {
+  restrictToCurrentUserWindows,
+  protectSecretFile
+};

package/dist/chunks/chunk-M2F7C2UJ.mjs

@@ -0,0 +1,425 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  writeSecretFileAtomic
+} from "./chunk-ZPB3HYM7.mjs";
+
+// src/main/services/remote-hello.ts
+import { createHash as createHash3, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+
+// src/main/daemon/remote-access/device-store.ts
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+
+// src/main/daemon/remote-access/config.ts
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join } from "node:path";
+var REMOTE_ACCESS_FILENAME = "remote-access.json", BASE32 = "abcdefghijklmnopqrstuvwxyz234567";
+function base32(bytes) {
+  let bits = 0, value = 0, out = "";
+  for (let byte of bytes)
+    for (value = value << 8 | byte, bits += 8; bits >= 5; )
+      out += BASE32[value >>> bits - 5 & 31], bits -= 5;
+  return bits > 0 && (out += BASE32[value << 5 - bits & 31]), out;
+}
+function fingerprintOf(daemonId) {
+  let fp = base32(createHash("sha256").update(daemonId, "utf-8").digest().subarray(0, 5)).toUpperCase();
+  return `${fp.slice(0, 4)}-${fp.slice(4, 8)}`;
+}
+var UNSAFE_DISPLAY_CHARS = /[\u0000-\u001f\u007f-\u009f\u00ad\u061c\u115f\u180e\u200b-\u200f\u2028-\u202e\u2060-\u2064\u2066-\u2069\u3164\ufeff\uffa0\u{e0000}-\u{e007f}]|\u034f/u, UNSAFE_CHARS = UNSAFE_DISPLAY_CHARS;
+function cleanDisplayName(raw, max) {
+  if (typeof raw != "string" || raw.length > max * 4 || UNSAFE_CHARS.test(raw)) return null;
+  let name = raw.replace(/\s+/g, " ").trim();
+  return !name || [...name].length > max ? null : name;
+}
+function defaultComputerName() {
+  return cleanDisplayName(hostname(), 63) ?? "ADF computer";
+}
+function defaultRemoteAccessConfig(name = defaultComputerName()) {
+  return { v: 1, enabled: !1, name, daemonId: null, allowedNetworks: [] };
+}
+function remoteAccessConfigPath(settingsDir) {
+  return join(settingsDir, REMOTE_ACCESS_FILENAME);
+}
+function isRecord(value) {
+  return !!value && typeof value == "object" && !Array.isArray(value);
+}
+function loadRemoteAccessConfig(settingsDir, defaultName) {
+  let path = remoteAccessConfigPath(settingsDir), defaults = defaultRemoteAccessConfig(defaultName);
+  if (!existsSync(path)) return { config: defaults, problem: null };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    return { config: defaults, problem: `${path} is not valid JSON (${err instanceof Error ? err.message : String(err)}); remote access is off until it is fixed or deleted` };
+  }
+  if (!isRecord(raw) || raw.v !== 1)
+    return { config: defaults, problem: `${path} has an unsupported version; remote access is off until it is fixed or deleted` };
+  let networks = parseAllowedNetworks(raw.allowedNetworks), addresses = Array.isArray(raw.addresses) ? raw.addresses.filter((a) => typeof a == "string") : void 0;
+  return {
+    config: {
+      v: 1,
+      enabled: raw.enabled === !0,
+      name: cleanDisplayName(raw.name, 63) ?? defaults.name,
+      daemonId: typeof raw.daemonId == "string" && /^[a-z2-7]{26}$/.test(raw.daemonId) ? raw.daemonId : null,
+      allowedNetworks: networks,
+      ...addresses && addresses.length ? { addresses } : {}
+    },
+    problem: null
+  };
+}
+function saveRemoteAccessConfig(settingsDir, config) {
+  writeSecretFileAtomic(remoteAccessConfigPath(settingsDir), `${JSON.stringify(config, null, 2)}
+`);
+}
+function parseAllowedNetworks(raw) {
+  return Array.isArray(raw) ? raw.filter((n) => isRecord(n) && typeof n.id == "string" && /^(lan|tailnet)-[0-9a-f]{16}$/.test(n.id) && (n.kind === "lan" || n.kind === "tailnet") && typeof n.label == "string" && typeof n.addedAt == "string") : [];
+}
+async function readAllowedNetworks(settingsDir) {
+  if (!settingsDir) return [];
+  try {
+    let raw = JSON.parse(await readFile(remoteAccessConfigPath(settingsDir), "utf-8"));
+    return isRecord(raw) && raw.v === 1 ? parseAllowedNetworks(raw.allowedNetworks) : [];
+  } catch {
+    return [];
+  }
+}
+function newDaemonId() {
+  return base32(randomBytes(16));
+}
+
+// src/main/daemon/remote-access/device-store.ts
+var DEVICES_FILENAME = "daemon-devices.json", DEVICE_TOKEN_PREFIX = "adfd_", TOKEN_RE = /^adfd_([a-z2-7]{10})_([A-Za-z0-9_-]{43})$/, TOMBSTONE_DAYS = 30, LAST_SEEN_FLUSH_MS = 5 * 6e4;
+function isDeviceTokenShape(token) {
+  return token.startsWith(DEVICE_TOKEN_PREFIX);
+}
+function parseDeviceToken(token) {
+  let match = TOKEN_RE.exec(token);
+  return match ? { id: match[1], secret: match[2] } : null;
+}
+function sha256Hex(text) {
+  return createHash2("sha256").update(text, "utf-8").digest("hex");
+}
+function isRecord2(value) {
+  return !!value && typeof value == "object" && !Array.isArray(value);
+}
+function validDevice(value) {
+  return isRecord2(value) && typeof value.id == "string" && /^[a-z2-7]{10}$/.test(value.id) && typeof value.label == "string" && (value.origin === "paired" || value.origin === "token") && typeof value.createdAt == "string" && (value.createdBy === "studio" || value.createdBy === "cli") && typeof value.secretSha256 == "string" && /^[0-9a-f]{64}$/.test(value.secretSha256);
+}
+var DeviceStore = class {
+  path;
+  devices = /* @__PURE__ */ new Map();
+  revoked = /* @__PURE__ */ new Map();
+  problemText = null;
+  lastFlushAt = /* @__PURE__ */ new Map();
+  dirty = !1;
+  now;
+  constructor(settingsDir, opts = {}) {
+    this.path = join2(settingsDir, DEVICES_FILENAME), this.now = opts.now ?? Date.now, this.load();
+  }
+  /** Why no device token is accepted (unreadable file); null when fine. */
+  get problem() {
+    return this.problemText;
+  }
+  load() {
+    if (existsSync2(this.path))
+      try {
+        let raw = JSON.parse(readFileSync2(this.path, "utf-8"));
+        if (!isRecord2(raw) || raw.v !== 1 || !Array.isArray(raw.devices)) throw new Error("unsupported version or shape");
+        for (let device of raw.devices) {
+          if (!validDevice(device)) throw new Error("a device record is malformed");
+          this.devices.set(device.id, {
+            ...device,
+            lastSeenAt: typeof device.lastSeenAt == "string" ? device.lastSeenAt : null,
+            lastSeenAddress: typeof device.lastSeenAddress == "string" ? device.lastSeenAddress : null
+          });
+        }
+        let cutoff = this.now() - TOMBSTONE_DAYS * 864e5;
+        for (let t of Array.isArray(raw.revoked) ? raw.revoked : [])
+          isRecord2(t) && typeof t.id == "string" && typeof t.label == "string" && typeof t.revokedAt == "string" && Date.parse(t.revokedAt) >= cutoff && this.revoked.set(t.id, { id: t.id, label: t.label, revokedAt: t.revokedAt });
+      } catch (err) {
+        this.devices.clear(), this.revoked.clear(), this.problemText = `${this.path} cannot be read (${err instanceof Error ? err.message : String(err)}); no device token is accepted until it is fixed or deleted`;
+      }
+  }
+  list() {
+    return [...this.devices.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  }
+  get(id) {
+    return this.devices.get(id);
+  }
+  /** Mint a device: the record is written before the token is returned. Throws when the store is unreadable. */
+  create(input) {
+    if (this.problemText) throw new Error(this.problemText);
+    let id = "";
+    do
+      id = base32(randomBytes2(7)).slice(0, 10);
+    while (this.devices.has(id) || this.revoked.has(id));
+    let secret = randomBytes2(32).toString("base64url"), device = {
+      id,
+      label: input.label,
+      origin: input.origin,
+      createdAt: new Date(this.now()).toISOString(),
+      createdBy: input.createdBy,
+      secretSha256: sha256Hex(secret),
+      lastSeenAt: null,
+      lastSeenAddress: null
+    };
+    this.devices.set(id, device);
+    try {
+      this.write();
+    } catch (err) {
+      throw this.devices.delete(id), err;
+    }
+    return { device, token: `${DEVICE_TOKEN_PREFIX}${id}_${secret}` };
+  }
+  /** Remove a device and keep its tombstone; the file is written first. Null for an unknown id. */
+  revoke(id) {
+    let device = this.devices.get(id);
+    if (!device) return null;
+    let tombstone = { id, label: device.label, revokedAt: new Date(this.now()).toISOString() };
+    this.devices.delete(id), this.revoked.set(id, tombstone);
+    try {
+      this.write();
+    } catch (err) {
+      throw this.devices.set(id, device), this.revoked.delete(id), err;
+    }
+    return this.lastFlushAt.delete(id), device;
+  }
+  /**
+   * The device behind an id, for the authenticated hello (remote-access.md
+   * §5.2.1): its record, a tombstone, or unknown (also while the store is
+   * unreadable). No secret is compared here.
+   */
+  lookup(id) {
+    if (this.problemText) return { kind: "unknown" };
+    let device = this.devices.get(id);
+    return device ? { kind: "device", device } : this.revoked.has(id) ? { kind: "revoked" } : { kind: "unknown" };
+  }
+  /** Constant-time check of a presented `adfd_` token. */
+  check(token) {
+    if (this.problemText) return { kind: "unknown" };
+    let parsed = parseDeviceToken(token);
+    if (!parsed) return { kind: "unknown" };
+    let device = this.devices.get(parsed.id);
+    if (device) {
+      let a = Buffer.from(sha256Hex(parsed.secret), "hex"), b = Buffer.from(device.secretSha256, "hex");
+      return a.length === b.length && timingSafeEqual(a, b) ? { kind: "device", device } : { kind: "unknown" };
+    }
+    let tombstone = this.revoked.get(parsed.id);
+    return tombstone ? { kind: "revoked", tombstone } : { kind: "unknown" };
+  }
+  /** A request from the device: exact in memory, written at most every LAST_SEEN_FLUSH_MS (flushDue). */
+  touch(id, address) {
+    let device = this.devices.get(id);
+    device && (device.lastSeenAt = new Date(this.now()).toISOString(), device.lastSeenAddress = address, this.dirty = !0);
+  }
+  /** Write lastSeen changes when a device's last write is older than LAST_SEEN_FLUSH_MS (or `force`, at shutdown). */
+  flushLastSeen(force = !1) {
+    if (!this.dirty || this.problemText) return;
+    let now = this.now();
+    if (force || [...this.devices.values()].some((d) => d.lastSeenAt && now - (this.lastFlushAt.get(d.id) ?? 0) >= LAST_SEEN_FLUSH_MS))
+      try {
+        this.write();
+        for (let id of this.devices.keys()) this.lastFlushAt.set(id, now);
+        this.dirty = !1;
+      } catch (err) {
+        console.error(`[remote-access] Could not write ${this.path}:`, err instanceof Error ? err.message : err);
+      }
+  }
+  write() {
+    let file = { v: 1, devices: this.list(), revoked: [...this.revoked.values()] };
+    writeSecretFileAtomic(this.path, `${JSON.stringify(file, null, 2)}
+`);
+  }
+};
+
+// src/main/services/peer-text.ts
+var PEER_BODY_MAX_BYTES = 4096, TXT_VALUE_MAX_BYTES = 255, TERMINAL_SEQUENCES = /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b\u009c]*(?:\u0007|\u001b\\|\u009c)?|\u001b[PX^_][^\u001b\u009c]*(?:\u001b\\|\u009c)?|\u001b[@-Z\\-_]|\u009b[0-?]*[ -/]*[@-~]|\u009d[^\u0007\u009c]*(?:\u0007|\u009c)?|[\u0090\u0098\u009e\u009f][^\u009c]*\u009c?/g;
+function printable(text) {
+  let unsafe = new RegExp(UNSAFE_DISPLAY_CHARS.source, "gu");
+  return text.replace(TERMINAL_SEQUENCES, "").split(`
+`).map((line) => line.replace(unsafe, "")).join(`
+`);
+}
+function peerName(raw, max = 63) {
+  if (typeof raw != "string" || raw.length > PEER_BODY_MAX_BYTES) return null;
+  let cut = [...printable(raw).replace(/\s+/g, " ").trim()].slice(0, max).join("").trim();
+  return cleanDisplayName(cut, max);
+}
+function txtWithinBounds(txt) {
+  let total = 0;
+  for (let [key, value] of Object.entries(txt)) {
+    let bytes = Buffer.byteLength(key) + 1 + (typeof value == "string" ? Buffer.byteLength(value) : value instanceof Uint8Array ? value.byteLength : String(value).length);
+    if (bytes > TXT_VALUE_MAX_BYTES || (total += bytes + 1, total > PEER_BODY_MAX_BYTES)) return !1;
+  }
+  return !0;
+}
+async function readCapped(res, max = PEER_BODY_MAX_BYTES) {
+  let declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > max) return null;
+  if (!res.body) return "";
+  let reader = res.body.getReader(), chunks = [], size = 0;
+  try {
+    for (; ; ) {
+      let { done, value } = await reader.read();
+      if (done) break;
+      if (size += value.byteLength, size > max)
+        return await reader.cancel().catch(() => {
+        }), null;
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock?.();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/main/services/remote-hello.ts
+var FINGERPRINT = /^[A-Z2-7]{4}-[A-Z2-7]{4}$/;
+function parseHello(body) {
+  if (!body || body.v !== 1 || typeof body.fingerprint != "string" || !FINGERPRINT.test(body.fingerprint)) return null;
+  let name = peerName(body.name);
+  return name ? {
+    v: 1,
+    name,
+    fingerprint: body.fingerprint,
+    pairingOpen: body.pairingOpen === !0,
+    clientApiVersion: typeof body.clientApiVersion == "number" && Number.isInteger(body.clientApiVersion) ? body.clientApiVersion : 0,
+    ...body.helloProof === 1 ? { helloProof: 1 } : {}
+  } : null;
+}
+async function fetchHello(url, fetchImpl = fetch, timeoutMs = 2500) {
+  try {
+    let res = await fetchImpl(`${url.replace(/\/+$/, "")}/remote/hello`, { signal: AbortSignal.timeout(timeoutMs), redirect: "manual" });
+    if (!res.ok) return null;
+    let text = await readCapped(res);
+    return text === null ? null : parseHello(JSON.parse(text));
+  } catch {
+    return null;
+  }
+}
+var HELLO_PROOF_DOMAIN = "adf-remote-hello-v1", NONCE = /^[A-Za-z0-9_-]{43}$/, DEVICE_ID = /^[a-z2-7]{10}$/, MAX_ORIGIN = 300;
+function newHelloNonce() {
+  return randomBytes3(32).toString("base64url");
+}
+function helloOrigin(raw) {
+  if (typeof raw != "string" || raw.length > MAX_ORIGIN) return null;
+  try {
+    let url = new URL(raw);
+    return url.protocol !== "http:" && url.protocol !== "https:" ? null : url.origin;
+  } catch {
+    return null;
+  }
+}
+function helloProofRequest(query) {
+  let { nonce, device, origin } = query;
+  return typeof nonce != "string" || !NONCE.test(nonce) || typeof device != "string" || !DEVICE_ID.test(device) || typeof origin != "string" || helloOrigin(origin) !== origin ? null : { nonce, device, origin };
+}
+function helloProofMessage(input) {
+  return [HELLO_PROOF_DOMAIN, input.nonce, input.fingerprint, input.origin, input.device].join(`
+`);
+}
+function helloProofMac(secretSha256, message) {
+  return createHmac("sha256", secretSha256).update(message, "utf-8").digest("base64url");
+}
+function deviceKey(token) {
+  let parsed = parseDeviceToken(token);
+  return parsed ? { id: parsed.id, key: createHash3("sha256").update(parsed.secret, "utf-8").digest() } : null;
+}
+async function verifyHello(url, token, opts = {}) {
+  let device = deviceKey(token);
+  if (!device) return { kind: "not_device_token" };
+  let origin = helloOrigin(url);
+  if (!origin) return { kind: "none" };
+  let nonce = opts.nonce ?? newHelloNonce(), query = new URLSearchParams({ nonce, device: device.id, origin }), body;
+  try {
+    let signals = [AbortSignal.timeout(opts.timeoutMs ?? 5e3), ...opts.signal ? [opts.signal] : []], res = await (opts.fetch ?? fetch)(`${url.replace(/\/+$/, "")}/remote/hello?${query}`, { signal: AbortSignal.any(signals), redirect: "manual" });
+    if (res.status === 429)
+      return res.body?.cancel().catch(() => {
+      }), { kind: "rate_limited", retryAfterMs: retryAfterMs(res.headers.get("retry-after")) };
+    if (!res.ok) return { kind: "none" };
+    let text = await readCapped(res);
+    if (text === null) return { kind: "none" };
+    body = JSON.parse(text);
+  } catch {
+    return { kind: "none" };
+  }
+  let hello = parseHello(body);
+  if (!hello || !body) return { kind: "none" };
+  if (body.helloProof !== 1 || !("proof" in body)) return { kind: "unsigned", hello };
+  if (body.device === "revoked") return { kind: "revoked", hello };
+  if (body.device !== "known") return { kind: "unknown_device", hello };
+  if (typeof body.proof != "string") return { kind: "forged", hello };
+  let expected = Buffer.from(helloProofMac(device.key, helloProofMessage({ nonce, fingerprint: hello.fingerprint, origin, device: device.id }))), given = Buffer.from(body.proof);
+  return given.length === expected.length && timingSafeEqual2(given, expected) ? { kind: "verified", hello } : { kind: "forged", hello };
+}
+function retryAfterMs(header) {
+  let seconds = Number(header);
+  return Number.isFinite(seconds) && seconds > 0 ? Math.min(60, Math.max(1, Math.ceil(seconds))) * 1e3 : 1e4;
+}
+function rateLimitedSentence(name) {
+  return `${name} is rate-limiting connections; retrying.`;
+}
+function olderAdfSentence(name) {
+  return `${name} runs an older ADF; update it.`;
+}
+function helloRefusal(check, name, url) {
+  switch (check.kind) {
+    case "unsigned":
+      return olderAdfSentence(name);
+    case "forged":
+      return `${url} could not prove it is ${name}; the token was not sent.`;
+    case "unknown_device":
+      return `${name} does not know this computer's token, which was not sent; pair it again.`;
+    case "revoked":
+      return `${name} removed this computer's access; pair it again.`;
+    case "not_device_token":
+      return `${name} can prove who it is only for a device token; pair it again.`;
+    case "rate_limited":
+      return rateLimitedSentence(name);
+    default:
+      return null;
+  }
+}
+async function verifyHelloWaiting(url, token, opts = {}) {
+  let { retries = 3, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), onWait, ...verify } = opts, check = await verifyHello(url, token, verify);
+  for (let attempt = 0; check.kind === "rate_limited" && attempt < retries; attempt++)
+    onWait?.(check.retryAfterMs), await sleep(check.retryAfterMs), check = await verifyHello(url, token, verify);
+  return check;
+}
+
+export {
+  fingerprintOf,
+  UNSAFE_DISPLAY_CHARS,
+  cleanDisplayName,
+  defaultComputerName,
+  loadRemoteAccessConfig,
+  saveRemoteAccessConfig,
+  readAllowedNetworks,
+  newDaemonId,
+  isDeviceTokenShape,
+  DeviceStore,
+  printable,
+  peerName,
+  txtWithinBounds,
+  fetchHello,
+  HELLO_PROOF_DOMAIN,
+  newHelloNonce,
+  helloOrigin,
+  helloProofRequest,
+  helloProofMessage,
+  helloProofMac,
+  verifyHello,
+  rateLimitedSentence,
+  olderAdfSentence,
+  helloRefusal,
+  verifyHelloWaiting
+};

package/dist/chunks/{chunk-62NE4LG4.mjs → chunk-MQAMI5BF.mjs}

@@ -6,16 +6,16 @@ const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
 import {
   ID3v2Parser
-} from "./chunk-XYTWGHFS.mjs";
+} from "./chunk-H3XLRWVE.mjs";
 import {
   ID3v1Parser
-} from "./chunk-VAUOM3IN.mjs";
-import {
-  ID3v2Header
-} from "./chunk-DXWDD5XJ.mjs";
+} from "./chunk-DLWCKKIO.mjs";
 import {
   EndOfStreamError
 } from "./chunk-HBUENVQL.mjs";
+import {
+  ID3v2Header
+} from "./chunk-DXWDD5XJ.mjs";
 import {
   BasicParser
 } from "./chunk-I2HJYHFT.mjs";