@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/services/remoteAccess/index.mjs

@@ -0,0 +1,396 @@
+import { COOKIE_CEILING_SECONDS, PAIRING_PAGE_ROUTE, REMOTE_PAIRING_REQUEST_TYPE, REMOTE_STATE_TYPE } from "../../constants/remote.mjs";
+import { cookieMaxAgeSeconds } from "../deviceSessions/index.mjs";
+import { createDeviceAuth } from "../deviceAuth/index.mjs";
+import { createPairingFlow } from "../pairingFlow/index.mjs";
+import { parseRemoteAccessSettings, serializeRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
+import { tunnelOriginPolicy } from "../remoteGuardPolicy/index.mjs";
+import { createWebAuthn } from "../webauthn/index.mjs";
+import { createHash, randomBytes, randomInt } from "node:crypto";
+import { createHostHandshake } from "@agimon-ai/doompi-web-security/node";
+import { SEALED_KEY_PARAM } from "@agimon-ai/doompi-web-security";
+//#region src/services/remoteAccess/index.ts
+const TOKEN_BYTES = 32;
+const SWEEP_INTERVAL_MS = 3e5;
+const MS_PER_MINUTE = 6e4;
+function bundlePairingTrust(value) {
+	if (value === void 0) return void 0;
+	return {
+		...value,
+		fingerprint: createHash("sha256").update(Buffer.from(value.publicKey, "base64url")).digest("hex")
+	};
+}
+function createRemoteAccess(options) {
+	const notice = options.onNotice ?? (() => {});
+	const now = options.now ?? (() => Date.now());
+	const broadcastLocal = options.broadcastLocal ?? (() => {});
+	const broadcastAll = options.broadcastAll ?? (() => {});
+	let settings = options.store.settings();
+	let status = "off";
+	let listener;
+	let stopTunnel;
+	let tunnelStartup;
+	let publicOrigin;
+	let publicOriginRevision = 0;
+	let policy;
+	let startedAt;
+	let closesAt;
+	let failure;
+	/** Settings an `enable` asked to hand over with, waiting for its response to flush. */
+	let pendingHandover;
+	let autoCloseTimer;
+	/** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */
+	let handshake;
+	const channels = /* @__PURE__ */ new Map();
+	const sockets = /* @__PURE__ */ new Map();
+	const channelKey = (deviceId, scope) => `${deviceId}:${scope}`;
+	const dropDeviceAccess = (deviceId, reason) => {
+		options.onDeviceDropped?.(deviceId);
+		for (const scope of [
+			"session",
+			"protocol",
+			"http"
+		]) channels.delete(channelKey(deviceId, scope));
+		const held = sockets.get(deviceId);
+		sockets.delete(deviceId);
+		for (const close of held ?? []) try {
+			close(1008, `device ${reason}`);
+		} catch {}
+	};
+	const devices = createDeviceAuth({
+		settings: () => settings,
+		now,
+		onNotice: notice,
+		onDrop: (record, reason) => dropDeviceAccess(record.id, reason)
+	});
+	const webauthn = createWebAuthn({
+		publicOrigin: () => publicOrigin,
+		credentials: () => options.store.credentials(),
+		saveCredential: (credential) => options.store.saveCredential(credential),
+		removeCredential: (id) => options.store.removeCredential(id),
+		now,
+		onNotice: notice
+	});
+	const pairing = createPairingFlow({
+		randomToken: () => randomBytes(TOKEN_BYTES).toString("base64url"),
+		randomManualCode: () => randomInt(1e8).toString().padStart(8, "0"),
+		digest: (token) => createHash("sha256").update(token).digest("hex"),
+		now,
+		onNotice: notice
+	});
+	const sweeper = setInterval(() => {
+		devices.sweep();
+		pairing.sweep();
+	}, SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	function publish() {
+		broadcastAll({
+			type: REMOTE_STATE_TYPE,
+			state: view(void 0, false)
+		});
+	}
+	function view(selfDeviceId, forLocalCaller) {
+		return {
+			status,
+			...publicOrigin === void 0 ? {} : { publicUrl: publicOrigin },
+			...startedAt === void 0 ? {} : { startedAt: new Date(startedAt).toISOString() },
+			...closesAt === void 0 ? {} : { closesAt: new Date(closesAt).toISOString() },
+			...failure === void 0 ? {} : { error: failure },
+			devices: devices.list().map((record) => ({
+				id: record.id,
+				label: record.label,
+				userAgent: record.userAgent,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: record.id === selfDeviceId
+			})),
+			pending: forLocalCaller ? pairing.pending().map((request) => ({
+				id: request.id,
+				userAgent: request.userAgent,
+				edgeIp: request.edgeIp,
+				createdAt: new Date(request.createdAt).toISOString(),
+				expiresAt: new Date(request.createdAt + 18e4).toISOString()
+			})) : [],
+			settings
+		};
+	}
+	function armAutoClose() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		if (!settings.autoCloseEnabled || status !== "on") return;
+		closesAt = now() + settings.autoCloseMinutes * MS_PER_MINUTE;
+		autoCloseTimer = setTimeout(() => {
+			notice("remote access reached its time limit; closing");
+			disable();
+		}, settings.autoCloseMinutes * MS_PER_MINUTE);
+		autoCloseTimer.unref();
+	}
+	/** Everything teardown has to do, in the order it has to happen. */
+	async function teardown() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		for (const held of sockets.values()) for (const close of held) try {
+			close(1008, "remote access revoked");
+		} catch {}
+		sockets.clear();
+		const starting = tunnelStartup;
+		tunnelStartup = void 0;
+		starting?.controller.abort();
+		const startingOutcome = await starting?.outcome.catch(() => void 0);
+		if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => void 0);
+		await stopTunnel?.().catch(() => void 0);
+		stopTunnel = void 0;
+		await listener?.close().catch(() => void 0);
+		listener = void 0;
+		if (publicOrigin !== void 0) publicOriginRevision += 1;
+		publicOrigin = void 0;
+		policy = void 0;
+		startedAt = void 0;
+		pairing.clear();
+		webauthn.clearChallenges();
+		handshake = void 0;
+		channels.clear();
+		devices.revokeAll();
+	}
+	async function disable() {
+		if (status === "off") return;
+		await teardown();
+		status = "off";
+		failure = void 0;
+		notice("remote access off");
+		publish();
+	}
+	return {
+		state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),
+		settings: () => settings,
+		publicOrigin: () => publicOrigin,
+		publicOriginRevision: () => publicOriginRevision,
+		updateSettings(patch) {
+			const parsed = parseRemoteAccessSettings(serializeRemoteAccessSettings({
+				...settings,
+				...patch
+			}));
+			for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);
+			settings = parsed.settings;
+			options.store.save(settings);
+			devices.reschedule();
+			armAutoClose();
+			publish();
+			return settings;
+		},
+		/**
+		* Runs a handover `enable` deferred, once its response is on the wire.
+		*
+		* Split out rather than done inside `enable` because the reply and the
+		* teardown travel over the same socket, and doing them in the wrong order
+		* leaves the caller unable to tell success from a dropped connection.
+		*/
+		commitHandover() {
+			const handing = pendingHandover;
+			if (handing === void 0) return;
+			pendingHandover = void 0;
+			notice("handing the cockpit over to a container");
+			options.requestHandover?.(handing);
+		},
+		/** True between a contained `enable` and the handover its response defers. */
+		handoverPending: () => pendingHandover !== void 0,
+		tunnelPort: () => listener?.port,
+		tunnelPolicy: () => policy,
+		async enable() {
+			if (status === "on" || status === "starting") return { ok: true };
+			status = "starting";
+			failure = void 0;
+			publish();
+			if (settings.sandbox.enabled && options.contained !== true) {
+				if (settings.sandbox.workspaces.length === 0) {
+					status = "failed";
+					failure = "Add at least one workspace before running the cockpit in a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				if (options.requestHandover === void 0) {
+					status = "failed";
+					failure = "This cockpit cannot hand over to a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				pendingHandover = settings;
+				return { ok: true };
+			}
+			let bound;
+			try {
+				bound = await options.bindListener();
+			} catch (error) {
+				status = "failed";
+				failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;
+				publish();
+				return {
+					ok: false,
+					error: failure
+				};
+			}
+			listener = bound;
+			const controller = new AbortController();
+			const launching = options.launchTunnel({
+				port: bound.port,
+				config: settings.tunnel,
+				signal: controller.signal,
+				acceptOrigin: (origin) => {
+					policy = tunnelOriginPolicy(origin);
+				}
+			});
+			const startup = {
+				controller,
+				outcome: launching
+			};
+			tunnelStartup = startup;
+			const outcome = await launching;
+			if (tunnelStartup !== startup || controller.signal.aborted) return {
+				ok: false,
+				error: "Tunnel startup was cancelled."
+			};
+			tunnelStartup = void 0;
+			if (!outcome.ok) {
+				await teardown();
+				status = "failed";
+				failure = outcome.message;
+				notice(`remote access failed: ${outcome.message}`);
+				publish();
+				return {
+					ok: false,
+					error: outcome.message
+				};
+			}
+			stopTunnel = outcome.stop;
+			handshake = createHostHandshake();
+			publicOrigin = outcome.publicOrigin;
+			policy = tunnelOriginPolicy(outcome.publicOrigin);
+			startedAt = now();
+			status = "on";
+			armAutoClose();
+			notice(`remote access on at ${outcome.publicOrigin}`);
+			publish();
+			return { ok: true };
+		},
+		disable,
+		mintPairing() {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const trust = bundlePairingTrust(options.bundleTrust?.());
+			if (trust === void 0) return void 0;
+			const { code, manualCode, expiresAt } = pairing.mintCode();
+			const fragment = new URLSearchParams({
+				c: code,
+				[SEALED_KEY_PARAM]: handshake.publicKey,
+				["s"]: trust.publicKey,
+				["r"]: String(trust.revision)
+			});
+			return {
+				code,
+				manualCode,
+				pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,
+				expiresAt: new Date(expiresAt).toISOString(),
+				...trust
+			};
+		},
+		bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),
+		claim(input) {
+			const outcome = pairing.claim(input);
+			if (outcome.ok) broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		pairingStatus: (requestId) => pairing.status(requestId),
+		approve(requestId) {
+			const outcome = pairing.approve(requestId);
+			if (outcome === "approved") broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		deny(requestId) {
+			const outcome = pairing.deny(requestId);
+			if (outcome === "denied") broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		redeem(requestId) {
+			const approved = pairing.consume(requestId);
+			if (approved === void 0) return void 0;
+			const enrolled = devices.enrol({ userAgent: approved.userAgent });
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS)
+			};
+		},
+		authorize: (token) => devices.verify(token)?.id,
+		sessionForPasskey(label) {
+			const enrolled = devices.enrol({ userAgent: label });
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS)
+			};
+		},
+		passkeys: () => ({
+			support: () => webauthn.support(),
+			list: () => options.store.credentials(),
+			beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),
+			finishRegistration: async (ceremonyId, caller, response, label) => await webauthn.finishRegistration(ceremonyId, caller, response, label),
+			beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),
+			finishAuthentication: async (ceremonyId, caller, response) => await webauthn.finishAuthentication(ceremonyId, caller, response),
+			beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),
+			finishStepUp: async (ceremonyId, caller, action, response) => await webauthn.finishStepUp(ceremonyId, caller, action, response),
+			forget: (id) => {
+				const forgotten = options.store.removeCredential(id);
+				if (forgotten) publish();
+				return forgotten;
+			}
+		}),
+		stepUpRequired: () => webauthn.support().supported,
+		channelPublicKey: () => handshake?.publicKey,
+		openChannel(deviceId, scope, clientPublicKey) {
+			const channel = handshake?.accept(clientPublicKey);
+			if (channel === void 0) return false;
+			channels.set(channelKey(deviceId, scope), channel);
+			return true;
+		},
+		channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),
+		revokeDevice(id) {
+			const revoked = devices.revoke(id);
+			if (revoked) publish();
+			return revoked;
+		},
+		isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,
+		trackSocket(deviceId, close) {
+			const held = sockets.get(deviceId) ?? /* @__PURE__ */ new Set();
+			held.add(close);
+			sockets.set(deviceId, held);
+			return () => {
+				held.delete(close);
+				if (held.size === 0) sockets.delete(deviceId);
+			};
+		},
+		async close() {
+			clearInterval(sweeper);
+			await teardown();
+			status = "off";
+		}
+	};
+}
+//#endregion
+export { createRemoteAccess };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/remoteAccess/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/remoteAccess/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomInt } from 'node:crypto';\n\nimport { SEALED_KEY_PARAM } from '@agimon-ai/doompi-web-security';\nimport { createHostHandshake, type HostHandshake, type SealedChannel } from '@agimon-ai/doompi-web-security/node';\n\nimport {\n  BUNDLE_MINIMUM_REVISION_PARAM,\n  BUNDLE_SIGNING_KEY_PARAM,\n  PAIRING_PAGE_ROUTE,\n  REMOTE_PAIRING_REQUEST_TYPE,\n  REMOTE_STATE_TYPE,\n} from '../../constants/remote';\nimport { COOKIE_CEILING_SECONDS } from '../../constants/remote';\nimport {\n  type BundlePairingTrust,\n  type PairingStatus,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n  type RemoteAccessStatus,\n  type RemoteChannelScope,\n  type TunnelLauncher,\n  type TunnelStartResult,\n} from '../../types/remote';\nimport { createDeviceAuth, type DeviceAuth, type EnrolledDevice } from '../deviceAuth';\nimport { cookieMaxAgeSeconds } from '../deviceSessions';\nimport { createPairingFlow, type PairingFlow } from '../pairingFlow';\nimport { parseRemoteAccessSettings, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { RemoteAccessStore } from '../remoteAccessStore';\nimport { type OriginPolicy, tunnelOriginPolicy } from '../remoteGuardPolicy';\nimport { createWebAuthn, type PasskeySupport, type WebAuthn } from '../webauthn';\nimport type { StepUpAction, StoredCredential } from '../webauthnPolicy';\n\nconst TOKEN_BYTES = 32;\nconst SWEEP_INTERVAL_MS = 5 * 60_000;\nconst MS_PER_MINUTE = 60_000;\n\n/** The tunnel listener, bound by the host so this file never imports an HTTP server. */\nexport interface TunnelListener {\n  port: number;\n  close: () => Promise<void>;\n}\n\nexport interface RemoteAccessOptions {\n  store: RemoteAccessStore;\n  launchTunnel: TunnelLauncher;\n  /** Binds a fresh loopback listener for the tunnel to point at. */\n  bindListener: () => Promise<TunnelListener>;\n  /** Current signed publication authenticated through the physical pairing display. */\n  bundleTrust?: () => { publicKey: string; revision: number } | undefined;\n  /** Removes ephemeral state owned by a paired device when its authorization ends. */\n  onDeviceDropped?: (deviceId: string) => void;\n  onNotice?: (message: string) => void;\n  /** Frames only the local cockpit may see, such as an approval prompt. */\n  broadcastLocal?: (frame: object) => void;\n  /** Frames both local and remote pages see. */\n  broadcastAll?: (frame: object) => void;\n  /**\n   * Asks the launcher to hand this cockpit over to a container.\n   *\n   * A signal rather than a call that does the work, because handing over means\n   * closing the server this code is running inside, which it cannot do to\n   * itself. The launcher owns that sequence and the rollback if it fails.\n   */\n  requestHandover?: (settings: RemoteAccessSettings) => void;\n  /**\n   * Whether this cockpit is already the one inside the container.\n   *\n   * Without it the contained hub would read the same settings it was handed and\n   * try to hand over again, to a container inside a container.\n   */\n  contained?: boolean;\n  now?: () => number;\n}\n\nexport interface RemoteAccess {\n  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;\n  settings(): RemoteAccessSettings;\n  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;\n  tunnelPort(): number | undefined;\n  /** The public origin the tunnel currently answers on, while one is up. */\n  publicOrigin(): string | undefined;\n  /** Changes whenever an established public exposure is torn down. */\n  publicOriginRevision(): number;\n  tunnelPolicy(): OriginPolicy | undefined;\n  enable(): Promise<{ ok: true } | { ok: false; error: string }>;\n  /** True between a contained `enable` and the handover its response defers. */\n  handoverPending(): boolean;\n  /** Runs that deferred handover, once the response asking for it is on the wire. */\n  commitHandover(): void;\n  disable(): Promise<void>;\n  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */\n  mintPairing():\n    | ({ code: string; manualCode: string; pairUrl: string; expiresAt: string } & BundlePairingTrust)\n    | undefined;\n  bundleTrust(): BundlePairingTrust | undefined;\n  claim(input: {\n    code: string;\n    userAgent: string | undefined;\n    edgeIp: string | undefined;\n    sourceAddress: string | undefined;\n  }): ReturnType<PairingFlow['claim']>;\n  pairingStatus(requestId: string): PairingStatus | undefined;\n  approve(requestId: string): ReturnType<PairingFlow['approve']>;\n  deny(requestId: string): ReturnType<PairingFlow['deny']>;\n  /** Turns an approved request into a session, exactly once. */\n  redeem(requestId: string): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  authorize(token: string | undefined): string | undefined;\n  /** Mints a session for a device that proved a registered passkey. */\n  sessionForPasskey(label: string): EnrolledDevice & { maxAgeSeconds: number };\n  passkeys(): {\n    support: () => PasskeySupport;\n    list: () => readonly StoredCredential[];\n    beginRegistration: WebAuthn['beginRegistration'];\n    finishRegistration: WebAuthn['finishRegistration'];\n    beginAuthentication: WebAuthn['beginAuthentication'];\n    finishAuthentication: WebAuthn['finishAuthentication'];\n    beginStepUp: WebAuthn['beginStepUp'];\n    finishStepUp: WebAuthn['finishStepUp'];\n    forget: (id: string) => boolean;\n  };\n  /** Whether this action needs a fresh gesture that has not been supplied. */\n  stepUpRequired(action: StepUpAction): boolean;\n  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */\n  channelPublicKey(): string | undefined;\n  /** Completes one purpose-bound sealed channel against a fresh device key. */\n  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;\n  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;\n  revokeDevice(id: string): boolean;\n  isDeviceConnected(deviceId: string): boolean;\n  /** Registers a remote socket against its device so revocation closes it immediately. */\n  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;\n  close(): Promise<void>;\n}\n\nfunction bundlePairingTrust(\n  value: { publicKey: string; revision: number } | undefined,\n): BundlePairingTrust | undefined {\n  if (value === undefined) return undefined;\n  return {\n    ...value,\n    fingerprint: createHash('sha256').update(Buffer.from(value.publicKey, 'base64url')).digest('hex'),\n  };\n}\n\nexport function createRemoteAccess(options: RemoteAccessOptions): RemoteAccess {\n  const notice = options.onNotice ?? ((): void => {});\n  const now = options.now ?? ((): number => Date.now());\n  const broadcastLocal = options.broadcastLocal ?? ((): void => {});\n  const broadcastAll = options.broadcastAll ?? ((): void => {});\n\n  let settings = options.store.settings();\n  let status: RemoteAccessStatus = 'off';\n  let listener: TunnelListener | undefined;\n  let stopTunnel: (() => Promise<void>) | undefined;\n  let tunnelStartup: { controller: AbortController; outcome: Promise<TunnelStartResult> } | undefined;\n  let publicOrigin: string | undefined;\n  let publicOriginRevision = 0;\n  let policy: OriginPolicy | undefined;\n  let startedAt: number | undefined;\n  let closesAt: number | undefined;\n  let failure: string | undefined;\n  /** Settings an `enable` asked to hand over with, waiting for its response to flush. */\n  let pendingHandover: RemoteAccessSettings | undefined;\n  let autoCloseTimer: ReturnType<typeof setTimeout> | undefined;\n  /** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */\n  let handshake: HostHandshake | undefined;\n  const channels = new Map<string, SealedChannel>();\n  const sockets = new Map<string, Set<(code: number, reason: string) => void>>();\n\n  const channelKey = (deviceId: string, scope: RemoteChannelScope): string => `${deviceId}:${scope}`;\n  const dropDeviceAccess = (deviceId: string, reason: 'revoked' | 'expired'): void => {\n    options.onDeviceDropped?.(deviceId);\n    for (const scope of ['session', 'protocol', 'http'] as const) channels.delete(channelKey(deviceId, scope));\n    const held = sockets.get(deviceId);\n    sockets.delete(deviceId);\n    for (const close of held ?? []) {\n      try {\n        close(1008, `device ${reason}`);\n      } catch {\n        // The socket is already gone.\n      }\n    }\n  };\n\n  const devices: DeviceAuth = createDeviceAuth({\n    settings: () => settings,\n    now,\n    onNotice: notice,\n    onDrop: (record, reason) => dropDeviceAccess(record.id, reason),\n  });\n\n  const webauthn: WebAuthn = createWebAuthn({\n    publicOrigin: () => publicOrigin,\n    credentials: () => options.store.credentials(),\n    saveCredential: (credential) => options.store.saveCredential(credential),\n    removeCredential: (id) => options.store.removeCredential(id),\n    now,\n    onNotice: notice,\n  });\n\n  const pairing: PairingFlow = createPairingFlow({\n    randomToken: () => randomBytes(TOKEN_BYTES).toString('base64url'),\n    randomManualCode: () => randomInt(100_000_000).toString().padStart(8, '0'),\n    digest: (token) => createHash('sha256').update(token).digest('hex'),\n    now,\n    onNotice: notice,\n  });\n\n  const sweeper = setInterval(() => {\n    devices.sweep();\n    pairing.sweep();\n  }, SWEEP_INTERVAL_MS);\n  sweeper.unref();\n\n  function publish(): void {\n    broadcastAll({ type: REMOTE_STATE_TYPE, state: view(undefined, false) });\n  }\n\n  function view(selfDeviceId: string | undefined, forLocalCaller: boolean): RemoteAccessStateView {\n    return {\n      status,\n      ...(publicOrigin === undefined ? {} : { publicUrl: publicOrigin }),\n      ...(startedAt === undefined ? {} : { startedAt: new Date(startedAt).toISOString() }),\n      ...(closesAt === undefined ? {} : { closesAt: new Date(closesAt).toISOString() }),\n      ...(failure === undefined ? {} : { error: failure }),\n      devices: devices.list().map((record) => ({\n        id: record.id,\n        label: record.label,\n        userAgent: record.userAgent,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: record.id === selfDeviceId,\n      })),\n      // A paired phone must never see the approval queue: a device that can\n      // approve devices makes its own access permanent, which is exactly what\n      // host confirmation exists to prevent.\n      pending: forLocalCaller\n        ? pairing.pending().map((request) => ({\n            id: request.id,\n            userAgent: request.userAgent,\n            edgeIp: request.edgeIp,\n            createdAt: new Date(request.createdAt).toISOString(),\n            expiresAt: new Date(request.createdAt + 180_000).toISOString(),\n          }))\n        : [],\n      settings,\n    };\n  }\n\n  function armAutoClose(): void {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    if (!settings.autoCloseEnabled || status !== 'on') return;\n    const at = now() + settings.autoCloseMinutes * MS_PER_MINUTE;\n    closesAt = at;\n    autoCloseTimer = setTimeout(() => {\n      notice('remote access reached its time limit; closing');\n      void disable();\n    }, settings.autoCloseMinutes * MS_PER_MINUTE);\n    autoCloseTimer.unref();\n  }\n\n  /** Everything teardown has to do, in the order it has to happen. */\n  async function teardown(): Promise<void> {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    // Sockets first. An upgraded socket has left the HTTP server's connection\n    // tracking, so closing the listener does not touch it: without this a\n    // paired phone keeps driving the agent after remote access is switched off.\n    for (const held of sockets.values()) {\n      for (const close of held) {\n        try {\n          close(1008, 'remote access revoked');\n        } catch {\n          // The socket is already gone, which is the outcome we wanted.\n        }\n      }\n    }\n    sockets.clear();\n    const starting = tunnelStartup;\n    tunnelStartup = undefined;\n    starting?.controller.abort();\n    const startingOutcome = await starting?.outcome.catch(() => undefined);\n    if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => undefined);\n    await stopTunnel?.().catch(() => undefined);\n    stopTunnel = undefined;\n    await listener?.close().catch(() => undefined);\n    listener = undefined;\n    if (publicOrigin !== undefined) publicOriginRevision += 1;\n    publicOrigin = undefined;\n    policy = undefined;\n    startedAt = undefined;\n    pairing.clear();\n    webauthn.clearChallenges();\n    handshake = undefined;\n    channels.clear();\n    // Sessions go; passkeys and any other durable credential do not, so\n    // switching back on does not mean enrolling every device again.\n    devices.revokeAll();\n  }\n\n  async function disable(): Promise<void> {\n    if (status === 'off') return;\n    await teardown();\n    status = 'off';\n    failure = undefined;\n    notice('remote access off');\n    publish();\n  }\n\n  return {\n    state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),\n    settings: () => settings,\n    publicOrigin: () => publicOrigin,\n    publicOriginRevision: () => publicOriginRevision,\n\n    updateSettings(patch) {\n      // Through the parser rather than spread straight in, so a value out of\n      // range is clamped now instead of silently differing until the next load.\n      const parsed = parseRemoteAccessSettings(\n        serializeRemoteAccessSettings({ ...settings, ...patch }) as Record<string, unknown>,\n      );\n      for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);\n      settings = parsed.settings;\n      options.store.save(settings);\n      // Re-arm rather than leave the old deadline: shortening the window has to\n      // take effect now, and lengthening it should not close early.\n      devices.reschedule();\n      armAutoClose();\n      publish();\n      return settings;\n    },\n\n    /**\n     * Runs a handover `enable` deferred, once its response is on the wire.\n     *\n     * Split out rather than done inside `enable` because the reply and the\n     * teardown travel over the same socket, and doing them in the wrong order\n     * leaves the caller unable to tell success from a dropped connection.\n     */\n    commitHandover() {\n      const handing = pendingHandover;\n      if (handing === undefined) return;\n      pendingHandover = undefined;\n      notice('handing the cockpit over to a container');\n      options.requestHandover?.(handing);\n    },\n\n    /** True between a contained `enable` and the handover its response defers. */\n    handoverPending: () => pendingHandover !== undefined,\n\n    tunnelPort: () => listener?.port,\n    tunnelPolicy: () => policy,\n\n    async enable() {\n      if (status === 'on' || status === 'starting') return { ok: true };\n      status = 'starting';\n      failure = undefined;\n      publish();\n\n      // Containment has to be in place before the tunnel is, so a contained\n      // cockpit hands over instead of starting a tunnel here. The container's\n      // own hub turns remote access on once it is serving.\n      if (settings.sandbox.enabled && options.contained !== true) {\n        if (settings.sandbox.workspaces.length === 0) {\n          status = 'failed';\n          failure = 'Add at least one workspace before running the cockpit in a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        if (options.requestHandover === undefined) {\n          status = 'failed';\n          failure = 'This cockpit cannot hand over to a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        // Held rather than run: the handover closes the server carrying this\n        // very response, so the caller has to hear the answer first.\n        pendingHandover = settings;\n        return { ok: true };\n      }\n      let bound: TunnelListener;\n      try {\n        bound = await options.bindListener();\n      } catch (error) {\n        status = 'failed';\n        failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;\n        publish();\n        return { ok: false, error: failure };\n      }\n      listener = bound;\n      const controller = new AbortController();\n      const launching = options.launchTunnel({\n        port: bound.port,\n        config: settings.tunnel,\n        signal: controller.signal,\n        acceptOrigin: (origin) => {\n          policy = tunnelOriginPolicy(origin);\n        },\n      });\n      const startup = { controller, outcome: launching };\n      tunnelStartup = startup;\n      const outcome = await launching;\n      if (tunnelStartup !== startup || controller.signal.aborted) {\n        return { ok: false, error: 'Tunnel startup was cancelled.' };\n      }\n      tunnelStartup = undefined;\n      if (!outcome.ok) {\n        await teardown();\n        status = 'failed';\n        failure = outcome.message;\n        notice(`remote access failed: ${outcome.message}`);\n        publish();\n        return { ok: false, error: outcome.message };\n      }\n      stopTunnel = outcome.stop;\n      // A fresh key pair per tunnel: the QR is the only place its public half\n      // travels, so it must not outlive the code that carried it.\n      handshake = createHostHandshake();\n      publicOrigin = outcome.publicOrigin;\n      policy = tunnelOriginPolicy(outcome.publicOrigin);\n      startedAt = now();\n      status = 'on';\n      armAutoClose();\n      notice(`remote access on at ${outcome.publicOrigin}`);\n      publish();\n      return { ok: true };\n    },\n\n    disable,\n\n    mintPairing() {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const trust = bundlePairingTrust(options.bundleTrust?.());\n      if (trust === undefined) return undefined;\n      const { code, manualCode, expiresAt } = pairing.mintCode();\n      // The token, channel key, signer key, and publication floor ride in the fragment,\n      // so the relay never observes the values used to authenticate either channel.\n      const fragment = new URLSearchParams({\n        c: code,\n        [SEALED_KEY_PARAM]: handshake.publicKey,\n        [BUNDLE_SIGNING_KEY_PARAM]: trust.publicKey,\n        [BUNDLE_MINIMUM_REVISION_PARAM]: String(trust.revision),\n      });\n      return {\n        code,\n        manualCode,\n        pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,\n        expiresAt: new Date(expiresAt).toISOString(),\n        ...trust,\n      };\n    },\n\n    bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),\n\n    claim(input) {\n      const outcome = pairing.claim(input);\n      if (outcome.ok) {\n        broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      }\n      return outcome;\n    },\n\n    pairingStatus: (requestId) => pairing.status(requestId),\n\n    approve(requestId) {\n      const outcome = pairing.approve(requestId);\n      if (outcome === 'approved') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    deny(requestId) {\n      const outcome = pairing.deny(requestId);\n      if (outcome === 'denied') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    redeem(requestId) {\n      const approved = pairing.consume(requestId);\n      if (approved === undefined) return undefined;\n      const enrolled = devices.enrol({ userAgent: approved.userAgent });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    authorize: (token) => devices.verify(token)?.id,\n\n    sessionForPasskey(label) {\n      const enrolled = devices.enrol({ userAgent: label });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    passkeys: () => ({\n      support: () => webauthn.support(),\n      list: () => options.store.credentials(),\n      // Wrapped rather than passed by reference: an unbound method carries\n      // whatever `this` the caller happens to have.\n      beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),\n      finishRegistration: async (ceremonyId, caller, response, label) =>\n        await webauthn.finishRegistration(ceremonyId, caller, response, label),\n      beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),\n      finishAuthentication: async (ceremonyId, caller, response) =>\n        await webauthn.finishAuthentication(ceremonyId, caller, response),\n      beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),\n      finishStepUp: async (ceremonyId, caller, action, response) =>\n        await webauthn.finishStepUp(ceremonyId, caller, action, response),\n      forget: (id) => {\n        const forgotten = options.store.removeCredential(id);\n        if (forgotten) publish();\n        return forgotten;\n      },\n    }),\n\n    // Only meaningful where passkeys are: a quick tunnel has no stable rpID, so\n    // there is nothing to step up with and the session cookie is all there is.\n    stepUpRequired: () => webauthn.support().supported,\n\n    channelPublicKey: () => handshake?.publicKey,\n\n    openChannel(deviceId, scope, clientPublicKey) {\n      const channel = handshake?.accept(clientPublicKey);\n      if (channel === undefined) return false;\n      channels.set(channelKey(deviceId, scope), channel);\n      return true;\n    },\n\n    channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),\n\n    revokeDevice(id) {\n      const revoked = devices.revoke(id);\n      if (revoked) publish();\n      return revoked;\n    },\n\n    isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,\n\n    trackSocket(deviceId, close) {\n      const held = sockets.get(deviceId) ?? new Set();\n      held.add(close);\n      sockets.set(deviceId, held);\n      return () => {\n        held.delete(close);\n        if (held.size === 0) sockets.delete(deviceId);\n      };\n    },\n\n    async close() {\n      clearInterval(sweeper);\n      await teardown();\n      status = 'off';\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AAgCA,MAAM,cAAc;AACpB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AAoGtB,SAAS,mBACP,OACgC;CAChC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EACL,GAAG;EACH,aAAa,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK;CAClG;AACF;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,iBAAiB,QAAQ,yBAA+B,CAAC;CAC/D,MAAM,eAAe,QAAQ,uBAA6B,CAAC;CAE3D,IAAI,WAAW,QAAQ,MAAM,SAAS;CACtC,IAAI,SAA6B;CACjC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,uBAAuB;CAC3B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,MAAM,2BAAW,IAAI,IAA2B;CAChD,MAAM,0BAAU,IAAI,IAAyD;CAE7E,MAAM,cAAc,UAAkB,UAAsC,GAAG,SAAS,GAAG;CAC3F,MAAM,oBAAoB,UAAkB,WAAwC;EAClF,QAAQ,kBAAkB,QAAQ;EAClC,KAAK,MAAM,SAAS;GAAC;GAAW;GAAY;EAAM,GAAY,SAAS,OAAO,WAAW,UAAU,KAAK,CAAC;EACzG,MAAM,OAAO,QAAQ,IAAI,QAAQ;EACjC,QAAQ,OAAO,QAAQ;EACvB,KAAK,MAAM,SAAS,QAAQ,CAAC,GAC3B,IAAI;GACF,MAAM,MAAM,UAAU,QAAQ;EAChC,QAAQ,CAER;CAEJ;CAEA,MAAM,UAAsB,iBAAiB;EAC3C,gBAAgB;EAChB;EACA,UAAU;EACV,SAAS,QAAQ,WAAW,iBAAiB,OAAO,IAAI,MAAM;CAChE,CAAC;CAED,MAAM,WAAqB,eAAe;EACxC,oBAAoB;EACpB,mBAAmB,QAAQ,MAAM,YAAY;EAC7C,iBAAiB,eAAe,QAAQ,MAAM,eAAe,UAAU;EACvE,mBAAmB,OAAO,QAAQ,MAAM,iBAAiB,EAAE;EAC3D;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAuB,kBAAkB;EAC7C,mBAAmB,YAAY,WAAW,CAAC,CAAC,SAAS,WAAW;EAChE,wBAAwB,UAAU,GAAW,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACzE,SAAS,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAClE;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAU,kBAAkB;EAChC,QAAQ,MAAM;EACd,QAAQ,MAAM;CAChB,GAAG,iBAAiB;CACpB,QAAQ,MAAM;CAEd,SAAS,UAAgB;EACvB,aAAa;GAAE,MAAM;GAAmB,OAAO,KAAK,KAAA,GAAW,KAAK;EAAE,CAAC;CACzE;CAEA,SAAS,KAAK,cAAkC,gBAAgD;EAC9F,OAAO;GACL;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,aAAa;GAChE,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY,EAAE;GAClF,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,YAAY,EAAE;GAC/E,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ;GAClD,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,YAAY;IACvC,IAAI,OAAO;IACX,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,OAAO,OAAO;GACtB,EAAE;GAIF,SAAS,iBACL,QAAQ,QAAQ,CAAC,CAAC,KAAK,aAAa;IAClC,IAAI,QAAQ;IACZ,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,WAAW,IAAI,KAAK,QAAQ,SAAS,CAAC,CAAC,YAAY;IACnD,WAAW,IAAI,KAAK,QAAQ,YAAY,IAAO,CAAC,CAAC,YAAY;GAC/D,EAAE,IACF,CAAC;GACL;EACF;CACF;CAEA,SAAS,eAAqB;EAC5B,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EACX,IAAI,CAAC,SAAS,oBAAoB,WAAW,MAAM;EAEnD,WADW,IAAI,IAAI,SAAS,mBAAmB;EAE/C,iBAAiB,iBAAiB;GAChC,OAAO,+CAA+C;GACtD,QAAa;EACf,GAAG,SAAS,mBAAmB,aAAa;EAC5C,eAAe,MAAM;CACvB;;CAGA,eAAe,WAA0B;EACvC,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EAIX,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,KAAK,MAAM,SAAS,MAClB,IAAI;GACF,MAAM,MAAM,uBAAuB;EACrC,QAAQ,CAER;EAGJ,QAAQ,MAAM;EACd,MAAM,WAAW;EACjB,gBAAgB,KAAA;EAChB,UAAU,WAAW,MAAM;EAC3B,MAAM,kBAAkB,MAAM,UAAU,QAAQ,YAAY,KAAA,CAAS;EACrE,IAAI,iBAAiB,OAAO,MAAM,MAAM,gBAAgB,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EACpF,MAAM,aAAa,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C,aAAa,KAAA;EACb,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,WAAW,KAAA;EACX,IAAI,iBAAiB,KAAA,GAAW,wBAAwB;EACxD,eAAe,KAAA;EACf,SAAS,KAAA;EACT,YAAY,KAAA;EACZ,QAAQ,MAAM;EACd,SAAS,gBAAgB;EACzB,YAAY,KAAA;EACZ,SAAS,MAAM;EAGf,QAAQ,UAAU;CACpB;CAEA,eAAe,UAAyB;EACtC,IAAI,WAAW,OAAO;EACtB,MAAM,SAAS;EACf,SAAS;EACT,UAAU,KAAA;EACV,OAAO,mBAAmB;EAC1B,QAAQ;CACV;CAEA,OAAO;EACL,QAAQ,cAAc,iBAAiB,UAAU,KAAK,cAAc,cAAc;EAClF,gBAAgB;EAChB,oBAAoB;EACpB,4BAA4B;EAE5B,eAAe,OAAO;GAGpB,MAAM,SAAS,0BACb,8BAA8B;IAAE,GAAG;IAAU,GAAG;GAAM,CAAC,CACzD;GACA,KAAK,MAAM,WAAW,OAAO,UAAU,OAAO,2BAA2B,SAAS;GAClF,WAAW,OAAO;GAClB,QAAQ,MAAM,KAAK,QAAQ;GAG3B,QAAQ,WAAW;GACnB,aAAa;GACb,QAAQ;GACR,OAAO;EACT;;;;;;;;EASA,iBAAiB;GACf,MAAM,UAAU;GAChB,IAAI,YAAY,KAAA,GAAW;GAC3B,kBAAkB,KAAA;GAClB,OAAO,yCAAyC;GAChD,QAAQ,kBAAkB,OAAO;EACnC;;EAGA,uBAAuB,oBAAoB,KAAA;EAE3C,kBAAkB,UAAU;EAC5B,oBAAoB;EAEpB,MAAM,SAAS;GACb,IAAI,WAAW,QAAQ,WAAW,YAAY,OAAO,EAAE,IAAI,KAAK;GAChE,SAAS;GACT,UAAU,KAAA;GACV,QAAQ;GAKR,IAAI,SAAS,QAAQ,WAAW,QAAQ,cAAc,MAAM;IAC1D,IAAI,SAAS,QAAQ,WAAW,WAAW,GAAG;KAC5C,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IACA,IAAI,QAAQ,oBAAoB,KAAA,GAAW;KACzC,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IAGA,kBAAkB;IAClB,OAAO,EAAE,IAAI,KAAK;GACpB;GACA,IAAI;GACJ,IAAI;IACF,QAAQ,MAAM,QAAQ,aAAa;GACrC,SAAS,OAAO;IACd,SAAS;IACT,UAAU,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IACtG,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO;IAAQ;GACrC;GACA,WAAW;GACX,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,YAAY,QAAQ,aAAa;IACrC,MAAM,MAAM;IACZ,QAAQ,SAAS;IACjB,QAAQ,WAAW;IACnB,eAAe,WAAW;KACxB,SAAS,mBAAmB,MAAM;IACpC;GACF,CAAC;GACD,MAAM,UAAU;IAAE;IAAY,SAAS;GAAU;GACjD,gBAAgB;GAChB,MAAM,UAAU,MAAM;GACtB,IAAI,kBAAkB,WAAW,WAAW,OAAO,SACjD,OAAO;IAAE,IAAI;IAAO,OAAO;GAAgC;GAE7D,gBAAgB,KAAA;GAChB,IAAI,CAAC,QAAQ,IAAI;IACf,MAAM,SAAS;IACf,SAAS;IACT,UAAU,QAAQ;IAClB,OAAO,yBAAyB,QAAQ,SAAS;IACjD,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO,QAAQ;IAAQ;GAC7C;GACA,aAAa,QAAQ;GAGrB,YAAY,oBAAoB;GAChC,eAAe,QAAQ;GACvB,SAAS,mBAAmB,QAAQ,YAAY;GAChD,YAAY,IAAI;GAChB,SAAS;GACT,aAAa;GACb,OAAO,uBAAuB,QAAQ,cAAc;GACpD,QAAQ;GACR,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA;EAEA,cAAc;GACZ,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,QAAQ,mBAAmB,QAAQ,cAAc,CAAC;GACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,EAAE,MAAM,YAAY,cAAc,QAAQ,SAAS;GAGzD,MAAM,WAAW,IAAI,gBAAgB;IACnC,GAAG;KACF,mBAAmB,UAAU;KACF,MAAA,MAAM;KACD,MAAA,OAAO,MAAM,QAAQ;GACxD,CAAC;GACD,OAAO;IACL;IACA;IACA,SAAS,GAAG,eAAe,mBAAmB,GAAG,SAAS,SAAS;IACnE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY;IAC3C,GAAG;GACL;EACF;EAEA,mBAAmB,mBAAmB,QAAQ,cAAc,CAAC;EAE7D,MAAM,OAAO;GACX,MAAM,UAAU,QAAQ,MAAM,KAAK;GACnC,IAAI,QAAQ,IACV,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAEpF,OAAO;EACT;EAEA,gBAAgB,cAAc,QAAQ,OAAO,SAAS;EAEtD,QAAQ,WAAW;GACjB,MAAM,UAAU,QAAQ,QAAQ,SAAS;GACzC,IAAI,YAAY,YAAY,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC9G,OAAO;EACT;EAEA,KAAK,WAAW;GACd,MAAM,UAAU,QAAQ,KAAK,SAAS;GACtC,IAAI,YAAY,UAAU,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC5G,OAAO;EACT;EAEA,OAAO,WAAW;GAChB,MAAM,WAAW,QAAQ,QAAQ,SAAS;GAC1C,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,WAAW,QAAQ,MAAM,EAAE,WAAW,SAAS,UAAU,CAAC;GAChE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAe,oBAAoB,UAAU,sBAAsB;GAAE;EAC7F;EAEA,YAAY,UAAU,QAAQ,OAAO,KAAK,CAAC,EAAE;EAE7C,kBAAkB,OAAO;GACvB,MAAM,WAAW,QAAQ,MAAM,EAAE,WAAW,MAAM,CAAC;GACnD,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAe,oBAAoB,UAAU,sBAAsB;GAAE;EAC7F;EAEA,iBAAiB;GACf,eAAe,SAAS,QAAQ;GAChC,YAAY,QAAQ,MAAM,YAAY;GAGtC,mBAAmB,OAAO,QAAQ,UAAU,MAAM,SAAS,kBAAkB,QAAQ,KAAK;GAC1F,oBAAoB,OAAO,YAAY,QAAQ,UAAU,UACvD,MAAM,SAAS,mBAAmB,YAAY,QAAQ,UAAU,KAAK;GACvE,qBAAqB,OAAO,WAAW,MAAM,SAAS,oBAAoB,MAAM;GAChF,sBAAsB,OAAO,YAAY,QAAQ,aAC/C,MAAM,SAAS,qBAAqB,YAAY,QAAQ,QAAQ;GAClE,aAAa,OAAO,QAAQ,WAAW,MAAM,SAAS,YAAY,QAAQ,MAAM;GAChF,cAAc,OAAO,YAAY,QAAQ,QAAQ,aAC/C,MAAM,SAAS,aAAa,YAAY,QAAQ,QAAQ,QAAQ;GAClE,SAAS,OAAO;IACd,MAAM,YAAY,QAAQ,MAAM,iBAAiB,EAAE;IACnD,IAAI,WAAW,QAAQ;IACvB,OAAO;GACT;EACF;EAIA,sBAAsB,SAAS,QAAQ,CAAC,CAAC;EAEzC,wBAAwB,WAAW;EAEnC,YAAY,UAAU,OAAO,iBAAiB;GAC5C,MAAM,UAAU,WAAW,OAAO,eAAe;GACjD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,SAAS,IAAI,WAAW,UAAU,KAAK,GAAG,OAAO;GACjD,OAAO;EACT;EAEA,aAAa,UAAU,UAAU,SAAS,IAAI,WAAW,UAAU,KAAK,CAAC;EAEzE,aAAa,IAAI;GACf,MAAM,UAAU,QAAQ,OAAO,EAAE;GACjC,IAAI,SAAS,QAAQ;GACrB,OAAO;EACT;EAEA,oBAAoB,cAAc,QAAQ,IAAI,QAAQ,CAAC,EAAE,QAAQ,KAAK;EAEtE,YAAY,UAAU,OAAO;GAC3B,MAAM,OAAO,QAAQ,IAAI,QAAQ,qBAAK,IAAI,IAAI;GAC9C,KAAK,IAAI,KAAK;GACd,QAAQ,IAAI,UAAU,IAAI;GAC1B,aAAa;IACX,KAAK,OAAO,KAAK;IACjB,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,QAAQ;GAC9C;EACF;EAEA,MAAM,QAAQ;GACZ,cAAc,OAAO;GACrB,MAAM,SAAS;GACf,SAAS;EACX;CACF;AACF"}

package/dist/src/services/remoteAccessSettings/index.cjs

@@ -0,0 +1,151 @@
+const MIN_MINUTES = 1;
+const MAX_MINUTES = 1440;
+const MIN_HOURS = 1;
+const MAX_HOURS = 720;
+/**
+* Both time limits start off.
+*
+* The durations are still here so switching one on lands on a sensible number
+* rather than an empty field. What being off actually means: a tunnel stays up
+* until it is closed or the hub restarts, and a paired session lasts until it
+* is revoked or remote access is switched off. Those two events are the only
+* expiry there is by default.
+*/
+const DEFAULT_REMOTE_SETTINGS = {
+	autoCloseEnabled: false,
+	autoCloseMinutes: 60,
+	sessionExpiryEnabled: false,
+	idleMinutes: 30,
+	absoluteHours: 12,
+	tunnel: { kind: "quick" },
+	sandbox: {
+		enabled: false,
+		workspaces: []
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBoolean(raw, fallback, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "boolean") {
+		warnings.push(`${field} must be true or false; using ${String(fallback)}.`);
+		return fallback;
+	}
+	return raw;
+}
+function readClamped(raw, fallback, bounds, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) {
+		warnings.push(`${field} must be a number; using ${String(fallback)}.`);
+		return fallback;
+	}
+	const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));
+	if (clamped !== raw) warnings.push(`${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`);
+	return clamped;
+}
+/**
+* A tunnel configuration is only accepted whole.
+*
+* A named tunnel missing its hostname is not a named tunnel with a default, it
+* is a misconfiguration, and quietly falling back to a quick tunnel would swap
+* a stable origin for a rotating one without telling anybody.
+*/
+function readTunnel(raw, warnings) {
+	if (raw === void 0) return DEFAULT_REMOTE_SETTINGS.tunnel;
+	if (!isRecord(raw)) {
+		warnings.push("tunnel must be an object; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	if (raw.kind === "quick") return { kind: "quick" };
+	if (raw.kind !== "named") {
+		warnings.push(`tunnel.kind must be "quick" or "named"; using a quick tunnel.`);
+		return { kind: "quick" };
+	}
+	if (typeof raw.hostname !== "string" || raw.hostname === "") {
+		warnings.push("A named tunnel needs a hostname; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	return {
+		kind: "named",
+		hostname: raw.hostname,
+		...typeof raw.name === "string" && raw.name !== "" ? { name: raw.name } : {},
+		...typeof raw.tokenFile === "string" && raw.tokenFile !== "" ? { tokenFile: raw.tokenFile } : {},
+		...typeof raw.configFile === "string" && raw.configFile !== "" ? { configFile: raw.configFile } : {}
+	};
+}
+/**
+* Reads the container settings, keeping only absolute workspace paths.
+*
+* A relative path would resolve against the container's working directory
+* rather than the host's, which is a mount that silently points somewhere else.
+* Refusing one is better than mounting the wrong directory.
+*/
+function readSandbox(raw, warnings) {
+	const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;
+	if (raw === void 0) return fallback;
+	if (!isRecord(raw)) {
+		warnings.push("sandbox must be an object; the cockpit will not be contained.");
+		return fallback;
+	}
+	const workspaces = [];
+	for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {
+		if (typeof entry !== "string" || !entry.startsWith("/")) {
+			warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);
+			continue;
+		}
+		if (!workspaces.includes(entry)) workspaces.push(entry);
+	}
+	return {
+		enabled: readBoolean(raw.enabled, fallback.enabled, "sandbox.enabled", warnings),
+		workspaces
+	};
+}
+function parseRemoteAccessSettings(raw) {
+	const warnings = [];
+	if (!isRecord(raw)) return {
+		settings: DEFAULT_REMOTE_SETTINGS,
+		warnings
+	};
+	if (raw.version !== 1) {
+		warnings.push(`Settings version ${String(raw.version)} is not version ${String(1)}; using defaults.`);
+		return {
+			settings: DEFAULT_REMOTE_SETTINGS,
+			warnings
+		};
+	}
+	const defaults = DEFAULT_REMOTE_SETTINGS;
+	return {
+		settings: {
+			autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, "autoCloseEnabled", warnings),
+			autoCloseMinutes: readClamped(raw.autoCloseMinutes, defaults.autoCloseMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "autoCloseMinutes", warnings),
+			sessionExpiryEnabled: readBoolean(raw.sessionExpiryEnabled, defaults.sessionExpiryEnabled, "sessionExpiryEnabled", warnings),
+			idleMinutes: readClamped(raw.idleMinutes, defaults.idleMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "idleMinutes", warnings),
+			absoluteHours: readClamped(raw.absoluteHours, defaults.absoluteHours, {
+				min: MIN_HOURS,
+				max: MAX_HOURS
+			}, "absoluteHours", warnings),
+			tunnel: readTunnel(raw.tunnel, warnings),
+			sandbox: readSandbox(raw.sandbox, warnings)
+		},
+		warnings
+	};
+}
+function serializeRemoteAccessSettings(settings) {
+	return {
+		version: 1,
+		...settings
+	};
+}
+//#endregion
+exports.DEFAULT_REMOTE_SETTINGS = DEFAULT_REMOTE_SETTINGS;
+exports.parseRemoteAccessSettings = parseRemoteAccessSettings;
+exports.serializeRemoteAccessSettings = serializeRemoteAccessSettings;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/remoteAccessSettings/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/remoteAccessSettings/index.ts"],"sourcesContent":["/**\n * The persisted remote-access settings, and how a bad file becomes a good one.\n *\n * Every failure here is recoverable by falling back, never by throwing: a\n * corrupt settings file must not stop the cockpit from starting, because the\n * cockpit is how you would fix it.\n */\n\nimport type { RemoteAccessSettings, SandboxSettings, TunnelConfig } from '../../types/remote';\n\n/** Bumped when a field changes meaning; an unrecognised version falls back to defaults. */\nexport const REMOTE_SETTINGS_VERSION = 1;\n\nconst MIN_MINUTES = 1;\nconst MAX_MINUTES = 1440;\nconst MIN_HOURS = 1;\nconst MAX_HOURS = 720;\n\n/**\n * Both time limits start off.\n *\n * The durations are still here so switching one on lands on a sensible number\n * rather than an empty field. What being off actually means: a tunnel stays up\n * until it is closed or the hub restarts, and a paired session lasts until it\n * is revoked or remote access is switched off. Those two events are the only\n * expiry there is by default.\n */\nexport const DEFAULT_REMOTE_SETTINGS: RemoteAccessSettings = {\n  autoCloseEnabled: false,\n  autoCloseMinutes: 60,\n  sessionExpiryEnabled: false,\n  idleMinutes: 30,\n  absoluteHours: 12,\n  tunnel: { kind: 'quick' },\n  sandbox: { enabled: false, workspaces: [] },\n};\n\nexport interface ParsedRemoteSettings {\n  settings: RemoteAccessSettings;\n  /** Everything that had to be corrected, so the host can say so once rather than silently differ. */\n  warnings: string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readBoolean(raw: unknown, fallback: boolean, field: string, warnings: string[]): boolean {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'boolean') {\n    warnings.push(`${field} must be true or false; using ${String(fallback)}.`);\n    return fallback;\n  }\n  return raw;\n}\n\nfunction readClamped(\n  raw: unknown,\n  fallback: number,\n  bounds: { min: number; max: number },\n  field: string,\n  warnings: string[],\n): number {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n    warnings.push(`${field} must be a number; using ${String(fallback)}.`);\n    return fallback;\n  }\n  const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));\n  if (clamped !== raw) {\n    warnings.push(\n      `${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`,\n    );\n  }\n  return clamped;\n}\n\n/**\n * A tunnel configuration is only accepted whole.\n *\n * A named tunnel missing its hostname is not a named tunnel with a default, it\n * is a misconfiguration, and quietly falling back to a quick tunnel would swap\n * a stable origin for a rotating one without telling anybody.\n */\nfunction readTunnel(raw: unknown, warnings: string[]): TunnelConfig {\n  if (raw === undefined) return DEFAULT_REMOTE_SETTINGS.tunnel;\n  if (!isRecord(raw)) {\n    warnings.push('tunnel must be an object; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  if (raw.kind === 'quick') return { kind: 'quick' };\n  if (raw.kind !== 'named') {\n    warnings.push(`tunnel.kind must be \"quick\" or \"named\"; using a quick tunnel.`);\n    return { kind: 'quick' };\n  }\n  if (typeof raw.hostname !== 'string' || raw.hostname === '') {\n    warnings.push('A named tunnel needs a hostname; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  return {\n    kind: 'named',\n    hostname: raw.hostname,\n    ...(typeof raw.name === 'string' && raw.name !== '' ? { name: raw.name } : {}),\n    ...(typeof raw.tokenFile === 'string' && raw.tokenFile !== '' ? { tokenFile: raw.tokenFile } : {}),\n    ...(typeof raw.configFile === 'string' && raw.configFile !== '' ? { configFile: raw.configFile } : {}),\n  };\n}\n\n/**\n * Reads the container settings, keeping only absolute workspace paths.\n *\n * A relative path would resolve against the container's working directory\n * rather than the host's, which is a mount that silently points somewhere else.\n * Refusing one is better than mounting the wrong directory.\n */\nfunction readSandbox(raw: unknown, warnings: string[]): SandboxSettings {\n  const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;\n  if (raw === undefined) return fallback;\n  if (!isRecord(raw)) {\n    warnings.push('sandbox must be an object; the cockpit will not be contained.');\n    return fallback;\n  }\n  const workspaces: string[] = [];\n  for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {\n    if (typeof entry !== 'string' || !entry.startsWith('/')) {\n      warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);\n      continue;\n    }\n    if (!workspaces.includes(entry)) workspaces.push(entry);\n  }\n  return { enabled: readBoolean(raw.enabled, fallback.enabled, 'sandbox.enabled', warnings), workspaces };\n}\n\nexport function parseRemoteAccessSettings(raw: unknown): ParsedRemoteSettings {\n  const warnings: string[] = [];\n  if (!isRecord(raw)) {\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  if (raw.version !== REMOTE_SETTINGS_VERSION) {\n    warnings.push(\n      `Settings version ${String(raw.version)} is not version ${String(REMOTE_SETTINGS_VERSION)}; using defaults.`,\n    );\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  const defaults = DEFAULT_REMOTE_SETTINGS;\n  return {\n    settings: {\n      autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, 'autoCloseEnabled', warnings),\n      autoCloseMinutes: readClamped(\n        raw.autoCloseMinutes,\n        defaults.autoCloseMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'autoCloseMinutes',\n        warnings,\n      ),\n      sessionExpiryEnabled: readBoolean(\n        raw.sessionExpiryEnabled,\n        defaults.sessionExpiryEnabled,\n        'sessionExpiryEnabled',\n        warnings,\n      ),\n      idleMinutes: readClamped(\n        raw.idleMinutes,\n        defaults.idleMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'idleMinutes',\n        warnings,\n      ),\n      absoluteHours: readClamped(\n        raw.absoluteHours,\n        defaults.absoluteHours,\n        { min: MIN_HOURS, max: MAX_HOURS },\n        'absoluteHours',\n        warnings,\n      ),\n      tunnel: readTunnel(raw.tunnel, warnings),\n      sandbox: readSandbox(raw.sandbox, warnings),\n    },\n    warnings,\n  };\n}\n\nexport function serializeRemoteAccessSettings(settings: RemoteAccessSettings): unknown {\n  return { version: REMOTE_SETTINGS_VERSION, ...settings };\n}\n"],"mappings":"AAaA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;;;;;;;;;;AAWlB,MAAa,0BAAgD;CAC3D,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CACtB,aAAa;CACb,eAAe;CACf,QAAQ,EAAE,MAAM,QAAQ;CACxB,SAAS;EAAE,SAAS;EAAO,YAAY,CAAC;CAAE;AAC5C;AAQA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,KAAc,UAAmB,OAAe,UAA6B;CAChG,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,WAAW;EAC5B,SAAS,KAAK,GAAG,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;EAC1E,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,YACP,KACA,UACA,QACA,OACA,UACQ;CACR,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;EACpD,SAAS,KAAK,GAAG,MAAM,2BAA2B,OAAO,QAAQ,EAAE,EAAE;EACrE,OAAO;CACT;CACA,MAAM,UAAU,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;CAC1E,IAAI,YAAY,KACd,SAAS,KACP,GAAG,MAAM,mBAAmB,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,EACrG;CAEF,OAAO;AACT;;;;;;;;AASA,SAAS,WAAW,KAAc,UAAkC;CAClE,IAAI,QAAQ,KAAA,GAAW,OAAO,wBAAwB;CACtD,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,iDAAiD;EAC/D,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CACjD,IAAI,IAAI,SAAS,SAAS;EACxB,SAAS,KAAK,+DAA+D;EAC7E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,IAAI;EAC3D,SAAS,KAAK,wDAAwD;EACtE,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,OAAO;EACL,MAAM;EACN,UAAU,IAAI;EACd,GAAI,OAAO,IAAI,SAAS,YAAY,IAAI,SAAS,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EAC5E,GAAI,OAAO,IAAI,cAAc,YAAY,IAAI,cAAc,KAAK,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EAChG,GAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,KAAK,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;CACtG;AACF;;;;;;;;AASA,SAAS,YAAY,KAAc,UAAqC;CACtE,MAAM,WAAW,wBAAwB;CACzC,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,+DAA+D;EAC7E,OAAO;CACT;CACA,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC,GAAG;EACvE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,GAAG;GACvD,SAAS,KAAK,kDAAkD,OAAO,KAAK,EAAE,EAAE;GAChF;EACF;EACA,IAAI,CAAC,WAAW,SAAS,KAAK,GAAG,WAAW,KAAK,KAAK;CACxD;CACA,OAAO;EAAE,SAAS,YAAY,IAAI,SAAS,SAAS,SAAS,mBAAmB,QAAQ;EAAG;CAAW;AACxG;AAEA,SAAgB,0BAA0B,KAAoC;CAC5E,MAAM,WAAqB,CAAC;CAC5B,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAAE,UAAU;EAAyB;CAAS;CAEvD,IAAI,IAAI,YAAA,GAAqC;EAC3C,SAAS,KACP,oBAAoB,OAAO,IAAI,OAAO,EAAE,kBAAkB,OAAA,CAA8B,EAAE,kBAC5F;EACA,OAAO;GAAE,UAAU;GAAyB;EAAS;CACvD;CACA,MAAM,WAAW;CACjB,OAAO;EACL,UAAU;GACR,kBAAkB,YAAY,IAAI,kBAAkB,SAAS,kBAAkB,oBAAoB,QAAQ;GAC3G,kBAAkB,YAChB,IAAI,kBACJ,SAAS,kBACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,oBACA,QACF;GACA,sBAAsB,YACpB,IAAI,sBACJ,SAAS,sBACT,wBACA,QACF;GACA,aAAa,YACX,IAAI,aACJ,SAAS,aACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,eACA,QACF;GACA,eAAe,YACb,IAAI,eACJ,SAAS,eACT;IAAE,KAAK;IAAW,KAAK;GAAU,GACjC,iBACA,QACF;GACA,QAAQ,WAAW,IAAI,QAAQ,QAAQ;GACvC,SAAS,YAAY,IAAI,SAAS,QAAQ;EAC5C;EACA;CACF;AACF;AAEA,SAAgB,8BAA8B,UAAyC;CACrF,OAAO;EAAE,SAAA;EAAkC,GAAG;CAAS;AACzD"}