@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/pairingPage/index.cjs

@@ -0,0 +1,450 @@
+const require_remote = require("../../constants/remote.cjs");
+//#region src/services/pairingPage/index.ts
+/**
+* The package-owned page a scanned QR opens before any cockpit JavaScript runs.
+*
+* It cannot be the cockpit bundle. The bundle sits behind the guard and must be
+* verified first. Its only subresource is the separately built package-owned PWA
+* bootstrap, whose worker verifies and stages the signed host bundle.
+*
+* Request data is never echoed into the markup. Local-loopback responses may embed
+* the package-generated public signer fields, whose alphabets cannot form markup.
+*/
+/** Asserted by the tunnel self-test to prove the pairing route is reachable end to end. */
+const PAIRING_PAGE_MARKER = "doompi-pairing-page";
+/** How often the phone asks whether the host has answered. */
+const POLL_INTERVAL_MS = 1e3;
+function pairingPageCsp(nonce) {
+	return [
+		"default-src 'none'",
+		"style-src 'unsafe-inline'",
+		`script-src 'nonce-${nonce}' 'self'`,
+		"connect-src 'self'",
+		"img-src 'self'",
+		"manifest-src 'self'",
+		"worker-src 'self'",
+		"base-uri 'none'",
+		"form-action 'none'",
+		"frame-ancestors 'none'"
+	].join("; ");
+}
+function pairingPageHeaders(nonce) {
+	return {
+		"Content-Type": "text/html; charset=utf-8",
+		"Cache-Control": "no-store",
+		"Referrer-Policy": "no-referrer",
+		"X-Frame-Options": "DENY",
+		"Content-Security-Policy": pairingPageCsp(nonce)
+	};
+}
+/**
+* Colours are literals here rather than theme tokens on purpose: this page
+* renders before, and without, the cockpit bundle that defines the tokens, and
+* it lives outside `src/web` so the browser theming rule does not reach it.
+*/
+const STYLE = `
+  :root { color-scheme: dark; }
+  body {
+    margin: 0; min-height: 100vh; display: grid; place-items: center;
+    background: #14161a; color: #e6e8ec;
+    font: 16px/1.5 ui-sans-serif, system-ui, -apple-system, sans-serif;
+  }
+  main { width: min(30rem, 100% - 2.5rem); text-align: center; }
+  [hidden] { display: none !important; }
+  h1 { font-size: 1.25rem; font-weight: 600; margin: 0 0 0.5rem; }
+  p { margin: 0 0 1rem; color: #a2a8b4; }
+  .state { font-weight: 600; color: #e6e8ec; }
+  .bad { color: #ff6b6b; }
+  .ok { color: #6bd68a; }
+  form, .actions { display: flex; gap: 0.5rem; margin-top: 1.5rem; }
+  input, button {
+    font: inherit; padding: 0.6rem 0.8rem; border-radius: 0.5rem;
+    border: 1px solid #2c313a; background: #1b1e24; color: inherit;
+  }
+  input { flex: 1; min-width: 0; }
+  button { flex: 1; background: #2f6feb; border-color: #2f6feb; font-weight: 600; }
+  button.secondary { background: #1b1e24; border-color: #2c313a; }
+  button:disabled { opacity: 0.6; }
+  video { width: 100%; max-height: 18rem; border-radius: 0.75rem; margin-top: 1rem; }
+  code { display: block; overflow-wrap: anywhere; margin: 0.75rem 0; color: #e6e8ec; }
+`;
+/**
+* The client half of the pairing handshake.
+*
+* The code arrives in the URL fragment, which no browser sends to any server,
+* so it never reaches Cloudflare's edge logs, this process's access log, or a
+* Referer header. It is scrubbed from the address bar before anything else
+* runs, so a screenshot or a shared history entry does not carry it either.
+*/
+const SCRIPT = `
+  const params = new URLSearchParams(location.hash.slice(1));
+  const code = params.get('c') ?? '';
+  const state = document.getElementById('state');
+  const manual = document.getElementById('manual');
+  const actions = document.getElementById('actions');
+  const addPasskey = document.getElementById('add-passkey');
+  const skipPasskey = document.getElementById('skip-passkey');
+  const trustPanel = document.getElementById('trust');
+  const trustFingerprint = document.getElementById('trust-fingerprint');
+  const acceptTrust = document.getElementById('accept-trust');
+  const say = (text, tone) => { state.textContent = text; state.className = 'state ' + (tone ?? ''); };
+  const openCockpit = () => location.replace('/');
+
+  function trustOf(value) {
+    if (!value || typeof value.publicKey !== 'string' || !/^[A-Za-z0-9_-]{80,512}$/.test(value.publicKey)) return undefined;
+    const revision = Number(value.revision);
+    if (!Number.isSafeInteger(revision) || revision < 1) return undefined;
+    return { publicKey: value.publicKey, revision, fingerprint: typeof value.fingerprint === 'string' ? value.fingerprint : '' };
+  }
+
+  const scannedTrust = trustOf({
+    publicKey: params.get('s'),
+    revision: params.get('r'),
+  });
+  let fragmentClaimStarted = code !== '';
+  const localTrust = trustOf({
+    publicKey: document.body.dataset.localSigner,
+    revision: document.body.dataset.localRevision,
+    fingerprint: document.body.dataset.localFingerprint,
+  });
+
+  function rememberChannelKey(value) {
+    if (typeof value !== 'string' || value === '') return false;
+    try { sessionStorage.setItem('doompi.channelKey', value); return true; } catch { return false; }
+  }
+  rememberChannelKey(params.get('k'));
+  history.replaceState(null, '', location.pathname);
+  window.addEventListener('hashchange', () => {
+    const nextParams = new URLSearchParams(location.hash.slice(1));
+    const nextCode = nextParams.get('c') ?? '';
+    if (nextCode === '') return;
+    fragmentClaimStarted = true;
+    const nextTrust = trustOf({
+      publicKey: nextParams.get('s'),
+      revision: nextParams.get('r'),
+    });
+    rememberChannelKey(nextParams.get('k'));
+    history.replaceState(null, '', location.pathname);
+    void claim(nextCode, nextTrust);
+  });
+
+  async function requestWorker(message) {
+    if (!('serviceWorker' in navigator)) return { ok: false, message: 'This browser cannot install the trusted verifier.' };
+    let registration;
+    try {
+      registration = await Promise.race([
+        navigator.serviceWorker.ready,
+        new Promise((_, reject) => setTimeout(() => reject(new Error('The trusted verifier did not start.')), 20000)),
+      ]);
+    } catch (error) {
+      return { ok: false, message: error?.message ?? 'The trusted verifier did not start.' };
+    }
+    const serviceWorker = registration.active ?? registration.waiting ?? registration.installing;
+    if (!serviceWorker) return { ok: false, message: 'The trusted verifier is unavailable.' };
+    const channel = new MessageChannel();
+    return await new Promise((resolve) => {
+      const timer = setTimeout(() => resolve({ ok: false, message: 'Bundle verification timed out.' }), 120000);
+      channel.port1.addEventListener('message', (event) => {
+        clearTimeout(timer);
+        resolve(event.data && typeof event.data.ok === 'boolean' ? event.data : { ok: false, message: 'The verifier returned invalid data.' });
+      }, { once: true });
+      channel.port1.start();
+      serviceWorker.postMessage(message, [channel.port2]);
+    });
+  }
+
+  /**
+   * Names the refusal in terms of what the person has to do about it.
+   *
+   * A rotated host key reaches the verifier as untrusted-public-key rather than
+   * signer-mismatch, because a refresh always re-sends the pinned key and only
+   * the signature check can notice the host moved on.
+   */
+  function bundleRefusalMessage(result) {
+    if (result.code === 'untrusted-public-key')
+      return 'This host now signs with a different key. Scan a fresh pairing QR so you can confirm the new fingerprint.';
+    if (result.code === 'stale-revision')
+      return 'This host offers an older cockpit build than this device already verified. Clear this site data to accept it.';
+    return result.message ?? 'The signed cockpit bundle was refused.';
+  }
+
+  async function activateTrust(trust, alreadyConfirmed = false) {
+    say('Verifying every cockpit file before it can run.');
+    let result = await requestWorker({ type: 'doompi:activate-bundle', publicKey: trust.publicKey, minimumRevision: trust.revision });
+    if (!result.ok && result.code === 'signer-mismatch') {
+      if (!alreadyConfirmed && !(await confirmManualTrust(trust))) return false;
+      say('Resetting the old host key and verifying the newly paired host.');
+      const reset = await requestWorker({ type: 'doompi:reset-bundle-trust' });
+      if (!reset.ok) { say(reset.message ?? 'The old host key could not be reset.', 'bad'); return false; }
+      result = await requestWorker({ type: 'doompi:activate-bundle', publicKey: trust.publicKey, minimumRevision: trust.revision });
+    }
+    if (!result.ok) {
+      say(bundleRefusalMessage(result), 'bad');
+      return false;
+    }
+    return true;
+  }
+
+  function offerPasskey() {
+    if (!window.PublicKeyCredential) {
+      say('Paired and verified. Opening the cockpit.', 'ok');
+      setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});
+      return;
+    }
+    say('Paired and verified. Add a passkey to use Face ID, Touch ID, or your device PIN next time.', 'ok');
+    actions.hidden = false;
+  }
+
+  async function signingFingerprint(publicKey) {
+    try {
+      const normalized = publicKey.replaceAll('-', '+').replaceAll('_', '/');
+      const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');
+      const bytes = Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+      const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+      return Array.from(digest, (byte) => byte.toString(16).padStart(2, '0')).join('');
+    } catch {
+      return 'unavailable';
+    }
+  }
+
+  async function confirmManualTrust(trust) {
+    const fingerprint = trust.fingerprint || await signingFingerprint(trust.publicKey);
+    return await new Promise((resolve) => {
+      trustFingerprint.textContent = fingerprint.match(/.{1,8}/g)?.join(' ') ?? fingerprint;
+      trustPanel.hidden = false;
+      say('Compare this signing-key fingerprint with the one shown on the host.');
+      acceptTrust.addEventListener('click', () => { trustPanel.hidden = true; resolve(true); }, { once: true });
+    });
+  }
+
+  async function poll(requestId) {
+    for (;;) {
+      await new Promise((resolve) => setTimeout(resolve, ${String(POLL_INTERVAL_MS)}));
+      const response = await fetch('${require_remote.PAIRING_STATUS_ROUTE}?${require_remote.PAIRING_STATUS_QUERY}=' + encodeURIComponent(requestId), { credentials: 'same-origin' });
+      if (!response.ok) { say('This pairing request is no longer valid. Scan again.', 'bad'); return undefined; }
+      const body = await response.json();
+      if (body.status === 'approved') return body;
+      if (body.status === 'denied') { say('The host denied this device.', 'bad'); return undefined; }
+      if (body.status === 'expired') { say('The request timed out. Scan again.', 'bad'); return undefined; }
+    }
+  }
+
+  async function claim(value, candidateTrust) {
+    if (value === '') { say('Scan the code shown on the host or enter its manual code.', 'bad'); manual.hidden = false; return; }
+    say('Asking the host to approve this device...');
+    const response = await fetch('${require_remote.PAIRING_CLAIM_ROUTE}', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      credentials: 'same-origin',
+      body: JSON.stringify({ code: value }),
+    });
+    if (!response.ok) {
+      say(response.status === 429 ? 'Too many attempts. Wait a minute.' : 'That code is not valid. Scan again.', 'bad');
+      manual.hidden = false;
+      return;
+    }
+    const claimed = await response.json();
+    say('Waiting for the host to approve this device.');
+    const approved = await poll(claimed.requestId);
+    if (!approved) return;
+    rememberChannelKey(approved.hostPublicKey);
+    const trust = candidateTrust ?? trustOf(approved.bundleTrust);
+    if (!trust) { say('The host did not provide signed-bundle trust. Pair again.', 'bad'); return; }
+    if (!candidateTrust && !(await confirmManualTrust(trust))) return;
+    if (await activateTrust(trust, !candidateTrust)) offerPasskey();
+  }
+
+  const fromBase64Url = (value) =>
+    Uint8Array.from(atob(value.replaceAll('-', '+').replaceAll('_', '/')), (c) => c.charCodeAt(0));
+  const toBase64Url = (buffer) =>
+    btoa(String.fromCharCode(...new Uint8Array(buffer))).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+
+  function decodeAuthenticationOptions(options) {
+    return {
+      ...options,
+      challenge: fromBase64Url(options.challenge),
+      allowCredentials: (options.allowCredentials ?? []).map((entry) => ({ ...entry, id: fromBase64Url(entry.id) })),
+    };
+  }
+
+  function decodeRegistrationOptions(options) {
+    return {
+      ...options,
+      challenge: fromBase64Url(options.challenge),
+      user: { ...options.user, id: fromBase64Url(options.user.id) },
+      excludeCredentials: (options.excludeCredentials ?? []).map((entry) => ({ ...entry, id: fromBase64Url(entry.id) })),
+    };
+  }
+
+  function encodeCredential(credential) {
+    const assertion = credential.response;
+    return {
+      id: credential.id,
+      rawId: toBase64Url(credential.rawId),
+      type: credential.type,
+      clientExtensionResults: credential.getClientExtensionResults(),
+      response: {
+        clientDataJSON: toBase64Url(assertion.clientDataJSON),
+        authenticatorData: toBase64Url(assertion.authenticatorData),
+        signature: toBase64Url(assertion.signature),
+        userHandle: assertion.userHandle ? toBase64Url(assertion.userHandle) : undefined,
+      },
+    };
+  }
+
+  function encodeRegistrationCredential(credential) {
+    const attestation = credential.response;
+    return {
+      id: credential.id,
+      rawId: toBase64Url(credential.rawId),
+      type: credential.type,
+      authenticatorAttachment: credential.authenticatorAttachment,
+      clientExtensionResults: credential.getClientExtensionResults(),
+      response: {
+        clientDataJSON: toBase64Url(attestation.clientDataJSON),
+        attestationObject: toBase64Url(attestation.attestationObject),
+        transports: typeof attestation.getTransports === 'function' ? attestation.getTransports() : [],
+      },
+    };
+  }
+
+  async function passkeySignIn() {
+    if (!window.PublicKeyCredential) return false;
+    try {
+      const begun = await fetch('${require_remote.REMOTE_API_ROUTE}/passkeys/authenticate/begin', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: '{}',
+      });
+      if (!begun.ok) return false;
+      const { ceremonyId, options } = await begun.json();
+      if (typeof ceremonyId !== 'string') return false;
+      const credential = await navigator.credentials.get({ publicKey: decodeAuthenticationOptions(options) });
+      if (!credential) return false;
+      const finished = await fetch('${require_remote.REMOTE_API_ROUTE}/passkeys/authenticate/finish', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin',
+        body: JSON.stringify({ ceremonyId, response: encodeCredential(credential) }),
+      });
+      if (!finished.ok) return false;
+      const result = await finished.json();
+      if (!rememberChannelKey(result.hostPublicKey)) return false;
+      const refreshed = await requestWorker({ type: 'doompi:refresh-bundle' });
+      // A host this device cannot reach is not a trust decision. The pin is the
+      // last bundle this device verified for itself, so it stays usable while
+      // the host is away. Every other refusal is a trust decision and still
+      // blocks entry.
+      if (!refreshed.ok && refreshed.code === 'manifest-fetch') {
+        say('Could not check for a newer cockpit build. Opening the last verified one.');
+        return true;
+      }
+      if (!refreshed.ok) say(bundleRefusalMessage(refreshed), 'bad');
+      return refreshed.ok;
+    } catch {
+      return false;
+    }
+  }
+
+  async function registerPasskey() {
+    addPasskey.disabled = true;
+    skipPasskey.disabled = true;
+    say('Confirm passkey setup on this device.');
+    try {
+      const begun = await fetch('${require_remote.PASSKEY_REGISTER_BEGIN_ROUTE}', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: '{}',
+      });
+      if (!begun.ok) throw new Error('Passkey setup is unavailable.');
+      const { ceremonyId, options } = await begun.json();
+      if (typeof ceremonyId !== 'string') throw new Error('Passkey setup is unavailable.');
+      const credential = await navigator.credentials.create({ publicKey: decodeRegistrationOptions(options) });
+      if (!credential) throw new Error('Passkey setup was cancelled.');
+      const finished = await fetch('${require_remote.PASSKEY_REGISTER_FINISH_ROUTE}', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin',
+        body: JSON.stringify({ ceremonyId, response: encodeRegistrationCredential(credential) }),
+      });
+      if (!finished.ok) throw new Error('That passkey was not accepted.');
+      say('Passkey added. Opening the cockpit.', 'ok');
+      setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});
+    } catch (error) {
+      if (error?.name === 'InvalidStateError') {
+        say('A passkey for this site already exists. Opening the cockpit.', 'ok');
+        setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});
+        return;
+      }
+      say(error?.name === 'NotAllowedError' ? 'Passkey setup was cancelled.' : (error?.message ?? 'Passkey setup failed.'), 'bad');
+      addPasskey.disabled = false;
+      skipPasskey.disabled = false;
+    }
+  }
+
+  manual.addEventListener('submit', (event) => {
+    event.preventDefault();
+    manual.hidden = true;
+    void claim(new FormData(manual).get('code')?.toString().trim() ?? '', undefined);
+  });
+  addPasskey.addEventListener('click', () => void registerPasskey());
+  skipPasskey.addEventListener('click', openCockpit);
+
+  void (async () => {
+    if (localTrust) {
+      if (await activateTrust(localTrust)) openCockpit();
+      return;
+    }
+    if (code !== '') { await claim(code, scannedTrust); return; }
+    say('Checking for a passkey on this device...');
+    if (await passkeySignIn()) { say('Signed in and verified. Opening the cockpit.', 'ok'); openCockpit(); return; }
+    if (!fragmentClaimStarted) await claim('', undefined);
+  })();
+`;
+function pairingPageHtml(input) {
+	const localSigner = input.localTrust?.publicKey ?? "";
+	const localRevision = input.localTrust?.revision ?? "";
+	const localFingerprint = input.localTrust?.fingerprint ?? "";
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<meta name="theme-color" content="#14161a">
+<link rel="manifest" href="/manifest.webmanifest">
+<title>Pair with DoomPi</title>
+<style>${STYLE}</style>
+</head>
+<body data-marker="${PAIRING_PAGE_MARKER}" data-local-signer="${localSigner}" data-local-revision="${String(localRevision)}" data-local-fingerprint="${localFingerprint}">
+<main>
+  <h1>Pair this device</h1>
+  <p>This cockpit can run shell commands on the host machine. Pair only your own device.</p>
+  <p id="state" class="state">Starting.</p>
+  <form id="manual" hidden>
+    <input name="code" inputmode="numeric" pattern="[0-9]{8}" maxlength="8" autocomplete="one-time-code" placeholder="8-digit pairing code" aria-label="8-digit pairing code">
+    <button type="submit">Pair</button>
+  </form>
+  <div id="trust" hidden>
+    <p>Signing-key fingerprint</p>
+    <code id="trust-fingerprint"></code>
+    <button id="accept-trust" type="button">Fingerprint matches</button>
+  </div>
+  <div id="actions" class="actions" hidden>
+    <button id="add-passkey" type="button">Add passkey</button>
+    <button id="skip-passkey" class="secondary" type="button">Not now</button>
+  </div>
+  <section id="scanner">
+    <p id="pwa-status" role="status">Checking browser support.</p>
+    <video id="camera" playsinline muted hidden></video>
+    <div class="actions">
+      <button id="scan" type="button">Scan pairing QR</button>
+      <button id="cancel" class="secondary" type="button" hidden>Cancel</button>
+    </div>
+  </section>
+  <noscript><p class="bad">Pairing needs JavaScript, because the code never leaves your browser.</p></noscript>
+</main>
+<script nonce="${input.nonce}">${SCRIPT}<\/script>
+<script type="module" src="/pwa/pwa.js"><\/script>
+</body>
+</html>`;
+}
+//#endregion
+exports.PAIRING_PAGE_MARKER = PAIRING_PAGE_MARKER;
+exports.pairingPageCsp = pairingPageCsp;
+exports.pairingPageHeaders = pairingPageHeaders;
+exports.pairingPageHtml = pairingPageHtml;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/pairingPage/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["PAIRING_STATUS_ROUTE","PAIRING_STATUS_QUERY","PAIRING_CLAIM_ROUTE","REMOTE_API_ROUTE","PASSKEY_REGISTER_BEGIN_ROUTE","PASSKEY_REGISTER_FINISH_ROUTE"],"sources":["../../../src/services/pairingPage/index.ts"],"sourcesContent":["/**\n * The package-owned page a scanned QR opens before any cockpit JavaScript runs.\n *\n * It cannot be the cockpit bundle. The bundle sits behind the guard and must be\n * verified first. Its only subresource is the separately built package-owned PWA\n * bootstrap, whose worker verifies and stages the signed host bundle.\n *\n * Request data is never echoed into the markup. Local-loopback responses may embed\n * the package-generated public signer fields, whose alphabets cannot form markup.\n */\n\nimport {\n  BUNDLE_MINIMUM_REVISION_PARAM,\n  BUNDLE_SIGNING_KEY_PARAM,\n  PAIRING_CLAIM_ROUTE,\n  PAIRING_STATUS_QUERY,\n  PAIRING_STATUS_ROUTE,\n  PASSKEY_REGISTER_BEGIN_ROUTE,\n  PASSKEY_REGISTER_FINISH_ROUTE,\n  REMOTE_API_ROUTE,\n} from '../../constants/remote';\nimport { type BundlePairingTrust } from '../../types/remote';\n\n/** Asserted by the tunnel self-test to prove the pairing route is reachable end to end. */\nexport const PAIRING_PAGE_MARKER = 'doompi-pairing-page';\n\n/** How often the phone asks whether the host has answered. */\nconst POLL_INTERVAL_MS = 1000;\n\nexport interface PairingPageInput {\n  /** Per-response nonce; the CSP admits exactly this one inline script. */\n  nonce: string;\n  /** Local-loopback bootstrap trust. Remote callers must bring it in the QR fragment. */\n  localTrust?: BundlePairingTrust;\n}\n\nexport function pairingPageCsp(nonce: string): string {\n  return [\n    \"default-src 'none'\",\n    \"style-src 'unsafe-inline'\",\n    `script-src 'nonce-${nonce}' 'self'`,\n    \"connect-src 'self'\",\n    \"img-src 'self'\",\n    \"manifest-src 'self'\",\n    \"worker-src 'self'\",\n    \"base-uri 'none'\",\n    \"form-action 'none'\",\n    \"frame-ancestors 'none'\",\n  ].join('; ');\n}\n\nexport function pairingPageHeaders(nonce: string): Record<string, string> {\n  return {\n    'Content-Type': 'text/html; charset=utf-8',\n    'Cache-Control': 'no-store',\n    'Referrer-Policy': 'no-referrer',\n    'X-Frame-Options': 'DENY',\n    'Content-Security-Policy': pairingPageCsp(nonce),\n  };\n}\n\n/**\n * Colours are literals here rather than theme tokens on purpose: this page\n * renders before, and without, the cockpit bundle that defines the tokens, and\n * it lives outside `src/web` so the browser theming rule does not reach it.\n */\nconst STYLE = `\n  :root { color-scheme: dark; }\n  body {\n    margin: 0; min-height: 100vh; display: grid; place-items: center;\n    background: #14161a; color: #e6e8ec;\n    font: 16px/1.5 ui-sans-serif, system-ui, -apple-system, sans-serif;\n  }\n  main { width: min(30rem, 100% - 2.5rem); text-align: center; }\n  [hidden] { display: none !important; }\n  h1 { font-size: 1.25rem; font-weight: 600; margin: 0 0 0.5rem; }\n  p { margin: 0 0 1rem; color: #a2a8b4; }\n  .state { font-weight: 600; color: #e6e8ec; }\n  .bad { color: #ff6b6b; }\n  .ok { color: #6bd68a; }\n  form, .actions { display: flex; gap: 0.5rem; margin-top: 1.5rem; }\n  input, button {\n    font: inherit; padding: 0.6rem 0.8rem; border-radius: 0.5rem;\n    border: 1px solid #2c313a; background: #1b1e24; color: inherit;\n  }\n  input { flex: 1; min-width: 0; }\n  button { flex: 1; background: #2f6feb; border-color: #2f6feb; font-weight: 600; }\n  button.secondary { background: #1b1e24; border-color: #2c313a; }\n  button:disabled { opacity: 0.6; }\n  video { width: 100%; max-height: 18rem; border-radius: 0.75rem; margin-top: 1rem; }\n  code { display: block; overflow-wrap: anywhere; margin: 0.75rem 0; color: #e6e8ec; }\n`;\n\n/**\n * The client half of the pairing handshake.\n *\n * The code arrives in the URL fragment, which no browser sends to any server,\n * so it never reaches Cloudflare's edge logs, this process's access log, or a\n * Referer header. It is scrubbed from the address bar before anything else\n * runs, so a screenshot or a shared history entry does not carry it either.\n */\nconst SCRIPT = `\n  const params = new URLSearchParams(location.hash.slice(1));\n  const code = params.get('c') ?? '';\n  const state = document.getElementById('state');\n  const manual = document.getElementById('manual');\n  const actions = document.getElementById('actions');\n  const addPasskey = document.getElementById('add-passkey');\n  const skipPasskey = document.getElementById('skip-passkey');\n  const trustPanel = document.getElementById('trust');\n  const trustFingerprint = document.getElementById('trust-fingerprint');\n  const acceptTrust = document.getElementById('accept-trust');\n  const say = (text, tone) => { state.textContent = text; state.className = 'state ' + (tone ?? ''); };\n  const openCockpit = () => location.replace('/');\n\n  function trustOf(value) {\n    if (!value || typeof value.publicKey !== 'string' || !/^[A-Za-z0-9_-]{80,512}$/.test(value.publicKey)) return undefined;\n    const revision = Number(value.revision);\n    if (!Number.isSafeInteger(revision) || revision < 1) return undefined;\n    return { publicKey: value.publicKey, revision, fingerprint: typeof value.fingerprint === 'string' ? value.fingerprint : '' };\n  }\n\n  const scannedTrust = trustOf({\n    publicKey: params.get('${BUNDLE_SIGNING_KEY_PARAM}'),\n    revision: params.get('${BUNDLE_MINIMUM_REVISION_PARAM}'),\n  });\n  let fragmentClaimStarted = code !== '';\n  const localTrust = trustOf({\n    publicKey: document.body.dataset.localSigner,\n    revision: document.body.dataset.localRevision,\n    fingerprint: document.body.dataset.localFingerprint,\n  });\n\n  function rememberChannelKey(value) {\n    if (typeof value !== 'string' || value === '') return false;\n    try { sessionStorage.setItem('doompi.channelKey', value); return true; } catch { return false; }\n  }\n  rememberChannelKey(params.get('k'));\n  history.replaceState(null, '', location.pathname);\n  window.addEventListener('hashchange', () => {\n    const nextParams = new URLSearchParams(location.hash.slice(1));\n    const nextCode = nextParams.get('c') ?? '';\n    if (nextCode === '') return;\n    fragmentClaimStarted = true;\n    const nextTrust = trustOf({\n      publicKey: nextParams.get('${BUNDLE_SIGNING_KEY_PARAM}'),\n      revision: nextParams.get('${BUNDLE_MINIMUM_REVISION_PARAM}'),\n    });\n    rememberChannelKey(nextParams.get('k'));\n    history.replaceState(null, '', location.pathname);\n    void claim(nextCode, nextTrust);\n  });\n\n  async function requestWorker(message) {\n    if (!('serviceWorker' in navigator)) return { ok: false, message: 'This browser cannot install the trusted verifier.' };\n    let registration;\n    try {\n      registration = await Promise.race([\n        navigator.serviceWorker.ready,\n        new Promise((_, reject) => setTimeout(() => reject(new Error('The trusted verifier did not start.')), 20000)),\n      ]);\n    } catch (error) {\n      return { ok: false, message: error?.message ?? 'The trusted verifier did not start.' };\n    }\n    const serviceWorker = registration.active ?? registration.waiting ?? registration.installing;\n    if (!serviceWorker) return { ok: false, message: 'The trusted verifier is unavailable.' };\n    const channel = new MessageChannel();\n    return await new Promise((resolve) => {\n      const timer = setTimeout(() => resolve({ ok: false, message: 'Bundle verification timed out.' }), 120000);\n      channel.port1.addEventListener('message', (event) => {\n        clearTimeout(timer);\n        resolve(event.data && typeof event.data.ok === 'boolean' ? event.data : { ok: false, message: 'The verifier returned invalid data.' });\n      }, { once: true });\n      channel.port1.start();\n      serviceWorker.postMessage(message, [channel.port2]);\n    });\n  }\n\n  /**\n   * Names the refusal in terms of what the person has to do about it.\n   *\n   * A rotated host key reaches the verifier as untrusted-public-key rather than\n   * signer-mismatch, because a refresh always re-sends the pinned key and only\n   * the signature check can notice the host moved on.\n   */\n  function bundleRefusalMessage(result) {\n    if (result.code === 'untrusted-public-key')\n      return 'This host now signs with a different key. Scan a fresh pairing QR so you can confirm the new fingerprint.';\n    if (result.code === 'stale-revision')\n      return 'This host offers an older cockpit build than this device already verified. Clear this site data to accept it.';\n    return result.message ?? 'The signed cockpit bundle was refused.';\n  }\n\n  async function activateTrust(trust, alreadyConfirmed = false) {\n    say('Verifying every cockpit file before it can run.');\n    let result = await requestWorker({ type: 'doompi:activate-bundle', publicKey: trust.publicKey, minimumRevision: trust.revision });\n    if (!result.ok && result.code === 'signer-mismatch') {\n      if (!alreadyConfirmed && !(await confirmManualTrust(trust))) return false;\n      say('Resetting the old host key and verifying the newly paired host.');\n      const reset = await requestWorker({ type: 'doompi:reset-bundle-trust' });\n      if (!reset.ok) { say(reset.message ?? 'The old host key could not be reset.', 'bad'); return false; }\n      result = await requestWorker({ type: 'doompi:activate-bundle', publicKey: trust.publicKey, minimumRevision: trust.revision });\n    }\n    if (!result.ok) {\n      say(bundleRefusalMessage(result), 'bad');\n      return false;\n    }\n    return true;\n  }\n\n  function offerPasskey() {\n    if (!window.PublicKeyCredential) {\n      say('Paired and verified. Opening the cockpit.', 'ok');\n      setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});\n      return;\n    }\n    say('Paired and verified. Add a passkey to use Face ID, Touch ID, or your device PIN next time.', 'ok');\n    actions.hidden = false;\n  }\n\n  async function signingFingerprint(publicKey) {\n    try {\n      const normalized = publicKey.replaceAll('-', '+').replaceAll('_', '/');\n      const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');\n      const bytes = Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));\n      const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));\n      return Array.from(digest, (byte) => byte.toString(16).padStart(2, '0')).join('');\n    } catch {\n      return 'unavailable';\n    }\n  }\n\n  async function confirmManualTrust(trust) {\n    const fingerprint = trust.fingerprint || await signingFingerprint(trust.publicKey);\n    return await new Promise((resolve) => {\n      trustFingerprint.textContent = fingerprint.match(/.{1,8}/g)?.join(' ') ?? fingerprint;\n      trustPanel.hidden = false;\n      say('Compare this signing-key fingerprint with the one shown on the host.');\n      acceptTrust.addEventListener('click', () => { trustPanel.hidden = true; resolve(true); }, { once: true });\n    });\n  }\n\n  async function poll(requestId) {\n    for (;;) {\n      await new Promise((resolve) => setTimeout(resolve, ${String(POLL_INTERVAL_MS)}));\n      const response = await fetch('${PAIRING_STATUS_ROUTE}?${PAIRING_STATUS_QUERY}=' + encodeURIComponent(requestId), { credentials: 'same-origin' });\n      if (!response.ok) { say('This pairing request is no longer valid. Scan again.', 'bad'); return undefined; }\n      const body = await response.json();\n      if (body.status === 'approved') return body;\n      if (body.status === 'denied') { say('The host denied this device.', 'bad'); return undefined; }\n      if (body.status === 'expired') { say('The request timed out. Scan again.', 'bad'); return undefined; }\n    }\n  }\n\n  async function claim(value, candidateTrust) {\n    if (value === '') { say('Scan the code shown on the host or enter its manual code.', 'bad'); manual.hidden = false; return; }\n    say('Asking the host to approve this device...');\n    const response = await fetch('${PAIRING_CLAIM_ROUTE}', {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      credentials: 'same-origin',\n      body: JSON.stringify({ code: value }),\n    });\n    if (!response.ok) {\n      say(response.status === 429 ? 'Too many attempts. Wait a minute.' : 'That code is not valid. Scan again.', 'bad');\n      manual.hidden = false;\n      return;\n    }\n    const claimed = await response.json();\n    say('Waiting for the host to approve this device.');\n    const approved = await poll(claimed.requestId);\n    if (!approved) return;\n    rememberChannelKey(approved.hostPublicKey);\n    const trust = candidateTrust ?? trustOf(approved.bundleTrust);\n    if (!trust) { say('The host did not provide signed-bundle trust. Pair again.', 'bad'); return; }\n    if (!candidateTrust && !(await confirmManualTrust(trust))) return;\n    if (await activateTrust(trust, !candidateTrust)) offerPasskey();\n  }\n\n  const fromBase64Url = (value) =>\n    Uint8Array.from(atob(value.replaceAll('-', '+').replaceAll('_', '/')), (c) => c.charCodeAt(0));\n  const toBase64Url = (buffer) =>\n    btoa(String.fromCharCode(...new Uint8Array(buffer))).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');\n\n  function decodeAuthenticationOptions(options) {\n    return {\n      ...options,\n      challenge: fromBase64Url(options.challenge),\n      allowCredentials: (options.allowCredentials ?? []).map((entry) => ({ ...entry, id: fromBase64Url(entry.id) })),\n    };\n  }\n\n  function decodeRegistrationOptions(options) {\n    return {\n      ...options,\n      challenge: fromBase64Url(options.challenge),\n      user: { ...options.user, id: fromBase64Url(options.user.id) },\n      excludeCredentials: (options.excludeCredentials ?? []).map((entry) => ({ ...entry, id: fromBase64Url(entry.id) })),\n    };\n  }\n\n  function encodeCredential(credential) {\n    const assertion = credential.response;\n    return {\n      id: credential.id,\n      rawId: toBase64Url(credential.rawId),\n      type: credential.type,\n      clientExtensionResults: credential.getClientExtensionResults(),\n      response: {\n        clientDataJSON: toBase64Url(assertion.clientDataJSON),\n        authenticatorData: toBase64Url(assertion.authenticatorData),\n        signature: toBase64Url(assertion.signature),\n        userHandle: assertion.userHandle ? toBase64Url(assertion.userHandle) : undefined,\n      },\n    };\n  }\n\n  function encodeRegistrationCredential(credential) {\n    const attestation = credential.response;\n    return {\n      id: credential.id,\n      rawId: toBase64Url(credential.rawId),\n      type: credential.type,\n      authenticatorAttachment: credential.authenticatorAttachment,\n      clientExtensionResults: credential.getClientExtensionResults(),\n      response: {\n        clientDataJSON: toBase64Url(attestation.clientDataJSON),\n        attestationObject: toBase64Url(attestation.attestationObject),\n        transports: typeof attestation.getTransports === 'function' ? attestation.getTransports() : [],\n      },\n    };\n  }\n\n  async function passkeySignIn() {\n    if (!window.PublicKeyCredential) return false;\n    try {\n      const begun = await fetch('${REMOTE_API_ROUTE}/passkeys/authenticate/begin', {\n        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: '{}',\n      });\n      if (!begun.ok) return false;\n      const { ceremonyId, options } = await begun.json();\n      if (typeof ceremonyId !== 'string') return false;\n      const credential = await navigator.credentials.get({ publicKey: decodeAuthenticationOptions(options) });\n      if (!credential) return false;\n      const finished = await fetch('${REMOTE_API_ROUTE}/passkeys/authenticate/finish', {\n        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin',\n        body: JSON.stringify({ ceremonyId, response: encodeCredential(credential) }),\n      });\n      if (!finished.ok) return false;\n      const result = await finished.json();\n      if (!rememberChannelKey(result.hostPublicKey)) return false;\n      const refreshed = await requestWorker({ type: 'doompi:refresh-bundle' });\n      // A host this device cannot reach is not a trust decision. The pin is the\n      // last bundle this device verified for itself, so it stays usable while\n      // the host is away. Every other refusal is a trust decision and still\n      // blocks entry.\n      if (!refreshed.ok && refreshed.code === 'manifest-fetch') {\n        say('Could not check for a newer cockpit build. Opening the last verified one.');\n        return true;\n      }\n      if (!refreshed.ok) say(bundleRefusalMessage(refreshed), 'bad');\n      return refreshed.ok;\n    } catch {\n      return false;\n    }\n  }\n\n  async function registerPasskey() {\n    addPasskey.disabled = true;\n    skipPasskey.disabled = true;\n    say('Confirm passkey setup on this device.');\n    try {\n      const begun = await fetch('${PASSKEY_REGISTER_BEGIN_ROUTE}', {\n        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: '{}',\n      });\n      if (!begun.ok) throw new Error('Passkey setup is unavailable.');\n      const { ceremonyId, options } = await begun.json();\n      if (typeof ceremonyId !== 'string') throw new Error('Passkey setup is unavailable.');\n      const credential = await navigator.credentials.create({ publicKey: decodeRegistrationOptions(options) });\n      if (!credential) throw new Error('Passkey setup was cancelled.');\n      const finished = await fetch('${PASSKEY_REGISTER_FINISH_ROUTE}', {\n        method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin',\n        body: JSON.stringify({ ceremonyId, response: encodeRegistrationCredential(credential) }),\n      });\n      if (!finished.ok) throw new Error('That passkey was not accepted.');\n      say('Passkey added. Opening the cockpit.', 'ok');\n      setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});\n    } catch (error) {\n      if (error?.name === 'InvalidStateError') {\n        say('A passkey for this site already exists. Opening the cockpit.', 'ok');\n        setTimeout(openCockpit, ${String(POLL_INTERVAL_MS)});\n        return;\n      }\n      say(error?.name === 'NotAllowedError' ? 'Passkey setup was cancelled.' : (error?.message ?? 'Passkey setup failed.'), 'bad');\n      addPasskey.disabled = false;\n      skipPasskey.disabled = false;\n    }\n  }\n\n  manual.addEventListener('submit', (event) => {\n    event.preventDefault();\n    manual.hidden = true;\n    void claim(new FormData(manual).get('code')?.toString().trim() ?? '', undefined);\n  });\n  addPasskey.addEventListener('click', () => void registerPasskey());\n  skipPasskey.addEventListener('click', openCockpit);\n\n  void (async () => {\n    if (localTrust) {\n      if (await activateTrust(localTrust)) openCockpit();\n      return;\n    }\n    if (code !== '') { await claim(code, scannedTrust); return; }\n    say('Checking for a passkey on this device...');\n    if (await passkeySignIn()) { say('Signed in and verified. Opening the cockpit.', 'ok'); openCockpit(); return; }\n    if (!fragmentClaimStarted) await claim('', undefined);\n  })();\n`;\n\nexport function pairingPageHtml(input: PairingPageInput): string {\n  const localSigner = input.localTrust?.publicKey ?? '';\n  const localRevision = input.localTrust?.revision ?? '';\n  const localFingerprint = input.localTrust?.fingerprint ?? '';\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<meta name=\"robots\" content=\"noindex, nofollow\">\n<meta name=\"theme-color\" content=\"#14161a\">\n<link rel=\"manifest\" href=\"/manifest.webmanifest\">\n<title>Pair with DoomPi</title>\n<style>${STYLE}</style>\n</head>\n<body data-marker=\"${PAIRING_PAGE_MARKER}\" data-local-signer=\"${localSigner}\" data-local-revision=\"${String(localRevision)}\" data-local-fingerprint=\"${localFingerprint}\">\n<main>\n  <h1>Pair this device</h1>\n  <p>This cockpit can run shell commands on the host machine. Pair only your own device.</p>\n  <p id=\"state\" class=\"state\">Starting.</p>\n  <form id=\"manual\" hidden>\n    <input name=\"code\" inputmode=\"numeric\" pattern=\"[0-9]{8}\" maxlength=\"8\" autocomplete=\"one-time-code\" placeholder=\"8-digit pairing code\" aria-label=\"8-digit pairing code\">\n    <button type=\"submit\">Pair</button>\n  </form>\n  <div id=\"trust\" hidden>\n    <p>Signing-key fingerprint</p>\n    <code id=\"trust-fingerprint\"></code>\n    <button id=\"accept-trust\" type=\"button\">Fingerprint matches</button>\n  </div>\n  <div id=\"actions\" class=\"actions\" hidden>\n    <button id=\"add-passkey\" type=\"button\">Add passkey</button>\n    <button id=\"skip-passkey\" class=\"secondary\" type=\"button\">Not now</button>\n  </div>\n  <section id=\"scanner\">\n    <p id=\"pwa-status\" role=\"status\">Checking browser support.</p>\n    <video id=\"camera\" playsinline muted hidden></video>\n    <div class=\"actions\">\n      <button id=\"scan\" type=\"button\">Scan pairing QR</button>\n      <button id=\"cancel\" class=\"secondary\" type=\"button\" hidden>Cancel</button>\n    </div>\n  </section>\n  <noscript><p class=\"bad\">Pairing needs JavaScript, because the code never leaves your browser.</p></noscript>\n</main>\n<script nonce=\"${input.nonce}\">${SCRIPT}</script>\n<script type=\"module\" src=\"/pwa/pwa.js\"></script>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,MAAa,sBAAsB;;AAGnC,MAAM,mBAAmB;AASzB,SAAgB,eAAe,OAAuB;CACpD,OAAO;EACL;EACA;EACA,qBAAqB,MAAM;EAC3B;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,mBAAmB,OAAuC;CACxE,OAAO;EACL,gBAAgB;EAChB,iBAAiB;EACjB,mBAAmB;EACnB,mBAAmB;EACnB,2BAA2B,eAAe,KAAK;CACjD;AACF;;;;;;AAOA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCd,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgHiB,OAAO,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DA+BE,OAAO,gBAAgB,EAAE;sCAC9CA,eAAAA,qBAAqB,GAAGC,eAAAA,qBAAqB;;;;;;;;;;;;oCAY/CC,eAAAA,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+ErBC,eAAAA,iBAAiB;;;;;;;;sCAQdA,eAAAA,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA4BpBC,eAAAA,6BAA6B;;;;;;;;sCAQ1BC,eAAAA,8BAA8B;;;;;;gCAMpC,OAAO,gBAAgB,EAAE;;;;kCAIvB,OAAO,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6B3D,SAAgB,gBAAgB,OAAiC;CAC/D,MAAM,cAAc,MAAM,YAAY,aAAa;CACnD,MAAM,gBAAgB,MAAM,YAAY,YAAY;CACpD,MAAM,mBAAmB,MAAM,YAAY,eAAe;CAC1D,OAAO;;;;;;;;;SASA,MAAM;;qBAEM,oBAAoB,uBAAuB,YAAY,yBAAyB,OAAO,aAAa,EAAE,4BAA4B,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BvJ,MAAM,MAAM,IAAI,OAAO;;;;AAIxC"}