@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/remoteAccess/index.cjs

@@ -0,0 +1,393 @@
+const require_remote = require("../../constants/remote.cjs");
+const require_index = require("../deviceSessions/index.cjs");
+const require_index$1 = require("../deviceAuth/index.cjs");
+const require_index$2 = require("../pairingFlow/index.cjs");
+const require_index$3 = require("../remoteAccessSettings/index.cjs");
+const require_index$4 = require("../remoteGuardPolicy/index.cjs");
+const require_index$5 = require("../webauthn/index.cjs");
+let node_crypto = require("node:crypto");
+let _agimon_ai_doompi_web_security_node = require("@agimon-ai/doompi-web-security/node");
+let _agimon_ai_doompi_web_security = require("@agimon-ai/doompi-web-security");
+//#region src/services/remoteAccess/index.ts
+const TOKEN_BYTES = 32;
+const SWEEP_INTERVAL_MS = 3e5;
+const MS_PER_MINUTE = 6e4;
+function bundlePairingTrust(value) {
+	if (value === void 0) return void 0;
+	return {
+		...value,
+		fingerprint: (0, node_crypto.createHash)("sha256").update(Buffer.from(value.publicKey, "base64url")).digest("hex")
+	};
+}
+function createRemoteAccess(options) {
+	const notice = options.onNotice ?? (() => {});
+	const now = options.now ?? (() => Date.now());
+	const broadcastLocal = options.broadcastLocal ?? (() => {});
+	const broadcastAll = options.broadcastAll ?? (() => {});
+	let settings = options.store.settings();
+	let status = "off";
+	let listener;
+	let stopTunnel;
+	let tunnelStartup;
+	let publicOrigin;
+	let policy;
+	let startedAt;
+	let closesAt;
+	let failure;
+	/** Settings an `enable` asked to hand over with, waiting for its response to flush. */
+	let pendingHandover;
+	let autoCloseTimer;
+	/** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */
+	let handshake;
+	const channels = /* @__PURE__ */ new Map();
+	const sockets = /* @__PURE__ */ new Map();
+	const channelKey = (deviceId, scope) => `${deviceId}:${scope}`;
+	const dropDeviceAccess = (deviceId, reason) => {
+		options.onDeviceDropped?.(deviceId);
+		for (const scope of [
+			"session",
+			"protocol",
+			"http"
+		]) channels.delete(channelKey(deviceId, scope));
+		const held = sockets.get(deviceId);
+		sockets.delete(deviceId);
+		for (const close of held ?? []) try {
+			close(1008, `device ${reason}`);
+		} catch {}
+	};
+	const devices = require_index$1.createDeviceAuth({
+		settings: () => settings,
+		now,
+		onNotice: notice,
+		onDrop: (record, reason) => dropDeviceAccess(record.id, reason)
+	});
+	const webauthn = require_index$5.createWebAuthn({
+		publicOrigin: () => publicOrigin,
+		credentials: () => options.store.credentials(),
+		saveCredential: (credential) => options.store.saveCredential(credential),
+		removeCredential: (id) => options.store.removeCredential(id),
+		now,
+		onNotice: notice
+	});
+	const pairing = require_index$2.createPairingFlow({
+		randomToken: () => (0, node_crypto.randomBytes)(TOKEN_BYTES).toString("base64url"),
+		randomManualCode: () => (0, node_crypto.randomInt)(1e8).toString().padStart(8, "0"),
+		digest: (token) => (0, node_crypto.createHash)("sha256").update(token).digest("hex"),
+		now,
+		onNotice: notice
+	});
+	const sweeper = setInterval(() => {
+		devices.sweep();
+		pairing.sweep();
+	}, SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	function publish() {
+		broadcastAll({
+			type: require_remote.REMOTE_STATE_TYPE,
+			state: view(void 0, false)
+		});
+	}
+	function view(selfDeviceId, forLocalCaller) {
+		return {
+			status,
+			...publicOrigin === void 0 ? {} : { publicUrl: publicOrigin },
+			...startedAt === void 0 ? {} : { startedAt: new Date(startedAt).toISOString() },
+			...closesAt === void 0 ? {} : { closesAt: new Date(closesAt).toISOString() },
+			...failure === void 0 ? {} : { error: failure },
+			devices: devices.list().map((record) => ({
+				id: record.id,
+				label: record.label,
+				userAgent: record.userAgent,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: record.id === selfDeviceId
+			})),
+			pending: forLocalCaller ? pairing.pending().map((request) => ({
+				id: request.id,
+				userAgent: request.userAgent,
+				edgeIp: request.edgeIp,
+				createdAt: new Date(request.createdAt).toISOString(),
+				expiresAt: new Date(request.createdAt + 18e4).toISOString()
+			})) : [],
+			settings
+		};
+	}
+	function armAutoClose() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		if (!settings.autoCloseEnabled || status !== "on") return;
+		closesAt = now() + settings.autoCloseMinutes * MS_PER_MINUTE;
+		autoCloseTimer = setTimeout(() => {
+			notice("remote access reached its time limit; closing");
+			disable();
+		}, settings.autoCloseMinutes * MS_PER_MINUTE);
+		autoCloseTimer.unref();
+	}
+	/** Everything teardown has to do, in the order it has to happen. */
+	async function teardown() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		for (const held of sockets.values()) for (const close of held) try {
+			close(1008, "remote access revoked");
+		} catch {}
+		sockets.clear();
+		const starting = tunnelStartup;
+		tunnelStartup = void 0;
+		starting?.controller.abort();
+		const startingOutcome = await starting?.outcome.catch(() => void 0);
+		if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => void 0);
+		await stopTunnel?.().catch(() => void 0);
+		stopTunnel = void 0;
+		await listener?.close().catch(() => void 0);
+		listener = void 0;
+		publicOrigin = void 0;
+		policy = void 0;
+		startedAt = void 0;
+		pairing.clear();
+		webauthn.clearChallenges();
+		handshake = void 0;
+		channels.clear();
+		devices.revokeAll();
+	}
+	async function disable() {
+		if (status === "off") return;
+		await teardown();
+		status = "off";
+		failure = void 0;
+		notice("remote access off");
+		publish();
+	}
+	return {
+		state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),
+		settings: () => settings,
+		publicOrigin: () => publicOrigin,
+		updateSettings(patch) {
+			const parsed = require_index$3.parseRemoteAccessSettings(require_index$3.serializeRemoteAccessSettings({
+				...settings,
+				...patch
+			}));
+			for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);
+			settings = parsed.settings;
+			options.store.save(settings);
+			devices.reschedule();
+			armAutoClose();
+			publish();
+			return settings;
+		},
+		/**
+		* Runs a handover `enable` deferred, once its response is on the wire.
+		*
+		* Split out rather than done inside `enable` because the reply and the
+		* teardown travel over the same socket, and doing them in the wrong order
+		* leaves the caller unable to tell success from a dropped connection.
+		*/
+		commitHandover() {
+			const handing = pendingHandover;
+			if (handing === void 0) return;
+			pendingHandover = void 0;
+			notice("handing the cockpit over to a container");
+			options.requestHandover?.(handing);
+		},
+		/** True between a contained `enable` and the handover its response defers. */
+		handoverPending: () => pendingHandover !== void 0,
+		tunnelPort: () => listener?.port,
+		tunnelPolicy: () => policy,
+		async enable() {
+			if (status === "on" || status === "starting") return { ok: true };
+			status = "starting";
+			failure = void 0;
+			publish();
+			if (settings.sandbox.enabled && options.contained !== true) {
+				if (settings.sandbox.workspaces.length === 0) {
+					status = "failed";
+					failure = "Add at least one workspace before running the cockpit in a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				if (options.requestHandover === void 0) {
+					status = "failed";
+					failure = "This cockpit cannot hand over to a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				pendingHandover = settings;
+				return { ok: true };
+			}
+			let bound;
+			try {
+				bound = await options.bindListener();
+			} catch (error) {
+				status = "failed";
+				failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;
+				publish();
+				return {
+					ok: false,
+					error: failure
+				};
+			}
+			listener = bound;
+			const controller = new AbortController();
+			const launching = options.launchTunnel({
+				port: bound.port,
+				config: settings.tunnel,
+				signal: controller.signal,
+				acceptOrigin: (origin) => {
+					policy = require_index$4.tunnelOriginPolicy(origin);
+				}
+			});
+			const startup = {
+				controller,
+				outcome: launching
+			};
+			tunnelStartup = startup;
+			const outcome = await launching;
+			if (tunnelStartup !== startup || controller.signal.aborted) return {
+				ok: false,
+				error: "Tunnel startup was cancelled."
+			};
+			tunnelStartup = void 0;
+			if (!outcome.ok) {
+				await teardown();
+				status = "failed";
+				failure = outcome.message;
+				notice(`remote access failed: ${outcome.message}`);
+				publish();
+				return {
+					ok: false,
+					error: outcome.message
+				};
+			}
+			stopTunnel = outcome.stop;
+			handshake = (0, _agimon_ai_doompi_web_security_node.createHostHandshake)();
+			publicOrigin = outcome.publicOrigin;
+			policy = require_index$4.tunnelOriginPolicy(outcome.publicOrigin);
+			startedAt = now();
+			status = "on";
+			armAutoClose();
+			notice(`remote access on at ${outcome.publicOrigin}`);
+			publish();
+			return { ok: true };
+		},
+		disable,
+		mintPairing() {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const trust = bundlePairingTrust(options.bundleTrust?.());
+			if (trust === void 0) return void 0;
+			const { code, manualCode, expiresAt } = pairing.mintCode();
+			const fragment = new URLSearchParams({
+				c: code,
+				[_agimon_ai_doompi_web_security.SEALED_KEY_PARAM]: handshake.publicKey,
+				["s"]: trust.publicKey,
+				["r"]: String(trust.revision)
+			});
+			return {
+				code,
+				manualCode,
+				pairUrl: `${publicOrigin}${require_remote.PAIRING_PAGE_ROUTE}#${fragment.toString()}`,
+				expiresAt: new Date(expiresAt).toISOString(),
+				...trust
+			};
+		},
+		bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),
+		claim(input) {
+			const outcome = pairing.claim(input);
+			if (outcome.ok) broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		pairingStatus: (requestId) => pairing.status(requestId),
+		approve(requestId) {
+			const outcome = pairing.approve(requestId);
+			if (outcome === "approved") broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		deny(requestId) {
+			const outcome = pairing.deny(requestId);
+			if (outcome === "denied") broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		redeem(requestId) {
+			const approved = pairing.consume(requestId);
+			if (approved === void 0) return void 0;
+			const enrolled = devices.enrol({ userAgent: approved.userAgent });
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: require_index.cookieMaxAgeSeconds(settings, require_remote.COOKIE_CEILING_SECONDS)
+			};
+		},
+		authorize: (token) => devices.verify(token)?.id,
+		sessionForPasskey(label) {
+			const enrolled = devices.enrol({ userAgent: label });
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: require_index.cookieMaxAgeSeconds(settings, require_remote.COOKIE_CEILING_SECONDS)
+			};
+		},
+		passkeys: () => ({
+			support: () => webauthn.support(),
+			list: () => options.store.credentials(),
+			beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),
+			finishRegistration: async (ceremonyId, caller, response, label) => await webauthn.finishRegistration(ceremonyId, caller, response, label),
+			beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),
+			finishAuthentication: async (ceremonyId, caller, response) => await webauthn.finishAuthentication(ceremonyId, caller, response),
+			beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),
+			finishStepUp: async (ceremonyId, caller, action, response) => await webauthn.finishStepUp(ceremonyId, caller, action, response),
+			forget: (id) => {
+				const forgotten = options.store.removeCredential(id);
+				if (forgotten) publish();
+				return forgotten;
+			}
+		}),
+		stepUpRequired: () => webauthn.support().supported,
+		channelPublicKey: () => handshake?.publicKey,
+		openChannel(deviceId, scope, clientPublicKey) {
+			const channel = handshake?.accept(clientPublicKey);
+			if (channel === void 0) return false;
+			channels.set(channelKey(deviceId, scope), channel);
+			return true;
+		},
+		channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),
+		revokeDevice(id) {
+			const revoked = devices.revoke(id);
+			if (revoked) publish();
+			return revoked;
+		},
+		isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,
+		trackSocket(deviceId, close) {
+			const held = sockets.get(deviceId) ?? /* @__PURE__ */ new Set();
+			held.add(close);
+			sockets.set(deviceId, held);
+			return () => {
+				held.delete(close);
+				if (held.size === 0) sockets.delete(deviceId);
+			};
+		},
+		async close() {
+			clearInterval(sweeper);
+			await teardown();
+			status = "off";
+		}
+	};
+}
+//#endregion
+exports.createRemoteAccess = createRemoteAccess;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/remoteAccess/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createHash","createDeviceAuth","createWebAuthn","createPairingFlow","randomBytes","randomInt","REMOTE_STATE_TYPE","parseRemoteAccessSettings","serializeRemoteAccessSettings","tunnelOriginPolicy","createHostHandshake","SEALED_KEY_PARAM","PAIRING_PAGE_ROUTE","REMOTE_PAIRING_REQUEST_TYPE","cookieMaxAgeSeconds","COOKIE_CEILING_SECONDS"],"sources":["../../../src/services/remoteAccess/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomInt } from 'node:crypto';\n\nimport { SEALED_KEY_PARAM } from '@agimon-ai/doompi-web-security';\nimport { createHostHandshake, type HostHandshake, type SealedChannel } from '@agimon-ai/doompi-web-security/node';\n\nimport {\n  BUNDLE_MINIMUM_REVISION_PARAM,\n  BUNDLE_SIGNING_KEY_PARAM,\n  PAIRING_PAGE_ROUTE,\n  REMOTE_PAIRING_REQUEST_TYPE,\n  REMOTE_STATE_TYPE,\n} from '../../constants/remote';\nimport { COOKIE_CEILING_SECONDS } from '../../constants/remote';\nimport {\n  type BundlePairingTrust,\n  type PairingStatus,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n  type RemoteAccessStatus,\n  type RemoteChannelScope,\n  type TunnelLauncher,\n  type TunnelStartResult,\n} from '../../types/remote';\nimport { createDeviceAuth, type DeviceAuth, type EnrolledDevice } from '../deviceAuth';\nimport { cookieMaxAgeSeconds } from '../deviceSessions';\nimport { createPairingFlow, type PairingFlow } from '../pairingFlow';\nimport { parseRemoteAccessSettings, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { RemoteAccessStore } from '../remoteAccessStore';\nimport { type OriginPolicy, tunnelOriginPolicy } from '../remoteGuardPolicy';\nimport { createWebAuthn, type PasskeySupport, type WebAuthn } from '../webauthn';\nimport type { StepUpAction, StoredCredential } from '../webauthnPolicy';\n\nconst TOKEN_BYTES = 32;\nconst SWEEP_INTERVAL_MS = 5 * 60_000;\nconst MS_PER_MINUTE = 60_000;\n\n/** The tunnel listener, bound by the host so this file never imports an HTTP server. */\nexport interface TunnelListener {\n  port: number;\n  close: () => Promise<void>;\n}\n\nexport interface RemoteAccessOptions {\n  store: RemoteAccessStore;\n  launchTunnel: TunnelLauncher;\n  /** Binds a fresh loopback listener for the tunnel to point at. */\n  bindListener: () => Promise<TunnelListener>;\n  /** Current signed publication authenticated through the physical pairing display. */\n  bundleTrust?: () => { publicKey: string; revision: number } | undefined;\n  /** Removes ephemeral state owned by a paired device when its authorization ends. */\n  onDeviceDropped?: (deviceId: string) => void;\n  onNotice?: (message: string) => void;\n  /** Frames only the local cockpit may see, such as an approval prompt. */\n  broadcastLocal?: (frame: object) => void;\n  /** Frames both local and remote pages see. */\n  broadcastAll?: (frame: object) => void;\n  /**\n   * Asks the launcher to hand this cockpit over to a container.\n   *\n   * A signal rather than a call that does the work, because handing over means\n   * closing the server this code is running inside, which it cannot do to\n   * itself. The launcher owns that sequence and the rollback if it fails.\n   */\n  requestHandover?: (settings: RemoteAccessSettings) => void;\n  /**\n   * Whether this cockpit is already the one inside the container.\n   *\n   * Without it the contained hub would read the same settings it was handed and\n   * try to hand over again, to a container inside a container.\n   */\n  contained?: boolean;\n  now?: () => number;\n}\n\nexport interface RemoteAccess {\n  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;\n  settings(): RemoteAccessSettings;\n  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;\n  tunnelPort(): number | undefined;\n  /** The public origin the tunnel currently answers on, while one is up. */\n  publicOrigin(): string | undefined;\n  tunnelPolicy(): OriginPolicy | undefined;\n  enable(): Promise<{ ok: true } | { ok: false; error: string }>;\n  /** True between a contained `enable` and the handover its response defers. */\n  handoverPending(): boolean;\n  /** Runs that deferred handover, once the response asking for it is on the wire. */\n  commitHandover(): void;\n  disable(): Promise<void>;\n  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */\n  mintPairing():\n    | ({ code: string; manualCode: string; pairUrl: string; expiresAt: string } & BundlePairingTrust)\n    | undefined;\n  bundleTrust(): BundlePairingTrust | undefined;\n  claim(input: {\n    code: string;\n    userAgent: string | undefined;\n    edgeIp: string | undefined;\n    sourceAddress: string | undefined;\n  }): ReturnType<PairingFlow['claim']>;\n  pairingStatus(requestId: string): PairingStatus | undefined;\n  approve(requestId: string): ReturnType<PairingFlow['approve']>;\n  deny(requestId: string): ReturnType<PairingFlow['deny']>;\n  /** Turns an approved request into a session, exactly once. */\n  redeem(requestId: string): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  authorize(token: string | undefined): string | undefined;\n  /** Mints a session for a device that proved a registered passkey. */\n  sessionForPasskey(label: string): EnrolledDevice & { maxAgeSeconds: number };\n  passkeys(): {\n    support: () => PasskeySupport;\n    list: () => readonly StoredCredential[];\n    beginRegistration: WebAuthn['beginRegistration'];\n    finishRegistration: WebAuthn['finishRegistration'];\n    beginAuthentication: WebAuthn['beginAuthentication'];\n    finishAuthentication: WebAuthn['finishAuthentication'];\n    beginStepUp: WebAuthn['beginStepUp'];\n    finishStepUp: WebAuthn['finishStepUp'];\n    forget: (id: string) => boolean;\n  };\n  /** Whether this action needs a fresh gesture that has not been supplied. */\n  stepUpRequired(action: StepUpAction): boolean;\n  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */\n  channelPublicKey(): string | undefined;\n  /** Completes one purpose-bound sealed channel against a fresh device key. */\n  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;\n  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;\n  revokeDevice(id: string): boolean;\n  isDeviceConnected(deviceId: string): boolean;\n  /** Registers a remote socket against its device so revocation closes it immediately. */\n  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;\n  close(): Promise<void>;\n}\n\nfunction bundlePairingTrust(\n  value: { publicKey: string; revision: number } | undefined,\n): BundlePairingTrust | undefined {\n  if (value === undefined) return undefined;\n  return {\n    ...value,\n    fingerprint: createHash('sha256').update(Buffer.from(value.publicKey, 'base64url')).digest('hex'),\n  };\n}\n\nexport function createRemoteAccess(options: RemoteAccessOptions): RemoteAccess {\n  const notice = options.onNotice ?? ((): void => {});\n  const now = options.now ?? ((): number => Date.now());\n  const broadcastLocal = options.broadcastLocal ?? ((): void => {});\n  const broadcastAll = options.broadcastAll ?? ((): void => {});\n\n  let settings = options.store.settings();\n  let status: RemoteAccessStatus = 'off';\n  let listener: TunnelListener | undefined;\n  let stopTunnel: (() => Promise<void>) | undefined;\n  let tunnelStartup: { controller: AbortController; outcome: Promise<TunnelStartResult> } | undefined;\n  let publicOrigin: string | undefined;\n  let policy: OriginPolicy | undefined;\n  let startedAt: number | undefined;\n  let closesAt: number | undefined;\n  let failure: string | undefined;\n  /** Settings an `enable` asked to hand over with, waiting for its response to flush. */\n  let pendingHandover: RemoteAccessSettings | undefined;\n  let autoCloseTimer: ReturnType<typeof setTimeout> | undefined;\n  /** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */\n  let handshake: HostHandshake | undefined;\n  const channels = new Map<string, SealedChannel>();\n  const sockets = new Map<string, Set<(code: number, reason: string) => void>>();\n\n  const channelKey = (deviceId: string, scope: RemoteChannelScope): string => `${deviceId}:${scope}`;\n  const dropDeviceAccess = (deviceId: string, reason: 'revoked' | 'expired'): void => {\n    options.onDeviceDropped?.(deviceId);\n    for (const scope of ['session', 'protocol', 'http'] as const) channels.delete(channelKey(deviceId, scope));\n    const held = sockets.get(deviceId);\n    sockets.delete(deviceId);\n    for (const close of held ?? []) {\n      try {\n        close(1008, `device ${reason}`);\n      } catch {\n        // The socket is already gone.\n      }\n    }\n  };\n\n  const devices: DeviceAuth = createDeviceAuth({\n    settings: () => settings,\n    now,\n    onNotice: notice,\n    onDrop: (record, reason) => dropDeviceAccess(record.id, reason),\n  });\n\n  const webauthn: WebAuthn = createWebAuthn({\n    publicOrigin: () => publicOrigin,\n    credentials: () => options.store.credentials(),\n    saveCredential: (credential) => options.store.saveCredential(credential),\n    removeCredential: (id) => options.store.removeCredential(id),\n    now,\n    onNotice: notice,\n  });\n\n  const pairing: PairingFlow = createPairingFlow({\n    randomToken: () => randomBytes(TOKEN_BYTES).toString('base64url'),\n    randomManualCode: () => randomInt(100_000_000).toString().padStart(8, '0'),\n    digest: (token) => createHash('sha256').update(token).digest('hex'),\n    now,\n    onNotice: notice,\n  });\n\n  const sweeper = setInterval(() => {\n    devices.sweep();\n    pairing.sweep();\n  }, SWEEP_INTERVAL_MS);\n  sweeper.unref();\n\n  function publish(): void {\n    broadcastAll({ type: REMOTE_STATE_TYPE, state: view(undefined, false) });\n  }\n\n  function view(selfDeviceId: string | undefined, forLocalCaller: boolean): RemoteAccessStateView {\n    return {\n      status,\n      ...(publicOrigin === undefined ? {} : { publicUrl: publicOrigin }),\n      ...(startedAt === undefined ? {} : { startedAt: new Date(startedAt).toISOString() }),\n      ...(closesAt === undefined ? {} : { closesAt: new Date(closesAt).toISOString() }),\n      ...(failure === undefined ? {} : { error: failure }),\n      devices: devices.list().map((record) => ({\n        id: record.id,\n        label: record.label,\n        userAgent: record.userAgent,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: record.id === selfDeviceId,\n      })),\n      // A paired phone must never see the approval queue: a device that can\n      // approve devices makes its own access permanent, which is exactly what\n      // host confirmation exists to prevent.\n      pending: forLocalCaller\n        ? pairing.pending().map((request) => ({\n            id: request.id,\n            userAgent: request.userAgent,\n            edgeIp: request.edgeIp,\n            createdAt: new Date(request.createdAt).toISOString(),\n            expiresAt: new Date(request.createdAt + 180_000).toISOString(),\n          }))\n        : [],\n      settings,\n    };\n  }\n\n  function armAutoClose(): void {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    if (!settings.autoCloseEnabled || status !== 'on') return;\n    const at = now() + settings.autoCloseMinutes * MS_PER_MINUTE;\n    closesAt = at;\n    autoCloseTimer = setTimeout(() => {\n      notice('remote access reached its time limit; closing');\n      void disable();\n    }, settings.autoCloseMinutes * MS_PER_MINUTE);\n    autoCloseTimer.unref();\n  }\n\n  /** Everything teardown has to do, in the order it has to happen. */\n  async function teardown(): Promise<void> {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    // Sockets first. An upgraded socket has left the HTTP server's connection\n    // tracking, so closing the listener does not touch it: without this a\n    // paired phone keeps driving the agent after remote access is switched off.\n    for (const held of sockets.values()) {\n      for (const close of held) {\n        try {\n          close(1008, 'remote access revoked');\n        } catch {\n          // The socket is already gone, which is the outcome we wanted.\n        }\n      }\n    }\n    sockets.clear();\n    const starting = tunnelStartup;\n    tunnelStartup = undefined;\n    starting?.controller.abort();\n    const startingOutcome = await starting?.outcome.catch(() => undefined);\n    if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => undefined);\n    await stopTunnel?.().catch(() => undefined);\n    stopTunnel = undefined;\n    await listener?.close().catch(() => undefined);\n    listener = undefined;\n    publicOrigin = undefined;\n    policy = undefined;\n    startedAt = undefined;\n    pairing.clear();\n    webauthn.clearChallenges();\n    handshake = undefined;\n    channels.clear();\n    // Sessions go; passkeys and any other durable credential do not, so\n    // switching back on does not mean enrolling every device again.\n    devices.revokeAll();\n  }\n\n  async function disable(): Promise<void> {\n    if (status === 'off') return;\n    await teardown();\n    status = 'off';\n    failure = undefined;\n    notice('remote access off');\n    publish();\n  }\n\n  return {\n    state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),\n    settings: () => settings,\n    publicOrigin: () => publicOrigin,\n\n    updateSettings(patch) {\n      // Through the parser rather than spread straight in, so a value out of\n      // range is clamped now instead of silently differing until the next load.\n      const parsed = parseRemoteAccessSettings(\n        serializeRemoteAccessSettings({ ...settings, ...patch }) as Record<string, unknown>,\n      );\n      for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);\n      settings = parsed.settings;\n      options.store.save(settings);\n      // Re-arm rather than leave the old deadline: shortening the window has to\n      // take effect now, and lengthening it should not close early.\n      devices.reschedule();\n      armAutoClose();\n      publish();\n      return settings;\n    },\n\n    /**\n     * Runs a handover `enable` deferred, once its response is on the wire.\n     *\n     * Split out rather than done inside `enable` because the reply and the\n     * teardown travel over the same socket, and doing them in the wrong order\n     * leaves the caller unable to tell success from a dropped connection.\n     */\n    commitHandover() {\n      const handing = pendingHandover;\n      if (handing === undefined) return;\n      pendingHandover = undefined;\n      notice('handing the cockpit over to a container');\n      options.requestHandover?.(handing);\n    },\n\n    /** True between a contained `enable` and the handover its response defers. */\n    handoverPending: () => pendingHandover !== undefined,\n\n    tunnelPort: () => listener?.port,\n    tunnelPolicy: () => policy,\n\n    async enable() {\n      if (status === 'on' || status === 'starting') return { ok: true };\n      status = 'starting';\n      failure = undefined;\n      publish();\n\n      // Containment has to be in place before the tunnel is, so a contained\n      // cockpit hands over instead of starting a tunnel here. The container's\n      // own hub turns remote access on once it is serving.\n      if (settings.sandbox.enabled && options.contained !== true) {\n        if (settings.sandbox.workspaces.length === 0) {\n          status = 'failed';\n          failure = 'Add at least one workspace before running the cockpit in a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        if (options.requestHandover === undefined) {\n          status = 'failed';\n          failure = 'This cockpit cannot hand over to a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        // Held rather than run: the handover closes the server carrying this\n        // very response, so the caller has to hear the answer first.\n        pendingHandover = settings;\n        return { ok: true };\n      }\n      let bound: TunnelListener;\n      try {\n        bound = await options.bindListener();\n      } catch (error) {\n        status = 'failed';\n        failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;\n        publish();\n        return { ok: false, error: failure };\n      }\n      listener = bound;\n      const controller = new AbortController();\n      const launching = options.launchTunnel({\n        port: bound.port,\n        config: settings.tunnel,\n        signal: controller.signal,\n        acceptOrigin: (origin) => {\n          policy = tunnelOriginPolicy(origin);\n        },\n      });\n      const startup = { controller, outcome: launching };\n      tunnelStartup = startup;\n      const outcome = await launching;\n      if (tunnelStartup !== startup || controller.signal.aborted) {\n        return { ok: false, error: 'Tunnel startup was cancelled.' };\n      }\n      tunnelStartup = undefined;\n      if (!outcome.ok) {\n        await teardown();\n        status = 'failed';\n        failure = outcome.message;\n        notice(`remote access failed: ${outcome.message}`);\n        publish();\n        return { ok: false, error: outcome.message };\n      }\n      stopTunnel = outcome.stop;\n      // A fresh key pair per tunnel: the QR is the only place its public half\n      // travels, so it must not outlive the code that carried it.\n      handshake = createHostHandshake();\n      publicOrigin = outcome.publicOrigin;\n      policy = tunnelOriginPolicy(outcome.publicOrigin);\n      startedAt = now();\n      status = 'on';\n      armAutoClose();\n      notice(`remote access on at ${outcome.publicOrigin}`);\n      publish();\n      return { ok: true };\n    },\n\n    disable,\n\n    mintPairing() {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const trust = bundlePairingTrust(options.bundleTrust?.());\n      if (trust === undefined) return undefined;\n      const { code, manualCode, expiresAt } = pairing.mintCode();\n      // The token, channel key, signer key, and publication floor ride in the fragment,\n      // so the relay never observes the values used to authenticate either channel.\n      const fragment = new URLSearchParams({\n        c: code,\n        [SEALED_KEY_PARAM]: handshake.publicKey,\n        [BUNDLE_SIGNING_KEY_PARAM]: trust.publicKey,\n        [BUNDLE_MINIMUM_REVISION_PARAM]: String(trust.revision),\n      });\n      return {\n        code,\n        manualCode,\n        pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,\n        expiresAt: new Date(expiresAt).toISOString(),\n        ...trust,\n      };\n    },\n\n    bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),\n\n    claim(input) {\n      const outcome = pairing.claim(input);\n      if (outcome.ok) {\n        broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      }\n      return outcome;\n    },\n\n    pairingStatus: (requestId) => pairing.status(requestId),\n\n    approve(requestId) {\n      const outcome = pairing.approve(requestId);\n      if (outcome === 'approved') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    deny(requestId) {\n      const outcome = pairing.deny(requestId);\n      if (outcome === 'denied') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    redeem(requestId) {\n      const approved = pairing.consume(requestId);\n      if (approved === undefined) return undefined;\n      const enrolled = devices.enrol({ userAgent: approved.userAgent });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    authorize: (token) => devices.verify(token)?.id,\n\n    sessionForPasskey(label) {\n      const enrolled = devices.enrol({ userAgent: label });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    passkeys: () => ({\n      support: () => webauthn.support(),\n      list: () => options.store.credentials(),\n      // Wrapped rather than passed by reference: an unbound method carries\n      // whatever `this` the caller happens to have.\n      beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),\n      finishRegistration: async (ceremonyId, caller, response, label) =>\n        await webauthn.finishRegistration(ceremonyId, caller, response, label),\n      beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),\n      finishAuthentication: async (ceremonyId, caller, response) =>\n        await webauthn.finishAuthentication(ceremonyId, caller, response),\n      beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),\n      finishStepUp: async (ceremonyId, caller, action, response) =>\n        await webauthn.finishStepUp(ceremonyId, caller, action, response),\n      forget: (id) => {\n        const forgotten = options.store.removeCredential(id);\n        if (forgotten) publish();\n        return forgotten;\n      },\n    }),\n\n    // Only meaningful where passkeys are: a quick tunnel has no stable rpID, so\n    // there is nothing to step up with and the session cookie is all there is.\n    stepUpRequired: () => webauthn.support().supported,\n\n    channelPublicKey: () => handshake?.publicKey,\n\n    openChannel(deviceId, scope, clientPublicKey) {\n      const channel = handshake?.accept(clientPublicKey);\n      if (channel === undefined) return false;\n      channels.set(channelKey(deviceId, scope), channel);\n      return true;\n    },\n\n    channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),\n\n    revokeDevice(id) {\n      const revoked = devices.revoke(id);\n      if (revoked) publish();\n      return revoked;\n    },\n\n    isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,\n\n    trackSocket(deviceId, close) {\n      const held = sockets.get(deviceId) ?? new Set();\n      held.add(close);\n      sockets.set(deviceId, held);\n      return () => {\n        held.delete(close);\n        if (held.size === 0) sockets.delete(deviceId);\n      };\n    },\n\n    async close() {\n      clearInterval(sweeper);\n      await teardown();\n      status = 'off';\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AAgCA,MAAM,cAAc;AACpB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AAkGtB,SAAS,mBACP,OACgC;CAChC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EACL,GAAG;EACH,cAAA,GAAaA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK;CAClG;AACF;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,iBAAiB,QAAQ,yBAA+B,CAAC;CAC/D,MAAM,eAAe,QAAQ,uBAA6B,CAAC;CAE3D,IAAI,WAAW,QAAQ,MAAM,SAAS;CACtC,IAAI,SAA6B;CACjC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,MAAM,2BAAW,IAAI,IAA2B;CAChD,MAAM,0BAAU,IAAI,IAAyD;CAE7E,MAAM,cAAc,UAAkB,UAAsC,GAAG,SAAS,GAAG;CAC3F,MAAM,oBAAoB,UAAkB,WAAwC;EAClF,QAAQ,kBAAkB,QAAQ;EAClC,KAAK,MAAM,SAAS;GAAC;GAAW;GAAY;EAAM,GAAY,SAAS,OAAO,WAAW,UAAU,KAAK,CAAC;EACzG,MAAM,OAAO,QAAQ,IAAI,QAAQ;EACjC,QAAQ,OAAO,QAAQ;EACvB,KAAK,MAAM,SAAS,QAAQ,CAAC,GAC3B,IAAI;GACF,MAAM,MAAM,UAAU,QAAQ;EAChC,QAAQ,CAER;CAEJ;CAEA,MAAM,UAAsBC,gBAAAA,iBAAiB;EAC3C,gBAAgB;EAChB;EACA,UAAU;EACV,SAAS,QAAQ,WAAW,iBAAiB,OAAO,IAAI,MAAM;CAChE,CAAC;CAED,MAAM,WAAqBC,gBAAAA,eAAe;EACxC,oBAAoB;EACpB,mBAAmB,QAAQ,MAAM,YAAY;EAC7C,iBAAiB,eAAe,QAAQ,MAAM,eAAe,UAAU;EACvE,mBAAmB,OAAO,QAAQ,MAAM,iBAAiB,EAAE;EAC3D;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAuBC,gBAAAA,kBAAkB;EAC7C,oBAAA,GAAmBC,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,WAAW;EAChE,yBAAA,GAAwBC,YAAAA,UAAAA,CAAU,GAAW,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACzE,SAAS,WAAA,GAAUL,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAClE;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAU,kBAAkB;EAChC,QAAQ,MAAM;EACd,QAAQ,MAAM;CAChB,GAAG,iBAAiB;CACpB,QAAQ,MAAM;CAEd,SAAS,UAAgB;EACvB,aAAa;GAAE,MAAMM,eAAAA;GAAmB,OAAO,KAAK,KAAA,GAAW,KAAK;EAAE,CAAC;CACzE;CAEA,SAAS,KAAK,cAAkC,gBAAgD;EAC9F,OAAO;GACL;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,aAAa;GAChE,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY,EAAE;GAClF,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,YAAY,EAAE;GAC/E,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ;GAClD,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,YAAY;IACvC,IAAI,OAAO;IACX,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,OAAO,OAAO;GACtB,EAAE;GAIF,SAAS,iBACL,QAAQ,QAAQ,CAAC,CAAC,KAAK,aAAa;IAClC,IAAI,QAAQ;IACZ,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,WAAW,IAAI,KAAK,QAAQ,SAAS,CAAC,CAAC,YAAY;IACnD,WAAW,IAAI,KAAK,QAAQ,YAAY,IAAO,CAAC,CAAC,YAAY;GAC/D,EAAE,IACF,CAAC;GACL;EACF;CACF;CAEA,SAAS,eAAqB;EAC5B,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EACX,IAAI,CAAC,SAAS,oBAAoB,WAAW,MAAM;EAEnD,WADW,IAAI,IAAI,SAAS,mBAAmB;EAE/C,iBAAiB,iBAAiB;GAChC,OAAO,+CAA+C;GACtD,QAAa;EACf,GAAG,SAAS,mBAAmB,aAAa;EAC5C,eAAe,MAAM;CACvB;;CAGA,eAAe,WAA0B;EACvC,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EAIX,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,KAAK,MAAM,SAAS,MAClB,IAAI;GACF,MAAM,MAAM,uBAAuB;EACrC,QAAQ,CAER;EAGJ,QAAQ,MAAM;EACd,MAAM,WAAW;EACjB,gBAAgB,KAAA;EAChB,UAAU,WAAW,MAAM;EAC3B,MAAM,kBAAkB,MAAM,UAAU,QAAQ,YAAY,KAAA,CAAS;EACrE,IAAI,iBAAiB,OAAO,MAAM,MAAM,gBAAgB,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EACpF,MAAM,aAAa,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C,aAAa,KAAA;EACb,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,WAAW,KAAA;EACX,eAAe,KAAA;EACf,SAAS,KAAA;EACT,YAAY,KAAA;EACZ,QAAQ,MAAM;EACd,SAAS,gBAAgB;EACzB,YAAY,KAAA;EACZ,SAAS,MAAM;EAGf,QAAQ,UAAU;CACpB;CAEA,eAAe,UAAyB;EACtC,IAAI,WAAW,OAAO;EACtB,MAAM,SAAS;EACf,SAAS;EACT,UAAU,KAAA;EACV,OAAO,mBAAmB;EAC1B,QAAQ;CACV;CAEA,OAAO;EACL,QAAQ,cAAc,iBAAiB,UAAU,KAAK,cAAc,cAAc;EAClF,gBAAgB;EAChB,oBAAoB;EAEpB,eAAe,OAAO;GAGpB,MAAM,SAASC,gBAAAA,0BACbC,gBAAAA,8BAA8B;IAAE,GAAG;IAAU,GAAG;GAAM,CAAC,CACzD;GACA,KAAK,MAAM,WAAW,OAAO,UAAU,OAAO,2BAA2B,SAAS;GAClF,WAAW,OAAO;GAClB,QAAQ,MAAM,KAAK,QAAQ;GAG3B,QAAQ,WAAW;GACnB,aAAa;GACb,QAAQ;GACR,OAAO;EACT;;;;;;;;EASA,iBAAiB;GACf,MAAM,UAAU;GAChB,IAAI,YAAY,KAAA,GAAW;GAC3B,kBAAkB,KAAA;GAClB,OAAO,yCAAyC;GAChD,QAAQ,kBAAkB,OAAO;EACnC;;EAGA,uBAAuB,oBAAoB,KAAA;EAE3C,kBAAkB,UAAU;EAC5B,oBAAoB;EAEpB,MAAM,SAAS;GACb,IAAI,WAAW,QAAQ,WAAW,YAAY,OAAO,EAAE,IAAI,KAAK;GAChE,SAAS;GACT,UAAU,KAAA;GACV,QAAQ;GAKR,IAAI,SAAS,QAAQ,WAAW,QAAQ,cAAc,MAAM;IAC1D,IAAI,SAAS,QAAQ,WAAW,WAAW,GAAG;KAC5C,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IACA,IAAI,QAAQ,oBAAoB,KAAA,GAAW;KACzC,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IAGA,kBAAkB;IAClB,OAAO,EAAE,IAAI,KAAK;GACpB;GACA,IAAI;GACJ,IAAI;IACF,QAAQ,MAAM,QAAQ,aAAa;GACrC,SAAS,OAAO;IACd,SAAS;IACT,UAAU,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IACtG,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO;IAAQ;GACrC;GACA,WAAW;GACX,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,YAAY,QAAQ,aAAa;IACrC,MAAM,MAAM;IACZ,QAAQ,SAAS;IACjB,QAAQ,WAAW;IACnB,eAAe,WAAW;KACxB,SAASC,gBAAAA,mBAAmB,MAAM;IACpC;GACF,CAAC;GACD,MAAM,UAAU;IAAE;IAAY,SAAS;GAAU;GACjD,gBAAgB;GAChB,MAAM,UAAU,MAAM;GACtB,IAAI,kBAAkB,WAAW,WAAW,OAAO,SACjD,OAAO;IAAE,IAAI;IAAO,OAAO;GAAgC;GAE7D,gBAAgB,KAAA;GAChB,IAAI,CAAC,QAAQ,IAAI;IACf,MAAM,SAAS;IACf,SAAS;IACT,UAAU,QAAQ;IAClB,OAAO,yBAAyB,QAAQ,SAAS;IACjD,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO,QAAQ;IAAQ;GAC7C;GACA,aAAa,QAAQ;GAGrB,aAAA,GAAYC,oCAAAA,oBAAAA,CAAoB;GAChC,eAAe,QAAQ;GACvB,SAASD,gBAAAA,mBAAmB,QAAQ,YAAY;GAChD,YAAY,IAAI;GAChB,SAAS;GACT,aAAa;GACb,OAAO,uBAAuB,QAAQ,cAAc;GACpD,QAAQ;GACR,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA;EAEA,cAAc;GACZ,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,QAAQ,mBAAmB,QAAQ,cAAc,CAAC;GACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,EAAE,MAAM,YAAY,cAAc,QAAQ,SAAS;GAGzD,MAAM,WAAW,IAAI,gBAAgB;IACnC,GAAG;KACFE,+BAAAA,mBAAmB,UAAU;KACF,MAAA,MAAM;KACD,MAAA,OAAO,MAAM,QAAQ;GACxD,CAAC;GACD,OAAO;IACL;IACA;IACA,SAAS,GAAG,eAAeC,eAAAA,mBAAmB,GAAG,SAAS,SAAS;IACnE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY;IAC3C,GAAG;GACL;EACF;EAEA,mBAAmB,mBAAmB,QAAQ,cAAc,CAAC;EAE7D,MAAM,OAAO;GACX,MAAM,UAAU,QAAQ,MAAM,KAAK;GACnC,IAAI,QAAQ,IACV,eAAe;IAAE,MAAMC,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAEpF,OAAO;EACT;EAEA,gBAAgB,cAAc,QAAQ,OAAO,SAAS;EAEtD,QAAQ,WAAW;GACjB,MAAM,UAAU,QAAQ,QAAQ,SAAS;GACzC,IAAI,YAAY,YAAY,eAAe;IAAE,MAAMA,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC9G,OAAO;EACT;EAEA,KAAK,WAAW;GACd,MAAM,UAAU,QAAQ,KAAK,SAAS;GACtC,IAAI,YAAY,UAAU,eAAe;IAAE,MAAMA,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC5G,OAAO;EACT;EAEA,OAAO,WAAW;GAChB,MAAM,WAAW,QAAQ,QAAQ,SAAS;GAC1C,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,WAAW,QAAQ,MAAM,EAAE,WAAW,SAAS,UAAU,CAAC;GAChE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAeC,cAAAA,oBAAoB,UAAUC,eAAAA,sBAAsB;GAAE;EAC7F;EAEA,YAAY,UAAU,QAAQ,OAAO,KAAK,CAAC,EAAE;EAE7C,kBAAkB,OAAO;GACvB,MAAM,WAAW,QAAQ,MAAM,EAAE,WAAW,MAAM,CAAC;GACnD,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAeD,cAAAA,oBAAoB,UAAUC,eAAAA,sBAAsB;GAAE;EAC7F;EAEA,iBAAiB;GACf,eAAe,SAAS,QAAQ;GAChC,YAAY,QAAQ,MAAM,YAAY;GAGtC,mBAAmB,OAAO,QAAQ,UAAU,MAAM,SAAS,kBAAkB,QAAQ,KAAK;GAC1F,oBAAoB,OAAO,YAAY,QAAQ,UAAU,UACvD,MAAM,SAAS,mBAAmB,YAAY,QAAQ,UAAU,KAAK;GACvE,qBAAqB,OAAO,WAAW,MAAM,SAAS,oBAAoB,MAAM;GAChF,sBAAsB,OAAO,YAAY,QAAQ,aAC/C,MAAM,SAAS,qBAAqB,YAAY,QAAQ,QAAQ;GAClE,aAAa,OAAO,QAAQ,WAAW,MAAM,SAAS,YAAY,QAAQ,MAAM;GAChF,cAAc,OAAO,YAAY,QAAQ,QAAQ,aAC/C,MAAM,SAAS,aAAa,YAAY,QAAQ,QAAQ,QAAQ;GAClE,SAAS,OAAO;IACd,MAAM,YAAY,QAAQ,MAAM,iBAAiB,EAAE;IACnD,IAAI,WAAW,QAAQ;IACvB,OAAO;GACT;EACF;EAIA,sBAAsB,SAAS,QAAQ,CAAC,CAAC;EAEzC,wBAAwB,WAAW;EAEnC,YAAY,UAAU,OAAO,iBAAiB;GAC5C,MAAM,UAAU,WAAW,OAAO,eAAe;GACjD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,SAAS,IAAI,WAAW,UAAU,KAAK,GAAG,OAAO;GACjD,OAAO;EACT;EAEA,aAAa,UAAU,UAAU,SAAS,IAAI,WAAW,UAAU,KAAK,CAAC;EAEzE,aAAa,IAAI;GACf,MAAM,UAAU,QAAQ,OAAO,EAAE;GACjC,IAAI,SAAS,QAAQ;GACrB,OAAO;EACT;EAEA,oBAAoB,cAAc,QAAQ,IAAI,QAAQ,CAAC,EAAE,QAAQ,KAAK;EAEtE,YAAY,UAAU,OAAO;GAC3B,MAAM,OAAO,QAAQ,IAAI,QAAQ,qBAAK,IAAI,IAAI;GAC9C,KAAK,IAAI,KAAK;GACd,QAAQ,IAAI,UAAU,IAAI;GAC1B,aAAa;IACX,KAAK,OAAO,KAAK;IACjB,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,QAAQ;GAC9C;EACF;EAEA,MAAM,QAAQ;GACZ,cAAc,OAAO;GACrB,MAAM,SAAS;GACf,SAAS;EACX;CACF;AACF"}

package/dist/services/remoteAccess/index.d.cts

@@ -0,0 +1,79 @@
+import { BundlePairingTrust, PairingStatus, RemoteAccessSettings, RemoteAccessStateView, RemoteChannelScope } from "../../types/remote.cjs";
+import { EnrolledDevice } from "../deviceAuth/index.cjs";
+import { PairingFlow } from "../pairingFlow/index.cjs";
+import { StepUpAction, StoredCredential } from "../webauthnPolicy/index.cjs";
+import { OriginPolicy } from "../remoteGuardPolicy/index.cjs";
+import { PasskeySupport, WebAuthn } from "../webauthn/index.cjs";
+import { SealedChannel } from "@agimon-ai/doompi-web-security/node";
+//#region src/services/remoteAccess/index.d.ts
+export interface RemoteAccess {
+  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;
+  settings(): RemoteAccessSettings;
+  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;
+  tunnelPort(): number | undefined;
+  /** The public origin the tunnel currently answers on, while one is up. */
+  publicOrigin(): string | undefined;
+  tunnelPolicy(): OriginPolicy | undefined;
+  enable(): Promise<{
+    ok: true;
+  } | {
+    ok: false;
+    error: string;
+  }>;
+  /** True between a contained `enable` and the handover its response defers. */
+  handoverPending(): boolean;
+  /** Runs that deferred handover, once the response asking for it is on the wire. */
+  commitHandover(): void;
+  disable(): Promise<void>;
+  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */
+  mintPairing(): ({
+    code: string;
+    manualCode: string;
+    pairUrl: string;
+    expiresAt: string;
+  } & BundlePairingTrust) | undefined;
+  bundleTrust(): BundlePairingTrust | undefined;
+  claim(input: {
+    code: string;
+    userAgent: string | undefined;
+    edgeIp: string | undefined;
+    sourceAddress: string | undefined;
+  }): ReturnType<PairingFlow['claim']>;
+  pairingStatus(requestId: string): PairingStatus | undefined;
+  approve(requestId: string): ReturnType<PairingFlow['approve']>;
+  deny(requestId: string): ReturnType<PairingFlow['deny']>;
+  /** Turns an approved request into a session, exactly once. */
+  redeem(requestId: string): (EnrolledDevice & {
+    maxAgeSeconds: number;
+  }) | undefined;
+  authorize(token: string | undefined): string | undefined;
+  /** Mints a session for a device that proved a registered passkey. */
+  sessionForPasskey(label: string): EnrolledDevice & {
+    maxAgeSeconds: number;
+  };
+  passkeys(): {
+    support: () => PasskeySupport;
+    list: () => readonly StoredCredential[];
+    beginRegistration: WebAuthn['beginRegistration'];
+    finishRegistration: WebAuthn['finishRegistration'];
+    beginAuthentication: WebAuthn['beginAuthentication'];
+    finishAuthentication: WebAuthn['finishAuthentication'];
+    beginStepUp: WebAuthn['beginStepUp'];
+    finishStepUp: WebAuthn['finishStepUp'];
+    forget: (id: string) => boolean;
+  };
+  /** Whether this action needs a fresh gesture that has not been supplied. */
+  stepUpRequired(action: StepUpAction): boolean;
+  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */
+  channelPublicKey(): string | undefined;
+  /** Completes one purpose-bound sealed channel against a fresh device key. */
+  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;
+  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;
+  revokeDevice(id: string): boolean;
+  isDeviceConnected(deviceId: string): boolean;
+  /** Registers a remote socket against its device so revocation closes it immediately. */
+  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;
+  close(): Promise<void>;
+}
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/remoteAccess/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/remoteAccess/index.ts"],"mappings":";;;;;;;;iBA0EiB;EACf,MAAM,uBAAuB,2BAA2B;EACxD,YAAY;EACZ,eAAe,OAAO,QAAQ,wBAAwB;EACtD;;EAEA;EACA,gBAAgB;EAChB,UAAU;IAAU;;IAAe;IAAW;;;EAE9C;;EAEA;EACA,WAAW;;EAEX;IACO;IAAc;IAAoB;IAAiB;MAAsB;EAEhF,eAAe;EACf,MAAM;IACJ;IACA;IACA;IACA;MACE,WAAW;EACf,cAAc,oBAAoB;EAClC,QAAQ,oBAAoB,WAAW;EACvC,KAAK,oBAAoB,WAAW;;EAEpC,OAAO,qBAAqB;IAAmB;;EAC/C,UAAU;;EAEV,kBAAkB,gBAAgB;IAAmB;;EACrD;IACE,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,SAAS;;;EAGX,eAAe,QAAQ;;EAEvB;;EAEA,YAAY,kBAAkB,OAAO,oBAAoB;EACzD,WAAW,kBAAkB,OAAO,qBAAqB;EACzD,aAAa;EACb,kBAAkB;;EAElB,YAAY,kBAAkB,QAAQ,cAAc;EACpD,SAAS"}

package/dist/services/remoteAccess/index.d.mts

@@ -0,0 +1,79 @@
+import { BundlePairingTrust, PairingStatus, RemoteAccessSettings, RemoteAccessStateView, RemoteChannelScope } from "../../types/remote.mjs";
+import { EnrolledDevice } from "../deviceAuth/index.mjs";
+import { PairingFlow } from "../pairingFlow/index.mjs";
+import { StepUpAction, StoredCredential } from "../webauthnPolicy/index.mjs";
+import { OriginPolicy } from "../remoteGuardPolicy/index.mjs";
+import { PasskeySupport, WebAuthn } from "../webauthn/index.mjs";
+import { SealedChannel } from "@agimon-ai/doompi-web-security/node";
+//#region src/services/remoteAccess/index.d.ts
+export interface RemoteAccess {
+  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;
+  settings(): RemoteAccessSettings;
+  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;
+  tunnelPort(): number | undefined;
+  /** The public origin the tunnel currently answers on, while one is up. */
+  publicOrigin(): string | undefined;
+  tunnelPolicy(): OriginPolicy | undefined;
+  enable(): Promise<{
+    ok: true;
+  } | {
+    ok: false;
+    error: string;
+  }>;
+  /** True between a contained `enable` and the handover its response defers. */
+  handoverPending(): boolean;
+  /** Runs that deferred handover, once the response asking for it is on the wire. */
+  commitHandover(): void;
+  disable(): Promise<void>;
+  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */
+  mintPairing(): ({
+    code: string;
+    manualCode: string;
+    pairUrl: string;
+    expiresAt: string;
+  } & BundlePairingTrust) | undefined;
+  bundleTrust(): BundlePairingTrust | undefined;
+  claim(input: {
+    code: string;
+    userAgent: string | undefined;
+    edgeIp: string | undefined;
+    sourceAddress: string | undefined;
+  }): ReturnType<PairingFlow['claim']>;
+  pairingStatus(requestId: string): PairingStatus | undefined;
+  approve(requestId: string): ReturnType<PairingFlow['approve']>;
+  deny(requestId: string): ReturnType<PairingFlow['deny']>;
+  /** Turns an approved request into a session, exactly once. */
+  redeem(requestId: string): (EnrolledDevice & {
+    maxAgeSeconds: number;
+  }) | undefined;
+  authorize(token: string | undefined): string | undefined;
+  /** Mints a session for a device that proved a registered passkey. */
+  sessionForPasskey(label: string): EnrolledDevice & {
+    maxAgeSeconds: number;
+  };
+  passkeys(): {
+    support: () => PasskeySupport;
+    list: () => readonly StoredCredential[];
+    beginRegistration: WebAuthn['beginRegistration'];
+    finishRegistration: WebAuthn['finishRegistration'];
+    beginAuthentication: WebAuthn['beginAuthentication'];
+    finishAuthentication: WebAuthn['finishAuthentication'];
+    beginStepUp: WebAuthn['beginStepUp'];
+    finishStepUp: WebAuthn['finishStepUp'];
+    forget: (id: string) => boolean;
+  };
+  /** Whether this action needs a fresh gesture that has not been supplied. */
+  stepUpRequired(action: StepUpAction): boolean;
+  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */
+  channelPublicKey(): string | undefined;
+  /** Completes one purpose-bound sealed channel against a fresh device key. */
+  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;
+  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;
+  revokeDevice(id: string): boolean;
+  isDeviceConnected(deviceId: string): boolean;
+  /** Registers a remote socket against its device so revocation closes it immediately. */
+  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;
+  close(): Promise<void>;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/remoteAccess/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/remoteAccess/index.ts"],"mappings":";;;;;;;;iBA0EiB;EACf,MAAM,uBAAuB,2BAA2B;EACxD,YAAY;EACZ,eAAe,OAAO,QAAQ,wBAAwB;EACtD;;EAEA;EACA,gBAAgB;EAChB,UAAU;IAAU;;IAAe;IAAW;;;EAE9C;;EAEA;EACA,WAAW;;EAEX;IACO;IAAc;IAAoB;IAAiB;MAAsB;EAEhF,eAAe;EACf,MAAM;IACJ;IACA;IACA;IACA;MACE,WAAW;EACf,cAAc,oBAAoB;EAClC,QAAQ,oBAAoB,WAAW;EACvC,KAAK,oBAAoB,WAAW;;EAEpC,OAAO,qBAAqB;IAAmB;;EAC/C,UAAU;;EAEV,kBAAkB,gBAAgB;IAAmB;;EACrD;IACE,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,SAAS;;;EAGX,eAAe,QAAQ;;EAEvB;;EAEA,YAAY,kBAAkB,OAAO,oBAAoB;EACzD,WAAW,kBAAkB,OAAO,qBAAqB;EACzD,aAAa;EACb,kBAAkB;;EAElB,YAAY,kBAAkB,QAAQ,cAAc;EACpD,SAAS"}