@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/remoteAccessSettings/index.mjs

@@ -0,0 +1,149 @@
+const MIN_MINUTES = 1;
+const MAX_MINUTES = 1440;
+const MIN_HOURS = 1;
+const MAX_HOURS = 720;
+/**
+* Both time limits start off.
+*
+* The durations are still here so switching one on lands on a sensible number
+* rather than an empty field. What being off actually means: a tunnel stays up
+* until it is closed or the hub restarts, and a paired session lasts until it
+* is revoked or remote access is switched off. Those two events are the only
+* expiry there is by default.
+*/
+const DEFAULT_REMOTE_SETTINGS = {
+	autoCloseEnabled: false,
+	autoCloseMinutes: 60,
+	sessionExpiryEnabled: false,
+	idleMinutes: 30,
+	absoluteHours: 12,
+	tunnel: { kind: "quick" },
+	sandbox: {
+		enabled: false,
+		workspaces: []
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBoolean(raw, fallback, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "boolean") {
+		warnings.push(`${field} must be true or false; using ${String(fallback)}.`);
+		return fallback;
+	}
+	return raw;
+}
+function readClamped(raw, fallback, bounds, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) {
+		warnings.push(`${field} must be a number; using ${String(fallback)}.`);
+		return fallback;
+	}
+	const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));
+	if (clamped !== raw) warnings.push(`${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`);
+	return clamped;
+}
+/**
+* A tunnel configuration is only accepted whole.
+*
+* A named tunnel missing its hostname is not a named tunnel with a default, it
+* is a misconfiguration, and quietly falling back to a quick tunnel would swap
+* a stable origin for a rotating one without telling anybody.
+*/
+function readTunnel(raw, warnings) {
+	if (raw === void 0) return DEFAULT_REMOTE_SETTINGS.tunnel;
+	if (!isRecord(raw)) {
+		warnings.push("tunnel must be an object; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	if (raw.kind === "quick") return { kind: "quick" };
+	if (raw.kind !== "named") {
+		warnings.push(`tunnel.kind must be "quick" or "named"; using a quick tunnel.`);
+		return { kind: "quick" };
+	}
+	if (typeof raw.hostname !== "string" || raw.hostname === "") {
+		warnings.push("A named tunnel needs a hostname; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	return {
+		kind: "named",
+		hostname: raw.hostname,
+		...typeof raw.name === "string" && raw.name !== "" ? { name: raw.name } : {},
+		...typeof raw.tokenFile === "string" && raw.tokenFile !== "" ? { tokenFile: raw.tokenFile } : {},
+		...typeof raw.configFile === "string" && raw.configFile !== "" ? { configFile: raw.configFile } : {}
+	};
+}
+/**
+* Reads the container settings, keeping only absolute workspace paths.
+*
+* A relative path would resolve against the container's working directory
+* rather than the host's, which is a mount that silently points somewhere else.
+* Refusing one is better than mounting the wrong directory.
+*/
+function readSandbox(raw, warnings) {
+	const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;
+	if (raw === void 0) return fallback;
+	if (!isRecord(raw)) {
+		warnings.push("sandbox must be an object; the cockpit will not be contained.");
+		return fallback;
+	}
+	const workspaces = [];
+	for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {
+		if (typeof entry !== "string" || !entry.startsWith("/")) {
+			warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);
+			continue;
+		}
+		if (!workspaces.includes(entry)) workspaces.push(entry);
+	}
+	return {
+		enabled: readBoolean(raw.enabled, fallback.enabled, "sandbox.enabled", warnings),
+		workspaces
+	};
+}
+function parseRemoteAccessSettings(raw) {
+	const warnings = [];
+	if (!isRecord(raw)) return {
+		settings: DEFAULT_REMOTE_SETTINGS,
+		warnings
+	};
+	if (raw.version !== 1) {
+		warnings.push(`Settings version ${String(raw.version)} is not version ${String(1)}; using defaults.`);
+		return {
+			settings: DEFAULT_REMOTE_SETTINGS,
+			warnings
+		};
+	}
+	const defaults = DEFAULT_REMOTE_SETTINGS;
+	return {
+		settings: {
+			autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, "autoCloseEnabled", warnings),
+			autoCloseMinutes: readClamped(raw.autoCloseMinutes, defaults.autoCloseMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "autoCloseMinutes", warnings),
+			sessionExpiryEnabled: readBoolean(raw.sessionExpiryEnabled, defaults.sessionExpiryEnabled, "sessionExpiryEnabled", warnings),
+			idleMinutes: readClamped(raw.idleMinutes, defaults.idleMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "idleMinutes", warnings),
+			absoluteHours: readClamped(raw.absoluteHours, defaults.absoluteHours, {
+				min: MIN_HOURS,
+				max: MAX_HOURS
+			}, "absoluteHours", warnings),
+			tunnel: readTunnel(raw.tunnel, warnings),
+			sandbox: readSandbox(raw.sandbox, warnings)
+		},
+		warnings
+	};
+}
+function serializeRemoteAccessSettings(settings) {
+	return {
+		version: 1,
+		...settings
+	};
+}
+//#endregion
+export { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings, serializeRemoteAccessSettings };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/remoteAccessSettings/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/remoteAccessSettings/index.ts"],"sourcesContent":["/**\n * The persisted remote-access settings, and how a bad file becomes a good one.\n *\n * Every failure here is recoverable by falling back, never by throwing: a\n * corrupt settings file must not stop the cockpit from starting, because the\n * cockpit is how you would fix it.\n */\n\nimport type { RemoteAccessSettings, SandboxSettings, TunnelConfig } from '../../types/remote';\n\n/** Bumped when a field changes meaning; an unrecognised version falls back to defaults. */\nexport const REMOTE_SETTINGS_VERSION = 1;\n\nconst MIN_MINUTES = 1;\nconst MAX_MINUTES = 1440;\nconst MIN_HOURS = 1;\nconst MAX_HOURS = 720;\n\n/**\n * Both time limits start off.\n *\n * The durations are still here so switching one on lands on a sensible number\n * rather than an empty field. What being off actually means: a tunnel stays up\n * until it is closed or the hub restarts, and a paired session lasts until it\n * is revoked or remote access is switched off. Those two events are the only\n * expiry there is by default.\n */\nexport const DEFAULT_REMOTE_SETTINGS: RemoteAccessSettings = {\n  autoCloseEnabled: false,\n  autoCloseMinutes: 60,\n  sessionExpiryEnabled: false,\n  idleMinutes: 30,\n  absoluteHours: 12,\n  tunnel: { kind: 'quick' },\n  sandbox: { enabled: false, workspaces: [] },\n};\n\nexport interface ParsedRemoteSettings {\n  settings: RemoteAccessSettings;\n  /** Everything that had to be corrected, so the host can say so once rather than silently differ. */\n  warnings: string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readBoolean(raw: unknown, fallback: boolean, field: string, warnings: string[]): boolean {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'boolean') {\n    warnings.push(`${field} must be true or false; using ${String(fallback)}.`);\n    return fallback;\n  }\n  return raw;\n}\n\nfunction readClamped(\n  raw: unknown,\n  fallback: number,\n  bounds: { min: number; max: number },\n  field: string,\n  warnings: string[],\n): number {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n    warnings.push(`${field} must be a number; using ${String(fallback)}.`);\n    return fallback;\n  }\n  const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));\n  if (clamped !== raw) {\n    warnings.push(\n      `${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`,\n    );\n  }\n  return clamped;\n}\n\n/**\n * A tunnel configuration is only accepted whole.\n *\n * A named tunnel missing its hostname is not a named tunnel with a default, it\n * is a misconfiguration, and quietly falling back to a quick tunnel would swap\n * a stable origin for a rotating one without telling anybody.\n */\nfunction readTunnel(raw: unknown, warnings: string[]): TunnelConfig {\n  if (raw === undefined) return DEFAULT_REMOTE_SETTINGS.tunnel;\n  if (!isRecord(raw)) {\n    warnings.push('tunnel must be an object; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  if (raw.kind === 'quick') return { kind: 'quick' };\n  if (raw.kind !== 'named') {\n    warnings.push(`tunnel.kind must be \"quick\" or \"named\"; using a quick tunnel.`);\n    return { kind: 'quick' };\n  }\n  if (typeof raw.hostname !== 'string' || raw.hostname === '') {\n    warnings.push('A named tunnel needs a hostname; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  return {\n    kind: 'named',\n    hostname: raw.hostname,\n    ...(typeof raw.name === 'string' && raw.name !== '' ? { name: raw.name } : {}),\n    ...(typeof raw.tokenFile === 'string' && raw.tokenFile !== '' ? { tokenFile: raw.tokenFile } : {}),\n    ...(typeof raw.configFile === 'string' && raw.configFile !== '' ? { configFile: raw.configFile } : {}),\n  };\n}\n\n/**\n * Reads the container settings, keeping only absolute workspace paths.\n *\n * A relative path would resolve against the container's working directory\n * rather than the host's, which is a mount that silently points somewhere else.\n * Refusing one is better than mounting the wrong directory.\n */\nfunction readSandbox(raw: unknown, warnings: string[]): SandboxSettings {\n  const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;\n  if (raw === undefined) return fallback;\n  if (!isRecord(raw)) {\n    warnings.push('sandbox must be an object; the cockpit will not be contained.');\n    return fallback;\n  }\n  const workspaces: string[] = [];\n  for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {\n    if (typeof entry !== 'string' || !entry.startsWith('/')) {\n      warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);\n      continue;\n    }\n    if (!workspaces.includes(entry)) workspaces.push(entry);\n  }\n  return { enabled: readBoolean(raw.enabled, fallback.enabled, 'sandbox.enabled', warnings), workspaces };\n}\n\nexport function parseRemoteAccessSettings(raw: unknown): ParsedRemoteSettings {\n  const warnings: string[] = [];\n  if (!isRecord(raw)) {\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  if (raw.version !== REMOTE_SETTINGS_VERSION) {\n    warnings.push(\n      `Settings version ${String(raw.version)} is not version ${String(REMOTE_SETTINGS_VERSION)}; using defaults.`,\n    );\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  const defaults = DEFAULT_REMOTE_SETTINGS;\n  return {\n    settings: {\n      autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, 'autoCloseEnabled', warnings),\n      autoCloseMinutes: readClamped(\n        raw.autoCloseMinutes,\n        defaults.autoCloseMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'autoCloseMinutes',\n        warnings,\n      ),\n      sessionExpiryEnabled: readBoolean(\n        raw.sessionExpiryEnabled,\n        defaults.sessionExpiryEnabled,\n        'sessionExpiryEnabled',\n        warnings,\n      ),\n      idleMinutes: readClamped(\n        raw.idleMinutes,\n        defaults.idleMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'idleMinutes',\n        warnings,\n      ),\n      absoluteHours: readClamped(\n        raw.absoluteHours,\n        defaults.absoluteHours,\n        { min: MIN_HOURS, max: MAX_HOURS },\n        'absoluteHours',\n        warnings,\n      ),\n      tunnel: readTunnel(raw.tunnel, warnings),\n      sandbox: readSandbox(raw.sandbox, warnings),\n    },\n    warnings,\n  };\n}\n\nexport function serializeRemoteAccessSettings(settings: RemoteAccessSettings): unknown {\n  return { version: REMOTE_SETTINGS_VERSION, ...settings };\n}\n"],"mappings":"AAaA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;;;;;;;;;;AAWlB,MAAa,0BAAgD;CAC3D,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CACtB,aAAa;CACb,eAAe;CACf,QAAQ,EAAE,MAAM,QAAQ;CACxB,SAAS;EAAE,SAAS;EAAO,YAAY,CAAC;CAAE;AAC5C;AAQA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,KAAc,UAAmB,OAAe,UAA6B;CAChG,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,WAAW;EAC5B,SAAS,KAAK,GAAG,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;EAC1E,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,YACP,KACA,UACA,QACA,OACA,UACQ;CACR,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;EACpD,SAAS,KAAK,GAAG,MAAM,2BAA2B,OAAO,QAAQ,EAAE,EAAE;EACrE,OAAO;CACT;CACA,MAAM,UAAU,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;CAC1E,IAAI,YAAY,KACd,SAAS,KACP,GAAG,MAAM,mBAAmB,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,EACrG;CAEF,OAAO;AACT;;;;;;;;AASA,SAAS,WAAW,KAAc,UAAkC;CAClE,IAAI,QAAQ,KAAA,GAAW,OAAO,wBAAwB;CACtD,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,iDAAiD;EAC/D,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CACjD,IAAI,IAAI,SAAS,SAAS;EACxB,SAAS,KAAK,+DAA+D;EAC7E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,IAAI;EAC3D,SAAS,KAAK,wDAAwD;EACtE,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,OAAO;EACL,MAAM;EACN,UAAU,IAAI;EACd,GAAI,OAAO,IAAI,SAAS,YAAY,IAAI,SAAS,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EAC5E,GAAI,OAAO,IAAI,cAAc,YAAY,IAAI,cAAc,KAAK,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EAChG,GAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,KAAK,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;CACtG;AACF;;;;;;;;AASA,SAAS,YAAY,KAAc,UAAqC;CACtE,MAAM,WAAW,wBAAwB;CACzC,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,+DAA+D;EAC7E,OAAO;CACT;CACA,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC,GAAG;EACvE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,GAAG;GACvD,SAAS,KAAK,kDAAkD,OAAO,KAAK,EAAE,EAAE;GAChF;EACF;EACA,IAAI,CAAC,WAAW,SAAS,KAAK,GAAG,WAAW,KAAK,KAAK;CACxD;CACA,OAAO;EAAE,SAAS,YAAY,IAAI,SAAS,SAAS,SAAS,mBAAmB,QAAQ;EAAG;CAAW;AACxG;AAEA,SAAgB,0BAA0B,KAAoC;CAC5E,MAAM,WAAqB,CAAC;CAC5B,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAAE,UAAU;EAAyB;CAAS;CAEvD,IAAI,IAAI,YAAA,GAAqC;EAC3C,SAAS,KACP,oBAAoB,OAAO,IAAI,OAAO,EAAE,kBAAkB,OAAA,CAA8B,EAAE,kBAC5F;EACA,OAAO;GAAE,UAAU;GAAyB;EAAS;CACvD;CACA,MAAM,WAAW;CACjB,OAAO;EACL,UAAU;GACR,kBAAkB,YAAY,IAAI,kBAAkB,SAAS,kBAAkB,oBAAoB,QAAQ;GAC3G,kBAAkB,YAChB,IAAI,kBACJ,SAAS,kBACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,oBACA,QACF;GACA,sBAAsB,YACpB,IAAI,sBACJ,SAAS,sBACT,wBACA,QACF;GACA,aAAa,YACX,IAAI,aACJ,SAAS,aACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,eACA,QACF;GACA,eAAe,YACb,IAAI,eACJ,SAAS,eACT;IAAE,KAAK;IAAW,KAAK;GAAU,GACjC,iBACA,QACF;GACA,QAAQ,WAAW,IAAI,QAAQ,QAAQ;GACvC,SAAS,YAAY,IAAI,SAAS,QAAQ;EAC5C;EACA;CACF;AACF;AAEA,SAAgB,8BAA8B,UAAyC;CACrF,OAAO;EAAE,SAAA;EAAkC,GAAG;CAAS;AACzD"}

package/dist/services/remoteAccessStore/index.cjs

@@ -0,0 +1,126 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_index = require("../remoteAccessSettings/index.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_os = require("node:os");
+node_os = require_runtime.__toESM(node_os, 1);
+//#region src/services/remoteAccessStore/index.ts
+/** Where the cockpit keeps machine-local state; `doompi sync` already writes its bundle here. */
+const STATE_SEGMENTS = [".doompi", "web"];
+const SETTINGS_FILE = "remote-access.json";
+const CREDENTIALS_FILE = "credentials.json";
+const DIRECTORY_MODE = 448;
+const FILE_MODE = 384;
+/** Any bit set for group or other; a state file readable by another account is worth repairing. */
+const LOOSE_MODE_MASK = 63;
+function defaultRemoteStateDir(homeDir = node_os.default.homedir()) {
+	return node_path.default.join(homeDir, ...STATE_SEGMENTS);
+}
+/**
+* Repairs a state file another account can read.
+*
+* Cheap, and it catches the cases a fresh write never would: a file restored
+* from a backup, copied with a permissive umask, or checked out of somewhere it
+* should not have been.
+*/
+function tightenMode(filePath, notice) {
+	try {
+		if ((node_fs.default.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;
+		node_fs.default.chmodSync(filePath, FILE_MODE);
+		notice(`tightened permissions on ${filePath}`);
+	} catch {}
+}
+/**
+* Settings and passkeys on disk. Sessions deliberately not.
+*
+* A session is revoked when remote access is switched off, and a hub restart is
+* a switch-off, so persisting one would buy nothing while creating a bearer
+* secret worth stealing. A passkey is the opposite: surviving is its whole
+* point, and what is stored is a public key.
+*/
+function createRemoteAccessStore(options = {}) {
+	const directory = options.stateDir ?? defaultRemoteStateDir();
+	const notice = options.onNotice ?? (() => {});
+	const settingsPath = node_path.default.join(directory, SETTINGS_FILE);
+	const credentialsPath = node_path.default.join(directory, CREDENTIALS_FILE);
+	let current = load();
+	let registered = loadCredentials();
+	function load() {
+		let raw;
+		try {
+			raw = node_fs.default.readFileSync(settingsPath, "utf8");
+		} catch {
+			return require_index.DEFAULT_REMOTE_SETTINGS;
+		}
+		tightenMode(settingsPath, notice);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
+			return require_index.DEFAULT_REMOTE_SETTINGS;
+		}
+		const outcome = require_index.parseRemoteAccessSettings(parsed);
+		for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
+		return outcome.settings;
+	}
+	function loadCredentials() {
+		let raw;
+		try {
+			raw = node_fs.default.readFileSync(credentialsPath, "utf8");
+		} catch {
+			return [];
+		}
+		tightenMode(credentialsPath, notice);
+		try {
+			const parsed = JSON.parse(raw);
+			return Array.isArray(parsed) ? parsed : [];
+		} catch {
+			notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
+			return [];
+		}
+	}
+	function writeJson(target, body) {
+		const temporary = `${target}.${String(process.pid)}.tmp`;
+		try {
+			node_fs.default.mkdirSync(directory, {
+				recursive: true,
+				mode: DIRECTORY_MODE
+			});
+			node_fs.default.writeFileSync(temporary, `${JSON.stringify(body, void 0, 2)}\n`, { mode: FILE_MODE });
+			node_fs.default.renameSync(temporary, target);
+		} catch (error) {
+			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
+			try {
+				node_fs.default.rmSync(temporary, { force: true });
+			} catch {}
+		}
+	}
+	return {
+		directory,
+		settings: () => current,
+		credentials: () => registered,
+		saveCredential(credential) {
+			registered = [...registered.filter((held) => held.id !== credential.id), credential];
+			writeJson(credentialsPath, registered);
+		},
+		removeCredential(id) {
+			const next = registered.filter((held) => held.id !== id);
+			if (next.length === registered.length) return false;
+			registered = next;
+			writeJson(credentialsPath, registered);
+			return true;
+		},
+		save(settings) {
+			current = settings;
+			writeJson(settingsPath, require_index.serializeRemoteAccessSettings(settings));
+		}
+	};
+}
+//#endregion
+exports.createRemoteAccessStore = createRemoteAccessStore;
+exports.defaultRemoteStateDir = defaultRemoteStateDir;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/remoteAccessStore/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["os","path","fs","DEFAULT_REMOTE_SETTINGS","parseRemoteAccessSettings","serializeRemoteAccessSettings"],"sources":["../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport {\n  DEFAULT_REMOTE_SETTINGS,\n  parseRemoteAccessSettings,\n  serializeRemoteAccessSettings,\n} from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `doompi sync` already writes its bundle here. */\nconst STATE_SEGMENTS = ['.doompi', 'web'];\nconst SETTINGS_FILE = 'remote-access.json';\nconst CREDENTIALS_FILE = 'credentials.json';\nconst DIRECTORY_MODE = 0o700;\nconst FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nconst LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.doompi/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = os.homedir()): string {\n  return path.join(homeDir, ...STATE_SEGMENTS);\n}\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n\n  let current = load();\n  let registered = loadCredentials();\n\n  function load(): RemoteAccessSettings {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(settingsPath, 'utf8');\n    } catch {\n      // No file is the normal first run, so this is not worth a notice.\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    tightenMode(settingsPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Left in place rather than rewritten: silently overwriting a file\n      // somebody hand-edited is worse than ignoring it for this run.\n      notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    const outcome = parseRemoteAccessSettings(parsed);\n    for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n    return outcome.settings;\n  }\n\n  function loadCredentials(): StoredCredential[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(credentialsPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(credentialsPath, notice);\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n    } catch {\n      // Fails closed: a half-readable credential file means enrolling again,\n      // not guessing which entries survived.\n      notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n      return [];\n    }\n  }\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, `${JSON.stringify(body, undefined, 2)}\\n`, { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;AAaA,MAAM,iBAAiB,CAAC,WAAW,KAAK;AACxC,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,YAAY;;AAElB,MAAM,kBAAkB;AAqBxB,SAAgB,sBAAsB,UAAkBA,QAAAA,QAAG,QAAQ,GAAW;CAC5E,OAAOC,UAAAA,QAAK,KAAK,SAAS,GAAG,cAAc;AAC7C;;;;;;;;AASA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,KAAKC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,qBAAqB,GAAG;EAC1D,QAAA,QAAG,UAAU,UAAU,SAAS;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;;;;;;;;;AAUA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAY,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAeD,UAAAA,QAAK,KAAK,WAAW,aAAa;CACvD,MAAM,kBAAkBA,UAAAA,QAAK,KAAK,WAAW,gBAAgB;CAE7D,IAAI,UAAU,KAAK;CACnB,IAAI,aAAa,gBAAgB;CAEjC,SAAS,OAA6B;EACpC,IAAI;EACJ,IAAI;GACF,MAAMC,QAAAA,QAAG,aAAa,cAAc,MAAM;EAC5C,QAAQ;GAEN,OAAOC,cAAAA;EACT;EACA,YAAY,cAAc,MAAM;EAChC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAGN,OAAO,6BAA6B,aAAa,oCAAoC;GACrF,OAAOA,cAAAA;EACT;EACA,MAAM,UAAUC,cAAAA,0BAA0B,MAAM;EAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;EACnF,OAAO,QAAQ;CACjB;CAEA,SAAS,kBAAsC;EAC7C,IAAI;EACJ,IAAI;GACF,MAAMF,QAAAA,QAAG,aAAa,iBAAiB,MAAM;EAC/C,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,iBAAiB,MAAM;EACnC,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,GAAG;GACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;EACnE,QAAQ;GAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;GACrF,OAAO,CAAC;EACV;CACF;CAEA,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,QAAA,QAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAM;GAAe,CAAC;GACjE,QAAA,QAAG,cAAc,WAAW,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;GAG1F,QAAA,QAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAcG,cAAAA,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}

package/dist/services/remoteAccessStore/index.mjs

@@ -0,0 +1,121 @@
+import { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings, serializeRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+//#region src/services/remoteAccessStore/index.ts
+/** Where the cockpit keeps machine-local state; `doompi sync` already writes its bundle here. */
+const STATE_SEGMENTS = [".doompi", "web"];
+const SETTINGS_FILE = "remote-access.json";
+const CREDENTIALS_FILE = "credentials.json";
+const DIRECTORY_MODE = 448;
+const FILE_MODE = 384;
+/** Any bit set for group or other; a state file readable by another account is worth repairing. */
+const LOOSE_MODE_MASK = 63;
+function defaultRemoteStateDir(homeDir = os.homedir()) {
+	return path.join(homeDir, ...STATE_SEGMENTS);
+}
+/**
+* Repairs a state file another account can read.
+*
+* Cheap, and it catches the cases a fresh write never would: a file restored
+* from a backup, copied with a permissive umask, or checked out of somewhere it
+* should not have been.
+*/
+function tightenMode(filePath, notice) {
+	try {
+		if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;
+		fs.chmodSync(filePath, FILE_MODE);
+		notice(`tightened permissions on ${filePath}`);
+	} catch {}
+}
+/**
+* Settings and passkeys on disk. Sessions deliberately not.
+*
+* A session is revoked when remote access is switched off, and a hub restart is
+* a switch-off, so persisting one would buy nothing while creating a bearer
+* secret worth stealing. A passkey is the opposite: surviving is its whole
+* point, and what is stored is a public key.
+*/
+function createRemoteAccessStore(options = {}) {
+	const directory = options.stateDir ?? defaultRemoteStateDir();
+	const notice = options.onNotice ?? (() => {});
+	const settingsPath = path.join(directory, SETTINGS_FILE);
+	const credentialsPath = path.join(directory, CREDENTIALS_FILE);
+	let current = load();
+	let registered = loadCredentials();
+	function load() {
+		let raw;
+		try {
+			raw = fs.readFileSync(settingsPath, "utf8");
+		} catch {
+			return DEFAULT_REMOTE_SETTINGS;
+		}
+		tightenMode(settingsPath, notice);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
+			return DEFAULT_REMOTE_SETTINGS;
+		}
+		const outcome = parseRemoteAccessSettings(parsed);
+		for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
+		return outcome.settings;
+	}
+	function loadCredentials() {
+		let raw;
+		try {
+			raw = fs.readFileSync(credentialsPath, "utf8");
+		} catch {
+			return [];
+		}
+		tightenMode(credentialsPath, notice);
+		try {
+			const parsed = JSON.parse(raw);
+			return Array.isArray(parsed) ? parsed : [];
+		} catch {
+			notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
+			return [];
+		}
+	}
+	function writeJson(target, body) {
+		const temporary = `${target}.${String(process.pid)}.tmp`;
+		try {
+			fs.mkdirSync(directory, {
+				recursive: true,
+				mode: DIRECTORY_MODE
+			});
+			fs.writeFileSync(temporary, `${JSON.stringify(body, void 0, 2)}\n`, { mode: FILE_MODE });
+			fs.renameSync(temporary, target);
+		} catch (error) {
+			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
+			try {
+				fs.rmSync(temporary, { force: true });
+			} catch {}
+		}
+	}
+	return {
+		directory,
+		settings: () => current,
+		credentials: () => registered,
+		saveCredential(credential) {
+			registered = [...registered.filter((held) => held.id !== credential.id), credential];
+			writeJson(credentialsPath, registered);
+		},
+		removeCredential(id) {
+			const next = registered.filter((held) => held.id !== id);
+			if (next.length === registered.length) return false;
+			registered = next;
+			writeJson(credentialsPath, registered);
+			return true;
+		},
+		save(settings) {
+			current = settings;
+			writeJson(settingsPath, serializeRemoteAccessSettings(settings));
+		}
+	};
+}
+//#endregion
+export { createRemoteAccessStore, defaultRemoteStateDir };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/remoteAccessStore/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport {\n  DEFAULT_REMOTE_SETTINGS,\n  parseRemoteAccessSettings,\n  serializeRemoteAccessSettings,\n} from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `doompi sync` already writes its bundle here. */\nconst STATE_SEGMENTS = ['.doompi', 'web'];\nconst SETTINGS_FILE = 'remote-access.json';\nconst CREDENTIALS_FILE = 'credentials.json';\nconst DIRECTORY_MODE = 0o700;\nconst FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nconst LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.doompi/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = os.homedir()): string {\n  return path.join(homeDir, ...STATE_SEGMENTS);\n}\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n\n  let current = load();\n  let registered = loadCredentials();\n\n  function load(): RemoteAccessSettings {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(settingsPath, 'utf8');\n    } catch {\n      // No file is the normal first run, so this is not worth a notice.\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    tightenMode(settingsPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Left in place rather than rewritten: silently overwriting a file\n      // somebody hand-edited is worse than ignoring it for this run.\n      notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    const outcome = parseRemoteAccessSettings(parsed);\n    for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n    return outcome.settings;\n  }\n\n  function loadCredentials(): StoredCredential[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(credentialsPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(credentialsPath, notice);\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n    } catch {\n      // Fails closed: a half-readable credential file means enrolling again,\n      // not guessing which entries survived.\n      notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n      return [];\n    }\n  }\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, `${JSON.stringify(body, undefined, 2)}\\n`, { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;AAaA,MAAM,iBAAiB,CAAC,WAAW,KAAK;AACxC,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,YAAY;;AAElB,MAAM,kBAAkB;AAqBxB,SAAgB,sBAAsB,UAAkB,GAAG,QAAQ,GAAW;CAC5E,OAAO,KAAK,KAAK,SAAS,GAAG,cAAc;AAC7C;;;;;;;;AASA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,KAAK,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,qBAAqB,GAAG;EAC1D,GAAG,UAAU,UAAU,SAAS;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;;;;;;;;;AAUA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAY,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAe,KAAK,KAAK,WAAW,aAAa;CACvD,MAAM,kBAAkB,KAAK,KAAK,WAAW,gBAAgB;CAE7D,IAAI,UAAU,KAAK;CACnB,IAAI,aAAa,gBAAgB;CAEjC,SAAS,OAA6B;EACpC,IAAI;EACJ,IAAI;GACF,MAAM,GAAG,aAAa,cAAc,MAAM;EAC5C,QAAQ;GAEN,OAAO;EACT;EACA,YAAY,cAAc,MAAM;EAChC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAGN,OAAO,6BAA6B,aAAa,oCAAoC;GACrF,OAAO;EACT;EACA,MAAM,UAAU,0BAA0B,MAAM;EAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;EACnF,OAAO,QAAQ;CACjB;CAEA,SAAS,kBAAsC;EAC7C,IAAI;EACJ,IAAI;GACF,MAAM,GAAG,aAAa,iBAAiB,MAAM;EAC/C,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,iBAAiB,MAAM;EACnC,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,GAAG;GACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;EACnE,QAAQ;GAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;GACrF,OAAO,CAAC;EACV;CACF;CAEA,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,GAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAM;GAAe,CAAC;GACjE,GAAG,cAAc,WAAW,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;GAG1F,GAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAc,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}

package/dist/services/remoteGuardPolicy/index.cjs

@@ -0,0 +1,190 @@
+const require_remote = require("../../constants/remote.cjs");
+//#region src/services/remoteGuardPolicy/index.ts
+/**
+* Who may do what, on which listener.
+*
+* The cockpit runs one Hono app behind two sockets: a loopback listener that is
+* open to whoever already has an account on the machine, and a tunnel listener
+* that faces the public internet. Every decision here answers one question
+* about one request, with no I/O, so the whole trust boundary is readable in a
+* single sitting and testable without a server.
+*/
+const METHOD_GET = "GET";
+const METHOD_HEAD = "HEAD";
+const METHOD_POST = "POST";
+/** Cloudflare's edge speaks to us on 443, so the Host it forwards may or may not carry the port. */
+const HTTPS_DEFAULT_PORT = "443";
+/**
+* The exact package-owned pairing and PWA bootstrap routes the tunnel listener
+* answers directly. They are matched by string equality, never prefixes or
+* wildcards. A contract test pins the list so additions require review.
+*
+* Passkey sign-in is public because it creates a session by proving a credential.
+* Registration is also direct so the self-contained pairing page can run it, but
+* its handlers require the paired device cookie issued only after host approval.
+*/
+const PUBLIC_PAIRING_ROUTES = [
+	{
+		method: METHOD_GET,
+		path: "/"
+	},
+	{
+		method: METHOD_GET,
+		path: require_remote.PAIRING_PAGE_ROUTE
+	},
+	{
+		method: METHOD_GET,
+		path: "/manifest.webmanifest"
+	},
+	{
+		method: METHOD_GET,
+		path: "/sw.js"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/pwa.js"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/icon-192.png"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/icon-512.png"
+	},
+	{
+		method: METHOD_POST,
+		path: require_remote.PAIRING_CLAIM_ROUTE
+	},
+	{
+		method: METHOD_GET,
+		path: require_remote.PAIRING_STATUS_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: require_remote.PASSKEY_AUTH_BEGIN_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: require_remote.PASSKEY_AUTH_FINISH_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: require_remote.PASSKEY_REGISTER_BEGIN_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: require_remote.PASSKEY_REGISTER_FINISH_ROUTE
+	}
+];
+/**
+* Whether the tunnel listener may answer this request directly.
+*
+* Session requirements for direct routes are enforced by their exact handlers.
+* `path` must be the value the router matched on, which for Hono is
+* `c.req.path`. That value is percent-decoded, so `/%70air` reaches the `/pair`
+* handler; comparing against a separately parsed pathname would let the guard
+* and the router disagree about the same request, which is how an allowlist
+* turns into a bypass.
+*/
+function isPublicPairingRoute(method, path) {
+	const wanted = method.toUpperCase();
+	return PUBLIC_PAIRING_ROUTES.some((route) => route.method === wanted && route.path === path);
+}
+/** Normalizes to scheme://host[:port], lowercased. Undefined for anything unparseable, `null` included. */
+function normalizeOrigin(raw) {
+	try {
+		return new URL(raw).origin.toLowerCase();
+	} catch {
+		return;
+	}
+}
+function normalizeHost(raw) {
+	return raw.trim().toLowerCase();
+}
+/**
+* What the loopback listener accepts.
+*
+* The port is the one the socket actually bound, not a constant, because the
+* hub takes `--port` and the e2e fixture reserves a random free one. The vite
+* dev server is allowed unconditionally so the documented two-terminal plugin
+* loop keeps working; anything that can bind that port already runs as this
+* user, so the marginal risk is close to nothing.
+*/
+function localOriginPolicy(port, extraOrigins = []) {
+	const hosts = /* @__PURE__ */ new Set();
+	const origins = /* @__PURE__ */ new Set();
+	for (const listenPort of [port, require_remote.WEB_DEV_SERVER_PORT]) for (const name of [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	]) {
+		const host = `${name}:${String(listenPort)}`;
+		hosts.add(host);
+		origins.add(`http://${host}`);
+	}
+	for (const extra of extraOrigins) {
+		const normalized = normalizeOrigin(extra);
+		if (normalized !== void 0) origins.add(normalized);
+	}
+	return {
+		origins,
+		hosts
+	};
+}
+/** What the tunnel listener accepts: its own origin and nothing else. */
+function tunnelOriginPolicy(publicOrigin, extraHosts = []) {
+	const normalized = normalizeOrigin(publicOrigin);
+	if (normalized === void 0) throw new Error(`The tunnel origin "${publicOrigin}" is not a URL.`);
+	const host = new URL(normalized).host;
+	const hosts = /* @__PURE__ */ new Set([host, `${host}:${HTTPS_DEFAULT_PORT}`]);
+	for (const extra of extraHosts) hosts.add(normalizeHost(extra));
+	return {
+		origins: /* @__PURE__ */ new Set([normalized]),
+		hosts
+	};
+}
+/** A request with a side effect: anything that is not a plain read, plus every socket upgrade. */
+function isMutating(method, isUpgrade) {
+	if (isUpgrade) return true;
+	const wanted = method.toUpperCase();
+	return wanted !== METHOD_GET && wanted !== METHOD_HEAD;
+}
+/**
+* Whether the request's Origin and Host are ones this listener answers to.
+*
+* The loopback listener is lenient about a missing Origin and strict about one
+* that is present. That asymmetry is deliberate: a browser always sends Origin
+* on a socket handshake and on a cross-origin mutation, which is the attack
+* this closes, while curl, the health probe, and the test harness send none and
+* would break for no security gain. It buys nothing against a local program,
+* which can send whatever it likes, and is not meant to.
+*
+* The tunnel listener requires Origin on anything with a side effect and
+* tolerates its absence only on a plain read, because a top-level navigation
+* (following the scanned link) legitimately sends none.
+*
+* Host is checked on both. On the loopback listener that is the DNS-rebinding
+* defence for a well-known port, and it is the only check a socket upgrade gets
+* at all, since the upgrade path never reaches the node-server host parsing.
+*/
+function originVerdict(input) {
+	const policy = input.listener === "local" ? input.local : input.tunnel;
+	if (policy === void 0) return "not-ready";
+	if (input.host === void 0 || !policy.hosts.has(normalizeHost(input.host))) return "bad-host";
+	if (input.origin === void 0) {
+		if (input.listener === "local") return "allow";
+		return isMutating(input.method, input.isUpgrade) ? "bad-origin" : "allow";
+	}
+	const origin = normalizeOrigin(input.origin);
+	if (origin === void 0 || !policy.origins.has(origin)) return "bad-origin";
+	return "allow";
+}
+//#endregion
+exports.PUBLIC_PAIRING_ROUTES = PUBLIC_PAIRING_ROUTES;
+exports.isPublicPairingRoute = isPublicPairingRoute;
+exports.localOriginPolicy = localOriginPolicy;
+exports.originVerdict = originVerdict;
+exports.tunnelOriginPolicy = tunnelOriginPolicy;
+
+//# sourceMappingURL=index.cjs.map