@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/remoteGuardPolicy/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["PAIRING_PAGE_ROUTE","PAIRING_CLAIM_ROUTE","PAIRING_STATUS_ROUTE","PASSKEY_AUTH_BEGIN_ROUTE","PASSKEY_AUTH_FINISH_ROUTE","PASSKEY_REGISTER_BEGIN_ROUTE","PASSKEY_REGISTER_FINISH_ROUTE","WEB_DEV_SERVER_PORT"],"sources":["../../../src/services/remoteGuardPolicy/index.ts"],"sourcesContent":["/**\n * Who may do what, on which listener.\n *\n * The cockpit runs one Hono app behind two sockets: a loopback listener that is\n * open to whoever already has an account on the machine, and a tunnel listener\n * that faces the public internet. Every decision here answers one question\n * about one request, with no I/O, so the whole trust boundary is readable in a\n * single sitting and testable without a server.\n */\n\nimport {\n  PAIRING_CLAIM_ROUTE,\n  PAIRING_PAGE_ROUTE,\n  PAIRING_STATUS_ROUTE,\n  PASSKEY_AUTH_BEGIN_ROUTE,\n  PASSKEY_AUTH_FINISH_ROUTE,\n  PASSKEY_REGISTER_BEGIN_ROUTE,\n  PASSKEY_REGISTER_FINISH_ROUTE,\n  WEB_DEV_SERVER_PORT,\n} from '../../constants/remote';\n\nconst METHOD_GET = 'GET';\nconst METHOD_HEAD = 'HEAD';\nconst METHOD_POST = 'POST';\n/** Cloudflare's edge speaks to us on 443, so the Host it forwards may or may not carry the port. */\nconst HTTPS_DEFAULT_PORT = '443';\n\nexport type GuardListener = 'local' | 'tunnel';\n\nexport type OriginVerdict = 'allow' | 'bad-origin' | 'bad-host' | 'not-ready';\n\nexport interface OriginPolicy {\n  origins: ReadonlySet<string>;\n  hosts: ReadonlySet<string>;\n}\n\nexport interface OriginVerdictInput {\n  listener: GuardListener;\n  method: string;\n  isUpgrade: boolean;\n  origin: string | undefined;\n  host: string | undefined;\n  local: OriginPolicy;\n  /** Undefined until the tunnel reports its hostname; until then nothing on that listener is served. */\n  tunnel: OriginPolicy | undefined;\n}\n\n/**\n * Which socket a request arrived on.\n *\n * Phrased as allow-only-if-provably-local on purpose. A missing env, an\n * unreadable port, or a socket torn down mid-request all resolve to 'tunnel'\n * and therefore require a credential. The mirror-image phrasing\n * (`port === tunnelPort`) fails open on every one of those.\n */\nexport function listenerOf(socketLocalPort: number | undefined, loopbackPort: number | undefined): GuardListener {\n  if (loopbackPort === undefined || socketLocalPort === undefined) return 'tunnel';\n  return socketLocalPort === loopbackPort ? 'local' : 'tunnel';\n}\n\n/**\n * The exact package-owned pairing and PWA bootstrap routes the tunnel listener\n * answers directly. They are matched by string equality, never prefixes or\n * wildcards. A contract test pins the list so additions require review.\n *\n * Passkey sign-in is public because it creates a session by proving a credential.\n * Registration is also direct so the self-contained pairing page can run it, but\n * its handlers require the paired device cookie issued only after host approval.\n */\nexport const PUBLIC_PAIRING_ROUTES: readonly { method: string; path: string }[] = [\n  { method: METHOD_GET, path: '/' },\n  { method: METHOD_GET, path: PAIRING_PAGE_ROUTE },\n  { method: METHOD_GET, path: '/manifest.webmanifest' },\n  { method: METHOD_GET, path: '/sw.js' },\n  { method: METHOD_GET, path: '/pwa/pwa.js' },\n  { method: METHOD_GET, path: '/pwa/icon-192.png' },\n  { method: METHOD_GET, path: '/pwa/icon-512.png' },\n  { method: METHOD_POST, path: PAIRING_CLAIM_ROUTE },\n  { method: METHOD_GET, path: PAIRING_STATUS_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_AUTH_BEGIN_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_AUTH_FINISH_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_REGISTER_BEGIN_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_REGISTER_FINISH_ROUTE },\n];\n\n/**\n * Whether the tunnel listener may answer this request directly.\n *\n * Session requirements for direct routes are enforced by their exact handlers.\n * `path` must be the value the router matched on, which for Hono is\n * `c.req.path`. That value is percent-decoded, so `/%70air` reaches the `/pair`\n * handler; comparing against a separately parsed pathname would let the guard\n * and the router disagree about the same request, which is how an allowlist\n * turns into a bypass.\n */\nexport function isPublicPairingRoute(method: string, path: string): boolean {\n  const wanted = method.toUpperCase();\n  return PUBLIC_PAIRING_ROUTES.some((route) => route.method === wanted && route.path === path);\n}\n\n/**\n * Reads the operator's extra-origin allowlist.\n *\n * The escape hatch for a dev setup this package cannot guess: a second dev\n * server port, a reverse proxy, a `.local` hostname. Comma separated, blanks\n * dropped, so an empty or unset variable adds nothing.\n */\nexport function allowedOriginsFromEnv(raw: string | undefined): readonly string[] {\n  if (raw === undefined) return [];\n  return raw\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry !== '');\n}\n\n/** Normalizes to scheme://host[:port], lowercased. Undefined for anything unparseable, `null` included. */\nfunction normalizeOrigin(raw: string): string | undefined {\n  try {\n    return new URL(raw).origin.toLowerCase();\n  } catch {\n    // An Origin header that is not a URL is either the opaque `null` or a\n    // forgery; neither is on any allowlist, so refusing it is the answer.\n    return undefined;\n  }\n}\n\nfunction normalizeHost(raw: string): string {\n  return raw.trim().toLowerCase();\n}\n\n/**\n * What the loopback listener accepts.\n *\n * The port is the one the socket actually bound, not a constant, because the\n * hub takes `--port` and the e2e fixture reserves a random free one. The vite\n * dev server is allowed unconditionally so the documented two-terminal plugin\n * loop keeps working; anything that can bind that port already runs as this\n * user, so the marginal risk is close to nothing.\n */\nexport function localOriginPolicy(port: number, extraOrigins: readonly string[] = []): OriginPolicy {\n  const hosts = new Set<string>();\n  const origins = new Set<string>();\n  // The dev server's own port belongs here too: vite proxies /api to the hub\n  // without `changeOrigin`, so the browser's Host and Origin arrive unchanged\n  // and both name 7434 rather than the hub's port.\n  for (const listenPort of [port, WEB_DEV_SERVER_PORT]) {\n    for (const name of ['127.0.0.1', 'localhost', '[::1]']) {\n      const host = `${name}:${String(listenPort)}`;\n      hosts.add(host);\n      origins.add(`http://${host}`);\n    }\n  }\n  for (const extra of extraOrigins) {\n    const normalized = normalizeOrigin(extra);\n    if (normalized !== undefined) origins.add(normalized);\n  }\n  return { origins, hosts };\n}\n\n/** What the tunnel listener accepts: its own origin and nothing else. */\nexport function tunnelOriginPolicy(publicOrigin: string, extraHosts: readonly string[] = []): OriginPolicy {\n  const normalized = normalizeOrigin(publicOrigin);\n  if (normalized === undefined) throw new Error(`The tunnel origin \"${publicOrigin}\" is not a URL.`);\n  const host = new URL(normalized).host;\n  const hosts = new Set([host, `${host}:${HTTPS_DEFAULT_PORT}`]);\n  for (const extra of extraHosts) hosts.add(normalizeHost(extra));\n  return { origins: new Set([normalized]), hosts };\n}\n\n/** A request with a side effect: anything that is not a plain read, plus every socket upgrade. */\nfunction isMutating(method: string, isUpgrade: boolean): boolean {\n  if (isUpgrade) return true;\n  const wanted = method.toUpperCase();\n  return wanted !== METHOD_GET && wanted !== METHOD_HEAD;\n}\n\n/**\n * Whether the request's Origin and Host are ones this listener answers to.\n *\n * The loopback listener is lenient about a missing Origin and strict about one\n * that is present. That asymmetry is deliberate: a browser always sends Origin\n * on a socket handshake and on a cross-origin mutation, which is the attack\n * this closes, while curl, the health probe, and the test harness send none and\n * would break for no security gain. It buys nothing against a local program,\n * which can send whatever it likes, and is not meant to.\n *\n * The tunnel listener requires Origin on anything with a side effect and\n * tolerates its absence only on a plain read, because a top-level navigation\n * (following the scanned link) legitimately sends none.\n *\n * Host is checked on both. On the loopback listener that is the DNS-rebinding\n * defence for a well-known port, and it is the only check a socket upgrade gets\n * at all, since the upgrade path never reaches the node-server host parsing.\n */\nexport function originVerdict(input: OriginVerdictInput): OriginVerdict {\n  const policy = input.listener === 'local' ? input.local : input.tunnel;\n  // Before the tunnel names itself there is no legitimate traffic to serve and\n  // no origin to compare against, so the listener answers nothing at all.\n  if (policy === undefined) return 'not-ready';\n\n  if (input.host === undefined || !policy.hosts.has(normalizeHost(input.host))) return 'bad-host';\n\n  if (input.origin === undefined) {\n    if (input.listener === 'local') return 'allow';\n    return isMutating(input.method, input.isUpgrade) ? 'bad-origin' : 'allow';\n  }\n\n  const origin = normalizeOrigin(input.origin);\n  if (origin === undefined || !policy.origins.has(origin)) return 'bad-origin';\n  return 'allow';\n}\n"],"mappings":";;;;;;;;;;;AAqBA,MAAM,aAAa;AACnB,MAAM,cAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,qBAAqB;;;;;;;;;;AA4C3B,MAAa,wBAAqE;CAChF;EAAE,QAAQ;EAAY,MAAM;CAAI;CAChC;EAAE,QAAQ;EAAY,MAAMA,eAAAA;CAAmB;CAC/C;EAAE,QAAQ;EAAY,MAAM;CAAwB;CACpD;EAAE,QAAQ;EAAY,MAAM;CAAS;CACrC;EAAE,QAAQ;EAAY,MAAM;CAAc;CAC1C;EAAE,QAAQ;EAAY,MAAM;CAAoB;CAChD;EAAE,QAAQ;EAAY,MAAM;CAAoB;CAChD;EAAE,QAAQ;EAAa,MAAMC,eAAAA;CAAoB;CACjD;EAAE,QAAQ;EAAY,MAAMC,eAAAA;CAAqB;CACjD;EAAE,QAAQ;EAAa,MAAMC,eAAAA;CAAyB;CACtD;EAAE,QAAQ;EAAa,MAAMC,eAAAA;CAA0B;CACvD;EAAE,QAAQ;EAAa,MAAMC,eAAAA;CAA6B;CAC1D;EAAE,QAAQ;EAAa,MAAMC,eAAAA;CAA8B;AAC7D;;;;;;;;;;;AAYA,SAAgB,qBAAqB,QAAgB,MAAuB;CAC1E,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,sBAAsB,MAAM,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,IAAI;AAC7F;;AAkBA,SAAS,gBAAgB,KAAiC;CACxD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,YAAY;CACzC,QAAQ;EAGN;CACF;AACF;AAEA,SAAS,cAAc,KAAqB;CAC1C,OAAO,IAAI,KAAK,CAAC,CAAC,YAAY;AAChC;;;;;;;;;;AAWA,SAAgB,kBAAkB,MAAc,eAAkC,CAAC,GAAiB;CAClG,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,0BAAU,IAAI,IAAY;CAIhC,KAAK,MAAM,cAAc,CAAC,MAAMC,eAAAA,mBAAmB,GACjD,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAa;CAAO,GAAG;EACtD,MAAM,OAAO,GAAG,KAAK,GAAG,OAAO,UAAU;EACzC,MAAM,IAAI,IAAI;EACd,QAAQ,IAAI,UAAU,MAAM;CAC9B;CAEF,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,aAAa,gBAAgB,KAAK;EACxC,IAAI,eAAe,KAAA,GAAW,QAAQ,IAAI,UAAU;CACtD;CACA,OAAO;EAAE;EAAS;CAAM;AAC1B;;AAGA,SAAgB,mBAAmB,cAAsB,aAAgC,CAAC,GAAiB;CACzG,MAAM,aAAa,gBAAgB,YAAY;CAC/C,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sBAAsB,aAAa,gBAAgB;CACjG,MAAM,OAAO,IAAI,IAAI,UAAU,CAAC,CAAC;CACjC,MAAM,wBAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;CAC7D,KAAK,MAAM,SAAS,YAAY,MAAM,IAAI,cAAc,KAAK,CAAC;CAC9D,OAAO;EAAE,yBAAS,IAAI,IAAI,CAAC,UAAU,CAAC;EAAG;CAAM;AACjD;;AAGA,SAAS,WAAW,QAAgB,WAA6B;CAC/D,IAAI,WAAW,OAAO;CACtB,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,WAAW,cAAc,WAAW;AAC7C;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,cAAc,OAA0C;CACtE,MAAM,SAAS,MAAM,aAAa,UAAU,MAAM,QAAQ,MAAM;CAGhE,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,IAAI,MAAM,SAAS,KAAA,KAAa,CAAC,OAAO,MAAM,IAAI,cAAc,MAAM,IAAI,CAAC,GAAG,OAAO;CAErF,IAAI,MAAM,WAAW,KAAA,GAAW;EAC9B,IAAI,MAAM,aAAa,SAAS,OAAO;EACvC,OAAO,WAAW,MAAM,QAAQ,MAAM,SAAS,IAAI,eAAe;CACpE;CAEA,MAAM,SAAS,gBAAgB,MAAM,MAAM;CAC3C,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,QAAQ,IAAI,MAAM,GAAG,OAAO;CAChE,OAAO;AACT"}

package/dist/services/remoteGuardPolicy/index.d.cts

@@ -0,0 +1,7 @@
+//#region src/services/remoteGuardPolicy/index.d.ts
+export interface OriginPolicy {
+  origins: ReadonlySet<string>;
+  hosts: ReadonlySet<string>;
+}
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/remoteGuardPolicy/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/remoteGuardPolicy/index.ts"],"mappings":";iBA+BiB;EACf,SAAS;EACT,OAAO"}

package/dist/services/remoteGuardPolicy/index.d.mts

@@ -0,0 +1,7 @@
+//#region src/services/remoteGuardPolicy/index.d.ts
+export interface OriginPolicy {
+  origins: ReadonlySet<string>;
+  hosts: ReadonlySet<string>;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/remoteGuardPolicy/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/remoteGuardPolicy/index.ts"],"mappings":";iBA+BiB;EACf,SAAS;EACT,OAAO"}

package/dist/services/remoteGuardPolicy/index.mjs

@@ -0,0 +1,186 @@
+import { PAIRING_CLAIM_ROUTE, PAIRING_PAGE_ROUTE, PAIRING_STATUS_ROUTE, PASSKEY_AUTH_BEGIN_ROUTE, PASSKEY_AUTH_FINISH_ROUTE, PASSKEY_REGISTER_BEGIN_ROUTE, PASSKEY_REGISTER_FINISH_ROUTE, WEB_DEV_SERVER_PORT } from "../../constants/remote.mjs";
+//#region src/services/remoteGuardPolicy/index.ts
+/**
+* Who may do what, on which listener.
+*
+* The cockpit runs one Hono app behind two sockets: a loopback listener that is
+* open to whoever already has an account on the machine, and a tunnel listener
+* that faces the public internet. Every decision here answers one question
+* about one request, with no I/O, so the whole trust boundary is readable in a
+* single sitting and testable without a server.
+*/
+const METHOD_GET = "GET";
+const METHOD_HEAD = "HEAD";
+const METHOD_POST = "POST";
+/** Cloudflare's edge speaks to us on 443, so the Host it forwards may or may not carry the port. */
+const HTTPS_DEFAULT_PORT = "443";
+/**
+* The exact package-owned pairing and PWA bootstrap routes the tunnel listener
+* answers directly. They are matched by string equality, never prefixes or
+* wildcards. A contract test pins the list so additions require review.
+*
+* Passkey sign-in is public because it creates a session by proving a credential.
+* Registration is also direct so the self-contained pairing page can run it, but
+* its handlers require the paired device cookie issued only after host approval.
+*/
+const PUBLIC_PAIRING_ROUTES = [
+	{
+		method: METHOD_GET,
+		path: "/"
+	},
+	{
+		method: METHOD_GET,
+		path: PAIRING_PAGE_ROUTE
+	},
+	{
+		method: METHOD_GET,
+		path: "/manifest.webmanifest"
+	},
+	{
+		method: METHOD_GET,
+		path: "/sw.js"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/pwa.js"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/icon-192.png"
+	},
+	{
+		method: METHOD_GET,
+		path: "/pwa/icon-512.png"
+	},
+	{
+		method: METHOD_POST,
+		path: PAIRING_CLAIM_ROUTE
+	},
+	{
+		method: METHOD_GET,
+		path: PAIRING_STATUS_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: PASSKEY_AUTH_BEGIN_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: PASSKEY_AUTH_FINISH_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: PASSKEY_REGISTER_BEGIN_ROUTE
+	},
+	{
+		method: METHOD_POST,
+		path: PASSKEY_REGISTER_FINISH_ROUTE
+	}
+];
+/**
+* Whether the tunnel listener may answer this request directly.
+*
+* Session requirements for direct routes are enforced by their exact handlers.
+* `path` must be the value the router matched on, which for Hono is
+* `c.req.path`. That value is percent-decoded, so `/%70air` reaches the `/pair`
+* handler; comparing against a separately parsed pathname would let the guard
+* and the router disagree about the same request, which is how an allowlist
+* turns into a bypass.
+*/
+function isPublicPairingRoute(method, path) {
+	const wanted = method.toUpperCase();
+	return PUBLIC_PAIRING_ROUTES.some((route) => route.method === wanted && route.path === path);
+}
+/** Normalizes to scheme://host[:port], lowercased. Undefined for anything unparseable, `null` included. */
+function normalizeOrigin(raw) {
+	try {
+		return new URL(raw).origin.toLowerCase();
+	} catch {
+		return;
+	}
+}
+function normalizeHost(raw) {
+	return raw.trim().toLowerCase();
+}
+/**
+* What the loopback listener accepts.
+*
+* The port is the one the socket actually bound, not a constant, because the
+* hub takes `--port` and the e2e fixture reserves a random free one. The vite
+* dev server is allowed unconditionally so the documented two-terminal plugin
+* loop keeps working; anything that can bind that port already runs as this
+* user, so the marginal risk is close to nothing.
+*/
+function localOriginPolicy(port, extraOrigins = []) {
+	const hosts = /* @__PURE__ */ new Set();
+	const origins = /* @__PURE__ */ new Set();
+	for (const listenPort of [port, WEB_DEV_SERVER_PORT]) for (const name of [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	]) {
+		const host = `${name}:${String(listenPort)}`;
+		hosts.add(host);
+		origins.add(`http://${host}`);
+	}
+	for (const extra of extraOrigins) {
+		const normalized = normalizeOrigin(extra);
+		if (normalized !== void 0) origins.add(normalized);
+	}
+	return {
+		origins,
+		hosts
+	};
+}
+/** What the tunnel listener accepts: its own origin and nothing else. */
+function tunnelOriginPolicy(publicOrigin, extraHosts = []) {
+	const normalized = normalizeOrigin(publicOrigin);
+	if (normalized === void 0) throw new Error(`The tunnel origin "${publicOrigin}" is not a URL.`);
+	const host = new URL(normalized).host;
+	const hosts = /* @__PURE__ */ new Set([host, `${host}:${HTTPS_DEFAULT_PORT}`]);
+	for (const extra of extraHosts) hosts.add(normalizeHost(extra));
+	return {
+		origins: /* @__PURE__ */ new Set([normalized]),
+		hosts
+	};
+}
+/** A request with a side effect: anything that is not a plain read, plus every socket upgrade. */
+function isMutating(method, isUpgrade) {
+	if (isUpgrade) return true;
+	const wanted = method.toUpperCase();
+	return wanted !== METHOD_GET && wanted !== METHOD_HEAD;
+}
+/**
+* Whether the request's Origin and Host are ones this listener answers to.
+*
+* The loopback listener is lenient about a missing Origin and strict about one
+* that is present. That asymmetry is deliberate: a browser always sends Origin
+* on a socket handshake and on a cross-origin mutation, which is the attack
+* this closes, while curl, the health probe, and the test harness send none and
+* would break for no security gain. It buys nothing against a local program,
+* which can send whatever it likes, and is not meant to.
+*
+* The tunnel listener requires Origin on anything with a side effect and
+* tolerates its absence only on a plain read, because a top-level navigation
+* (following the scanned link) legitimately sends none.
+*
+* Host is checked on both. On the loopback listener that is the DNS-rebinding
+* defence for a well-known port, and it is the only check a socket upgrade gets
+* at all, since the upgrade path never reaches the node-server host parsing.
+*/
+function originVerdict(input) {
+	const policy = input.listener === "local" ? input.local : input.tunnel;
+	if (policy === void 0) return "not-ready";
+	if (input.host === void 0 || !policy.hosts.has(normalizeHost(input.host))) return "bad-host";
+	if (input.origin === void 0) {
+		if (input.listener === "local") return "allow";
+		return isMutating(input.method, input.isUpgrade) ? "bad-origin" : "allow";
+	}
+	const origin = normalizeOrigin(input.origin);
+	if (origin === void 0 || !policy.origins.has(origin)) return "bad-origin";
+	return "allow";
+}
+//#endregion
+export { PUBLIC_PAIRING_ROUTES, isPublicPairingRoute, localOriginPolicy, originVerdict, tunnelOriginPolicy };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/remoteGuardPolicy/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/remoteGuardPolicy/index.ts"],"sourcesContent":["/**\n * Who may do what, on which listener.\n *\n * The cockpit runs one Hono app behind two sockets: a loopback listener that is\n * open to whoever already has an account on the machine, and a tunnel listener\n * that faces the public internet. Every decision here answers one question\n * about one request, with no I/O, so the whole trust boundary is readable in a\n * single sitting and testable without a server.\n */\n\nimport {\n  PAIRING_CLAIM_ROUTE,\n  PAIRING_PAGE_ROUTE,\n  PAIRING_STATUS_ROUTE,\n  PASSKEY_AUTH_BEGIN_ROUTE,\n  PASSKEY_AUTH_FINISH_ROUTE,\n  PASSKEY_REGISTER_BEGIN_ROUTE,\n  PASSKEY_REGISTER_FINISH_ROUTE,\n  WEB_DEV_SERVER_PORT,\n} from '../../constants/remote';\n\nconst METHOD_GET = 'GET';\nconst METHOD_HEAD = 'HEAD';\nconst METHOD_POST = 'POST';\n/** Cloudflare's edge speaks to us on 443, so the Host it forwards may or may not carry the port. */\nconst HTTPS_DEFAULT_PORT = '443';\n\nexport type GuardListener = 'local' | 'tunnel';\n\nexport type OriginVerdict = 'allow' | 'bad-origin' | 'bad-host' | 'not-ready';\n\nexport interface OriginPolicy {\n  origins: ReadonlySet<string>;\n  hosts: ReadonlySet<string>;\n}\n\nexport interface OriginVerdictInput {\n  listener: GuardListener;\n  method: string;\n  isUpgrade: boolean;\n  origin: string | undefined;\n  host: string | undefined;\n  local: OriginPolicy;\n  /** Undefined until the tunnel reports its hostname; until then nothing on that listener is served. */\n  tunnel: OriginPolicy | undefined;\n}\n\n/**\n * Which socket a request arrived on.\n *\n * Phrased as allow-only-if-provably-local on purpose. A missing env, an\n * unreadable port, or a socket torn down mid-request all resolve to 'tunnel'\n * and therefore require a credential. The mirror-image phrasing\n * (`port === tunnelPort`) fails open on every one of those.\n */\nexport function listenerOf(socketLocalPort: number | undefined, loopbackPort: number | undefined): GuardListener {\n  if (loopbackPort === undefined || socketLocalPort === undefined) return 'tunnel';\n  return socketLocalPort === loopbackPort ? 'local' : 'tunnel';\n}\n\n/**\n * The exact package-owned pairing and PWA bootstrap routes the tunnel listener\n * answers directly. They are matched by string equality, never prefixes or\n * wildcards. A contract test pins the list so additions require review.\n *\n * Passkey sign-in is public because it creates a session by proving a credential.\n * Registration is also direct so the self-contained pairing page can run it, but\n * its handlers require the paired device cookie issued only after host approval.\n */\nexport const PUBLIC_PAIRING_ROUTES: readonly { method: string; path: string }[] = [\n  { method: METHOD_GET, path: '/' },\n  { method: METHOD_GET, path: PAIRING_PAGE_ROUTE },\n  { method: METHOD_GET, path: '/manifest.webmanifest' },\n  { method: METHOD_GET, path: '/sw.js' },\n  { method: METHOD_GET, path: '/pwa/pwa.js' },\n  { method: METHOD_GET, path: '/pwa/icon-192.png' },\n  { method: METHOD_GET, path: '/pwa/icon-512.png' },\n  { method: METHOD_POST, path: PAIRING_CLAIM_ROUTE },\n  { method: METHOD_GET, path: PAIRING_STATUS_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_AUTH_BEGIN_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_AUTH_FINISH_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_REGISTER_BEGIN_ROUTE },\n  { method: METHOD_POST, path: PASSKEY_REGISTER_FINISH_ROUTE },\n];\n\n/**\n * Whether the tunnel listener may answer this request directly.\n *\n * Session requirements for direct routes are enforced by their exact handlers.\n * `path` must be the value the router matched on, which for Hono is\n * `c.req.path`. That value is percent-decoded, so `/%70air` reaches the `/pair`\n * handler; comparing against a separately parsed pathname would let the guard\n * and the router disagree about the same request, which is how an allowlist\n * turns into a bypass.\n */\nexport function isPublicPairingRoute(method: string, path: string): boolean {\n  const wanted = method.toUpperCase();\n  return PUBLIC_PAIRING_ROUTES.some((route) => route.method === wanted && route.path === path);\n}\n\n/**\n * Reads the operator's extra-origin allowlist.\n *\n * The escape hatch for a dev setup this package cannot guess: a second dev\n * server port, a reverse proxy, a `.local` hostname. Comma separated, blanks\n * dropped, so an empty or unset variable adds nothing.\n */\nexport function allowedOriginsFromEnv(raw: string | undefined): readonly string[] {\n  if (raw === undefined) return [];\n  return raw\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry !== '');\n}\n\n/** Normalizes to scheme://host[:port], lowercased. Undefined for anything unparseable, `null` included. */\nfunction normalizeOrigin(raw: string): string | undefined {\n  try {\n    return new URL(raw).origin.toLowerCase();\n  } catch {\n    // An Origin header that is not a URL is either the opaque `null` or a\n    // forgery; neither is on any allowlist, so refusing it is the answer.\n    return undefined;\n  }\n}\n\nfunction normalizeHost(raw: string): string {\n  return raw.trim().toLowerCase();\n}\n\n/**\n * What the loopback listener accepts.\n *\n * The port is the one the socket actually bound, not a constant, because the\n * hub takes `--port` and the e2e fixture reserves a random free one. The vite\n * dev server is allowed unconditionally so the documented two-terminal plugin\n * loop keeps working; anything that can bind that port already runs as this\n * user, so the marginal risk is close to nothing.\n */\nexport function localOriginPolicy(port: number, extraOrigins: readonly string[] = []): OriginPolicy {\n  const hosts = new Set<string>();\n  const origins = new Set<string>();\n  // The dev server's own port belongs here too: vite proxies /api to the hub\n  // without `changeOrigin`, so the browser's Host and Origin arrive unchanged\n  // and both name 7434 rather than the hub's port.\n  for (const listenPort of [port, WEB_DEV_SERVER_PORT]) {\n    for (const name of ['127.0.0.1', 'localhost', '[::1]']) {\n      const host = `${name}:${String(listenPort)}`;\n      hosts.add(host);\n      origins.add(`http://${host}`);\n    }\n  }\n  for (const extra of extraOrigins) {\n    const normalized = normalizeOrigin(extra);\n    if (normalized !== undefined) origins.add(normalized);\n  }\n  return { origins, hosts };\n}\n\n/** What the tunnel listener accepts: its own origin and nothing else. */\nexport function tunnelOriginPolicy(publicOrigin: string, extraHosts: readonly string[] = []): OriginPolicy {\n  const normalized = normalizeOrigin(publicOrigin);\n  if (normalized === undefined) throw new Error(`The tunnel origin \"${publicOrigin}\" is not a URL.`);\n  const host = new URL(normalized).host;\n  const hosts = new Set([host, `${host}:${HTTPS_DEFAULT_PORT}`]);\n  for (const extra of extraHosts) hosts.add(normalizeHost(extra));\n  return { origins: new Set([normalized]), hosts };\n}\n\n/** A request with a side effect: anything that is not a plain read, plus every socket upgrade. */\nfunction isMutating(method: string, isUpgrade: boolean): boolean {\n  if (isUpgrade) return true;\n  const wanted = method.toUpperCase();\n  return wanted !== METHOD_GET && wanted !== METHOD_HEAD;\n}\n\n/**\n * Whether the request's Origin and Host are ones this listener answers to.\n *\n * The loopback listener is lenient about a missing Origin and strict about one\n * that is present. That asymmetry is deliberate: a browser always sends Origin\n * on a socket handshake and on a cross-origin mutation, which is the attack\n * this closes, while curl, the health probe, and the test harness send none and\n * would break for no security gain. It buys nothing against a local program,\n * which can send whatever it likes, and is not meant to.\n *\n * The tunnel listener requires Origin on anything with a side effect and\n * tolerates its absence only on a plain read, because a top-level navigation\n * (following the scanned link) legitimately sends none.\n *\n * Host is checked on both. On the loopback listener that is the DNS-rebinding\n * defence for a well-known port, and it is the only check a socket upgrade gets\n * at all, since the upgrade path never reaches the node-server host parsing.\n */\nexport function originVerdict(input: OriginVerdictInput): OriginVerdict {\n  const policy = input.listener === 'local' ? input.local : input.tunnel;\n  // Before the tunnel names itself there is no legitimate traffic to serve and\n  // no origin to compare against, so the listener answers nothing at all.\n  if (policy === undefined) return 'not-ready';\n\n  if (input.host === undefined || !policy.hosts.has(normalizeHost(input.host))) return 'bad-host';\n\n  if (input.origin === undefined) {\n    if (input.listener === 'local') return 'allow';\n    return isMutating(input.method, input.isUpgrade) ? 'bad-origin' : 'allow';\n  }\n\n  const origin = normalizeOrigin(input.origin);\n  if (origin === undefined || !policy.origins.has(origin)) return 'bad-origin';\n  return 'allow';\n}\n"],"mappings":";;;;;;;;;;;AAqBA,MAAM,aAAa;AACnB,MAAM,cAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,qBAAqB;;;;;;;;;;AA4C3B,MAAa,wBAAqE;CAChF;EAAE,QAAQ;EAAY,MAAM;CAAI;CAChC;EAAE,QAAQ;EAAY,MAAM;CAAmB;CAC/C;EAAE,QAAQ;EAAY,MAAM;CAAwB;CACpD;EAAE,QAAQ;EAAY,MAAM;CAAS;CACrC;EAAE,QAAQ;EAAY,MAAM;CAAc;CAC1C;EAAE,QAAQ;EAAY,MAAM;CAAoB;CAChD;EAAE,QAAQ;EAAY,MAAM;CAAoB;CAChD;EAAE,QAAQ;EAAa,MAAM;CAAoB;CACjD;EAAE,QAAQ;EAAY,MAAM;CAAqB;CACjD;EAAE,QAAQ;EAAa,MAAM;CAAyB;CACtD;EAAE,QAAQ;EAAa,MAAM;CAA0B;CACvD;EAAE,QAAQ;EAAa,MAAM;CAA6B;CAC1D;EAAE,QAAQ;EAAa,MAAM;CAA8B;AAC7D;;;;;;;;;;;AAYA,SAAgB,qBAAqB,QAAgB,MAAuB;CAC1E,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,sBAAsB,MAAM,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,IAAI;AAC7F;;AAkBA,SAAS,gBAAgB,KAAiC;CACxD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,YAAY;CACzC,QAAQ;EAGN;CACF;AACF;AAEA,SAAS,cAAc,KAAqB;CAC1C,OAAO,IAAI,KAAK,CAAC,CAAC,YAAY;AAChC;;;;;;;;;;AAWA,SAAgB,kBAAkB,MAAc,eAAkC,CAAC,GAAiB;CAClG,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,0BAAU,IAAI,IAAY;CAIhC,KAAK,MAAM,cAAc,CAAC,MAAM,mBAAmB,GACjD,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAa;CAAO,GAAG;EACtD,MAAM,OAAO,GAAG,KAAK,GAAG,OAAO,UAAU;EACzC,MAAM,IAAI,IAAI;EACd,QAAQ,IAAI,UAAU,MAAM;CAC9B;CAEF,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,aAAa,gBAAgB,KAAK;EACxC,IAAI,eAAe,KAAA,GAAW,QAAQ,IAAI,UAAU;CACtD;CACA,OAAO;EAAE;EAAS;CAAM;AAC1B;;AAGA,SAAgB,mBAAmB,cAAsB,aAAgC,CAAC,GAAiB;CACzG,MAAM,aAAa,gBAAgB,YAAY;CAC/C,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sBAAsB,aAAa,gBAAgB;CACjG,MAAM,OAAO,IAAI,IAAI,UAAU,CAAC,CAAC;CACjC,MAAM,wBAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;CAC7D,KAAK,MAAM,SAAS,YAAY,MAAM,IAAI,cAAc,KAAK,CAAC;CAC9D,OAAO;EAAE,yBAAS,IAAI,IAAI,CAAC,UAAU,CAAC;EAAG;CAAM;AACjD;;AAGA,SAAS,WAAW,QAAgB,WAA6B;CAC/D,IAAI,WAAW,OAAO;CACtB,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,WAAW,cAAc,WAAW;AAC7C;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,cAAc,OAA0C;CACtE,MAAM,SAAS,MAAM,aAAa,UAAU,MAAM,QAAQ,MAAM;CAGhE,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,IAAI,MAAM,SAAS,KAAA,KAAa,CAAC,OAAO,MAAM,IAAI,cAAc,MAAM,IAAI,CAAC,GAAG,OAAO;CAErF,IAAI,MAAM,WAAW,KAAA,GAAW;EAC9B,IAAI,MAAM,aAAa,SAAS,OAAO;EACvC,OAAO,WAAW,MAAM,QAAQ,MAAM,SAAS,IAAI,eAAe;CACpE;CAEA,MAAM,SAAS,gBAAgB,MAAM,MAAM;CAC3C,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,QAAQ,IAAI,MAAM,GAAG,OAAO;CAChE,OAAO;AACT"}