@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/webauthn/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/webauthn/index.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport {\n  generateAuthenticationOptions,\n  generateRegistrationOptions,\n  verifyAuthenticationResponse,\n  verifyRegistrationResponse,\n} from '@simplewebauthn/server';\n\nimport {\n  CEREMONY_TTL_MS,\n  STEP_UP_CHALLENGE_TTL_MS,\n  type StepUpAction,\n  type StoredCredential,\n  challengeIsFresh,\n  counterVerdict,\n  relyingPartyId,\n} from '../webauthnPolicy';\n\nconst ID_BYTES = 8;\nconst CEREMONY_ID_BYTES = 16;\nconst USER_ID_BYTES = 16;\nconst MAX_PENDING_CEREMONIES = 256;\nconst RP_NAME = 'DoomPi cockpit';\n/** One synthetic owner: there is exactly one person here, and passkeys need a subject. */\nconst OWNER_NAME = 'this machine';\nexport interface WebAuthnOptions {\n  /** The tunnel origin, or undefined while remote access is off. */\n  publicOrigin: () => string | undefined;\n  credentials: () => readonly StoredCredential[];\n  saveCredential: (credential: StoredCredential) => void;\n  removeCredential: (id: string) => boolean;\n  now?: () => number;\n  onNotice?: (message: string) => void;\n}\n\nexport type PasskeySupport = { supported: true; rpId: string } | { supported: false; reason: string };\n\nexport interface BegunCeremony {\n  ceremonyId: string;\n  options: Record<string, unknown>;\n}\n\nexport interface WebAuthn {\n  /** Whether the current tunnel can carry passkeys at all. */\n  support(): PasskeySupport;\n  beginRegistration(caller: string, label: string): Promise<BegunCeremony | undefined>;\n  finishRegistration(\n    ceremonyId: string,\n    caller: string,\n    response: unknown,\n    label: string,\n  ): Promise<{ ok: true; id: string } | { ok: false; error: string }>;\n  beginAuthentication(caller: string): Promise<BegunCeremony | undefined>;\n  finishAuthentication(\n    ceremonyId: string,\n    caller: string,\n    response: unknown,\n  ): Promise<{ ok: true; credential: StoredCredential } | { ok: false; error: string }>;\n  /** Mints a challenge bound to one caller and action, good once and briefly. */\n  beginStepUp(caller: string, action: StepUpAction): Promise<BegunCeremony | undefined>;\n  finishStepUp(ceremonyId: string, caller: string, action: StepUpAction, response: unknown): Promise<boolean>;\n  clearChallenges(): void;\n}\n\ntype CeremonyType = 'registration' | 'authentication' | 'step-up';\n\ninterface PendingChallenge {\n  challenge: string;\n  issuedAt: number;\n  caller: string;\n  type: CeremonyType;\n  /** Present for a step-up, so a challenge minted for one action cannot authorise another. */\n  action?: StepUpAction;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/**\n * Passkeys over the tunnel, and the step-up gate in front of the two actions a\n * live session should not be enough for.\n *\n * `rpID` and `expectedOrigin` come from the configured tunnel hostname, never\n * from the request. That is the entire scope of a credential, so a caller that\n * could influence it could mint credentials against somebody else's origin.\n */\nexport function createWebAuthn(options: WebAuthnOptions): WebAuthn {\n  const now = options.now ?? ((): number => Date.now());\n  const notice = options.onNotice ?? ((): void => {});\n  /** One synthetic subject, stable for the life of the process. */\n  const userId = randomBytes(USER_ID_BYTES);\n  const pending = new Map<string, PendingChallenge>();\n\n  const support = (): PasskeySupport => {\n    const origin = options.publicOrigin();\n    const rpId = relyingPartyId(origin);\n    if (origin === undefined) return { supported: false, reason: 'Remote access is not on.' };\n    if (rpId === undefined) {\n      return {\n        supported: false,\n        reason:\n          'A quick tunnel gets a new hostname every start, so a passkey registered now would not work again. Configure a named tunnel to use passkeys.',\n      };\n    }\n    return { supported: true, rpId };\n  };\n\n  const ceremonyKey = (id: string, caller: string, type: CeremonyType): string => `${type}\\u0000${caller}\\u0000${id}`;\n  const ttlFor = (held: PendingChallenge): number =>\n    held.type === 'step-up' ? STEP_UP_CHALLENGE_TTL_MS : CEREMONY_TTL_MS;\n\n  const sweepPending = (): void => {\n    const at = now();\n    for (const [id, held] of pending) {\n      if (!challengeIsFresh(held.issuedAt, at, ttlFor(held))) pending.delete(id);\n    }\n  };\n\n  const remember = (type: CeremonyType, caller: string, challenge: string, action?: StepUpAction): string => {\n    sweepPending();\n    while (pending.size >= MAX_PENDING_CEREMONIES) {\n      const oldest = pending.keys().next().value as string | undefined;\n      if (oldest === undefined) break;\n      pending.delete(oldest);\n    }\n    let id: string;\n    do {\n      id = randomBytes(CEREMONY_ID_BYTES).toString('base64url');\n    } while (pending.has(ceremonyKey(id, caller, type)));\n    pending.set(ceremonyKey(id, caller, type), {\n      challenge,\n      issuedAt: now(),\n      caller,\n      type,\n      ...(action === undefined ? {} : { action }),\n    });\n    return id;\n  };\n\n  const take = (id: string, caller: string, type: CeremonyType, action?: StepUpAction): string | undefined => {\n    const key = ceremonyKey(id, caller, type);\n    const held = pending.get(key);\n    if (held === undefined) return undefined;\n    if (!challengeIsFresh(held.issuedAt, now(), ttlFor(held))) {\n      pending.delete(key);\n      return undefined;\n    }\n    if (held.caller !== caller || held.type !== type || held.action !== action) return undefined;\n    pending.delete(key);\n    return held.challenge;\n  };\n\n  return {\n    support,\n\n    async beginRegistration(caller, label) {\n      const ready = support();\n      if (!ready.supported) return undefined;\n      const options_ = await generateRegistrationOptions({\n        rpName: RP_NAME,\n        rpID: ready.rpId,\n        userID: userId,\n        userName: OWNER_NAME,\n        userDisplayName: label,\n        attestationType: 'none',\n        // Discoverable so a return visit is one gesture with nothing typed,\n        // and platform so the key lands in the phone's secure enclave rather\n        // than on a roaming key the user has to carry.\n        authenticatorSelection: {\n          residentKey: 'required',\n          userVerification: 'required',\n          authenticatorAttachment: 'platform',\n        },\n        excludeCredentials: options.credentials().map((credential) => ({ id: credential.credentialId })),\n      });\n      const ceremonyId = remember('registration', caller, options_.challenge);\n      return { ceremonyId, options: options_ as unknown as Record<string, unknown> };\n    },\n\n    async finishRegistration(ceremonyId, caller, response, label) {\n      const ready = support();\n      if (!ready.supported) return { ok: false, error: ready.reason };\n      const challenge = take(ceremonyId, caller, 'registration');\n      if (challenge === undefined) return { ok: false, error: 'That registration expired. Try again.' };\n      try {\n        const verification = await verifyRegistrationResponse({\n          response: response as Parameters<typeof verifyRegistrationResponse>[0]['response'],\n          expectedChallenge: challenge,\n          expectedOrigin: `https://${ready.rpId}`,\n          expectedRPID: ready.rpId,\n          requireUserVerification: true,\n        });\n        if (!verification.verified || verification.registrationInfo === undefined) {\n          return { ok: false, error: 'That passkey could not be verified.' };\n        }\n        const info = verification.registrationInfo;\n        const at = now();\n        const credential: StoredCredential = {\n          id: randomBytes(ID_BYTES).toString('hex'),\n          credentialId: info.credential.id,\n          publicKey: Buffer.from(info.credential.publicKey).toString('base64url'),\n          counter: info.credential.counter,\n          transports: info.credential.transports ?? [],\n          label,\n          createdAt: at,\n          lastUsedAt: at,\n        };\n        options.saveCredential(credential);\n        notice(`registered a passkey for ${label}`);\n        return { ok: true, id: credential.id };\n      } catch (error) {\n        return { ok: false, error: describe(error) };\n      }\n    },\n\n    async beginAuthentication(caller) {\n      const ready = support();\n      if (!ready.supported) return undefined;\n      const options_ = await generateAuthenticationOptions({\n        rpID: ready.rpId,\n        userVerification: 'required',\n      });\n      const ceremonyId = remember('authentication', caller, options_.challenge);\n      return { ceremonyId, options: options_ as unknown as Record<string, unknown> };\n    },\n\n    async finishAuthentication(ceremonyId, caller, response) {\n      const ready = support();\n      if (!ready.supported) return { ok: false, error: ready.reason };\n      const challenge = take(ceremonyId, caller, 'authentication');\n      if (challenge === undefined) return { ok: false, error: 'That sign-in expired. Try again.' };\n      return await verifyAgainst(challenge, ready.rpId, response);\n    },\n\n    async beginStepUp(caller, action) {\n      const ready = support();\n      if (!ready.supported) return undefined;\n      const options_ = await generateAuthenticationOptions({\n        rpID: ready.rpId,\n        userVerification: 'required',\n      });\n      const ceremonyId = remember('step-up', caller, options_.challenge, action);\n      return { ceremonyId, options: options_ as unknown as Record<string, unknown> };\n    },\n\n    async finishStepUp(ceremonyId, caller, action, response) {\n      const ready = support();\n      if (!ready.supported) return false;\n      const challenge = take(ceremonyId, caller, 'step-up', action);\n      if (challenge === undefined) return false;\n      return (await verifyAgainst(challenge, ready.rpId, response)).ok;\n    },\n\n    clearChallenges() {\n      pending.clear();\n    },\n  };\n\n  async function verifyAgainst(\n    challenge: string,\n    rpId: string,\n    response: unknown,\n  ): Promise<{ ok: true; credential: StoredCredential } | { ok: false; error: string }> {\n    const presented = (response as { id?: unknown }).id;\n    if (typeof presented !== 'string') return { ok: false, error: 'That response named no credential.' };\n    const stored = options.credentials().find((candidate) => candidate.credentialId === presented);\n    if (stored === undefined) return { ok: false, error: 'That passkey is not registered here.' };\n    try {\n      const verification = await verifyAuthenticationResponse({\n        response: response as Parameters<typeof verifyAuthenticationResponse>[0]['response'],\n        expectedChallenge: challenge,\n        expectedOrigin: `https://${rpId}`,\n        expectedRPID: rpId,\n        requireUserVerification: true,\n        credential: {\n          id: stored.credentialId,\n          publicKey: new Uint8Array(Buffer.from(stored.publicKey, 'base64url')),\n          counter: stored.counter,\n          transports: stored.transports as never,\n        },\n      });\n      if (!verification.verified) return { ok: false, error: 'That passkey did not verify.' };\n      const presentedCounter = verification.authenticationInfo.newCounter;\n      if (counterVerdict(stored.counter, presentedCounter) === 'clone-suspected') {\n        // Two things are signing with one key. The credential is burnt.\n        options.removeCredential(stored.id);\n        notice(`revoked passkey ${stored.label}: its signature counter went backwards, which means a clone`);\n        return { ok: false, error: 'That passkey looks cloned and has been revoked.' };\n      }\n      const updated: StoredCredential = { ...stored, counter: presentedCounter, lastUsedAt: now() };\n      options.saveCredential(updated);\n      return { ok: true, credential: updated };\n    } catch (error) {\n      return { ok: false, error: describe(error) };\n    }\n  }\n}\n"],"mappings":";;;;AAmBA,MAAM,WAAW;AACjB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AACtB,MAAM,yBAAyB;AAC/B,MAAM,UAAU;;AAEhB,MAAM,aAAa;AAmDnB,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;;;;;;;AAUA,SAAgB,eAAe,SAAoC;CACjE,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,SAAS,QAAQ,mBAAyB,CAAC;;CAEjD,MAAM,SAAS,YAAY,aAAa;CACxC,MAAM,0BAAU,IAAI,IAA8B;CAElD,MAAM,gBAAgC;EACpC,MAAM,SAAS,QAAQ,aAAa;EACpC,MAAM,OAAO,eAAe,MAAM;EAClC,IAAI,WAAW,KAAA,GAAW,OAAO;GAAE,WAAW;GAAO,QAAQ;EAA2B;EACxF,IAAI,SAAS,KAAA,GACX,OAAO;GACL,WAAW;GACX,QACE;EACJ;EAEF,OAAO;GAAE,WAAW;GAAM;EAAK;CACjC;CAEA,MAAM,eAAe,IAAY,QAAgB,SAA+B,GAAG,KAAK,QAAQ,OAAO,QAAQ;CAC/G,MAAM,UAAU,SACd,KAAK,SAAS,YAAY,2BAA2B;CAEvD,MAAM,qBAA2B;EAC/B,MAAM,KAAK,IAAI;EACf,KAAK,MAAM,CAAC,IAAI,SAAS,SACvB,IAAI,CAAC,iBAAiB,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,QAAQ,OAAO,EAAE;CAE7E;CAEA,MAAM,YAAY,MAAoB,QAAgB,WAAmB,WAAkC;EACzG,aAAa;EACb,OAAO,QAAQ,QAAQ,wBAAwB;GAC7C,MAAM,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GACrC,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,OAAO,MAAM;EACvB;EACA,IAAI;EACJ;GACE,KAAK,YAAY,iBAAiB,CAAC,CAAC,SAAS,WAAW;SACjD,QAAQ,IAAI,YAAY,IAAI,QAAQ,IAAI,CAAC;EAClD,QAAQ,IAAI,YAAY,IAAI,QAAQ,IAAI,GAAG;GACzC;GACA,UAAU,IAAI;GACd;GACA;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EACD,OAAO;CACT;CAEA,MAAM,QAAQ,IAAY,QAAgB,MAAoB,WAA8C;EAC1G,MAAM,MAAM,YAAY,IAAI,QAAQ,IAAI;EACxC,MAAM,OAAO,QAAQ,IAAI,GAAG;EAC5B,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;EAC/B,IAAI,CAAC,iBAAiB,KAAK,UAAU,IAAI,GAAG,OAAO,IAAI,CAAC,GAAG;GACzD,QAAQ,OAAO,GAAG;GAClB;EACF;EACA,IAAI,KAAK,WAAW,UAAU,KAAK,SAAS,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAA;EACnF,QAAQ,OAAO,GAAG;EAClB,OAAO,KAAK;CACd;CAEA,OAAO;EACL;EAEA,MAAM,kBAAkB,QAAQ,OAAO;GACrC,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO,KAAA;GAC7B,MAAM,WAAW,MAAM,4BAA4B;IACjD,QAAQ;IACR,MAAM,MAAM;IACZ,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IAIjB,wBAAwB;KACtB,aAAa;KACb,kBAAkB;KAClB,yBAAyB;IAC3B;IACA,oBAAoB,QAAQ,YAAY,CAAC,CAAC,KAAK,gBAAgB,EAAE,IAAI,WAAW,aAAa,EAAE;GACjG,CAAC;GAED,OAAO;IAAE,YADU,SAAS,gBAAgB,QAAQ,SAAS,SAC3C;IAAG,SAAS;GAA+C;EAC/E;EAEA,MAAM,mBAAmB,YAAY,QAAQ,UAAU,OAAO;GAC5D,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO;IAAE,IAAI;IAAO,OAAO,MAAM;GAAO;GAC9D,MAAM,YAAY,KAAK,YAAY,QAAQ,cAAc;GACzD,IAAI,cAAc,KAAA,GAAW,OAAO;IAAE,IAAI;IAAO,OAAO;GAAwC;GAChG,IAAI;IACF,MAAM,eAAe,MAAM,2BAA2B;KAC1C;KACV,mBAAmB;KACnB,gBAAgB,WAAW,MAAM;KACjC,cAAc,MAAM;KACpB,yBAAyB;IAC3B,CAAC;IACD,IAAI,CAAC,aAAa,YAAY,aAAa,qBAAqB,KAAA,GAC9D,OAAO;KAAE,IAAI;KAAO,OAAO;IAAsC;IAEnE,MAAM,OAAO,aAAa;IAC1B,MAAM,KAAK,IAAI;IACf,MAAM,aAA+B;KACnC,IAAI,YAAY,QAAQ,CAAC,CAAC,SAAS,KAAK;KACxC,cAAc,KAAK,WAAW;KAC9B,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,CAAC,SAAS,WAAW;KACtE,SAAS,KAAK,WAAW;KACzB,YAAY,KAAK,WAAW,cAAc,CAAC;KAC3C;KACA,WAAW;KACX,YAAY;IACd;IACA,QAAQ,eAAe,UAAU;IACjC,OAAO,4BAA4B,OAAO;IAC1C,OAAO;KAAE,IAAI;KAAM,IAAI,WAAW;IAAG;GACvC,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE;GAC7C;EACF;EAEA,MAAM,oBAAoB,QAAQ;GAChC,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO,KAAA;GAC7B,MAAM,WAAW,MAAM,8BAA8B;IACnD,MAAM,MAAM;IACZ,kBAAkB;GACpB,CAAC;GAED,OAAO;IAAE,YADU,SAAS,kBAAkB,QAAQ,SAAS,SAC7C;IAAG,SAAS;GAA+C;EAC/E;EAEA,MAAM,qBAAqB,YAAY,QAAQ,UAAU;GACvD,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO;IAAE,IAAI;IAAO,OAAO,MAAM;GAAO;GAC9D,MAAM,YAAY,KAAK,YAAY,QAAQ,gBAAgB;GAC3D,IAAI,cAAc,KAAA,GAAW,OAAO;IAAE,IAAI;IAAO,OAAO;GAAmC;GAC3F,OAAO,MAAM,cAAc,WAAW,MAAM,MAAM,QAAQ;EAC5D;EAEA,MAAM,YAAY,QAAQ,QAAQ;GAChC,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO,KAAA;GAC7B,MAAM,WAAW,MAAM,8BAA8B;IACnD,MAAM,MAAM;IACZ,kBAAkB;GACpB,CAAC;GAED,OAAO;IAAE,YADU,SAAS,WAAW,QAAQ,SAAS,WAAW,MACjD;IAAG,SAAS;GAA+C;EAC/E;EAEA,MAAM,aAAa,YAAY,QAAQ,QAAQ,UAAU;GACvD,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,MAAM,WAAW,OAAO;GAC7B,MAAM,YAAY,KAAK,YAAY,QAAQ,WAAW,MAAM;GAC5D,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,QAAQ,MAAM,cAAc,WAAW,MAAM,MAAM,QAAQ,EAAA,CAAG;EAChE;EAEA,kBAAkB;GAChB,QAAQ,MAAM;EAChB;CACF;CAEA,eAAe,cACb,WACA,MACA,UACoF;EACpF,MAAM,YAAa,SAA8B;EACjD,IAAI,OAAO,cAAc,UAAU,OAAO;GAAE,IAAI;GAAO,OAAO;EAAqC;EACnG,MAAM,SAAS,QAAQ,YAAY,CAAC,CAAC,MAAM,cAAc,UAAU,iBAAiB,SAAS;EAC7F,IAAI,WAAW,KAAA,GAAW,OAAO;GAAE,IAAI;GAAO,OAAO;EAAuC;EAC5F,IAAI;GACF,MAAM,eAAe,MAAM,6BAA6B;IAC5C;IACV,mBAAmB;IACnB,gBAAgB,WAAW;IAC3B,cAAc;IACd,yBAAyB;IACzB,YAAY;KACV,IAAI,OAAO;KACX,WAAW,IAAI,WAAW,OAAO,KAAK,OAAO,WAAW,WAAW,CAAC;KACpE,SAAS,OAAO;KAChB,YAAY,OAAO;IACrB;GACF,CAAC;GACD,IAAI,CAAC,aAAa,UAAU,OAAO;IAAE,IAAI;IAAO,OAAO;GAA+B;GACtF,MAAM,mBAAmB,aAAa,mBAAmB;GACzD,IAAI,eAAe,OAAO,SAAS,gBAAgB,MAAM,mBAAmB;IAE1E,QAAQ,iBAAiB,OAAO,EAAE;IAClC,OAAO,mBAAmB,OAAO,MAAM,4DAA4D;IACnG,OAAO;KAAE,IAAI;KAAO,OAAO;IAAkD;GAC/E;GACA,MAAM,UAA4B;IAAE,GAAG;IAAQ,SAAS;IAAkB,YAAY,IAAI;GAAE;GAC5F,QAAQ,eAAe,OAAO;GAC9B,OAAO;IAAE,IAAI;IAAM,YAAY;GAAQ;EACzC,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAO,OAAO,SAAS,KAAK;GAAE;EAC7C;CACF;AACF"}

package/dist/services/webauthnPolicy/index.cjs

@@ -0,0 +1,178 @@
+//#region src/services/webauthnPolicy/index.ts
+/**
+* What a passkey is allowed to prove, and for how long.
+*
+* A session cookie is a bearer token: whoever holds the bytes is you. A passkey
+* is a private key in the device's secure enclave that never leaves it, so the
+* cookie stops being the only thing between a stolen phone and this machine.
+* The cookie does not go away, because a WebSocket cannot run a ceremony per
+* frame; what changes is that the cookie is short-lived, re-mintable with a
+* gesture rather than a QR, and insufficient on its own for the actions below.
+*
+* The crypto lives in the adapter. This file is the policy: which actions need
+* a fresh signature, how long a challenge is good for, and when a counter says
+* the credential has been cloned.
+*/
+/**
+* Actions that need a fresh gesture even from a live session.
+*
+* These are escalation paths rather than ordinary prompting or tool approval:
+* credentials redirect machine traffic, sessions run code in a selected directory,
+* repository writes change future sessions, and live MCP operations may start local
+* processes or contact remote servers.
+*/
+const STEP_UP_ACTIONS = [
+	"provider.login",
+	"provider.logout",
+	"session.create",
+	"settings.write",
+	"mcp.discover",
+	"mcp.authorize",
+	"computer-use.activate"
+];
+/** Short enough that a captured challenge is useless, long enough for a slow Face ID. */
+const STEP_UP_CHALLENGE_TTL_MS = 6e4;
+/** A registration or sign-in ceremony the user has to complete. */
+const CEREMONY_TTL_MS = 12e4;
+/**
+* Which action, if any, a request is attempting.
+*
+* Matched here rather than at each route so the list of gated operations is one
+* readable table instead of three call sites that can drift apart. Anything not
+* named is not gated, which is the safe default only because the gate is an
+* addition to the session check rather than a replacement for it.
+*/
+const GATED_ROUTES = [
+	{
+		method: "POST",
+		pattern: /^\/api\/sessions$/u,
+		action: "session.create"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/sessions\/[^/]+\/resume$/u,
+		action: "session.create"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/global\/plugin\/doompi\/logins$/u,
+		action: "provider.login"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/global\/plugin\/doompi\/logins\/[^/]+\/answer$/u,
+		action: "provider.login"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/global\/plugin\/doompi\/providers\/[^/]+$/u,
+		action: "provider.logout"
+	},
+	{
+		method: "PUT",
+		pattern: /^\/api\/(?:global|workspaces\/[^/]+)\/plugin\/config\/(?:value|repository\/selection|images)$/u,
+		action: "settings.write"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/auth\/logins\/[^/]+\/answer$/u,
+		action: "provider.login"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/auth\/providers\/[^/]+$/u,
+		action: "provider.logout"
+	},
+	{
+		method: "PUT",
+		pattern: /^\/api\/settings\/(?:value|repository\/selection)$/u,
+		action: "settings.write"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/mcp\/repository\/discover$/u,
+		action: "mcp.discover"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/mcp\/repository\/authorize$/u,
+		action: "mcp.authorize"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/plugin\/mcp\/repository\/authorize\/[^/]+$/u,
+		action: "mcp.authorize"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/computer-use\/activate$/u,
+		action: "computer-use.activate"
+	}
+];
+function stepUpActionFor(method, path) {
+	const wanted = method.toUpperCase();
+	return GATED_ROUTES.find((route) => route.method === wanted && route.pattern.test(path))?.action;
+}
+function isStepUpAction(value) {
+	return typeof value === "string" && STEP_UP_ACTIONS.includes(value);
+}
+/**
+* Whether a signature counter moved the way a real authenticator moves it.
+*
+* A counter that stays at zero means the authenticator does not implement one,
+* which is common and not a signal. A counter that goes backwards or repeats
+* while claiming to count means two things are signing with the same key, which
+* is the definition of a cloned credential.
+*/
+function counterVerdict(stored, presented) {
+	if (stored === 0 && presented === 0) return "ok";
+	return presented > stored ? "ok" : "clone-suspected";
+}
+/** Whether a ceremony or step-up challenge is still live. */
+function challengeIsFresh(issuedAt, now, ttlMs) {
+	return now - issuedAt < ttlMs;
+}
+/** A quick tunnel's domain; its hostname rotates on every start. */
+const ROTATING_SUFFIX = ".trycloudflare.com";
+/** Dotted-quad, and the bracketed form a URL uses for v6. */
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
+/**
+* The relying party id a passkey is bound to.
+*
+* Derived from the configured tunnel hostname and nothing else, never from a
+* request header: `rpID` is the entire scope of a credential, so a caller who
+* could influence it could mint credentials against somebody else's origin.
+*
+* Three things are refused rather than accepted and regretted later:
+*
+* - A quick tunnel, whose hostname rotates on every start, so a passkey
+*   registered now would silently stop working on the next one.
+* - An IP address, which WebAuthn does not accept as a relying party id at all;
+*   registering against one fails in the browser rather than here, which is a
+*   much worse place to find out.
+* - Anything without a dot, which cannot be a public tunnel hostname.
+*/
+function relyingPartyId(publicOrigin) {
+	if (publicOrigin === void 0) return void 0;
+	let host;
+	try {
+		host = new URL(publicOrigin).hostname.toLowerCase();
+	} catch {
+		return;
+	}
+	if (host.endsWith(ROTATING_SUFFIX)) return void 0;
+	if (IPV4.test(host) || host.startsWith("[")) return void 0;
+	if (!host.includes(".")) return void 0;
+	return host;
+}
+//#endregion
+exports.CEREMONY_TTL_MS = CEREMONY_TTL_MS;
+exports.STEP_UP_ACTIONS = STEP_UP_ACTIONS;
+exports.STEP_UP_CHALLENGE_TTL_MS = STEP_UP_CHALLENGE_TTL_MS;
+exports.challengeIsFresh = challengeIsFresh;
+exports.counterVerdict = counterVerdict;
+exports.isStepUpAction = isStepUpAction;
+exports.relyingPartyId = relyingPartyId;
+exports.stepUpActionFor = stepUpActionFor;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/webauthnPolicy/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/services/webauthnPolicy/index.ts"],"sourcesContent":["/**\n * What a passkey is allowed to prove, and for how long.\n *\n * A session cookie is a bearer token: whoever holds the bytes is you. A passkey\n * is a private key in the device's secure enclave that never leaves it, so the\n * cookie stops being the only thing between a stolen phone and this machine.\n * The cookie does not go away, because a WebSocket cannot run a ceremony per\n * frame; what changes is that the cookie is short-lived, re-mintable with a\n * gesture rather than a QR, and insufficient on its own for the actions below.\n *\n * The crypto lives in the adapter. This file is the policy: which actions need\n * a fresh signature, how long a challenge is good for, and when a counter says\n * the credential has been cloned.\n */\n\n/**\n * Actions that need a fresh gesture even from a live session.\n *\n * These are escalation paths rather than ordinary prompting or tool approval:\n * credentials redirect machine traffic, sessions run code in a selected directory,\n * repository writes change future sessions, and live MCP operations may start local\n * processes or contact remote servers.\n */\nexport const STEP_UP_ACTIONS = [\n  'provider.login',\n  'provider.logout',\n  'session.create',\n  'settings.write',\n  'mcp.discover',\n  'mcp.authorize',\n  'computer-use.activate',\n] as const;\n\nexport type StepUpAction = (typeof STEP_UP_ACTIONS)[number];\n\n/** Short enough that a captured challenge is useless, long enough for a slow Face ID. */\nexport const STEP_UP_CHALLENGE_TTL_MS = 60_000;\n/** A registration or sign-in ceremony the user has to complete. */\nexport const CEREMONY_TTL_MS = 120_000;\n\n/**\n * Which action, if any, a request is attempting.\n *\n * Matched here rather than at each route so the list of gated operations is one\n * readable table instead of three call sites that can drift apart. Anything not\n * named is not gated, which is the safe default only because the gate is an\n * addition to the session check rather than a replacement for it.\n */\nconst GATED_ROUTES: readonly { method: string; pattern: RegExp; action: StepUpAction }[] = [\n  { method: 'POST', pattern: /^\\/api\\/sessions$/u, action: 'session.create' },\n  { method: 'POST', pattern: /^\\/api\\/sessions\\/[^/]+\\/resume$/u, action: 'session.create' },\n  { method: 'POST', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/logins$/u, action: 'provider.login' },\n  { method: 'POST', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/logins\\/[^/]+\\/answer$/u, action: 'provider.login' },\n  { method: 'DELETE', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/providers\\/[^/]+$/u, action: 'provider.logout' },\n  {\n    method: 'PUT',\n    pattern: /^\\/api\\/(?:global|workspaces\\/[^/]+)\\/plugin\\/config\\/(?:value|repository\\/selection|images)$/u,\n    action: 'settings.write',\n  },\n  { method: 'POST', pattern: /^\\/api\\/auth\\/logins\\/[^/]+\\/answer$/u, action: 'provider.login' },\n  { method: 'DELETE', pattern: /^\\/api\\/auth\\/providers\\/[^/]+$/u, action: 'provider.logout' },\n  { method: 'PUT', pattern: /^\\/api\\/settings\\/(?:value|repository\\/selection)$/u, action: 'settings.write' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/discover$/u, action: 'mcp.discover' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/authorize$/u, action: 'mcp.authorize' },\n  { method: 'DELETE', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/authorize\\/[^/]+$/u, action: 'mcp.authorize' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/computer-use\\/activate$/u, action: 'computer-use.activate' },\n];\nexport function stepUpActionFor(method: string, path: string): StepUpAction | undefined {\n  const wanted = method.toUpperCase();\n  return GATED_ROUTES.find((route) => route.method === wanted && route.pattern.test(path))?.action;\n}\n\nexport function isStepUpAction(value: unknown): value is StepUpAction {\n  return typeof value === 'string' && (STEP_UP_ACTIONS as readonly string[]).includes(value);\n}\n\nexport interface StoredCredential {\n  /** Opaque handle for display and revocation. */\n  id: string;\n  /** The authenticator's credential id, base64url, as WebAuthn reports it. */\n  credentialId: string;\n  /** Base64url public key; the private half never leaves the device. */\n  publicKey: string;\n  /** Signature counter, for clone detection. */\n  counter: number;\n  transports: string[];\n  label: string;\n  createdAt: number;\n  lastUsedAt: number;\n}\n\nexport type CounterVerdict = 'ok' | 'clone-suspected';\n\n/**\n * Whether a signature counter moved the way a real authenticator moves it.\n *\n * A counter that stays at zero means the authenticator does not implement one,\n * which is common and not a signal. A counter that goes backwards or repeats\n * while claiming to count means two things are signing with the same key, which\n * is the definition of a cloned credential.\n */\nexport function counterVerdict(stored: number, presented: number): CounterVerdict {\n  if (stored === 0 && presented === 0) return 'ok';\n  return presented > stored ? 'ok' : 'clone-suspected';\n}\n\n/** Whether a ceremony or step-up challenge is still live. */\nexport function challengeIsFresh(issuedAt: number, now: number, ttlMs: number): boolean {\n  return now - issuedAt < ttlMs;\n}\n\n/** A quick tunnel's domain; its hostname rotates on every start. */\nconst ROTATING_SUFFIX = '.trycloudflare.com';\n/** Dotted-quad, and the bracketed form a URL uses for v6. */\nconst IPV4 = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/u;\n\n/**\n * The relying party id a passkey is bound to.\n *\n * Derived from the configured tunnel hostname and nothing else, never from a\n * request header: `rpID` is the entire scope of a credential, so a caller who\n * could influence it could mint credentials against somebody else's origin.\n *\n * Three things are refused rather than accepted and regretted later:\n *\n * - A quick tunnel, whose hostname rotates on every start, so a passkey\n *   registered now would silently stop working on the next one.\n * - An IP address, which WebAuthn does not accept as a relying party id at all;\n *   registering against one fails in the browser rather than here, which is a\n *   much worse place to find out.\n * - Anything without a dot, which cannot be a public tunnel hostname.\n */\nexport function relyingPartyId(publicOrigin: string | undefined): string | undefined {\n  if (publicOrigin === undefined) return undefined;\n  let host: string;\n  try {\n    host = new URL(publicOrigin).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (host.endsWith(ROTATING_SUFFIX)) return undefined;\n  if (IPV4.test(host) || host.startsWith('[')) return undefined;\n  if (!host.includes('.')) return undefined;\n  return host;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAKA,MAAa,2BAA2B;;AAExC,MAAa,kBAAkB;;;;;;;;;AAU/B,MAAM,eAAqF;CACzF;EAAE,QAAQ;EAAQ,SAAS;EAAsB,QAAQ;CAAiB;CAC1E;EAAE,QAAQ;EAAQ,SAAS;EAAqC,QAAQ;CAAiB;CACzF;EAAE,QAAQ;EAAQ,SAAS;EAA4C,QAAQ;CAAiB;CAChG;EAAE,QAAQ;EAAQ,SAAS;EAA2D,QAAQ;CAAiB;CAC/G;EAAE,QAAQ;EAAU,SAAS;EAAsD,QAAQ;CAAkB;CAC7G;EACE,QAAQ;EACR,SAAS;EACT,QAAQ;CACV;CACA;EAAE,QAAQ;EAAQ,SAAS;EAAyC,QAAQ;CAAiB;CAC7F;EAAE,QAAQ;EAAU,SAAS;EAAoC,QAAQ;CAAkB;CAC3F;EAAE,QAAQ;EAAO,SAAS;EAAuD,QAAQ;CAAiB;CAC1G;EAAE,QAAQ;EAAQ,SAAS;EAA+C,QAAQ;CAAe;CACjG;EAAE,QAAQ;EAAQ,SAAS;EAAgD,QAAQ;CAAgB;CACnG;EAAE,QAAQ;EAAU,SAAS;EAAuD,QAAQ;CAAgB;CAC5G;EAAE,QAAQ;EAAQ,SAAS;EAA4C,QAAQ;CAAwB;AACzG;AACA,SAAgB,gBAAgB,QAAgB,MAAwC;CACtF,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,aAAa,MAAM,UAAU,MAAM,WAAW,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,CAAC,EAAE;AAC5F;AAEA,SAAgB,eAAe,OAAuC;CACpE,OAAO,OAAO,UAAU,YAAa,gBAAsC,SAAS,KAAK;AAC3F;;;;;;;;;AA2BA,SAAgB,eAAe,QAAgB,WAAmC;CAChF,IAAI,WAAW,KAAK,cAAc,GAAG,OAAO;CAC5C,OAAO,YAAY,SAAS,OAAO;AACrC;;AAGA,SAAgB,iBAAiB,UAAkB,KAAa,OAAwB;CACtF,OAAO,MAAM,WAAW;AAC1B;;AAGA,MAAM,kBAAkB;;AAExB,MAAM,OAAO;;;;;;;;;;;;;;;;;AAkBb,SAAgB,eAAe,cAAsD;CACnF,IAAI,iBAAiB,KAAA,GAAW,OAAO,KAAA;CACvC,IAAI;CACJ,IAAI;EACF,OAAO,IAAI,IAAI,YAAY,CAAC,CAAC,SAAS,YAAY;CACpD,QAAQ;EACN;CACF;CACA,IAAI,KAAK,SAAS,eAAe,GAAG,OAAO,KAAA;CAC3C,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG,OAAO,KAAA;CACpD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO,KAAA;CAChC,OAAO;AACT"}

package/dist/services/webauthnPolicy/index.d.cts

@@ -0,0 +1,41 @@
+//#region src/services/webauthnPolicy/index.d.ts
+/**
+ * What a passkey is allowed to prove, and for how long.
+ *
+ * A session cookie is a bearer token: whoever holds the bytes is you. A passkey
+ * is a private key in the device's secure enclave that never leaves it, so the
+ * cookie stops being the only thing between a stolen phone and this machine.
+ * The cookie does not go away, because a WebSocket cannot run a ceremony per
+ * frame; what changes is that the cookie is short-lived, re-mintable with a
+ * gesture rather than a QR, and insufficient on its own for the actions below.
+ *
+ * The crypto lives in the adapter. This file is the policy: which actions need
+ * a fresh signature, how long a challenge is good for, and when a counter says
+ * the credential has been cloned.
+ */
+/**
+ * Actions that need a fresh gesture even from a live session.
+ *
+ * These are escalation paths rather than ordinary prompting or tool approval:
+ * credentials redirect machine traffic, sessions run code in a selected directory,
+ * repository writes change future sessions, and live MCP operations may start local
+ * processes or contact remote servers.
+ */
+export declare const STEP_UP_ACTIONS: readonly ['provider.login', 'provider.logout', 'session.create', 'settings.write', 'mcp.discover', 'mcp.authorize', 'computer-use.activate'];
+export type StepUpAction = (typeof STEP_UP_ACTIONS)[number];
+export interface StoredCredential {
+  /** Opaque handle for display and revocation. */
+  id: string;
+  /** The authenticator's credential id, base64url, as WebAuthn reports it. */
+  credentialId: string;
+  /** Base64url public key; the private half never leaves the device. */
+  publicKey: string;
+  /** Signature counter, for clone detection. */
+  counter: number;
+  transports: string[];
+  label: string;
+  createdAt: number;
+  lastUsedAt: number;
+}
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/webauthnPolicy/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/webauthnPolicy/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;qBAuBa;YAUD,uBAAuB;iBA2ClB;;EAEf;;EAEA;;EAEA;;EAEA;EACA;EACA;EACA;EACA"}

package/dist/services/webauthnPolicy/index.d.mts

@@ -0,0 +1,41 @@
+//#region src/services/webauthnPolicy/index.d.ts
+/**
+ * What a passkey is allowed to prove, and for how long.
+ *
+ * A session cookie is a bearer token: whoever holds the bytes is you. A passkey
+ * is a private key in the device's secure enclave that never leaves it, so the
+ * cookie stops being the only thing between a stolen phone and this machine.
+ * The cookie does not go away, because a WebSocket cannot run a ceremony per
+ * frame; what changes is that the cookie is short-lived, re-mintable with a
+ * gesture rather than a QR, and insufficient on its own for the actions below.
+ *
+ * The crypto lives in the adapter. This file is the policy: which actions need
+ * a fresh signature, how long a challenge is good for, and when a counter says
+ * the credential has been cloned.
+ */
+/**
+ * Actions that need a fresh gesture even from a live session.
+ *
+ * These are escalation paths rather than ordinary prompting or tool approval:
+ * credentials redirect machine traffic, sessions run code in a selected directory,
+ * repository writes change future sessions, and live MCP operations may start local
+ * processes or contact remote servers.
+ */
+export declare const STEP_UP_ACTIONS: readonly ['provider.login', 'provider.logout', 'session.create', 'settings.write', 'mcp.discover', 'mcp.authorize', 'computer-use.activate'];
+export type StepUpAction = (typeof STEP_UP_ACTIONS)[number];
+export interface StoredCredential {
+  /** Opaque handle for display and revocation. */
+  id: string;
+  /** The authenticator's credential id, base64url, as WebAuthn reports it. */
+  credentialId: string;
+  /** Base64url public key; the private half never leaves the device. */
+  publicKey: string;
+  /** Signature counter, for clone detection. */
+  counter: number;
+  transports: string[];
+  label: string;
+  createdAt: number;
+  lastUsedAt: number;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/webauthnPolicy/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/webauthnPolicy/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;qBAuBa;YAUD,uBAAuB;iBA2ClB;;EAEf;;EAEA;;EAEA;;EAEA;EACA;EACA;EACA;EACA"}

package/dist/services/webauthnPolicy/index.mjs

@@ -0,0 +1,171 @@
+//#region src/services/webauthnPolicy/index.ts
+/**
+* What a passkey is allowed to prove, and for how long.
+*
+* A session cookie is a bearer token: whoever holds the bytes is you. A passkey
+* is a private key in the device's secure enclave that never leaves it, so the
+* cookie stops being the only thing between a stolen phone and this machine.
+* The cookie does not go away, because a WebSocket cannot run a ceremony per
+* frame; what changes is that the cookie is short-lived, re-mintable with a
+* gesture rather than a QR, and insufficient on its own for the actions below.
+*
+* The crypto lives in the adapter. This file is the policy: which actions need
+* a fresh signature, how long a challenge is good for, and when a counter says
+* the credential has been cloned.
+*/
+/**
+* Actions that need a fresh gesture even from a live session.
+*
+* These are escalation paths rather than ordinary prompting or tool approval:
+* credentials redirect machine traffic, sessions run code in a selected directory,
+* repository writes change future sessions, and live MCP operations may start local
+* processes or contact remote servers.
+*/
+const STEP_UP_ACTIONS = [
+	"provider.login",
+	"provider.logout",
+	"session.create",
+	"settings.write",
+	"mcp.discover",
+	"mcp.authorize",
+	"computer-use.activate"
+];
+/** Short enough that a captured challenge is useless, long enough for a slow Face ID. */
+const STEP_UP_CHALLENGE_TTL_MS = 6e4;
+/** A registration or sign-in ceremony the user has to complete. */
+const CEREMONY_TTL_MS = 12e4;
+/**
+* Which action, if any, a request is attempting.
+*
+* Matched here rather than at each route so the list of gated operations is one
+* readable table instead of three call sites that can drift apart. Anything not
+* named is not gated, which is the safe default only because the gate is an
+* addition to the session check rather than a replacement for it.
+*/
+const GATED_ROUTES = [
+	{
+		method: "POST",
+		pattern: /^\/api\/sessions$/u,
+		action: "session.create"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/sessions\/[^/]+\/resume$/u,
+		action: "session.create"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/global\/plugin\/doompi\/logins$/u,
+		action: "provider.login"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/global\/plugin\/doompi\/logins\/[^/]+\/answer$/u,
+		action: "provider.login"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/global\/plugin\/doompi\/providers\/[^/]+$/u,
+		action: "provider.logout"
+	},
+	{
+		method: "PUT",
+		pattern: /^\/api\/(?:global|workspaces\/[^/]+)\/plugin\/config\/(?:value|repository\/selection|images)$/u,
+		action: "settings.write"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/auth\/logins\/[^/]+\/answer$/u,
+		action: "provider.login"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/auth\/providers\/[^/]+$/u,
+		action: "provider.logout"
+	},
+	{
+		method: "PUT",
+		pattern: /^\/api\/settings\/(?:value|repository\/selection)$/u,
+		action: "settings.write"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/mcp\/repository\/discover$/u,
+		action: "mcp.discover"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/mcp\/repository\/authorize$/u,
+		action: "mcp.authorize"
+	},
+	{
+		method: "DELETE",
+		pattern: /^\/api\/plugin\/mcp\/repository\/authorize\/[^/]+$/u,
+		action: "mcp.authorize"
+	},
+	{
+		method: "POST",
+		pattern: /^\/api\/plugin\/computer-use\/activate$/u,
+		action: "computer-use.activate"
+	}
+];
+function stepUpActionFor(method, path) {
+	const wanted = method.toUpperCase();
+	return GATED_ROUTES.find((route) => route.method === wanted && route.pattern.test(path))?.action;
+}
+function isStepUpAction(value) {
+	return typeof value === "string" && STEP_UP_ACTIONS.includes(value);
+}
+/**
+* Whether a signature counter moved the way a real authenticator moves it.
+*
+* A counter that stays at zero means the authenticator does not implement one,
+* which is common and not a signal. A counter that goes backwards or repeats
+* while claiming to count means two things are signing with the same key, which
+* is the definition of a cloned credential.
+*/
+function counterVerdict(stored, presented) {
+	if (stored === 0 && presented === 0) return "ok";
+	return presented > stored ? "ok" : "clone-suspected";
+}
+/** Whether a ceremony or step-up challenge is still live. */
+function challengeIsFresh(issuedAt, now, ttlMs) {
+	return now - issuedAt < ttlMs;
+}
+/** A quick tunnel's domain; its hostname rotates on every start. */
+const ROTATING_SUFFIX = ".trycloudflare.com";
+/** Dotted-quad, and the bracketed form a URL uses for v6. */
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
+/**
+* The relying party id a passkey is bound to.
+*
+* Derived from the configured tunnel hostname and nothing else, never from a
+* request header: `rpID` is the entire scope of a credential, so a caller who
+* could influence it could mint credentials against somebody else's origin.
+*
+* Three things are refused rather than accepted and regretted later:
+*
+* - A quick tunnel, whose hostname rotates on every start, so a passkey
+*   registered now would silently stop working on the next one.
+* - An IP address, which WebAuthn does not accept as a relying party id at all;
+*   registering against one fails in the browser rather than here, which is a
+*   much worse place to find out.
+* - Anything without a dot, which cannot be a public tunnel hostname.
+*/
+function relyingPartyId(publicOrigin) {
+	if (publicOrigin === void 0) return void 0;
+	let host;
+	try {
+		host = new URL(publicOrigin).hostname.toLowerCase();
+	} catch {
+		return;
+	}
+	if (host.endsWith(ROTATING_SUFFIX)) return void 0;
+	if (IPV4.test(host) || host.startsWith("[")) return void 0;
+	if (!host.includes(".")) return void 0;
+	return host;
+}
+//#endregion
+export { CEREMONY_TTL_MS, STEP_UP_ACTIONS, STEP_UP_CHALLENGE_TTL_MS, challengeIsFresh, counterVerdict, isStepUpAction, relyingPartyId, stepUpActionFor };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/webauthnPolicy/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/webauthnPolicy/index.ts"],"sourcesContent":["/**\n * What a passkey is allowed to prove, and for how long.\n *\n * A session cookie is a bearer token: whoever holds the bytes is you. A passkey\n * is a private key in the device's secure enclave that never leaves it, so the\n * cookie stops being the only thing between a stolen phone and this machine.\n * The cookie does not go away, because a WebSocket cannot run a ceremony per\n * frame; what changes is that the cookie is short-lived, re-mintable with a\n * gesture rather than a QR, and insufficient on its own for the actions below.\n *\n * The crypto lives in the adapter. This file is the policy: which actions need\n * a fresh signature, how long a challenge is good for, and when a counter says\n * the credential has been cloned.\n */\n\n/**\n * Actions that need a fresh gesture even from a live session.\n *\n * These are escalation paths rather than ordinary prompting or tool approval:\n * credentials redirect machine traffic, sessions run code in a selected directory,\n * repository writes change future sessions, and live MCP operations may start local\n * processes or contact remote servers.\n */\nexport const STEP_UP_ACTIONS = [\n  'provider.login',\n  'provider.logout',\n  'session.create',\n  'settings.write',\n  'mcp.discover',\n  'mcp.authorize',\n  'computer-use.activate',\n] as const;\n\nexport type StepUpAction = (typeof STEP_UP_ACTIONS)[number];\n\n/** Short enough that a captured challenge is useless, long enough for a slow Face ID. */\nexport const STEP_UP_CHALLENGE_TTL_MS = 60_000;\n/** A registration or sign-in ceremony the user has to complete. */\nexport const CEREMONY_TTL_MS = 120_000;\n\n/**\n * Which action, if any, a request is attempting.\n *\n * Matched here rather than at each route so the list of gated operations is one\n * readable table instead of three call sites that can drift apart. Anything not\n * named is not gated, which is the safe default only because the gate is an\n * addition to the session check rather than a replacement for it.\n */\nconst GATED_ROUTES: readonly { method: string; pattern: RegExp; action: StepUpAction }[] = [\n  { method: 'POST', pattern: /^\\/api\\/sessions$/u, action: 'session.create' },\n  { method: 'POST', pattern: /^\\/api\\/sessions\\/[^/]+\\/resume$/u, action: 'session.create' },\n  { method: 'POST', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/logins$/u, action: 'provider.login' },\n  { method: 'POST', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/logins\\/[^/]+\\/answer$/u, action: 'provider.login' },\n  { method: 'DELETE', pattern: /^\\/api\\/global\\/plugin\\/doompi\\/providers\\/[^/]+$/u, action: 'provider.logout' },\n  {\n    method: 'PUT',\n    pattern: /^\\/api\\/(?:global|workspaces\\/[^/]+)\\/plugin\\/config\\/(?:value|repository\\/selection|images)$/u,\n    action: 'settings.write',\n  },\n  { method: 'POST', pattern: /^\\/api\\/auth\\/logins\\/[^/]+\\/answer$/u, action: 'provider.login' },\n  { method: 'DELETE', pattern: /^\\/api\\/auth\\/providers\\/[^/]+$/u, action: 'provider.logout' },\n  { method: 'PUT', pattern: /^\\/api\\/settings\\/(?:value|repository\\/selection)$/u, action: 'settings.write' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/discover$/u, action: 'mcp.discover' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/authorize$/u, action: 'mcp.authorize' },\n  { method: 'DELETE', pattern: /^\\/api\\/plugin\\/mcp\\/repository\\/authorize\\/[^/]+$/u, action: 'mcp.authorize' },\n  { method: 'POST', pattern: /^\\/api\\/plugin\\/computer-use\\/activate$/u, action: 'computer-use.activate' },\n];\nexport function stepUpActionFor(method: string, path: string): StepUpAction | undefined {\n  const wanted = method.toUpperCase();\n  return GATED_ROUTES.find((route) => route.method === wanted && route.pattern.test(path))?.action;\n}\n\nexport function isStepUpAction(value: unknown): value is StepUpAction {\n  return typeof value === 'string' && (STEP_UP_ACTIONS as readonly string[]).includes(value);\n}\n\nexport interface StoredCredential {\n  /** Opaque handle for display and revocation. */\n  id: string;\n  /** The authenticator's credential id, base64url, as WebAuthn reports it. */\n  credentialId: string;\n  /** Base64url public key; the private half never leaves the device. */\n  publicKey: string;\n  /** Signature counter, for clone detection. */\n  counter: number;\n  transports: string[];\n  label: string;\n  createdAt: number;\n  lastUsedAt: number;\n}\n\nexport type CounterVerdict = 'ok' | 'clone-suspected';\n\n/**\n * Whether a signature counter moved the way a real authenticator moves it.\n *\n * A counter that stays at zero means the authenticator does not implement one,\n * which is common and not a signal. A counter that goes backwards or repeats\n * while claiming to count means two things are signing with the same key, which\n * is the definition of a cloned credential.\n */\nexport function counterVerdict(stored: number, presented: number): CounterVerdict {\n  if (stored === 0 && presented === 0) return 'ok';\n  return presented > stored ? 'ok' : 'clone-suspected';\n}\n\n/** Whether a ceremony or step-up challenge is still live. */\nexport function challengeIsFresh(issuedAt: number, now: number, ttlMs: number): boolean {\n  return now - issuedAt < ttlMs;\n}\n\n/** A quick tunnel's domain; its hostname rotates on every start. */\nconst ROTATING_SUFFIX = '.trycloudflare.com';\n/** Dotted-quad, and the bracketed form a URL uses for v6. */\nconst IPV4 = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/u;\n\n/**\n * The relying party id a passkey is bound to.\n *\n * Derived from the configured tunnel hostname and nothing else, never from a\n * request header: `rpID` is the entire scope of a credential, so a caller who\n * could influence it could mint credentials against somebody else's origin.\n *\n * Three things are refused rather than accepted and regretted later:\n *\n * - A quick tunnel, whose hostname rotates on every start, so a passkey\n *   registered now would silently stop working on the next one.\n * - An IP address, which WebAuthn does not accept as a relying party id at all;\n *   registering against one fails in the browser rather than here, which is a\n *   much worse place to find out.\n * - Anything without a dot, which cannot be a public tunnel hostname.\n */\nexport function relyingPartyId(publicOrigin: string | undefined): string | undefined {\n  if (publicOrigin === undefined) return undefined;\n  let host: string;\n  try {\n    host = new URL(publicOrigin).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (host.endsWith(ROTATING_SUFFIX)) return undefined;\n  if (IPV4.test(host) || host.startsWith('[')) return undefined;\n  if (!host.includes('.')) return undefined;\n  return host;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAKA,MAAa,2BAA2B;;AAExC,MAAa,kBAAkB;;;;;;;;;AAU/B,MAAM,eAAqF;CACzF;EAAE,QAAQ;EAAQ,SAAS;EAAsB,QAAQ;CAAiB;CAC1E;EAAE,QAAQ;EAAQ,SAAS;EAAqC,QAAQ;CAAiB;CACzF;EAAE,QAAQ;EAAQ,SAAS;EAA4C,QAAQ;CAAiB;CAChG;EAAE,QAAQ;EAAQ,SAAS;EAA2D,QAAQ;CAAiB;CAC/G;EAAE,QAAQ;EAAU,SAAS;EAAsD,QAAQ;CAAkB;CAC7G;EACE,QAAQ;EACR,SAAS;EACT,QAAQ;CACV;CACA;EAAE,QAAQ;EAAQ,SAAS;EAAyC,QAAQ;CAAiB;CAC7F;EAAE,QAAQ;EAAU,SAAS;EAAoC,QAAQ;CAAkB;CAC3F;EAAE,QAAQ;EAAO,SAAS;EAAuD,QAAQ;CAAiB;CAC1G;EAAE,QAAQ;EAAQ,SAAS;EAA+C,QAAQ;CAAe;CACjG;EAAE,QAAQ;EAAQ,SAAS;EAAgD,QAAQ;CAAgB;CACnG;EAAE,QAAQ;EAAU,SAAS;EAAuD,QAAQ;CAAgB;CAC5G;EAAE,QAAQ;EAAQ,SAAS;EAA4C,QAAQ;CAAwB;AACzG;AACA,SAAgB,gBAAgB,QAAgB,MAAwC;CACtF,MAAM,SAAS,OAAO,YAAY;CAClC,OAAO,aAAa,MAAM,UAAU,MAAM,WAAW,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,CAAC,EAAE;AAC5F;AAEA,SAAgB,eAAe,OAAuC;CACpE,OAAO,OAAO,UAAU,YAAa,gBAAsC,SAAS,KAAK;AAC3F;;;;;;;;;AA2BA,SAAgB,eAAe,QAAgB,WAAmC;CAChF,IAAI,WAAW,KAAK,cAAc,GAAG,OAAO;CAC5C,OAAO,YAAY,SAAS,OAAO;AACrC;;AAGA,SAAgB,iBAAiB,UAAkB,KAAa,OAAwB;CACtF,OAAO,MAAM,WAAW;AAC1B;;AAGA,MAAM,kBAAkB;;AAExB,MAAM,OAAO;;;;;;;;;;;;;;;;;AAkBb,SAAgB,eAAe,cAAsD;CACnF,IAAI,iBAAiB,KAAA,GAAW,OAAO,KAAA;CACvC,IAAI;CACJ,IAAI;EACF,OAAO,IAAI,IAAI,YAAY,CAAC,CAAC,SAAS,YAAY;CACpD,QAAQ;EACN;CACF;CACA,IAAI,KAAK,SAAS,eAAe,GAAG,OAAO,KAAA;CAC3C,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG,OAAO,KAAA;CACpD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO,KAAA;CAChC,OAAO;AACT"}

package/dist/session-files-api.cjs

@@ -0,0 +1,61 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/server/sessionFilesApi.ts
+const EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+const FILE_QUERY_TIMEOUT_MS = 2e3;
+const MAX_FILE_RESULTS = 50;
+async function listSessionFiles(cwd, query, signal) {
+	const deadline = Date.now() + FILE_QUERY_TIMEOUT_MS;
+	const pending = [""];
+	const matches = [];
+	while (pending.length > 0) {
+		if (signal.aborted) throw signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("File completion was aborted.");
+		if (Date.now() > deadline) throw new Error("File completion timed out.");
+		const relativeDirectory = pending.pop();
+		if (relativeDirectory === void 0) break;
+		const entries = await node_fs.default.promises.readdir(node_path.default.join(cwd, relativeDirectory), { withFileTypes: true });
+		for (const entry of entries) {
+			const relativePath = node_path.default.join(relativeDirectory, entry.name);
+			if (entry.isDirectory() && !EXCLUDED_DIRECTORIES.has(entry.name)) pending.push(relativePath);
+			else if (entry.isFile()) {
+				const file = relativePath.split(node_path.default.sep).join("/");
+				if (file.toLowerCase().includes(query)) matches.push(file);
+			}
+		}
+	}
+	return matches.sort().slice(0, MAX_FILE_RESULTS);
+}
+/** Bounded, read-only file completion rooted in the owning session. */
+const sessionFilesApi = {
+	basePath: "files",
+	start(context) {
+		if (context.scope !== "session" || !context.cwd) throw new Error("File completion requires a session.");
+		const cwd = context.cwd;
+		let closed = false;
+		return {
+			async fetch(request) {
+				if (closed) return new Response(null, { status: 503 });
+				const url = new URL(request.url);
+				if (request.method !== "GET" || url.pathname !== "/") return new Response(null, { status: 404 });
+				const query = (url.searchParams.get("q") ?? "").toLowerCase();
+				if (query.length > 256) return Response.json({ error: "File query is too long." }, { status: 400 });
+				try {
+					return Response.json({ files: await listSessionFiles(cwd, query, request.signal) });
+				} catch {
+					return Response.json({ error: "File completion could not be read." }, { status: 503 });
+				}
+			},
+			close() {
+				closed = true;
+			}
+		};
+	}
+};
+//#endregion
+exports.sessionFilesApi = sessionFilesApi;
+
+//# sourceMappingURL=session-files-api.cjs.map

package/dist/session-files-api.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-files-api.cjs","names":["fs","path"],"sources":["../src/server/sessionFilesApi.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { DoomApi } from '../exports/packageApi';\n\nconst EXCLUDED_DIRECTORIES = new Set(['.git', 'node_modules']);\nconst FILE_QUERY_TIMEOUT_MS = 2000;\nconst MAX_FILE_RESULTS = 50;\n\nasync function listSessionFiles(cwd: string, query: string, signal: AbortSignal): Promise<string[]> {\n  const deadline = Date.now() + FILE_QUERY_TIMEOUT_MS;\n  const pending = [''];\n  const matches: string[] = [];\n\n  while (pending.length > 0) {\n    if (signal.aborted) {\n      throw signal.reason instanceof Error ? signal.reason : new Error('File completion was aborted.');\n    }\n    if (Date.now() > deadline) throw new Error('File completion timed out.');\n    const relativeDirectory = pending.pop();\n    if (relativeDirectory === undefined) break;\n    const entries = await fs.promises.readdir(path.join(cwd, relativeDirectory), { withFileTypes: true });\n    for (const entry of entries) {\n      const relativePath = path.join(relativeDirectory, entry.name);\n      if (entry.isDirectory() && !EXCLUDED_DIRECTORIES.has(entry.name)) {\n        pending.push(relativePath);\n      } else if (entry.isFile()) {\n        const file = relativePath.split(path.sep).join('/');\n        if (file.toLowerCase().includes(query)) matches.push(file);\n      }\n    }\n  }\n\n  return matches.sort().slice(0, MAX_FILE_RESULTS);\n}\n\n/** Bounded, read-only file completion rooted in the owning session. */\nexport const sessionFilesApi: DoomApi = {\n  basePath: 'files',\n  start(context) {\n    if (context.scope !== 'session' || !context.cwd) throw new Error('File completion requires a session.');\n    const cwd = context.cwd;\n    let closed = false;\n    return {\n      async fetch(request) {\n        if (closed) return new Response(null, { status: 503 });\n        const url = new URL(request.url);\n        if (request.method !== 'GET' || url.pathname !== '/') return new Response(null, { status: 404 });\n        const query = (url.searchParams.get('q') ?? '').toLowerCase();\n        if (query.length > 256) return Response.json({ error: 'File query is too long.' }, { status: 400 });\n        try {\n          return Response.json({ files: await listSessionFiles(cwd, query, request.signal) });\n        } catch {\n          return Response.json({ error: 'File completion could not be read.' }, { status: 503 });\n        }\n      },\n      close() {\n        closed = true;\n      },\n    };\n  },\n};\n"],"mappings":";;;;;;;AAKA,MAAM,uCAAuB,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,mBAAmB;AAEzB,eAAe,iBAAiB,KAAa,OAAe,QAAwC;CAClG,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,MAAM,UAAU,CAAC,EAAE;CACnB,MAAM,UAAoB,CAAC;CAE3B,OAAO,QAAQ,SAAS,GAAG;EACzB,IAAI,OAAO,SACT,MAAM,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,8BAA8B;EAEjG,IAAI,KAAK,IAAI,IAAI,UAAU,MAAM,IAAI,MAAM,4BAA4B;EACvE,MAAM,oBAAoB,QAAQ,IAAI;EACtC,IAAI,sBAAsB,KAAA,GAAW;EACrC,MAAM,UAAU,MAAMA,QAAAA,QAAG,SAAS,QAAQC,UAAAA,QAAK,KAAK,KAAK,iBAAiB,GAAG,EAAE,eAAe,KAAK,CAAC;EACpG,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,eAAeA,UAAAA,QAAK,KAAK,mBAAmB,MAAM,IAAI;GAC5D,IAAI,MAAM,YAAY,KAAK,CAAC,qBAAqB,IAAI,MAAM,IAAI,GAC7D,QAAQ,KAAK,YAAY;QACpB,IAAI,MAAM,OAAO,GAAG;IACzB,MAAM,OAAO,aAAa,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,KAAK,GAAG;IAClD,IAAI,KAAK,YAAY,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,KAAK,IAAI;GAC3D;EACF;CACF;CAEA,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,gBAAgB;AACjD;;AAGA,MAAa,kBAA2B;CACtC,UAAU;CACV,MAAM,SAAS;EACb,IAAI,QAAQ,UAAU,aAAa,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,qCAAqC;EACtG,MAAM,MAAM,QAAQ;EACpB,IAAI,SAAS;EACb,OAAO;GACL,MAAM,MAAM,SAAS;IACnB,IAAI,QAAQ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IACrD,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;IAC/B,IAAI,QAAQ,WAAW,SAAS,IAAI,aAAa,KAAK,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IAC/F,MAAM,SAAS,IAAI,aAAa,IAAI,GAAG,KAAK,GAAA,CAAI,YAAY;IAC5D,IAAI,MAAM,SAAS,KAAK,OAAO,SAAS,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;IAClG,IAAI;KACF,OAAO,SAAS,KAAK,EAAE,OAAO,MAAM,iBAAiB,KAAK,OAAO,QAAQ,MAAM,EAAE,CAAC;IACpF,QAAQ;KACN,OAAO,SAAS,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;IACvF;GACF;GACA,QAAQ;IACN,SAAS;GACX;EACF;CACF;AACF"}

package/dist/session-files-api.d.cts

@@ -0,0 +1,7 @@
+import { DoomApi } from "./schemas/packageApi.cjs";
+import "./package-api.cjs";
+//#region src/server/sessionFilesApi.d.ts
+/** Bounded, read-only file completion rooted in the owning session. */
+export declare const sessionFilesApi: DoomApi;
+//#endregion
+//# sourceMappingURL=session-files-api.d.cts.map

package/dist/session-files-api.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-files-api.d.cts","names":[],"sources":["../src/server/sessionFilesApi.ts"],"mappings":";;;;qBAqCa,iBAAiB"}

package/dist/session-files-api.d.mts

@@ -0,0 +1,7 @@
+import { DoomApi } from "./schemas/packageApi.mjs";
+import "./package-api.mjs";
+//#region src/server/sessionFilesApi.d.ts
+/** Bounded, read-only file completion rooted in the owning session. */
+export declare const sessionFilesApi: DoomApi;
+//#endregion
+//# sourceMappingURL=session-files-api.d.mts.map

package/dist/session-files-api.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-files-api.d.mts","names":[],"sources":["../src/server/sessionFilesApi.ts"],"mappings":";;;;qBAqCa,iBAAiB"}