@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/services/remoteAccess/index.cjs

@@ -0,0 +1,567 @@
+const require_remote = require("../../constants/remote.cjs");
+const require_index = require("../deviceSessions/index.cjs");
+const require_index$1 = require("../deviceAuth/index.cjs");
+const require_index$2 = require("../deviceTrust/index.cjs");
+const require_index$3 = require("../pairingFlow/index.cjs");
+const require_index$4 = require("../remoteAccessSettings/index.cjs");
+const require_index$5 = require("../remoteGuardPolicy/index.cjs");
+const require_index$6 = require("../webauthn/index.cjs");
+let node_crypto = require("node:crypto");
+let _agimon_ai_po_web_security = require("@agimon-ai/po-web-security");
+let _agimon_ai_po_web_security_node = require("@agimon-ai/po-web-security/node");
+//#region src/services/remoteAccess/index.ts
+const TOKEN_BYTES = 32;
+const TRUSTED_DEVICE_ID_BYTES = 16;
+const PAIRING_TRUST = { kind: "pairing" };
+const PASSKEY_TRUST = { kind: "passkey" };
+const SWEEP_INTERVAL_MS = 3e5;
+const MS_PER_MINUTE = 6e4;
+function bundlePairingTrust(value) {
+	if (value === void 0) return void 0;
+	return {
+		...value,
+		fingerprint: (0, node_crypto.createHash)("sha256").update(Buffer.from(value.publicKey, "base64url")).digest("hex")
+	};
+}
+function createRemoteAccess(options) {
+	const notice = options.onNotice ?? (() => {});
+	const now = options.now ?? (() => Date.now());
+	const broadcastLocal = options.broadcastLocal ?? (() => {});
+	const broadcastAll = options.broadcastAll ?? (() => {});
+	let settings = options.store.settings();
+	let status = "off";
+	let listener;
+	let stopTunnel;
+	let tunnelStartup;
+	let publicOrigin;
+	let publicOriginRevision = 0;
+	let policy;
+	let startedAt;
+	let closesAt;
+	let failure;
+	/** Settings an `enable` asked to hand over with, waiting for its response to flush. */
+	let pendingHandover;
+	let autoCloseTimer;
+	/** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */
+	let handshake;
+	const channels = /* @__PURE__ */ new Map();
+	const deviceChallenges = require_index$2.createDeviceChallenges({ now });
+	const sockets = /* @__PURE__ */ new Map();
+	const channelKey = (deviceId, scope) => `${deviceId}:${scope}`;
+	const dropDeviceAccess = (deviceId, reason) => {
+		options.onDeviceDropped?.(deviceId);
+		for (const scope of [
+			"session",
+			"protocol",
+			"http"
+		]) channels.delete(channelKey(deviceId, scope));
+		const held = sockets.get(deviceId);
+		sockets.delete(deviceId);
+		for (const close of held ?? []) try {
+			close(1008, `device ${reason}`);
+		} catch {}
+	};
+	const devices = require_index$1.createDeviceAuth({
+		settings: () => settings,
+		now,
+		onNotice: notice,
+		onDrop: (record, reason) => dropDeviceAccess(record.id, reason)
+	});
+	const webauthn = require_index$6.createWebAuthn({
+		publicOrigin: () => publicOrigin,
+		credentials: () => options.store.credentials(),
+		saveCredential: (credential) => options.store.saveCredential(credential),
+		removeCredential: (id) => options.store.removeCredential(id),
+		now,
+		onNotice: notice
+	});
+	const pairing = require_index$3.createPairingFlow({
+		randomToken: () => (0, node_crypto.randomBytes)(TOKEN_BYTES).toString("base64url"),
+		randomManualCode: () => (0, node_crypto.randomInt)(1e8).toString().padStart(8, "0"),
+		digest: (token) => (0, node_crypto.createHash)("sha256").update(token).digest("hex"),
+		now,
+		onNotice: notice
+	});
+	const sweeper = setInterval(() => {
+		devices.sweep();
+		pairing.sweep();
+	}, SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	function publish() {
+		broadcastAll({
+			type: require_remote.REMOTE_STATE_TYPE,
+			state: view(void 0, false)
+		});
+	}
+	function view(selfDeviceId, forLocalCaller) {
+		const selfTrust = selfDeviceId === void 0 ? void 0 : devices.trustOf(selfDeviceId);
+		const selfTrustedDeviceId = selfTrust?.kind === "device-key" ? selfTrust.trustedDeviceId : void 0;
+		return {
+			status,
+			...publicOrigin === void 0 ? {} : { publicUrl: publicOrigin },
+			...startedAt === void 0 ? {} : { startedAt: new Date(startedAt).toISOString() },
+			...closesAt === void 0 ? {} : { closesAt: new Date(closesAt).toISOString() },
+			...failure === void 0 ? {} : { error: failure },
+			devices: devices.list().map((record) => ({
+				id: record.id,
+				label: record.label,
+				userAgent: record.userAgent,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: record.id === selfDeviceId
+			})),
+			pending: forLocalCaller ? pairing.pending().map((request) => ({
+				id: request.id,
+				userAgent: request.userAgent,
+				edgeIp: request.edgeIp,
+				createdAt: new Date(request.createdAt).toISOString(),
+				expiresAt: new Date(request.createdAt + 18e4).toISOString()
+			})) : [],
+			trustedDevices: options.store.trustedDevices().map((record) => ({
+				id: record.id,
+				label: record.label,
+				platform: record.platform,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: selfTrustedDeviceId !== void 0 && record.id === selfTrustedDeviceId
+			})),
+			settings
+		};
+	}
+	function armAutoClose() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		if (!settings.autoCloseEnabled || status !== "on") return;
+		closesAt = now() + settings.autoCloseMinutes * MS_PER_MINUTE;
+		autoCloseTimer = setTimeout(() => {
+			notice("remote access reached its time limit; closing");
+			disable();
+		}, settings.autoCloseMinutes * MS_PER_MINUTE);
+		autoCloseTimer.unref();
+	}
+	/** Everything teardown has to do, in the order it has to happen. */
+	async function teardown() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		for (const held of sockets.values()) for (const close of held) try {
+			close(1008, "remote access revoked");
+		} catch {}
+		sockets.clear();
+		const starting = tunnelStartup;
+		tunnelStartup = void 0;
+		starting?.controller.abort();
+		const startingOutcome = await starting?.outcome.catch(() => void 0);
+		if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => void 0);
+		await stopTunnel?.().catch(() => void 0);
+		stopTunnel = void 0;
+		await listener?.close().catch(() => void 0);
+		listener = void 0;
+		if (publicOrigin !== void 0) publicOriginRevision += 1;
+		publicOrigin = void 0;
+		policy = void 0;
+		startedAt = void 0;
+		pairing.clear();
+		webauthn.clearChallenges();
+		deviceChallenges.clear();
+		handshake = void 0;
+		channels.clear();
+		devices.revokeAll();
+	}
+	async function disable() {
+		if (status === "off") return;
+		await teardown();
+		status = "off";
+		failure = void 0;
+		notice("remote access off");
+		publish();
+	}
+	return {
+		state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),
+		settings: () => settings,
+		publicOrigin: () => publicOrigin,
+		publicOriginRevision: () => publicOriginRevision,
+		updateSettings(patch) {
+			const parsed = require_index$4.parseRemoteAccessSettings(require_index$4.serializeRemoteAccessSettings({
+				...settings,
+				...patch
+			}));
+			for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);
+			settings = parsed.settings;
+			options.store.save(settings);
+			devices.reschedule();
+			armAutoClose();
+			publish();
+			return settings;
+		},
+		/**
+		* Runs a handover `enable` deferred, once its response is on the wire.
+		*
+		* Split out rather than done inside `enable` because the reply and the
+		* teardown travel over the same socket, and doing them in the wrong order
+		* leaves the caller unable to tell success from a dropped connection.
+		*/
+		commitHandover() {
+			const handing = pendingHandover;
+			if (handing === void 0) return;
+			pendingHandover = void 0;
+			notice("handing the cockpit over to a container");
+			options.requestHandover?.(handing);
+		},
+		/** True between a contained `enable` and the handover its response defers. */
+		handoverPending: () => pendingHandover !== void 0,
+		tunnelPort: () => listener?.port,
+		tunnelPolicy: () => policy,
+		async enable() {
+			if (status === "on" || status === "starting") return { ok: true };
+			status = "starting";
+			failure = void 0;
+			publish();
+			if (settings.sandbox.enabled && options.contained !== true) {
+				if (settings.sandbox.workspaces.length === 0) {
+					status = "failed";
+					failure = "Add at least one workspace before running the cockpit in a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				if (options.requestHandover === void 0) {
+					status = "failed";
+					failure = "This cockpit cannot hand over to a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				pendingHandover = settings;
+				return { ok: true };
+			}
+			let bound;
+			try {
+				bound = await options.bindListener();
+			} catch (error) {
+				status = "failed";
+				failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;
+				publish();
+				return {
+					ok: false,
+					error: failure
+				};
+			}
+			listener = bound;
+			const controller = new AbortController();
+			const launching = options.launchTunnel({
+				port: bound.port,
+				config: settings.tunnel,
+				signal: controller.signal,
+				acceptOrigin: (origin) => {
+					policy = require_index$5.tunnelOriginPolicy(origin);
+				}
+			});
+			const startup = {
+				controller,
+				outcome: launching
+			};
+			tunnelStartup = startup;
+			const outcome = await launching;
+			if (tunnelStartup !== startup || controller.signal.aborted) return {
+				ok: false,
+				error: "Tunnel startup was cancelled."
+			};
+			tunnelStartup = void 0;
+			if (!outcome.ok) {
+				await teardown();
+				status = "failed";
+				failure = outcome.message;
+				notice(`remote access failed: ${outcome.message}`);
+				publish();
+				return {
+					ok: false,
+					error: outcome.message
+				};
+			}
+			stopTunnel = outcome.stop;
+			handshake = (0, _agimon_ai_po_web_security_node.createHostHandshake)();
+			publicOrigin = outcome.publicOrigin;
+			policy = require_index$5.tunnelOriginPolicy(outcome.publicOrigin);
+			startedAt = now();
+			status = "on";
+			armAutoClose();
+			notice(`remote access on at ${outcome.publicOrigin}`);
+			publish();
+			return { ok: true };
+		},
+		disable,
+		mintPairing() {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const trust = bundlePairingTrust(options.bundleTrust?.());
+			if (trust === void 0) return void 0;
+			const { code, manualCode, expiresAt } = pairing.mintCode();
+			const fragment = new URLSearchParams({
+				c: code,
+				[_agimon_ai_po_web_security.SEALED_KEY_PARAM]: handshake.publicKey,
+				["s"]: trust.publicKey,
+				["r"]: String(trust.revision)
+			});
+			return {
+				code,
+				manualCode,
+				pairUrl: `${publicOrigin}${require_remote.PAIRING_PAGE_ROUTE}#${fragment.toString()}`,
+				expiresAt: new Date(expiresAt).toISOString(),
+				...trust
+			};
+		},
+		bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),
+		claim(input) {
+			const outcome = pairing.claim(input);
+			if (outcome.ok) broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		pairingStatus: (requestId) => pairing.status(requestId),
+		approve(requestId) {
+			const outcome = pairing.approve(requestId);
+			if (outcome === "approved") broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		deny(requestId) {
+			const outcome = pairing.deny(requestId);
+			if (outcome === "denied") broadcastLocal({
+				type: require_remote.REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		redeem(requestId) {
+			const approved = pairing.consume(requestId);
+			if (approved === void 0) return void 0;
+			const enrolled = devices.enrol({
+				userAgent: approved.userAgent,
+				trust: PAIRING_TRUST
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: require_index.cookieMaxAgeSeconds(settings, require_remote.COOKIE_CEILING_SECONDS)
+			};
+		},
+		authorize: (token) => devices.verify(token)?.id,
+		isDeviceAuthorized(deviceId) {
+			devices.sweep();
+			return listener !== void 0 && devices.list().some((record) => record.id === deviceId);
+		},
+		sessionForPasskey(label) {
+			const enrolled = devices.enrol({
+				userAgent: label,
+				trust: PASSKEY_TRUST
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: require_index.cookieMaxAgeSeconds(settings, require_remote.COOKIE_CEILING_SECONDS)
+			};
+		},
+		passkeys: () => ({
+			support: () => webauthn.support(),
+			list: () => options.store.credentials(),
+			beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),
+			finishRegistration: async (ceremonyId, caller, response, label) => await webauthn.finishRegistration(ceremonyId, caller, response, label),
+			beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),
+			finishAuthentication: async (ceremonyId, caller, response) => await webauthn.finishAuthentication(ceremonyId, caller, response),
+			beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),
+			finishStepUp: async (ceremonyId, caller, action, response) => await webauthn.finishStepUp(ceremonyId, caller, action, response),
+			forget: (id) => {
+				const forgotten = options.store.removeCredential(id);
+				if (forgotten) publish();
+				return forgotten;
+			}
+		}),
+		registerTrustedDevice(sessionDeviceId, body) {
+			if (publicOrigin === void 0 || handshake === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			const verdict = require_index$2.verifyRegistration({
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				sessionDeviceId,
+				trust: devices.trustOf(sessionDeviceId),
+				body
+			});
+			if (!verdict.ok) return {
+				ok: false,
+				reason: verdict.reason === "not-pairing" ? "forbidden" : "invalid"
+			};
+			if (options.store.trustedDevices().length >= 32) return {
+				ok: false,
+				reason: "full"
+			};
+			const at = now();
+			const trustedDeviceId = (0, node_crypto.randomBytes)(TRUSTED_DEVICE_ID_BYTES).toString("base64url");
+			if (!options.store.saveTrustedDevice({
+				id: trustedDeviceId,
+				identityPublicKey: verdict.identityPublicKey,
+				stepUpPublicKey: verdict.stepUpPublicKey,
+				label: verdict.label,
+				platform: verdict.platform,
+				createdAt: at,
+				lastSeenAt: at
+			})) return {
+				ok: false,
+				reason: "full"
+			};
+			devices.setTrust(sessionDeviceId, {
+				kind: "device-key",
+				trustedDeviceId
+			});
+			notice(`trusted ${verdict.label} (${trustedDeviceId})`);
+			publish();
+			return {
+				ok: true,
+				trustedDeviceId
+			};
+		},
+		beginDeviceAuth(input) {
+			if (!require_index$2.isOpaqueId(input.trustedDeviceId) || !require_index$2.isDeviceNonce(input.nonce)) return {
+				ok: false,
+				reason: "invalid"
+			};
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0 || options.attestHost === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			const attest = options.attestHost;
+			const begun = require_index$2.deviceAuthChallenge({
+				challenges: deviceChallenges,
+				trustedDeviceId: input.trustedDeviceId,
+				nonce: input.nonce,
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				attest: (fields) => attest(fields)
+			});
+			return begun === void 0 ? {
+				ok: false,
+				reason: "unavailable"
+			} : {
+				ok: true,
+				...begun
+			};
+		},
+		finishDeviceAuth(body) {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const verdict = require_index$2.verifyAuthentication({
+				challenges: deviceChallenges,
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				find: (id) => options.store.trustedDevices().find((record) => record.id === id),
+				body
+			});
+			if (!verdict.ok) return void 0;
+			const enrolled = devices.enrol({
+				userAgent: verdict.record.label,
+				trust: {
+					kind: "device-key",
+					trustedDeviceId: verdict.record.id
+				}
+			});
+			const opened = [
+				["session", handshake.accept(verdict.channels.session)],
+				["protocol", handshake.accept(verdict.channels.protocol)],
+				["http", handshake.accept(verdict.channels.http)]
+			];
+			if (opened.some(([, channel]) => channel === void 0)) {
+				devices.revoke(enrolled.record.id);
+				return;
+			}
+			for (const [scope, channel] of opened) if (channel !== void 0) channels.set(channelKey(enrolled.record.id, scope), channel);
+			options.store.saveTrustedDevice({
+				...verdict.record,
+				lastSeenAt: now()
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: require_index.cookieMaxAgeSeconds(settings, require_remote.COOKIE_CEILING_SECONDS)
+			};
+		},
+		beginDeviceStepUp(sessionDeviceId, action) {
+			if (handshake === void 0 || devices.trustOf(sessionDeviceId)?.kind !== "device-key") return void 0;
+			return require_index$2.deviceStepUpChallenge({
+				challenges: deviceChallenges,
+				sessionDeviceId,
+				action,
+				hostPublicKey: handshake.publicKey
+			});
+		},
+		finishDeviceStepUp(sessionDeviceId, action, ceremonyId, signature) {
+			const trust = devices.trustOf(sessionDeviceId);
+			if (trust?.kind !== "device-key" || publicOrigin === void 0) return false;
+			const record = options.store.trustedDevices().find((held) => held.id === trust.trustedDeviceId);
+			if (record === void 0) return false;
+			return require_index$2.verifyStepUp({
+				challenges: deviceChallenges,
+				origin: publicOrigin,
+				hostPublicKey: handshake?.publicKey,
+				sessionDeviceId,
+				action,
+				ceremonyId,
+				signature,
+				stepUpPublicKey: record.stepUpPublicKey
+			});
+		},
+		revokeTrustedDevice(id) {
+			const heldBy = (record) => record.trust.kind === "device-key" && record.trust.trustedDeviceId === id;
+			const removed = options.store.removeTrustedDevice(id);
+			const endedIds = new Set(devices.list().filter(heldBy).map((record) => record.id));
+			const ended = devices.revokeWhere(heldBy);
+			deviceChallenges.dropWhere((challenge) => challenge.purpose.kind === "auth" && challenge.purpose.trustedDeviceId === id || challenge.purpose.kind === "step-up" && endedIds.has(challenge.purpose.sessionDeviceId));
+			if (!removed && ended === 0) return false;
+			notice(`revoked trusted device ${id}`);
+			publish();
+			return true;
+		},
+		trustKind: (deviceId) => devices.trustOf(deviceId)?.kind,
+		stepUpRequired: (_action, deviceId) => deviceId !== void 0 && devices.trustOf(deviceId)?.kind === "device-key" || webauthn.support().supported,
+		channelPublicKey: () => handshake?.publicKey,
+		openChannel(deviceId, scope, clientPublicKey) {
+			const channel = handshake?.accept(clientPublicKey);
+			if (channel === void 0) return false;
+			channels.set(channelKey(deviceId, scope), channel);
+			return true;
+		},
+		channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),
+		revokeDevice(id) {
+			const revoked = devices.revoke(id);
+			if (revoked) publish();
+			return revoked;
+		},
+		isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,
+		trackSocket(deviceId, close) {
+			const held = sockets.get(deviceId) ?? /* @__PURE__ */ new Set();
+			held.add(close);
+			sockets.set(deviceId, held);
+			return () => {
+				held.delete(close);
+				if (held.size === 0) sockets.delete(deviceId);
+			};
+		},
+		async close() {
+			clearInterval(sweeper);
+			await teardown();
+			status = "off";
+		}
+	};
+}
+//#endregion
+exports.createRemoteAccess = createRemoteAccess;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/remoteAccess/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createHash","createDeviceChallenges","createDeviceAuth","createWebAuthn","createPairingFlow","randomBytes","randomInt","REMOTE_STATE_TYPE","parseRemoteAccessSettings","serializeRemoteAccessSettings","tunnelOriginPolicy","createHostHandshake","SEALED_KEY_PARAM","PAIRING_PAGE_ROUTE","REMOTE_PAIRING_REQUEST_TYPE","cookieMaxAgeSeconds","COOKIE_CEILING_SECONDS","verifyRegistration","isOpaqueId","isDeviceNonce","deviceAuthChallenge","verifyAuthentication","deviceStepUpChallenge","verifyStepUp"],"sources":["../../../../src/services/remoteAccess/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomInt } from 'node:crypto';\n\nimport { SEALED_KEY_PARAM } from '@agimon-ai/po-web-security';\nimport { createHostHandshake, type HostHandshake, type SealedChannel } from '@agimon-ai/po-web-security/node';\n\nimport {\n  BUNDLE_MINIMUM_REVISION_PARAM,\n  BUNDLE_SIGNING_KEY_PARAM,\n  PAIRING_PAGE_ROUTE,\n  REMOTE_PAIRING_REQUEST_TYPE,\n  REMOTE_STATE_TYPE,\n} from '../../constants/remote';\nimport { COOKIE_CEILING_SECONDS, TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport {\n  type BundlePairingTrust,\n  type DeviceTrust,\n  type DeviceTrustKind,\n  type PairingStatus,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n  type RemoteAccessStatus,\n  type RemoteChannelScope,\n  type TunnelLauncher,\n  type TunnelStartResult,\n} from '../../types/remote';\nimport { createDeviceAuth, type DeviceAuth, type EnrolledDevice } from '../deviceAuth';\nimport { cookieMaxAgeSeconds } from '../deviceSessions';\nimport {\n  createDeviceChallenges,\n  deviceAuthChallenge,\n  deviceStepUpChallenge,\n  type DeviceChallenges,\n  isDeviceNonce,\n  isOpaqueId,\n  verifyAuthentication,\n  verifyRegistration,\n  verifyStepUp,\n} from '../deviceTrust';\nimport { createPairingFlow, type PairingFlow } from '../pairingFlow';\nimport { parseRemoteAccessSettings, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { RemoteAccessStore } from '../remoteAccessStore';\nimport { type OriginPolicy, tunnelOriginPolicy } from '../remoteGuardPolicy';\nimport { createWebAuthn, type PasskeySupport, type WebAuthn } from '../webauthn';\nimport type { StepUpAction, StoredCredential } from '../webauthnPolicy';\n\nconst TOKEN_BYTES = 32;\nconst TRUSTED_DEVICE_ID_BYTES = 16;\nconst PAIRING_TRUST: DeviceTrust = { kind: 'pairing' };\nconst PASSKEY_TRUST: DeviceTrust = { kind: 'passkey' };\nconst SWEEP_INTERVAL_MS = 5 * 60_000;\nconst MS_PER_MINUTE = 60_000;\n\n/** The tunnel listener, bound by the host so this file never imports an HTTP server. */\nexport interface TunnelListener {\n  port: number;\n  close: () => Promise<void>;\n}\n\nexport interface RemoteAccessOptions {\n  store: RemoteAccessStore;\n  launchTunnel: TunnelLauncher;\n  /** Binds a fresh loopback listener for the tunnel to point at. */\n  bindListener: () => Promise<TunnelListener>;\n  /** Current signed publication authenticated through the physical pairing display. */\n  bundleTrust?: () => { publicKey: string; revision: number } | undefined;\n  /**\n   * Signs `po/host-channel-key/v1` fields with the same bundle signer the QR pins, so a reconnecting\n   * phone can trust a fresh tunnel key. Undefined while no shell is published.\n   */\n  attestHost?: (fields: readonly string[]) => string | undefined;\n  /** Removes ephemeral state owned by a paired device when its authorization ends. */\n  onDeviceDropped?: (deviceId: string) => void;\n  onNotice?: (message: string) => void;\n  /** Frames only the local cockpit may see, such as an approval prompt. */\n  broadcastLocal?: (frame: object) => void;\n  /** Frames both local and remote pages see. */\n  broadcastAll?: (frame: object) => void;\n  /**\n   * Asks the launcher to hand this cockpit over to a container.\n   *\n   * A signal rather than a call that does the work, because handing over means\n   * closing the server this code is running inside, which it cannot do to\n   * itself. The launcher owns that sequence and the rollback if it fails.\n   */\n  requestHandover?: (settings: RemoteAccessSettings) => void;\n  /**\n   * Whether this cockpit is already the one inside the container.\n   *\n   * Without it the contained hub would read the same settings it was handed and\n   * try to hand over again, to a container inside a container.\n   */\n  contained?: boolean;\n  now?: () => number;\n}\n\nexport interface RemoteAccess {\n  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;\n  settings(): RemoteAccessSettings;\n  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;\n  tunnelPort(): number | undefined;\n  /** The public origin the tunnel currently answers on, while one is up. */\n  publicOrigin(): string | undefined;\n  /** Changes whenever an established public exposure is torn down. */\n  publicOriginRevision(): number;\n  tunnelPolicy(): OriginPolicy | undefined;\n  enable(): Promise<{ ok: true } | { ok: false; error: string }>;\n  /** True between a contained `enable` and the handover its response defers. */\n  handoverPending(): boolean;\n  /** Runs that deferred handover, once the response asking for it is on the wire. */\n  commitHandover(): void;\n  disable(): Promise<void>;\n  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */\n  mintPairing():\n    | ({ code: string; manualCode: string; pairUrl: string; expiresAt: string } & BundlePairingTrust)\n    | undefined;\n  bundleTrust(): BundlePairingTrust | undefined;\n  claim(input: {\n    code: string;\n    userAgent: string | undefined;\n    edgeIp: string | undefined;\n    sourceAddress: string | undefined;\n  }): ReturnType<PairingFlow['claim']>;\n  pairingStatus(requestId: string): PairingStatus | undefined;\n  approve(requestId: string): ReturnType<PairingFlow['approve']>;\n  deny(requestId: string): ReturnType<PairingFlow['deny']>;\n  /** Turns an approved request into a session, exactly once. */\n  redeem(requestId: string): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  authorize(token: string | undefined): string | undefined;\n  /** Liveness check for a server-authenticated device identity, without extending expiry. */\n  isDeviceAuthorized(deviceId: string): boolean;\n  /** Mints a session for a device that proved a registered passkey. */\n  sessionForPasskey(label: string): EnrolledDevice & { maxAgeSeconds: number };\n  passkeys(): {\n    support: () => PasskeySupport;\n    list: () => readonly StoredCredential[];\n    beginRegistration: WebAuthn['beginRegistration'];\n    finishRegistration: WebAuthn['finishRegistration'];\n    beginAuthentication: WebAuthn['beginAuthentication'];\n    finishAuthentication: WebAuthn['finishAuthentication'];\n    beginStepUp: WebAuthn['beginStepUp'];\n    finishStepUp: WebAuthn['finishStepUp'];\n    forget: (id: string) => boolean;\n  };\n  /** Registers a native device from a sealed, QR-approved pairing session, exactly once. */\n  registerTrustedDevice(\n    sessionDeviceId: string,\n    body: unknown,\n  ): { ok: true; trustedDeviceId: string } | { ok: false; reason: 'forbidden' | 'invalid' | 'full' | 'unavailable' };\n  /** Public reconnect challenge with the same shape for known and unknown ids. */\n  beginDeviceAuth(input: {\n    trustedDeviceId: unknown;\n    nonce: unknown;\n  }):\n    | { ok: true; challengeId: string; challenge: string; hostPublicKey: string; attestation: string }\n    | { ok: false; reason: 'invalid' | 'unavailable' };\n  /** Verifies a device sign-in, opens all three channels at once, and mints a session. */\n  finishDeviceAuth(body: unknown): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  beginDeviceStepUp(\n    sessionDeviceId: string,\n    action: StepUpAction,\n  ): { ceremonyId: string; challenge: string; kind: 'device-key' } | undefined;\n  finishDeviceStepUp(sessionDeviceId: string, action: StepUpAction, ceremonyId: unknown, signature: unknown): boolean;\n  /** Removes the stored device and ends every live session, channel, and socket it holds. */\n  revokeTrustedDevice(id: string): boolean;\n  trustKind(deviceId: string): DeviceTrustKind | undefined;\n  /**\n   * Whether this action needs a fresh gesture that has not been supplied. Always true for a device-key\n   * session; otherwise only where passkeys are supported.\n   */\n  stepUpRequired(action: StepUpAction, deviceId?: string): boolean;\n  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */\n  channelPublicKey(): string | undefined;\n  /** Completes one purpose-bound sealed channel against a fresh device key. */\n  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;\n  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;\n  revokeDevice(id: string): boolean;\n  isDeviceConnected(deviceId: string): boolean;\n  /** Registers a remote socket against its device so revocation closes it immediately. */\n  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;\n  close(): Promise<void>;\n}\n\nfunction bundlePairingTrust(\n  value: { publicKey: string; revision: number } | undefined,\n): BundlePairingTrust | undefined {\n  if (value === undefined) return undefined;\n  return {\n    ...value,\n    fingerprint: createHash('sha256').update(Buffer.from(value.publicKey, 'base64url')).digest('hex'),\n  };\n}\n\nexport function createRemoteAccess(options: RemoteAccessOptions): RemoteAccess {\n  const notice = options.onNotice ?? ((): void => {});\n  const now = options.now ?? ((): number => Date.now());\n  const broadcastLocal = options.broadcastLocal ?? ((): void => {});\n  const broadcastAll = options.broadcastAll ?? ((): void => {});\n\n  let settings = options.store.settings();\n  let status: RemoteAccessStatus = 'off';\n  let listener: TunnelListener | undefined;\n  let stopTunnel: (() => Promise<void>) | undefined;\n  let tunnelStartup: { controller: AbortController; outcome: Promise<TunnelStartResult> } | undefined;\n  let publicOrigin: string | undefined;\n  let publicOriginRevision = 0;\n  let policy: OriginPolicy | undefined;\n  let startedAt: number | undefined;\n  let closesAt: number | undefined;\n  let failure: string | undefined;\n  /** Settings an `enable` asked to hand over with, waiting for its response to flush. */\n  let pendingHandover: RemoteAccessSettings | undefined;\n  let autoCloseTimer: ReturnType<typeof setTimeout> | undefined;\n  /** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */\n  let handshake: HostHandshake | undefined;\n  const channels = new Map<string, SealedChannel>();\n  const deviceChallenges: DeviceChallenges = createDeviceChallenges({ now });\n  const sockets = new Map<string, Set<(code: number, reason: string) => void>>();\n\n  const channelKey = (deviceId: string, scope: RemoteChannelScope): string => `${deviceId}:${scope}`;\n  const dropDeviceAccess = (deviceId: string, reason: 'revoked' | 'expired'): void => {\n    options.onDeviceDropped?.(deviceId);\n    for (const scope of ['session', 'protocol', 'http'] as const) channels.delete(channelKey(deviceId, scope));\n    const held = sockets.get(deviceId);\n    sockets.delete(deviceId);\n    for (const close of held ?? []) {\n      try {\n        close(1008, `device ${reason}`);\n      } catch {\n        // The socket is already gone.\n      }\n    }\n  };\n\n  const devices: DeviceAuth = createDeviceAuth({\n    settings: () => settings,\n    now,\n    onNotice: notice,\n    onDrop: (record, reason) => dropDeviceAccess(record.id, reason),\n  });\n\n  const webauthn: WebAuthn = createWebAuthn({\n    publicOrigin: () => publicOrigin,\n    credentials: () => options.store.credentials(),\n    saveCredential: (credential) => options.store.saveCredential(credential),\n    removeCredential: (id) => options.store.removeCredential(id),\n    now,\n    onNotice: notice,\n  });\n\n  const pairing: PairingFlow = createPairingFlow({\n    randomToken: () => randomBytes(TOKEN_BYTES).toString('base64url'),\n    randomManualCode: () => randomInt(100_000_000).toString().padStart(8, '0'),\n    digest: (token) => createHash('sha256').update(token).digest('hex'),\n    now,\n    onNotice: notice,\n  });\n\n  const sweeper = setInterval(() => {\n    devices.sweep();\n    pairing.sweep();\n  }, SWEEP_INTERVAL_MS);\n  sweeper.unref();\n\n  function publish(): void {\n    broadcastAll({ type: REMOTE_STATE_TYPE, state: view(undefined, false) });\n  }\n\n  function view(selfDeviceId: string | undefined, forLocalCaller: boolean): RemoteAccessStateView {\n    const selfTrust = selfDeviceId === undefined ? undefined : devices.trustOf(selfDeviceId);\n    const selfTrustedDeviceId = selfTrust?.kind === 'device-key' ? selfTrust.trustedDeviceId : undefined;\n    return {\n      status,\n      ...(publicOrigin === undefined ? {} : { publicUrl: publicOrigin }),\n      ...(startedAt === undefined ? {} : { startedAt: new Date(startedAt).toISOString() }),\n      ...(closesAt === undefined ? {} : { closesAt: new Date(closesAt).toISOString() }),\n      ...(failure === undefined ? {} : { error: failure }),\n      devices: devices.list().map((record) => ({\n        id: record.id,\n        label: record.label,\n        userAgent: record.userAgent,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: record.id === selfDeviceId,\n      })),\n      // A paired phone must never see the approval queue: a device that can\n      // approve devices makes its own access permanent, which is exactly what\n      // host confirmation exists to prevent.\n      pending: forLocalCaller\n        ? pairing.pending().map((request) => ({\n            id: request.id,\n            userAgent: request.userAgent,\n            edgeIp: request.edgeIp,\n            createdAt: new Date(request.createdAt).toISOString(),\n            expiresAt: new Date(request.createdAt + 180_000).toISOString(),\n          }))\n        : [],\n      trustedDevices: options.store.trustedDevices().map((record) => ({\n        id: record.id,\n        label: record.label,\n        platform: record.platform,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: selfTrustedDeviceId !== undefined && record.id === selfTrustedDeviceId,\n      })),\n      settings,\n    };\n  }\n\n  function armAutoClose(): void {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    if (!settings.autoCloseEnabled || status !== 'on') return;\n    const at = now() + settings.autoCloseMinutes * MS_PER_MINUTE;\n    closesAt = at;\n    autoCloseTimer = setTimeout(() => {\n      notice('remote access reached its time limit; closing');\n      void disable();\n    }, settings.autoCloseMinutes * MS_PER_MINUTE);\n    autoCloseTimer.unref();\n  }\n\n  /** Everything teardown has to do, in the order it has to happen. */\n  async function teardown(): Promise<void> {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    // Sockets first. An upgraded socket has left the HTTP server's connection\n    // tracking, so closing the listener does not touch it: without this a\n    // paired phone keeps driving the agent after remote access is switched off.\n    for (const held of sockets.values()) {\n      for (const close of held) {\n        try {\n          close(1008, 'remote access revoked');\n        } catch {\n          // The socket is already gone, which is the outcome we wanted.\n        }\n      }\n    }\n    sockets.clear();\n    const starting = tunnelStartup;\n    tunnelStartup = undefined;\n    starting?.controller.abort();\n    const startingOutcome = await starting?.outcome.catch(() => undefined);\n    if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => undefined);\n    await stopTunnel?.().catch(() => undefined);\n    stopTunnel = undefined;\n    await listener?.close().catch(() => undefined);\n    listener = undefined;\n    if (publicOrigin !== undefined) publicOriginRevision += 1;\n    publicOrigin = undefined;\n    policy = undefined;\n    startedAt = undefined;\n    pairing.clear();\n    webauthn.clearChallenges();\n    // Challenges are bound to this tunnel's key. Trusted devices stay on disk, like passkeys.\n    deviceChallenges.clear();\n    handshake = undefined;\n    channels.clear();\n    // Sessions go; passkeys and any other durable credential do not, so\n    // switching back on does not mean enrolling every device again.\n    devices.revokeAll();\n  }\n\n  async function disable(): Promise<void> {\n    if (status === 'off') return;\n    await teardown();\n    status = 'off';\n    failure = undefined;\n    notice('remote access off');\n    publish();\n  }\n\n  return {\n    state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),\n    settings: () => settings,\n    publicOrigin: () => publicOrigin,\n    publicOriginRevision: () => publicOriginRevision,\n\n    updateSettings(patch) {\n      // Through the parser rather than spread straight in, so a value out of\n      // range is clamped now instead of silently differing until the next load.\n      const parsed = parseRemoteAccessSettings(\n        serializeRemoteAccessSettings({ ...settings, ...patch }) as Record<string, unknown>,\n      );\n      for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);\n      settings = parsed.settings;\n      options.store.save(settings);\n      // Re-arm rather than leave the old deadline: shortening the window has to\n      // take effect now, and lengthening it should not close early.\n      devices.reschedule();\n      armAutoClose();\n      publish();\n      return settings;\n    },\n\n    /**\n     * Runs a handover `enable` deferred, once its response is on the wire.\n     *\n     * Split out rather than done inside `enable` because the reply and the\n     * teardown travel over the same socket, and doing them in the wrong order\n     * leaves the caller unable to tell success from a dropped connection.\n     */\n    commitHandover() {\n      const handing = pendingHandover;\n      if (handing === undefined) return;\n      pendingHandover = undefined;\n      notice('handing the cockpit over to a container');\n      options.requestHandover?.(handing);\n    },\n\n    /** True between a contained `enable` and the handover its response defers. */\n    handoverPending: () => pendingHandover !== undefined,\n\n    tunnelPort: () => listener?.port,\n    tunnelPolicy: () => policy,\n\n    async enable() {\n      if (status === 'on' || status === 'starting') return { ok: true };\n      status = 'starting';\n      failure = undefined;\n      publish();\n\n      // Containment has to be in place before the tunnel is, so a contained\n      // cockpit hands over instead of starting a tunnel here. The container's\n      // own hub turns remote access on once it is serving.\n      if (settings.sandbox.enabled && options.contained !== true) {\n        if (settings.sandbox.workspaces.length === 0) {\n          status = 'failed';\n          failure = 'Add at least one workspace before running the cockpit in a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        if (options.requestHandover === undefined) {\n          status = 'failed';\n          failure = 'This cockpit cannot hand over to a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        // Held rather than run: the handover closes the server carrying this\n        // very response, so the caller has to hear the answer first.\n        pendingHandover = settings;\n        return { ok: true };\n      }\n      let bound: TunnelListener;\n      try {\n        bound = await options.bindListener();\n      } catch (error) {\n        status = 'failed';\n        failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;\n        publish();\n        return { ok: false, error: failure };\n      }\n      listener = bound;\n      const controller = new AbortController();\n      const launching = options.launchTunnel({\n        port: bound.port,\n        config: settings.tunnel,\n        signal: controller.signal,\n        acceptOrigin: (origin) => {\n          policy = tunnelOriginPolicy(origin);\n        },\n      });\n      const startup = { controller, outcome: launching };\n      tunnelStartup = startup;\n      const outcome = await launching;\n      if (tunnelStartup !== startup || controller.signal.aborted) {\n        return { ok: false, error: 'Tunnel startup was cancelled.' };\n      }\n      tunnelStartup = undefined;\n      if (!outcome.ok) {\n        await teardown();\n        status = 'failed';\n        failure = outcome.message;\n        notice(`remote access failed: ${outcome.message}`);\n        publish();\n        return { ok: false, error: outcome.message };\n      }\n      stopTunnel = outcome.stop;\n      // A fresh key pair per tunnel: the QR is the only place its public half\n      // travels, so it must not outlive the code that carried it.\n      handshake = createHostHandshake();\n      publicOrigin = outcome.publicOrigin;\n      policy = tunnelOriginPolicy(outcome.publicOrigin);\n      startedAt = now();\n      status = 'on';\n      armAutoClose();\n      notice(`remote access on at ${outcome.publicOrigin}`);\n      publish();\n      return { ok: true };\n    },\n\n    disable,\n\n    mintPairing() {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const trust = bundlePairingTrust(options.bundleTrust?.());\n      if (trust === undefined) return undefined;\n      const { code, manualCode, expiresAt } = pairing.mintCode();\n      // The token, channel key, signer key, and publication floor ride in the fragment,\n      // so the relay never observes the values used to authenticate either channel.\n      const fragment = new URLSearchParams({\n        c: code,\n        [SEALED_KEY_PARAM]: handshake.publicKey,\n        [BUNDLE_SIGNING_KEY_PARAM]: trust.publicKey,\n        [BUNDLE_MINIMUM_REVISION_PARAM]: String(trust.revision),\n      });\n      return {\n        code,\n        manualCode,\n        pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,\n        expiresAt: new Date(expiresAt).toISOString(),\n        ...trust,\n      };\n    },\n\n    bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),\n\n    claim(input) {\n      const outcome = pairing.claim(input);\n      if (outcome.ok) {\n        broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      }\n      return outcome;\n    },\n\n    pairingStatus: (requestId) => pairing.status(requestId),\n\n    approve(requestId) {\n      const outcome = pairing.approve(requestId);\n      if (outcome === 'approved') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    deny(requestId) {\n      const outcome = pairing.deny(requestId);\n      if (outcome === 'denied') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    redeem(requestId) {\n      const approved = pairing.consume(requestId);\n      if (approved === undefined) return undefined;\n      const enrolled = devices.enrol({ userAgent: approved.userAgent, trust: PAIRING_TRUST });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    authorize: (token) => devices.verify(token)?.id,\n    isDeviceAuthorized(deviceId) {\n      devices.sweep();\n      return listener !== undefined && devices.list().some((record) => record.id === deviceId);\n    },\n\n    sessionForPasskey(label) {\n      const enrolled = devices.enrol({ userAgent: label, trust: PASSKEY_TRUST });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    passkeys: () => ({\n      support: () => webauthn.support(),\n      list: () => options.store.credentials(),\n      // Wrapped rather than passed by reference: an unbound method carries\n      // whatever `this` the caller happens to have.\n      beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),\n      finishRegistration: async (ceremonyId, caller, response, label) =>\n        await webauthn.finishRegistration(ceremonyId, caller, response, label),\n      beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),\n      finishAuthentication: async (ceremonyId, caller, response) =>\n        await webauthn.finishAuthentication(ceremonyId, caller, response),\n      beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),\n      finishStepUp: async (ceremonyId, caller, action, response) =>\n        await webauthn.finishStepUp(ceremonyId, caller, action, response),\n      forget: (id) => {\n        const forgotten = options.store.removeCredential(id);\n        if (forgotten) publish();\n        return forgotten;\n      },\n    }),\n\n    registerTrustedDevice(sessionDeviceId, body) {\n      if (publicOrigin === undefined || handshake === undefined) return { ok: false, reason: 'unavailable' };\n      const verdict = verifyRegistration({\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        sessionDeviceId,\n        trust: devices.trustOf(sessionDeviceId),\n        body,\n      });\n      if (!verdict.ok) return { ok: false, reason: verdict.reason === 'not-pairing' ? 'forbidden' : 'invalid' };\n      if (options.store.trustedDevices().length >= TRUSTED_DEVICE_LIMIT) return { ok: false, reason: 'full' };\n      const at = now();\n      const trustedDeviceId = randomBytes(TRUSTED_DEVICE_ID_BYTES).toString('base64url');\n      const saved = options.store.saveTrustedDevice({\n        id: trustedDeviceId,\n        identityPublicKey: verdict.identityPublicKey,\n        stepUpPublicKey: verdict.stepUpPublicKey,\n        label: verdict.label,\n        platform: verdict.platform,\n        createdAt: at,\n        lastSeenAt: at,\n      });\n      if (!saved) return { ok: false, reason: 'full' };\n      // The pairing session becomes a device-key session, so it cannot register a second time and\n      // every gated action from it now needs the biometric key.\n      devices.setTrust(sessionDeviceId, { kind: 'device-key', trustedDeviceId });\n      notice(`trusted ${verdict.label} (${trustedDeviceId})`);\n      publish();\n      return { ok: true, trustedDeviceId };\n    },\n\n    beginDeviceAuth(input) {\n      if (!isOpaqueId(input.trustedDeviceId) || !isDeviceNonce(input.nonce)) return { ok: false, reason: 'invalid' };\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined || options.attestHost === undefined)\n        return { ok: false, reason: 'unavailable' };\n      const attest = options.attestHost;\n      const begun = deviceAuthChallenge({\n        challenges: deviceChallenges,\n        trustedDeviceId: input.trustedDeviceId,\n        nonce: input.nonce,\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        attest: (fields) => attest(fields),\n      });\n      return begun === undefined ? { ok: false, reason: 'unavailable' } : { ok: true, ...begun };\n    },\n\n    finishDeviceAuth(body) {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const verdict = verifyAuthentication({\n        challenges: deviceChallenges,\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        find: (id) => options.store.trustedDevices().find((record) => record.id === id),\n        body,\n      });\n      if (!verdict.ok) return undefined;\n      const enrolled = devices.enrol({\n        userAgent: verdict.record.label,\n        trust: { kind: 'device-key', trustedDeviceId: verdict.record.id },\n      });\n      // All three channels open together or the session goes: a relay holding the cookie must never\n      // be able to add a channel of its own.\n      const opened: [RemoteChannelScope, SealedChannel | undefined][] = [\n        ['session', handshake.accept(verdict.channels.session)],\n        ['protocol', handshake.accept(verdict.channels.protocol)],\n        ['http', handshake.accept(verdict.channels.http)],\n      ];\n      if (opened.some(([, channel]) => channel === undefined)) {\n        devices.revoke(enrolled.record.id);\n        return undefined;\n      }\n      for (const [scope, channel] of opened) {\n        if (channel !== undefined) channels.set(channelKey(enrolled.record.id, scope), channel);\n      }\n      options.store.saveTrustedDevice({ ...verdict.record, lastSeenAt: now() });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    beginDeviceStepUp(sessionDeviceId, action) {\n      if (handshake === undefined || devices.trustOf(sessionDeviceId)?.kind !== 'device-key') return undefined;\n      return deviceStepUpChallenge({\n        challenges: deviceChallenges,\n        sessionDeviceId,\n        action,\n        hostPublicKey: handshake.publicKey,\n      });\n    },\n\n    finishDeviceStepUp(sessionDeviceId, action, ceremonyId, signature) {\n      const trust = devices.trustOf(sessionDeviceId);\n      if (trust?.kind !== 'device-key' || publicOrigin === undefined) return false;\n      const record = options.store.trustedDevices().find((held) => held.id === trust.trustedDeviceId);\n      if (record === undefined) return false;\n      return verifyStepUp({\n        challenges: deviceChallenges,\n        origin: publicOrigin,\n        hostPublicKey: handshake?.publicKey,\n        sessionDeviceId,\n        action,\n        ceremonyId,\n        signature,\n        stepUpPublicKey: record.stepUpPublicKey,\n      });\n    },\n\n    revokeTrustedDevice(id) {\n      const heldBy = (record: { trust: DeviceTrust }): boolean =>\n        record.trust.kind === 'device-key' && record.trust.trustedDeviceId === id;\n      const removed = options.store.removeTrustedDevice(id);\n      const endedIds = new Set(\n        devices\n          .list()\n          .filter(heldBy)\n          .map((record) => record.id),\n      );\n      // The drop path deletes channels and closes sockets with 1008, exactly as a session revoke does.\n      const ended = devices.revokeWhere(heldBy);\n      deviceChallenges.dropWhere(\n        (challenge) =>\n          (challenge.purpose.kind === 'auth' && challenge.purpose.trustedDeviceId === id) ||\n          (challenge.purpose.kind === 'step-up' && endedIds.has(challenge.purpose.sessionDeviceId)),\n      );\n      if (!removed && ended === 0) return false;\n      notice(`revoked trusted device ${id}`);\n      publish();\n      return true;\n    },\n\n    trustKind: (deviceId) => devices.trustOf(deviceId)?.kind,\n\n    // A device-key session always steps up with its biometric key, on every tunnel. Otherwise this is\n    // only meaningful where passkeys are: a quick tunnel has no stable rpID, so there is nothing to\n    // step up with and the session cookie is all there is.\n    stepUpRequired: (_action, deviceId) =>\n      (deviceId !== undefined && devices.trustOf(deviceId)?.kind === 'device-key') || webauthn.support().supported,\n\n    channelPublicKey: () => handshake?.publicKey,\n\n    openChannel(deviceId, scope, clientPublicKey) {\n      const channel = handshake?.accept(clientPublicKey);\n      if (channel === undefined) return false;\n      channels.set(channelKey(deviceId, scope), channel);\n      return true;\n    },\n\n    channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),\n\n    revokeDevice(id) {\n      const revoked = devices.revoke(id);\n      if (revoked) publish();\n      return revoked;\n    },\n\n    isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,\n\n    trackSocket(deviceId, close) {\n      const held = sockets.get(deviceId) ?? new Set();\n      held.add(close);\n      sockets.set(deviceId, held);\n      return () => {\n        held.delete(close);\n        if (held.size === 0) sockets.delete(deviceId);\n      };\n    },\n\n    async close() {\n      clearInterval(sweeper);\n      await teardown();\n      status = 'off';\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AA6CA,MAAM,cAAc;AACpB,MAAM,0BAA0B;AAChC,MAAM,gBAA6B,EAAE,MAAM,UAAU;AACrD,MAAM,gBAA6B,EAAE,MAAM,UAAU;AACrD,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AAoItB,SAAS,mBACP,OACgC;CAChC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EACL,GAAG;EACH,cAAA,GAAaA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK;CAClG;AACF;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,iBAAiB,QAAQ,yBAA+B,CAAC;CAC/D,MAAM,eAAe,QAAQ,uBAA6B,CAAC;CAE3D,IAAI,WAAW,QAAQ,MAAM,SAAS;CACtC,IAAI,SAA6B;CACjC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,uBAAuB;CAC3B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,MAAM,2BAAW,IAAI,IAA2B;CAChD,MAAM,mBAAqCC,gBAAAA,uBAAuB,EAAE,IAAI,CAAC;CACzE,MAAM,0BAAU,IAAI,IAAyD;CAE7E,MAAM,cAAc,UAAkB,UAAsC,GAAG,SAAS,GAAG;CAC3F,MAAM,oBAAoB,UAAkB,WAAwC;EAClF,QAAQ,kBAAkB,QAAQ;EAClC,KAAK,MAAM,SAAS;GAAC;GAAW;GAAY;EAAM,GAAY,SAAS,OAAO,WAAW,UAAU,KAAK,CAAC;EACzG,MAAM,OAAO,QAAQ,IAAI,QAAQ;EACjC,QAAQ,OAAO,QAAQ;EACvB,KAAK,MAAM,SAAS,QAAQ,CAAC,GAC3B,IAAI;GACF,MAAM,MAAM,UAAU,QAAQ;EAChC,QAAQ,CAER;CAEJ;CAEA,MAAM,UAAsBC,gBAAAA,iBAAiB;EAC3C,gBAAgB;EAChB;EACA,UAAU;EACV,SAAS,QAAQ,WAAW,iBAAiB,OAAO,IAAI,MAAM;CAChE,CAAC;CAED,MAAM,WAAqBC,gBAAAA,eAAe;EACxC,oBAAoB;EACpB,mBAAmB,QAAQ,MAAM,YAAY;EAC7C,iBAAiB,eAAe,QAAQ,MAAM,eAAe,UAAU;EACvE,mBAAmB,OAAO,QAAQ,MAAM,iBAAiB,EAAE;EAC3D;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAuBC,gBAAAA,kBAAkB;EAC7C,oBAAA,GAAmBC,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,WAAW;EAChE,yBAAA,GAAwBC,YAAAA,UAAAA,CAAU,GAAW,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACzE,SAAS,WAAA,GAAUN,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAClE;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAU,kBAAkB;EAChC,QAAQ,MAAM;EACd,QAAQ,MAAM;CAChB,GAAG,iBAAiB;CACpB,QAAQ,MAAM;CAEd,SAAS,UAAgB;EACvB,aAAa;GAAE,MAAMO,eAAAA;GAAmB,OAAO,KAAK,KAAA,GAAW,KAAK;EAAE,CAAC;CACzE;CAEA,SAAS,KAAK,cAAkC,gBAAgD;EAC9F,MAAM,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,QAAQ,YAAY;EACvF,MAAM,sBAAsB,WAAW,SAAS,eAAe,UAAU,kBAAkB,KAAA;EAC3F,OAAO;GACL;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,aAAa;GAChE,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY,EAAE;GAClF,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,YAAY,EAAE;GAC/E,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ;GAClD,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,YAAY;IACvC,IAAI,OAAO;IACX,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,OAAO,OAAO;GACtB,EAAE;GAIF,SAAS,iBACL,QAAQ,QAAQ,CAAC,CAAC,KAAK,aAAa;IAClC,IAAI,QAAQ;IACZ,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,WAAW,IAAI,KAAK,QAAQ,SAAS,CAAC,CAAC,YAAY;IACnD,WAAW,IAAI,KAAK,QAAQ,YAAY,IAAO,CAAC,CAAC,YAAY;GAC/D,EAAE,IACF,CAAC;GACL,gBAAgB,QAAQ,MAAM,eAAe,CAAC,CAAC,KAAK,YAAY;IAC9D,IAAI,OAAO;IACX,OAAO,OAAO;IACd,UAAU,OAAO;IACjB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,wBAAwB,KAAA,KAAa,OAAO,OAAO;GAC3D,EAAE;GACF;EACF;CACF;CAEA,SAAS,eAAqB;EAC5B,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EACX,IAAI,CAAC,SAAS,oBAAoB,WAAW,MAAM;EAEnD,WADW,IAAI,IAAI,SAAS,mBAAmB;EAE/C,iBAAiB,iBAAiB;GAChC,OAAO,+CAA+C;GACtD,QAAa;EACf,GAAG,SAAS,mBAAmB,aAAa;EAC5C,eAAe,MAAM;CACvB;;CAGA,eAAe,WAA0B;EACvC,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EAIX,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,KAAK,MAAM,SAAS,MAClB,IAAI;GACF,MAAM,MAAM,uBAAuB;EACrC,QAAQ,CAER;EAGJ,QAAQ,MAAM;EACd,MAAM,WAAW;EACjB,gBAAgB,KAAA;EAChB,UAAU,WAAW,MAAM;EAC3B,MAAM,kBAAkB,MAAM,UAAU,QAAQ,YAAY,KAAA,CAAS;EACrE,IAAI,iBAAiB,OAAO,MAAM,MAAM,gBAAgB,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EACpF,MAAM,aAAa,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C,aAAa,KAAA;EACb,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,WAAW,KAAA;EACX,IAAI,iBAAiB,KAAA,GAAW,wBAAwB;EACxD,eAAe,KAAA;EACf,SAAS,KAAA;EACT,YAAY,KAAA;EACZ,QAAQ,MAAM;EACd,SAAS,gBAAgB;EAEzB,iBAAiB,MAAM;EACvB,YAAY,KAAA;EACZ,SAAS,MAAM;EAGf,QAAQ,UAAU;CACpB;CAEA,eAAe,UAAyB;EACtC,IAAI,WAAW,OAAO;EACtB,MAAM,SAAS;EACf,SAAS;EACT,UAAU,KAAA;EACV,OAAO,mBAAmB;EAC1B,QAAQ;CACV;CAEA,OAAO;EACL,QAAQ,cAAc,iBAAiB,UAAU,KAAK,cAAc,cAAc;EAClF,gBAAgB;EAChB,oBAAoB;EACpB,4BAA4B;EAE5B,eAAe,OAAO;GAGpB,MAAM,SAASC,gBAAAA,0BACbC,gBAAAA,8BAA8B;IAAE,GAAG;IAAU,GAAG;GAAM,CAAC,CACzD;GACA,KAAK,MAAM,WAAW,OAAO,UAAU,OAAO,2BAA2B,SAAS;GAClF,WAAW,OAAO;GAClB,QAAQ,MAAM,KAAK,QAAQ;GAG3B,QAAQ,WAAW;GACnB,aAAa;GACb,QAAQ;GACR,OAAO;EACT;;;;;;;;EASA,iBAAiB;GACf,MAAM,UAAU;GAChB,IAAI,YAAY,KAAA,GAAW;GAC3B,kBAAkB,KAAA;GAClB,OAAO,yCAAyC;GAChD,QAAQ,kBAAkB,OAAO;EACnC;;EAGA,uBAAuB,oBAAoB,KAAA;EAE3C,kBAAkB,UAAU;EAC5B,oBAAoB;EAEpB,MAAM,SAAS;GACb,IAAI,WAAW,QAAQ,WAAW,YAAY,OAAO,EAAE,IAAI,KAAK;GAChE,SAAS;GACT,UAAU,KAAA;GACV,QAAQ;GAKR,IAAI,SAAS,QAAQ,WAAW,QAAQ,cAAc,MAAM;IAC1D,IAAI,SAAS,QAAQ,WAAW,WAAW,GAAG;KAC5C,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IACA,IAAI,QAAQ,oBAAoB,KAAA,GAAW;KACzC,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IAGA,kBAAkB;IAClB,OAAO,EAAE,IAAI,KAAK;GACpB;GACA,IAAI;GACJ,IAAI;IACF,QAAQ,MAAM,QAAQ,aAAa;GACrC,SAAS,OAAO;IACd,SAAS;IACT,UAAU,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IACtG,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO;IAAQ;GACrC;GACA,WAAW;GACX,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,YAAY,QAAQ,aAAa;IACrC,MAAM,MAAM;IACZ,QAAQ,SAAS;IACjB,QAAQ,WAAW;IACnB,eAAe,WAAW;KACxB,SAASC,gBAAAA,mBAAmB,MAAM;IACpC;GACF,CAAC;GACD,MAAM,UAAU;IAAE;IAAY,SAAS;GAAU;GACjD,gBAAgB;GAChB,MAAM,UAAU,MAAM;GACtB,IAAI,kBAAkB,WAAW,WAAW,OAAO,SACjD,OAAO;IAAE,IAAI;IAAO,OAAO;GAAgC;GAE7D,gBAAgB,KAAA;GAChB,IAAI,CAAC,QAAQ,IAAI;IACf,MAAM,SAAS;IACf,SAAS;IACT,UAAU,QAAQ;IAClB,OAAO,yBAAyB,QAAQ,SAAS;IACjD,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO,QAAQ;IAAQ;GAC7C;GACA,aAAa,QAAQ;GAGrB,aAAA,GAAYC,gCAAAA,oBAAAA,CAAoB;GAChC,eAAe,QAAQ;GACvB,SAASD,gBAAAA,mBAAmB,QAAQ,YAAY;GAChD,YAAY,IAAI;GAChB,SAAS;GACT,aAAa;GACb,OAAO,uBAAuB,QAAQ,cAAc;GACpD,QAAQ;GACR,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA;EAEA,cAAc;GACZ,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,QAAQ,mBAAmB,QAAQ,cAAc,CAAC;GACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,EAAE,MAAM,YAAY,cAAc,QAAQ,SAAS;GAGzD,MAAM,WAAW,IAAI,gBAAgB;IACnC,GAAG;KACFE,2BAAAA,mBAAmB,UAAU;KACF,MAAA,MAAM;KACD,MAAA,OAAO,MAAM,QAAQ;GACxD,CAAC;GACD,OAAO;IACL;IACA;IACA,SAAS,GAAG,eAAeC,eAAAA,mBAAmB,GAAG,SAAS,SAAS;IACnE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY;IAC3C,GAAG;GACL;EACF;EAEA,mBAAmB,mBAAmB,QAAQ,cAAc,CAAC;EAE7D,MAAM,OAAO;GACX,MAAM,UAAU,QAAQ,MAAM,KAAK;GACnC,IAAI,QAAQ,IACV,eAAe;IAAE,MAAMC,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAEpF,OAAO;EACT;EAEA,gBAAgB,cAAc,QAAQ,OAAO,SAAS;EAEtD,QAAQ,WAAW;GACjB,MAAM,UAAU,QAAQ,QAAQ,SAAS;GACzC,IAAI,YAAY,YAAY,eAAe;IAAE,MAAMA,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC9G,OAAO;EACT;EAEA,KAAK,WAAW;GACd,MAAM,UAAU,QAAQ,KAAK,SAAS;GACtC,IAAI,YAAY,UAAU,eAAe;IAAE,MAAMA,eAAAA;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC5G,OAAO;EACT;EAEA,OAAO,WAAW;GAChB,MAAM,WAAW,QAAQ,QAAQ,SAAS;GAC1C,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,WAAW,QAAQ,MAAM;IAAE,WAAW,SAAS;IAAW,OAAO;GAAc,CAAC;GACtF,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAeC,cAAAA,oBAAoB,UAAUC,eAAAA,sBAAsB;GAAE;EAC7F;EAEA,YAAY,UAAU,QAAQ,OAAO,KAAK,CAAC,EAAE;EAC7C,mBAAmB,UAAU;GAC3B,QAAQ,MAAM;GACd,OAAO,aAAa,KAAA,KAAa,QAAQ,KAAK,CAAC,CAAC,MAAM,WAAW,OAAO,OAAO,QAAQ;EACzF;EAEA,kBAAkB,OAAO;GACvB,MAAM,WAAW,QAAQ,MAAM;IAAE,WAAW;IAAO,OAAO;GAAc,CAAC;GACzE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAeD,cAAAA,oBAAoB,UAAUC,eAAAA,sBAAsB;GAAE;EAC7F;EAEA,iBAAiB;GACf,eAAe,SAAS,QAAQ;GAChC,YAAY,QAAQ,MAAM,YAAY;GAGtC,mBAAmB,OAAO,QAAQ,UAAU,MAAM,SAAS,kBAAkB,QAAQ,KAAK;GAC1F,oBAAoB,OAAO,YAAY,QAAQ,UAAU,UACvD,MAAM,SAAS,mBAAmB,YAAY,QAAQ,UAAU,KAAK;GACvE,qBAAqB,OAAO,WAAW,MAAM,SAAS,oBAAoB,MAAM;GAChF,sBAAsB,OAAO,YAAY,QAAQ,aAC/C,MAAM,SAAS,qBAAqB,YAAY,QAAQ,QAAQ;GAClE,aAAa,OAAO,QAAQ,WAAW,MAAM,SAAS,YAAY,QAAQ,MAAM;GAChF,cAAc,OAAO,YAAY,QAAQ,QAAQ,aAC/C,MAAM,SAAS,aAAa,YAAY,QAAQ,QAAQ,QAAQ;GAClE,SAAS,OAAO;IACd,MAAM,YAAY,QAAQ,MAAM,iBAAiB,EAAE;IACnD,IAAI,WAAW,QAAQ;IACvB,OAAO;GACT;EACF;EAEA,sBAAsB,iBAAiB,MAAM;GAC3C,IAAI,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAc;GACrG,MAAM,UAAUC,gBAAAA,mBAAmB;IACjC,QAAQ;IACR,eAAe,UAAU;IACzB;IACA,OAAO,QAAQ,QAAQ,eAAe;IACtC;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI,OAAO;IAAE,IAAI;IAAO,QAAQ,QAAQ,WAAW,gBAAgB,cAAc;GAAU;GACxG,IAAI,QAAQ,MAAM,eAAe,CAAC,CAAC,UAAA,IAAgC,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAO;GACtG,MAAM,KAAK,IAAI;GACf,MAAM,mBAAA,GAAkBZ,YAAAA,YAAAA,CAAY,uBAAuB,CAAC,CAAC,SAAS,WAAW;GAUjF,IAAI,CATU,QAAQ,MAAM,kBAAkB;IAC5C,IAAI;IACJ,mBAAmB,QAAQ;IAC3B,iBAAiB,QAAQ;IACzB,OAAO,QAAQ;IACf,UAAU,QAAQ;IAClB,WAAW;IACX,YAAY;GACd,CACS,GAAG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAO;GAG/C,QAAQ,SAAS,iBAAiB;IAAE,MAAM;IAAc;GAAgB,CAAC;GACzE,OAAO,WAAW,QAAQ,MAAM,IAAI,gBAAgB,EAAE;GACtD,QAAQ;GACR,OAAO;IAAE,IAAI;IAAM;GAAgB;EACrC;EAEA,gBAAgB,OAAO;GACrB,IAAI,CAACa,gBAAAA,WAAW,MAAM,eAAe,KAAK,CAACC,gBAAAA,cAAc,MAAM,KAAK,GAAG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAC7G,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,KAAa,QAAQ,eAAe,KAAA,GACrG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAc;GAC5C,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQC,gBAAAA,oBAAoB;IAChC,YAAY;IACZ,iBAAiB,MAAM;IACvB,OAAO,MAAM;IACb,QAAQ;IACR,eAAe,UAAU;IACzB,SAAS,WAAW,OAAO,MAAM;GACnC,CAAC;GACD,OAAO,UAAU,KAAA,IAAY;IAAE,IAAI;IAAO,QAAQ;GAAc,IAAI;IAAE,IAAI;IAAM,GAAG;GAAM;EAC3F;EAEA,iBAAiB,MAAM;GACrB,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,UAAUC,gBAAAA,qBAAqB;IACnC,YAAY;IACZ,QAAQ;IACR,eAAe,UAAU;IACzB,OAAO,OAAO,QAAQ,MAAM,eAAe,CAAC,CAAC,MAAM,WAAW,OAAO,OAAO,EAAE;IAC9E;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAA;GACxB,MAAM,WAAW,QAAQ,MAAM;IAC7B,WAAW,QAAQ,OAAO;IAC1B,OAAO;KAAE,MAAM;KAAc,iBAAiB,QAAQ,OAAO;IAAG;GAClE,CAAC;GAGD,MAAM,SAA4D;IAChE,CAAC,WAAW,UAAU,OAAO,QAAQ,SAAS,OAAO,CAAC;IACtD,CAAC,YAAY,UAAU,OAAO,QAAQ,SAAS,QAAQ,CAAC;IACxD,CAAC,QAAQ,UAAU,OAAO,QAAQ,SAAS,IAAI,CAAC;GAClD;GACA,IAAI,OAAO,MAAM,GAAG,aAAa,YAAY,KAAA,CAAS,GAAG;IACvD,QAAQ,OAAO,SAAS,OAAO,EAAE;IACjC;GACF;GACA,KAAK,MAAM,CAAC,OAAO,YAAY,QAC7B,IAAI,YAAY,KAAA,GAAW,SAAS,IAAI,WAAW,SAAS,OAAO,IAAI,KAAK,GAAG,OAAO;GAExF,QAAQ,MAAM,kBAAkB;IAAE,GAAG,QAAQ;IAAQ,YAAY,IAAI;GAAE,CAAC;GACxE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAeN,cAAAA,oBAAoB,UAAUC,eAAAA,sBAAsB;GAAE;EAC7F;EAEA,kBAAkB,iBAAiB,QAAQ;GACzC,IAAI,cAAc,KAAA,KAAa,QAAQ,QAAQ,eAAe,CAAC,EAAE,SAAS,cAAc,OAAO,KAAA;GAC/F,OAAOM,gBAAAA,sBAAsB;IAC3B,YAAY;IACZ;IACA;IACA,eAAe,UAAU;GAC3B,CAAC;EACH;EAEA,mBAAmB,iBAAiB,QAAQ,YAAY,WAAW;GACjE,MAAM,QAAQ,QAAQ,QAAQ,eAAe;GAC7C,IAAI,OAAO,SAAS,gBAAgB,iBAAiB,KAAA,GAAW,OAAO;GACvE,MAAM,SAAS,QAAQ,MAAM,eAAe,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,MAAM,eAAe;GAC9F,IAAI,WAAW,KAAA,GAAW,OAAO;GACjC,OAAOC,gBAAAA,aAAa;IAClB,YAAY;IACZ,QAAQ;IACR,eAAe,WAAW;IAC1B;IACA;IACA;IACA;IACA,iBAAiB,OAAO;GAC1B,CAAC;EACH;EAEA,oBAAoB,IAAI;GACtB,MAAM,UAAU,WACd,OAAO,MAAM,SAAS,gBAAgB,OAAO,MAAM,oBAAoB;GACzE,MAAM,UAAU,QAAQ,MAAM,oBAAoB,EAAE;GACpD,MAAM,WAAW,IAAI,IACnB,QACG,KAAK,CAAC,CACN,OAAO,MAAM,CAAC,CACd,KAAK,WAAW,OAAO,EAAE,CAC9B;GAEA,MAAM,QAAQ,QAAQ,YAAY,MAAM;GACxC,iBAAiB,WACd,cACE,UAAU,QAAQ,SAAS,UAAU,UAAU,QAAQ,oBAAoB,MAC3E,UAAU,QAAQ,SAAS,aAAa,SAAS,IAAI,UAAU,QAAQ,eAAe,CAC3F;GACA,IAAI,CAAC,WAAW,UAAU,GAAG,OAAO;GACpC,OAAO,0BAA0B,IAAI;GACrC,QAAQ;GACR,OAAO;EACT;EAEA,YAAY,aAAa,QAAQ,QAAQ,QAAQ,CAAC,EAAE;EAKpD,iBAAiB,SAAS,aACvB,aAAa,KAAA,KAAa,QAAQ,QAAQ,QAAQ,CAAC,EAAE,SAAS,gBAAiB,SAAS,QAAQ,CAAC,CAAC;EAErG,wBAAwB,WAAW;EAEnC,YAAY,UAAU,OAAO,iBAAiB;GAC5C,MAAM,UAAU,WAAW,OAAO,eAAe;GACjD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,SAAS,IAAI,WAAW,UAAU,KAAK,GAAG,OAAO;GACjD,OAAO;EACT;EAEA,aAAa,UAAU,UAAU,SAAS,IAAI,WAAW,UAAU,KAAK,CAAC;EAEzE,aAAa,IAAI;GACf,MAAM,UAAU,QAAQ,OAAO,EAAE;GACjC,IAAI,SAAS,QAAQ;GACrB,OAAO;EACT;EAEA,oBAAoB,cAAc,QAAQ,IAAI,QAAQ,CAAC,EAAE,QAAQ,KAAK;EAEtE,YAAY,UAAU,OAAO;GAC3B,MAAM,OAAO,QAAQ,IAAI,QAAQ,qBAAK,IAAI,IAAI;GAC9C,KAAK,IAAI,KAAK;GACd,QAAQ,IAAI,UAAU,IAAI;GAC1B,aAAa;IACX,KAAK,OAAO,KAAK;IACjB,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,QAAQ;GAC9C;EACF;EAEA,MAAM,QAAQ;GACZ,cAAc,OAAO;GACrB,MAAM,SAAS;GACf,SAAS;EACX;CACF;AACF"}