@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/services/remoteAccess/index.d.mts

@@ -0,0 +1,121 @@
+import { BundlePairingTrust, DeviceTrustKind, PairingStatus, RemoteAccessSettings, RemoteAccessStateView, RemoteChannelScope } from "../../types/remote.mjs";
+import { EnrolledDevice } from "../deviceAuth/index.mjs";
+import { PairingFlow } from "../pairingFlow/index.mjs";
+import { StepUpAction, StoredCredential } from "../webauthnPolicy/index.mjs";
+import { OriginPolicy } from "../remoteGuardPolicy/index.mjs";
+import { PasskeySupport, WebAuthn } from "../webauthn/index.mjs";
+import { SealedChannel } from "@agimon-ai/po-web-security/node";
+//#region src/services/remoteAccess/index.d.ts
+export interface RemoteAccess {
+  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;
+  settings(): RemoteAccessSettings;
+  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;
+  tunnelPort(): number | undefined;
+  /** The public origin the tunnel currently answers on, while one is up. */
+  publicOrigin(): string | undefined;
+  /** Changes whenever an established public exposure is torn down. */
+  publicOriginRevision(): number;
+  tunnelPolicy(): OriginPolicy | undefined;
+  enable(): Promise<{
+    ok: true;
+  } | {
+    ok: false;
+    error: string;
+  }>;
+  /** True between a contained `enable` and the handover its response defers. */
+  handoverPending(): boolean;
+  /** Runs that deferred handover, once the response asking for it is on the wire. */
+  commitHandover(): void;
+  disable(): Promise<void>;
+  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */
+  mintPairing(): ({
+    code: string;
+    manualCode: string;
+    pairUrl: string;
+    expiresAt: string;
+  } & BundlePairingTrust) | undefined;
+  bundleTrust(): BundlePairingTrust | undefined;
+  claim(input: {
+    code: string;
+    userAgent: string | undefined;
+    edgeIp: string | undefined;
+    sourceAddress: string | undefined;
+  }): ReturnType<PairingFlow['claim']>;
+  pairingStatus(requestId: string): PairingStatus | undefined;
+  approve(requestId: string): ReturnType<PairingFlow['approve']>;
+  deny(requestId: string): ReturnType<PairingFlow['deny']>;
+  /** Turns an approved request into a session, exactly once. */
+  redeem(requestId: string): (EnrolledDevice & {
+    maxAgeSeconds: number;
+  }) | undefined;
+  authorize(token: string | undefined): string | undefined;
+  /** Liveness check for a server-authenticated device identity, without extending expiry. */
+  isDeviceAuthorized(deviceId: string): boolean;
+  /** Mints a session for a device that proved a registered passkey. */
+  sessionForPasskey(label: string): EnrolledDevice & {
+    maxAgeSeconds: number;
+  };
+  passkeys(): {
+    support: () => PasskeySupport;
+    list: () => readonly StoredCredential[];
+    beginRegistration: WebAuthn['beginRegistration'];
+    finishRegistration: WebAuthn['finishRegistration'];
+    beginAuthentication: WebAuthn['beginAuthentication'];
+    finishAuthentication: WebAuthn['finishAuthentication'];
+    beginStepUp: WebAuthn['beginStepUp'];
+    finishStepUp: WebAuthn['finishStepUp'];
+    forget: (id: string) => boolean;
+  };
+  /** Registers a native device from a sealed, QR-approved pairing session, exactly once. */
+  registerTrustedDevice(sessionDeviceId: string, body: unknown): {
+    ok: true;
+    trustedDeviceId: string;
+  } | {
+    ok: false;
+    reason: 'forbidden' | 'invalid' | 'full' | 'unavailable';
+  };
+  /** Public reconnect challenge with the same shape for known and unknown ids. */
+  beginDeviceAuth(input: {
+    trustedDeviceId: unknown;
+    nonce: unknown;
+  }): {
+    ok: true;
+    challengeId: string;
+    challenge: string;
+    hostPublicKey: string;
+    attestation: string;
+  } | {
+    ok: false;
+    reason: 'invalid' | 'unavailable';
+  };
+  /** Verifies a device sign-in, opens all three channels at once, and mints a session. */
+  finishDeviceAuth(body: unknown): (EnrolledDevice & {
+    maxAgeSeconds: number;
+  }) | undefined;
+  beginDeviceStepUp(sessionDeviceId: string, action: StepUpAction): {
+    ceremonyId: string;
+    challenge: string;
+    kind: 'device-key';
+  } | undefined;
+  finishDeviceStepUp(sessionDeviceId: string, action: StepUpAction, ceremonyId: unknown, signature: unknown): boolean;
+  /** Removes the stored device and ends every live session, channel, and socket it holds. */
+  revokeTrustedDevice(id: string): boolean;
+  trustKind(deviceId: string): DeviceTrustKind | undefined;
+  /**
+   * Whether this action needs a fresh gesture that has not been supplied. Always true for a device-key
+   * session; otherwise only where passkeys are supported.
+   */
+  stepUpRequired(action: StepUpAction, deviceId?: string): boolean;
+  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */
+  channelPublicKey(): string | undefined;
+  /** Completes one purpose-bound sealed channel against a fresh device key. */
+  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;
+  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;
+  revokeDevice(id: string): boolean;
+  isDeviceConnected(deviceId: string): boolean;
+  /** Registers a remote socket against its device so revocation closes it immediately. */
+  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;
+  close(): Promise<void>;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/remoteAccess/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/remoteAccess/index.ts"],"mappings":";;;;;;;;iBA+FiB;EACf,MAAM,uBAAuB,2BAA2B;EACxD,YAAY;EACZ,eAAe,OAAO,QAAQ,wBAAwB;EACtD;;EAEA;;EAEA;EACA,gBAAgB;EAChB,UAAU;IAAU;;IAAe;IAAW;;;EAE9C;;EAEA;EACA,WAAW;;EAEX;IACO;IAAc;IAAoB;IAAiB;MAAsB;EAEhF,eAAe;EACf,MAAM;IACJ;IACA;IACA;IACA;MACE,WAAW;EACf,cAAc,oBAAoB;EAClC,QAAQ,oBAAoB,WAAW;EACvC,KAAK,oBAAoB,WAAW;;EAEpC,OAAO,qBAAqB;IAAmB;;EAC/C,UAAU;;EAEV,mBAAmB;;EAEnB,kBAAkB,gBAAgB;IAAmB;;EACrD;IACE,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,SAAS;;;EAGX,sBACE,yBACA;IACG;IAAU;;IAA8B;IAAW;;;EAExD,gBAAgB;IACd;IACA;;IAEI;IAAU;IAAqB;IAAmB;IAAuB;;IACzE;IAAW;;;EAEjB,iBAAiB,iBAAiB;IAAmB;;EACrD,kBACE,yBACA,QAAQ;IACL;IAAoB;IAAmB;;EAC5C,mBAAmB,yBAAyB,QAAQ,cAAc,qBAAqB;;EAEvF,oBAAoB;EACpB,UAAU,mBAAmB;;;;;EAK7B,eAAe,QAAQ,cAAc;;EAErC;;EAEA,YAAY,kBAAkB,OAAO,oBAAoB;EACzD,WAAW,kBAAkB,OAAO,qBAAqB;EACzD,aAAa;EACb,kBAAkB;;EAElB,YAAY,kBAAkB,QAAQ,cAAc;EACpD,SAAS"}

package/dist/src/services/remoteAccess/index.mjs

@@ -0,0 +1,567 @@
+import { COOKIE_CEILING_SECONDS, PAIRING_PAGE_ROUTE, REMOTE_PAIRING_REQUEST_TYPE, REMOTE_STATE_TYPE } from "../../constants/remote.mjs";
+import { cookieMaxAgeSeconds } from "../deviceSessions/index.mjs";
+import { createDeviceAuth } from "../deviceAuth/index.mjs";
+import { createDeviceChallenges, deviceAuthChallenge, deviceStepUpChallenge, isDeviceNonce, isOpaqueId, verifyAuthentication, verifyRegistration, verifyStepUp } from "../deviceTrust/index.mjs";
+import { createPairingFlow } from "../pairingFlow/index.mjs";
+import { parseRemoteAccessSettings, serializeRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
+import { tunnelOriginPolicy } from "../remoteGuardPolicy/index.mjs";
+import { createWebAuthn } from "../webauthn/index.mjs";
+import { createHash, randomBytes, randomInt } from "node:crypto";
+import { SEALED_KEY_PARAM } from "@agimon-ai/po-web-security";
+import { createHostHandshake } from "@agimon-ai/po-web-security/node";
+//#region src/services/remoteAccess/index.ts
+const TOKEN_BYTES = 32;
+const TRUSTED_DEVICE_ID_BYTES = 16;
+const PAIRING_TRUST = { kind: "pairing" };
+const PASSKEY_TRUST = { kind: "passkey" };
+const SWEEP_INTERVAL_MS = 3e5;
+const MS_PER_MINUTE = 6e4;
+function bundlePairingTrust(value) {
+	if (value === void 0) return void 0;
+	return {
+		...value,
+		fingerprint: createHash("sha256").update(Buffer.from(value.publicKey, "base64url")).digest("hex")
+	};
+}
+function createRemoteAccess(options) {
+	const notice = options.onNotice ?? (() => {});
+	const now = options.now ?? (() => Date.now());
+	const broadcastLocal = options.broadcastLocal ?? (() => {});
+	const broadcastAll = options.broadcastAll ?? (() => {});
+	let settings = options.store.settings();
+	let status = "off";
+	let listener;
+	let stopTunnel;
+	let tunnelStartup;
+	let publicOrigin;
+	let publicOriginRevision = 0;
+	let policy;
+	let startedAt;
+	let closesAt;
+	let failure;
+	/** Settings an `enable` asked to hand over with, waiting for its response to flush. */
+	let pendingHandover;
+	let autoCloseTimer;
+	/** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */
+	let handshake;
+	const channels = /* @__PURE__ */ new Map();
+	const deviceChallenges = createDeviceChallenges({ now });
+	const sockets = /* @__PURE__ */ new Map();
+	const channelKey = (deviceId, scope) => `${deviceId}:${scope}`;
+	const dropDeviceAccess = (deviceId, reason) => {
+		options.onDeviceDropped?.(deviceId);
+		for (const scope of [
+			"session",
+			"protocol",
+			"http"
+		]) channels.delete(channelKey(deviceId, scope));
+		const held = sockets.get(deviceId);
+		sockets.delete(deviceId);
+		for (const close of held ?? []) try {
+			close(1008, `device ${reason}`);
+		} catch {}
+	};
+	const devices = createDeviceAuth({
+		settings: () => settings,
+		now,
+		onNotice: notice,
+		onDrop: (record, reason) => dropDeviceAccess(record.id, reason)
+	});
+	const webauthn = createWebAuthn({
+		publicOrigin: () => publicOrigin,
+		credentials: () => options.store.credentials(),
+		saveCredential: (credential) => options.store.saveCredential(credential),
+		removeCredential: (id) => options.store.removeCredential(id),
+		now,
+		onNotice: notice
+	});
+	const pairing = createPairingFlow({
+		randomToken: () => randomBytes(TOKEN_BYTES).toString("base64url"),
+		randomManualCode: () => randomInt(1e8).toString().padStart(8, "0"),
+		digest: (token) => createHash("sha256").update(token).digest("hex"),
+		now,
+		onNotice: notice
+	});
+	const sweeper = setInterval(() => {
+		devices.sweep();
+		pairing.sweep();
+	}, SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	function publish() {
+		broadcastAll({
+			type: REMOTE_STATE_TYPE,
+			state: view(void 0, false)
+		});
+	}
+	function view(selfDeviceId, forLocalCaller) {
+		const selfTrust = selfDeviceId === void 0 ? void 0 : devices.trustOf(selfDeviceId);
+		const selfTrustedDeviceId = selfTrust?.kind === "device-key" ? selfTrust.trustedDeviceId : void 0;
+		return {
+			status,
+			...publicOrigin === void 0 ? {} : { publicUrl: publicOrigin },
+			...startedAt === void 0 ? {} : { startedAt: new Date(startedAt).toISOString() },
+			...closesAt === void 0 ? {} : { closesAt: new Date(closesAt).toISOString() },
+			...failure === void 0 ? {} : { error: failure },
+			devices: devices.list().map((record) => ({
+				id: record.id,
+				label: record.label,
+				userAgent: record.userAgent,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: record.id === selfDeviceId
+			})),
+			pending: forLocalCaller ? pairing.pending().map((request) => ({
+				id: request.id,
+				userAgent: request.userAgent,
+				edgeIp: request.edgeIp,
+				createdAt: new Date(request.createdAt).toISOString(),
+				expiresAt: new Date(request.createdAt + 18e4).toISOString()
+			})) : [],
+			trustedDevices: options.store.trustedDevices().map((record) => ({
+				id: record.id,
+				label: record.label,
+				platform: record.platform,
+				createdAt: new Date(record.createdAt).toISOString(),
+				lastSeenAt: new Date(record.lastSeenAt).toISOString(),
+				self: selfTrustedDeviceId !== void 0 && record.id === selfTrustedDeviceId
+			})),
+			settings
+		};
+	}
+	function armAutoClose() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		if (!settings.autoCloseEnabled || status !== "on") return;
+		closesAt = now() + settings.autoCloseMinutes * MS_PER_MINUTE;
+		autoCloseTimer = setTimeout(() => {
+			notice("remote access reached its time limit; closing");
+			disable();
+		}, settings.autoCloseMinutes * MS_PER_MINUTE);
+		autoCloseTimer.unref();
+	}
+	/** Everything teardown has to do, in the order it has to happen. */
+	async function teardown() {
+		clearTimeout(autoCloseTimer);
+		autoCloseTimer = void 0;
+		closesAt = void 0;
+		for (const held of sockets.values()) for (const close of held) try {
+			close(1008, "remote access revoked");
+		} catch {}
+		sockets.clear();
+		const starting = tunnelStartup;
+		tunnelStartup = void 0;
+		starting?.controller.abort();
+		const startingOutcome = await starting?.outcome.catch(() => void 0);
+		if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => void 0);
+		await stopTunnel?.().catch(() => void 0);
+		stopTunnel = void 0;
+		await listener?.close().catch(() => void 0);
+		listener = void 0;
+		if (publicOrigin !== void 0) publicOriginRevision += 1;
+		publicOrigin = void 0;
+		policy = void 0;
+		startedAt = void 0;
+		pairing.clear();
+		webauthn.clearChallenges();
+		deviceChallenges.clear();
+		handshake = void 0;
+		channels.clear();
+		devices.revokeAll();
+	}
+	async function disable() {
+		if (status === "off") return;
+		await teardown();
+		status = "off";
+		failure = void 0;
+		notice("remote access off");
+		publish();
+	}
+	return {
+		state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),
+		settings: () => settings,
+		publicOrigin: () => publicOrigin,
+		publicOriginRevision: () => publicOriginRevision,
+		updateSettings(patch) {
+			const parsed = parseRemoteAccessSettings(serializeRemoteAccessSettings({
+				...settings,
+				...patch
+			}));
+			for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);
+			settings = parsed.settings;
+			options.store.save(settings);
+			devices.reschedule();
+			armAutoClose();
+			publish();
+			return settings;
+		},
+		/**
+		* Runs a handover `enable` deferred, once its response is on the wire.
+		*
+		* Split out rather than done inside `enable` because the reply and the
+		* teardown travel over the same socket, and doing them in the wrong order
+		* leaves the caller unable to tell success from a dropped connection.
+		*/
+		commitHandover() {
+			const handing = pendingHandover;
+			if (handing === void 0) return;
+			pendingHandover = void 0;
+			notice("handing the cockpit over to a container");
+			options.requestHandover?.(handing);
+		},
+		/** True between a contained `enable` and the handover its response defers. */
+		handoverPending: () => pendingHandover !== void 0,
+		tunnelPort: () => listener?.port,
+		tunnelPolicy: () => policy,
+		async enable() {
+			if (status === "on" || status === "starting") return { ok: true };
+			status = "starting";
+			failure = void 0;
+			publish();
+			if (settings.sandbox.enabled && options.contained !== true) {
+				if (settings.sandbox.workspaces.length === 0) {
+					status = "failed";
+					failure = "Add at least one workspace before running the cockpit in a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				if (options.requestHandover === void 0) {
+					status = "failed";
+					failure = "This cockpit cannot hand over to a container.";
+					publish();
+					return {
+						ok: false,
+						error: failure
+					};
+				}
+				pendingHandover = settings;
+				return { ok: true };
+			}
+			let bound;
+			try {
+				bound = await options.bindListener();
+			} catch (error) {
+				status = "failed";
+				failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;
+				publish();
+				return {
+					ok: false,
+					error: failure
+				};
+			}
+			listener = bound;
+			const controller = new AbortController();
+			const launching = options.launchTunnel({
+				port: bound.port,
+				config: settings.tunnel,
+				signal: controller.signal,
+				acceptOrigin: (origin) => {
+					policy = tunnelOriginPolicy(origin);
+				}
+			});
+			const startup = {
+				controller,
+				outcome: launching
+			};
+			tunnelStartup = startup;
+			const outcome = await launching;
+			if (tunnelStartup !== startup || controller.signal.aborted) return {
+				ok: false,
+				error: "Tunnel startup was cancelled."
+			};
+			tunnelStartup = void 0;
+			if (!outcome.ok) {
+				await teardown();
+				status = "failed";
+				failure = outcome.message;
+				notice(`remote access failed: ${outcome.message}`);
+				publish();
+				return {
+					ok: false,
+					error: outcome.message
+				};
+			}
+			stopTunnel = outcome.stop;
+			handshake = createHostHandshake();
+			publicOrigin = outcome.publicOrigin;
+			policy = tunnelOriginPolicy(outcome.publicOrigin);
+			startedAt = now();
+			status = "on";
+			armAutoClose();
+			notice(`remote access on at ${outcome.publicOrigin}`);
+			publish();
+			return { ok: true };
+		},
+		disable,
+		mintPairing() {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const trust = bundlePairingTrust(options.bundleTrust?.());
+			if (trust === void 0) return void 0;
+			const { code, manualCode, expiresAt } = pairing.mintCode();
+			const fragment = new URLSearchParams({
+				c: code,
+				[SEALED_KEY_PARAM]: handshake.publicKey,
+				["s"]: trust.publicKey,
+				["r"]: String(trust.revision)
+			});
+			return {
+				code,
+				manualCode,
+				pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,
+				expiresAt: new Date(expiresAt).toISOString(),
+				...trust
+			};
+		},
+		bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),
+		claim(input) {
+			const outcome = pairing.claim(input);
+			if (outcome.ok) broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		pairingStatus: (requestId) => pairing.status(requestId),
+		approve(requestId) {
+			const outcome = pairing.approve(requestId);
+			if (outcome === "approved") broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		deny(requestId) {
+			const outcome = pairing.deny(requestId);
+			if (outcome === "denied") broadcastLocal({
+				type: REMOTE_PAIRING_REQUEST_TYPE,
+				state: view(void 0, true)
+			});
+			return outcome;
+		},
+		redeem(requestId) {
+			const approved = pairing.consume(requestId);
+			if (approved === void 0) return void 0;
+			const enrolled = devices.enrol({
+				userAgent: approved.userAgent,
+				trust: PAIRING_TRUST
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS)
+			};
+		},
+		authorize: (token) => devices.verify(token)?.id,
+		isDeviceAuthorized(deviceId) {
+			devices.sweep();
+			return listener !== void 0 && devices.list().some((record) => record.id === deviceId);
+		},
+		sessionForPasskey(label) {
+			const enrolled = devices.enrol({
+				userAgent: label,
+				trust: PASSKEY_TRUST
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS)
+			};
+		},
+		passkeys: () => ({
+			support: () => webauthn.support(),
+			list: () => options.store.credentials(),
+			beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),
+			finishRegistration: async (ceremonyId, caller, response, label) => await webauthn.finishRegistration(ceremonyId, caller, response, label),
+			beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),
+			finishAuthentication: async (ceremonyId, caller, response) => await webauthn.finishAuthentication(ceremonyId, caller, response),
+			beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),
+			finishStepUp: async (ceremonyId, caller, action, response) => await webauthn.finishStepUp(ceremonyId, caller, action, response),
+			forget: (id) => {
+				const forgotten = options.store.removeCredential(id);
+				if (forgotten) publish();
+				return forgotten;
+			}
+		}),
+		registerTrustedDevice(sessionDeviceId, body) {
+			if (publicOrigin === void 0 || handshake === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			const verdict = verifyRegistration({
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				sessionDeviceId,
+				trust: devices.trustOf(sessionDeviceId),
+				body
+			});
+			if (!verdict.ok) return {
+				ok: false,
+				reason: verdict.reason === "not-pairing" ? "forbidden" : "invalid"
+			};
+			if (options.store.trustedDevices().length >= 32) return {
+				ok: false,
+				reason: "full"
+			};
+			const at = now();
+			const trustedDeviceId = randomBytes(TRUSTED_DEVICE_ID_BYTES).toString("base64url");
+			if (!options.store.saveTrustedDevice({
+				id: trustedDeviceId,
+				identityPublicKey: verdict.identityPublicKey,
+				stepUpPublicKey: verdict.stepUpPublicKey,
+				label: verdict.label,
+				platform: verdict.platform,
+				createdAt: at,
+				lastSeenAt: at
+			})) return {
+				ok: false,
+				reason: "full"
+			};
+			devices.setTrust(sessionDeviceId, {
+				kind: "device-key",
+				trustedDeviceId
+			});
+			notice(`trusted ${verdict.label} (${trustedDeviceId})`);
+			publish();
+			return {
+				ok: true,
+				trustedDeviceId
+			};
+		},
+		beginDeviceAuth(input) {
+			if (!isOpaqueId(input.trustedDeviceId) || !isDeviceNonce(input.nonce)) return {
+				ok: false,
+				reason: "invalid"
+			};
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0 || options.attestHost === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			const attest = options.attestHost;
+			const begun = deviceAuthChallenge({
+				challenges: deviceChallenges,
+				trustedDeviceId: input.trustedDeviceId,
+				nonce: input.nonce,
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				attest: (fields) => attest(fields)
+			});
+			return begun === void 0 ? {
+				ok: false,
+				reason: "unavailable"
+			} : {
+				ok: true,
+				...begun
+			};
+		},
+		finishDeviceAuth(body) {
+			if (status !== "on" || publicOrigin === void 0 || handshake === void 0) return void 0;
+			const verdict = verifyAuthentication({
+				challenges: deviceChallenges,
+				origin: publicOrigin,
+				hostPublicKey: handshake.publicKey,
+				find: (id) => options.store.trustedDevices().find((record) => record.id === id),
+				body
+			});
+			if (!verdict.ok) return void 0;
+			const enrolled = devices.enrol({
+				userAgent: verdict.record.label,
+				trust: {
+					kind: "device-key",
+					trustedDeviceId: verdict.record.id
+				}
+			});
+			const opened = [
+				["session", handshake.accept(verdict.channels.session)],
+				["protocol", handshake.accept(verdict.channels.protocol)],
+				["http", handshake.accept(verdict.channels.http)]
+			];
+			if (opened.some(([, channel]) => channel === void 0)) {
+				devices.revoke(enrolled.record.id);
+				return;
+			}
+			for (const [scope, channel] of opened) if (channel !== void 0) channels.set(channelKey(enrolled.record.id, scope), channel);
+			options.store.saveTrustedDevice({
+				...verdict.record,
+				lastSeenAt: now()
+			});
+			publish();
+			return {
+				...enrolled,
+				maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS)
+			};
+		},
+		beginDeviceStepUp(sessionDeviceId, action) {
+			if (handshake === void 0 || devices.trustOf(sessionDeviceId)?.kind !== "device-key") return void 0;
+			return deviceStepUpChallenge({
+				challenges: deviceChallenges,
+				sessionDeviceId,
+				action,
+				hostPublicKey: handshake.publicKey
+			});
+		},
+		finishDeviceStepUp(sessionDeviceId, action, ceremonyId, signature) {
+			const trust = devices.trustOf(sessionDeviceId);
+			if (trust?.kind !== "device-key" || publicOrigin === void 0) return false;
+			const record = options.store.trustedDevices().find((held) => held.id === trust.trustedDeviceId);
+			if (record === void 0) return false;
+			return verifyStepUp({
+				challenges: deviceChallenges,
+				origin: publicOrigin,
+				hostPublicKey: handshake?.publicKey,
+				sessionDeviceId,
+				action,
+				ceremonyId,
+				signature,
+				stepUpPublicKey: record.stepUpPublicKey
+			});
+		},
+		revokeTrustedDevice(id) {
+			const heldBy = (record) => record.trust.kind === "device-key" && record.trust.trustedDeviceId === id;
+			const removed = options.store.removeTrustedDevice(id);
+			const endedIds = new Set(devices.list().filter(heldBy).map((record) => record.id));
+			const ended = devices.revokeWhere(heldBy);
+			deviceChallenges.dropWhere((challenge) => challenge.purpose.kind === "auth" && challenge.purpose.trustedDeviceId === id || challenge.purpose.kind === "step-up" && endedIds.has(challenge.purpose.sessionDeviceId));
+			if (!removed && ended === 0) return false;
+			notice(`revoked trusted device ${id}`);
+			publish();
+			return true;
+		},
+		trustKind: (deviceId) => devices.trustOf(deviceId)?.kind,
+		stepUpRequired: (_action, deviceId) => deviceId !== void 0 && devices.trustOf(deviceId)?.kind === "device-key" || webauthn.support().supported,
+		channelPublicKey: () => handshake?.publicKey,
+		openChannel(deviceId, scope, clientPublicKey) {
+			const channel = handshake?.accept(clientPublicKey);
+			if (channel === void 0) return false;
+			channels.set(channelKey(deviceId, scope), channel);
+			return true;
+		},
+		channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),
+		revokeDevice(id) {
+			const revoked = devices.revoke(id);
+			if (revoked) publish();
+			return revoked;
+		},
+		isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,
+		trackSocket(deviceId, close) {
+			const held = sockets.get(deviceId) ?? /* @__PURE__ */ new Set();
+			held.add(close);
+			sockets.set(deviceId, held);
+			return () => {
+				held.delete(close);
+				if (held.size === 0) sockets.delete(deviceId);
+			};
+		},
+		async close() {
+			clearInterval(sweeper);
+			await teardown();
+			status = "off";
+		}
+	};
+}
+//#endregion
+export { createRemoteAccess };
+
+//# sourceMappingURL=index.mjs.map