@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/services/remoteAccess/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/remoteAccess/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomInt } from 'node:crypto';\n\nimport { SEALED_KEY_PARAM } from '@agimon-ai/po-web-security';\nimport { createHostHandshake, type HostHandshake, type SealedChannel } from '@agimon-ai/po-web-security/node';\n\nimport {\n  BUNDLE_MINIMUM_REVISION_PARAM,\n  BUNDLE_SIGNING_KEY_PARAM,\n  PAIRING_PAGE_ROUTE,\n  REMOTE_PAIRING_REQUEST_TYPE,\n  REMOTE_STATE_TYPE,\n} from '../../constants/remote';\nimport { COOKIE_CEILING_SECONDS, TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport {\n  type BundlePairingTrust,\n  type DeviceTrust,\n  type DeviceTrustKind,\n  type PairingStatus,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n  type RemoteAccessStatus,\n  type RemoteChannelScope,\n  type TunnelLauncher,\n  type TunnelStartResult,\n} from '../../types/remote';\nimport { createDeviceAuth, type DeviceAuth, type EnrolledDevice } from '../deviceAuth';\nimport { cookieMaxAgeSeconds } from '../deviceSessions';\nimport {\n  createDeviceChallenges,\n  deviceAuthChallenge,\n  deviceStepUpChallenge,\n  type DeviceChallenges,\n  isDeviceNonce,\n  isOpaqueId,\n  verifyAuthentication,\n  verifyRegistration,\n  verifyStepUp,\n} from '../deviceTrust';\nimport { createPairingFlow, type PairingFlow } from '../pairingFlow';\nimport { parseRemoteAccessSettings, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { RemoteAccessStore } from '../remoteAccessStore';\nimport { type OriginPolicy, tunnelOriginPolicy } from '../remoteGuardPolicy';\nimport { createWebAuthn, type PasskeySupport, type WebAuthn } from '../webauthn';\nimport type { StepUpAction, StoredCredential } from '../webauthnPolicy';\n\nconst TOKEN_BYTES = 32;\nconst TRUSTED_DEVICE_ID_BYTES = 16;\nconst PAIRING_TRUST: DeviceTrust = { kind: 'pairing' };\nconst PASSKEY_TRUST: DeviceTrust = { kind: 'passkey' };\nconst SWEEP_INTERVAL_MS = 5 * 60_000;\nconst MS_PER_MINUTE = 60_000;\n\n/** The tunnel listener, bound by the host so this file never imports an HTTP server. */\nexport interface TunnelListener {\n  port: number;\n  close: () => Promise<void>;\n}\n\nexport interface RemoteAccessOptions {\n  store: RemoteAccessStore;\n  launchTunnel: TunnelLauncher;\n  /** Binds a fresh loopback listener for the tunnel to point at. */\n  bindListener: () => Promise<TunnelListener>;\n  /** Current signed publication authenticated through the physical pairing display. */\n  bundleTrust?: () => { publicKey: string; revision: number } | undefined;\n  /**\n   * Signs `po/host-channel-key/v1` fields with the same bundle signer the QR pins, so a reconnecting\n   * phone can trust a fresh tunnel key. Undefined while no shell is published.\n   */\n  attestHost?: (fields: readonly string[]) => string | undefined;\n  /** Removes ephemeral state owned by a paired device when its authorization ends. */\n  onDeviceDropped?: (deviceId: string) => void;\n  onNotice?: (message: string) => void;\n  /** Frames only the local cockpit may see, such as an approval prompt. */\n  broadcastLocal?: (frame: object) => void;\n  /** Frames both local and remote pages see. */\n  broadcastAll?: (frame: object) => void;\n  /**\n   * Asks the launcher to hand this cockpit over to a container.\n   *\n   * A signal rather than a call that does the work, because handing over means\n   * closing the server this code is running inside, which it cannot do to\n   * itself. The launcher owns that sequence and the rollback if it fails.\n   */\n  requestHandover?: (settings: RemoteAccessSettings) => void;\n  /**\n   * Whether this cockpit is already the one inside the container.\n   *\n   * Without it the contained hub would read the same settings it was handed and\n   * try to hand over again, to a container inside a container.\n   */\n  contained?: boolean;\n  now?: () => number;\n}\n\nexport interface RemoteAccess {\n  state(selfDeviceId?: string, forLocalCaller?: boolean): RemoteAccessStateView;\n  settings(): RemoteAccessSettings;\n  updateSettings(patch: Partial<RemoteAccessSettings>): RemoteAccessSettings;\n  tunnelPort(): number | undefined;\n  /** The public origin the tunnel currently answers on, while one is up. */\n  publicOrigin(): string | undefined;\n  /** Changes whenever an established public exposure is torn down. */\n  publicOriginRevision(): number;\n  tunnelPolicy(): OriginPolicy | undefined;\n  enable(): Promise<{ ok: true } | { ok: false; error: string }>;\n  /** True between a contained `enable` and the handover its response defers. */\n  handoverPending(): boolean;\n  /** Runs that deferred handover, once the response asking for it is on the wire. */\n  commitHandover(): void;\n  disable(): Promise<void>;\n  /** Mints the QR credential, separate manual code, and URL. Undefined while unavailable. */\n  mintPairing():\n    | ({ code: string; manualCode: string; pairUrl: string; expiresAt: string } & BundlePairingTrust)\n    | undefined;\n  bundleTrust(): BundlePairingTrust | undefined;\n  claim(input: {\n    code: string;\n    userAgent: string | undefined;\n    edgeIp: string | undefined;\n    sourceAddress: string | undefined;\n  }): ReturnType<PairingFlow['claim']>;\n  pairingStatus(requestId: string): PairingStatus | undefined;\n  approve(requestId: string): ReturnType<PairingFlow['approve']>;\n  deny(requestId: string): ReturnType<PairingFlow['deny']>;\n  /** Turns an approved request into a session, exactly once. */\n  redeem(requestId: string): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  authorize(token: string | undefined): string | undefined;\n  /** Liveness check for a server-authenticated device identity, without extending expiry. */\n  isDeviceAuthorized(deviceId: string): boolean;\n  /** Mints a session for a device that proved a registered passkey. */\n  sessionForPasskey(label: string): EnrolledDevice & { maxAgeSeconds: number };\n  passkeys(): {\n    support: () => PasskeySupport;\n    list: () => readonly StoredCredential[];\n    beginRegistration: WebAuthn['beginRegistration'];\n    finishRegistration: WebAuthn['finishRegistration'];\n    beginAuthentication: WebAuthn['beginAuthentication'];\n    finishAuthentication: WebAuthn['finishAuthentication'];\n    beginStepUp: WebAuthn['beginStepUp'];\n    finishStepUp: WebAuthn['finishStepUp'];\n    forget: (id: string) => boolean;\n  };\n  /** Registers a native device from a sealed, QR-approved pairing session, exactly once. */\n  registerTrustedDevice(\n    sessionDeviceId: string,\n    body: unknown,\n  ): { ok: true; trustedDeviceId: string } | { ok: false; reason: 'forbidden' | 'invalid' | 'full' | 'unavailable' };\n  /** Public reconnect challenge with the same shape for known and unknown ids. */\n  beginDeviceAuth(input: {\n    trustedDeviceId: unknown;\n    nonce: unknown;\n  }):\n    | { ok: true; challengeId: string; challenge: string; hostPublicKey: string; attestation: string }\n    | { ok: false; reason: 'invalid' | 'unavailable' };\n  /** Verifies a device sign-in, opens all three channels at once, and mints a session. */\n  finishDeviceAuth(body: unknown): (EnrolledDevice & { maxAgeSeconds: number }) | undefined;\n  beginDeviceStepUp(\n    sessionDeviceId: string,\n    action: StepUpAction,\n  ): { ceremonyId: string; challenge: string; kind: 'device-key' } | undefined;\n  finishDeviceStepUp(sessionDeviceId: string, action: StepUpAction, ceremonyId: unknown, signature: unknown): boolean;\n  /** Removes the stored device and ends every live session, channel, and socket it holds. */\n  revokeTrustedDevice(id: string): boolean;\n  trustKind(deviceId: string): DeviceTrustKind | undefined;\n  /**\n   * Whether this action needs a fresh gesture that has not been supplied. Always true for a device-key\n   * session; otherwise only where passkeys are supported.\n   */\n  stepUpRequired(action: StepUpAction, deviceId?: string): boolean;\n  /** The host's ephemeral public key for this tunnel, delivered after QR pairing or passkey sign-in. */\n  channelPublicKey(): string | undefined;\n  /** Completes one purpose-bound sealed channel against a fresh device key. */\n  openChannel(deviceId: string, scope: RemoteChannelScope, clientPublicKey: string): boolean;\n  channelFor(deviceId: string, scope: RemoteChannelScope): SealedChannel | undefined;\n  revokeDevice(id: string): boolean;\n  isDeviceConnected(deviceId: string): boolean;\n  /** Registers a remote socket against its device so revocation closes it immediately. */\n  trackSocket(deviceId: string, close: (code: number, reason: string) => void): () => void;\n  close(): Promise<void>;\n}\n\nfunction bundlePairingTrust(\n  value: { publicKey: string; revision: number } | undefined,\n): BundlePairingTrust | undefined {\n  if (value === undefined) return undefined;\n  return {\n    ...value,\n    fingerprint: createHash('sha256').update(Buffer.from(value.publicKey, 'base64url')).digest('hex'),\n  };\n}\n\nexport function createRemoteAccess(options: RemoteAccessOptions): RemoteAccess {\n  const notice = options.onNotice ?? ((): void => {});\n  const now = options.now ?? ((): number => Date.now());\n  const broadcastLocal = options.broadcastLocal ?? ((): void => {});\n  const broadcastAll = options.broadcastAll ?? ((): void => {});\n\n  let settings = options.store.settings();\n  let status: RemoteAccessStatus = 'off';\n  let listener: TunnelListener | undefined;\n  let stopTunnel: (() => Promise<void>) | undefined;\n  let tunnelStartup: { controller: AbortController; outcome: Promise<TunnelStartResult> } | undefined;\n  let publicOrigin: string | undefined;\n  let publicOriginRevision = 0;\n  let policy: OriginPolicy | undefined;\n  let startedAt: number | undefined;\n  let closesAt: number | undefined;\n  let failure: string | undefined;\n  /** Settings an `enable` asked to hand over with, waiting for its response to flush. */\n  let pendingHandover: RemoteAccessSettings | undefined;\n  let autoCloseTimer: ReturnType<typeof setTimeout> | undefined;\n  /** One handshake per tunnel; its public half goes in every QR while the tunnel lives. */\n  let handshake: HostHandshake | undefined;\n  const channels = new Map<string, SealedChannel>();\n  const deviceChallenges: DeviceChallenges = createDeviceChallenges({ now });\n  const sockets = new Map<string, Set<(code: number, reason: string) => void>>();\n\n  const channelKey = (deviceId: string, scope: RemoteChannelScope): string => `${deviceId}:${scope}`;\n  const dropDeviceAccess = (deviceId: string, reason: 'revoked' | 'expired'): void => {\n    options.onDeviceDropped?.(deviceId);\n    for (const scope of ['session', 'protocol', 'http'] as const) channels.delete(channelKey(deviceId, scope));\n    const held = sockets.get(deviceId);\n    sockets.delete(deviceId);\n    for (const close of held ?? []) {\n      try {\n        close(1008, `device ${reason}`);\n      } catch {\n        // The socket is already gone.\n      }\n    }\n  };\n\n  const devices: DeviceAuth = createDeviceAuth({\n    settings: () => settings,\n    now,\n    onNotice: notice,\n    onDrop: (record, reason) => dropDeviceAccess(record.id, reason),\n  });\n\n  const webauthn: WebAuthn = createWebAuthn({\n    publicOrigin: () => publicOrigin,\n    credentials: () => options.store.credentials(),\n    saveCredential: (credential) => options.store.saveCredential(credential),\n    removeCredential: (id) => options.store.removeCredential(id),\n    now,\n    onNotice: notice,\n  });\n\n  const pairing: PairingFlow = createPairingFlow({\n    randomToken: () => randomBytes(TOKEN_BYTES).toString('base64url'),\n    randomManualCode: () => randomInt(100_000_000).toString().padStart(8, '0'),\n    digest: (token) => createHash('sha256').update(token).digest('hex'),\n    now,\n    onNotice: notice,\n  });\n\n  const sweeper = setInterval(() => {\n    devices.sweep();\n    pairing.sweep();\n  }, SWEEP_INTERVAL_MS);\n  sweeper.unref();\n\n  function publish(): void {\n    broadcastAll({ type: REMOTE_STATE_TYPE, state: view(undefined, false) });\n  }\n\n  function view(selfDeviceId: string | undefined, forLocalCaller: boolean): RemoteAccessStateView {\n    const selfTrust = selfDeviceId === undefined ? undefined : devices.trustOf(selfDeviceId);\n    const selfTrustedDeviceId = selfTrust?.kind === 'device-key' ? selfTrust.trustedDeviceId : undefined;\n    return {\n      status,\n      ...(publicOrigin === undefined ? {} : { publicUrl: publicOrigin }),\n      ...(startedAt === undefined ? {} : { startedAt: new Date(startedAt).toISOString() }),\n      ...(closesAt === undefined ? {} : { closesAt: new Date(closesAt).toISOString() }),\n      ...(failure === undefined ? {} : { error: failure }),\n      devices: devices.list().map((record) => ({\n        id: record.id,\n        label: record.label,\n        userAgent: record.userAgent,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: record.id === selfDeviceId,\n      })),\n      // A paired phone must never see the approval queue: a device that can\n      // approve devices makes its own access permanent, which is exactly what\n      // host confirmation exists to prevent.\n      pending: forLocalCaller\n        ? pairing.pending().map((request) => ({\n            id: request.id,\n            userAgent: request.userAgent,\n            edgeIp: request.edgeIp,\n            createdAt: new Date(request.createdAt).toISOString(),\n            expiresAt: new Date(request.createdAt + 180_000).toISOString(),\n          }))\n        : [],\n      trustedDevices: options.store.trustedDevices().map((record) => ({\n        id: record.id,\n        label: record.label,\n        platform: record.platform,\n        createdAt: new Date(record.createdAt).toISOString(),\n        lastSeenAt: new Date(record.lastSeenAt).toISOString(),\n        self: selfTrustedDeviceId !== undefined && record.id === selfTrustedDeviceId,\n      })),\n      settings,\n    };\n  }\n\n  function armAutoClose(): void {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    if (!settings.autoCloseEnabled || status !== 'on') return;\n    const at = now() + settings.autoCloseMinutes * MS_PER_MINUTE;\n    closesAt = at;\n    autoCloseTimer = setTimeout(() => {\n      notice('remote access reached its time limit; closing');\n      void disable();\n    }, settings.autoCloseMinutes * MS_PER_MINUTE);\n    autoCloseTimer.unref();\n  }\n\n  /** Everything teardown has to do, in the order it has to happen. */\n  async function teardown(): Promise<void> {\n    clearTimeout(autoCloseTimer);\n    autoCloseTimer = undefined;\n    closesAt = undefined;\n    // Sockets first. An upgraded socket has left the HTTP server's connection\n    // tracking, so closing the listener does not touch it: without this a\n    // paired phone keeps driving the agent after remote access is switched off.\n    for (const held of sockets.values()) {\n      for (const close of held) {\n        try {\n          close(1008, 'remote access revoked');\n        } catch {\n          // The socket is already gone, which is the outcome we wanted.\n        }\n      }\n    }\n    sockets.clear();\n    const starting = tunnelStartup;\n    tunnelStartup = undefined;\n    starting?.controller.abort();\n    const startingOutcome = await starting?.outcome.catch(() => undefined);\n    if (startingOutcome?.ok === true) await startingOutcome.stop().catch(() => undefined);\n    await stopTunnel?.().catch(() => undefined);\n    stopTunnel = undefined;\n    await listener?.close().catch(() => undefined);\n    listener = undefined;\n    if (publicOrigin !== undefined) publicOriginRevision += 1;\n    publicOrigin = undefined;\n    policy = undefined;\n    startedAt = undefined;\n    pairing.clear();\n    webauthn.clearChallenges();\n    // Challenges are bound to this tunnel's key. Trusted devices stay on disk, like passkeys.\n    deviceChallenges.clear();\n    handshake = undefined;\n    channels.clear();\n    // Sessions go; passkeys and any other durable credential do not, so\n    // switching back on does not mean enrolling every device again.\n    devices.revokeAll();\n  }\n\n  async function disable(): Promise<void> {\n    if (status === 'off') return;\n    await teardown();\n    status = 'off';\n    failure = undefined;\n    notice('remote access off');\n    publish();\n  }\n\n  return {\n    state: (selfDeviceId, forLocalCaller = false) => view(selfDeviceId, forLocalCaller),\n    settings: () => settings,\n    publicOrigin: () => publicOrigin,\n    publicOriginRevision: () => publicOriginRevision,\n\n    updateSettings(patch) {\n      // Through the parser rather than spread straight in, so a value out of\n      // range is clamped now instead of silently differing until the next load.\n      const parsed = parseRemoteAccessSettings(\n        serializeRemoteAccessSettings({ ...settings, ...patch }) as Record<string, unknown>,\n      );\n      for (const warning of parsed.warnings) notice(`remote access settings: ${warning}`);\n      settings = parsed.settings;\n      options.store.save(settings);\n      // Re-arm rather than leave the old deadline: shortening the window has to\n      // take effect now, and lengthening it should not close early.\n      devices.reschedule();\n      armAutoClose();\n      publish();\n      return settings;\n    },\n\n    /**\n     * Runs a handover `enable` deferred, once its response is on the wire.\n     *\n     * Split out rather than done inside `enable` because the reply and the\n     * teardown travel over the same socket, and doing them in the wrong order\n     * leaves the caller unable to tell success from a dropped connection.\n     */\n    commitHandover() {\n      const handing = pendingHandover;\n      if (handing === undefined) return;\n      pendingHandover = undefined;\n      notice('handing the cockpit over to a container');\n      options.requestHandover?.(handing);\n    },\n\n    /** True between a contained `enable` and the handover its response defers. */\n    handoverPending: () => pendingHandover !== undefined,\n\n    tunnelPort: () => listener?.port,\n    tunnelPolicy: () => policy,\n\n    async enable() {\n      if (status === 'on' || status === 'starting') return { ok: true };\n      status = 'starting';\n      failure = undefined;\n      publish();\n\n      // Containment has to be in place before the tunnel is, so a contained\n      // cockpit hands over instead of starting a tunnel here. The container's\n      // own hub turns remote access on once it is serving.\n      if (settings.sandbox.enabled && options.contained !== true) {\n        if (settings.sandbox.workspaces.length === 0) {\n          status = 'failed';\n          failure = 'Add at least one workspace before running the cockpit in a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        if (options.requestHandover === undefined) {\n          status = 'failed';\n          failure = 'This cockpit cannot hand over to a container.';\n          publish();\n          return { ok: false, error: failure };\n        }\n        // Held rather than run: the handover closes the server carrying this\n        // very response, so the caller has to hear the answer first.\n        pendingHandover = settings;\n        return { ok: true };\n      }\n      let bound: TunnelListener;\n      try {\n        bound = await options.bindListener();\n      } catch (error) {\n        status = 'failed';\n        failure = `The tunnel listener could not bind: ${error instanceof Error ? error.message : String(error)}`;\n        publish();\n        return { ok: false, error: failure };\n      }\n      listener = bound;\n      const controller = new AbortController();\n      const launching = options.launchTunnel({\n        port: bound.port,\n        config: settings.tunnel,\n        signal: controller.signal,\n        acceptOrigin: (origin) => {\n          policy = tunnelOriginPolicy(origin);\n        },\n      });\n      const startup = { controller, outcome: launching };\n      tunnelStartup = startup;\n      const outcome = await launching;\n      if (tunnelStartup !== startup || controller.signal.aborted) {\n        return { ok: false, error: 'Tunnel startup was cancelled.' };\n      }\n      tunnelStartup = undefined;\n      if (!outcome.ok) {\n        await teardown();\n        status = 'failed';\n        failure = outcome.message;\n        notice(`remote access failed: ${outcome.message}`);\n        publish();\n        return { ok: false, error: outcome.message };\n      }\n      stopTunnel = outcome.stop;\n      // A fresh key pair per tunnel: the QR is the only place its public half\n      // travels, so it must not outlive the code that carried it.\n      handshake = createHostHandshake();\n      publicOrigin = outcome.publicOrigin;\n      policy = tunnelOriginPolicy(outcome.publicOrigin);\n      startedAt = now();\n      status = 'on';\n      armAutoClose();\n      notice(`remote access on at ${outcome.publicOrigin}`);\n      publish();\n      return { ok: true };\n    },\n\n    disable,\n\n    mintPairing() {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const trust = bundlePairingTrust(options.bundleTrust?.());\n      if (trust === undefined) return undefined;\n      const { code, manualCode, expiresAt } = pairing.mintCode();\n      // The token, channel key, signer key, and publication floor ride in the fragment,\n      // so the relay never observes the values used to authenticate either channel.\n      const fragment = new URLSearchParams({\n        c: code,\n        [SEALED_KEY_PARAM]: handshake.publicKey,\n        [BUNDLE_SIGNING_KEY_PARAM]: trust.publicKey,\n        [BUNDLE_MINIMUM_REVISION_PARAM]: String(trust.revision),\n      });\n      return {\n        code,\n        manualCode,\n        pairUrl: `${publicOrigin}${PAIRING_PAGE_ROUTE}#${fragment.toString()}`,\n        expiresAt: new Date(expiresAt).toISOString(),\n        ...trust,\n      };\n    },\n\n    bundleTrust: () => bundlePairingTrust(options.bundleTrust?.()),\n\n    claim(input) {\n      const outcome = pairing.claim(input);\n      if (outcome.ok) {\n        broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      }\n      return outcome;\n    },\n\n    pairingStatus: (requestId) => pairing.status(requestId),\n\n    approve(requestId) {\n      const outcome = pairing.approve(requestId);\n      if (outcome === 'approved') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    deny(requestId) {\n      const outcome = pairing.deny(requestId);\n      if (outcome === 'denied') broadcastLocal({ type: REMOTE_PAIRING_REQUEST_TYPE, state: view(undefined, true) });\n      return outcome;\n    },\n\n    redeem(requestId) {\n      const approved = pairing.consume(requestId);\n      if (approved === undefined) return undefined;\n      const enrolled = devices.enrol({ userAgent: approved.userAgent, trust: PAIRING_TRUST });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    authorize: (token) => devices.verify(token)?.id,\n    isDeviceAuthorized(deviceId) {\n      devices.sweep();\n      return listener !== undefined && devices.list().some((record) => record.id === deviceId);\n    },\n\n    sessionForPasskey(label) {\n      const enrolled = devices.enrol({ userAgent: label, trust: PASSKEY_TRUST });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    passkeys: () => ({\n      support: () => webauthn.support(),\n      list: () => options.store.credentials(),\n      // Wrapped rather than passed by reference: an unbound method carries\n      // whatever `this` the caller happens to have.\n      beginRegistration: async (caller, label) => await webauthn.beginRegistration(caller, label),\n      finishRegistration: async (ceremonyId, caller, response, label) =>\n        await webauthn.finishRegistration(ceremonyId, caller, response, label),\n      beginAuthentication: async (caller) => await webauthn.beginAuthentication(caller),\n      finishAuthentication: async (ceremonyId, caller, response) =>\n        await webauthn.finishAuthentication(ceremonyId, caller, response),\n      beginStepUp: async (caller, action) => await webauthn.beginStepUp(caller, action),\n      finishStepUp: async (ceremonyId, caller, action, response) =>\n        await webauthn.finishStepUp(ceremonyId, caller, action, response),\n      forget: (id) => {\n        const forgotten = options.store.removeCredential(id);\n        if (forgotten) publish();\n        return forgotten;\n      },\n    }),\n\n    registerTrustedDevice(sessionDeviceId, body) {\n      if (publicOrigin === undefined || handshake === undefined) return { ok: false, reason: 'unavailable' };\n      const verdict = verifyRegistration({\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        sessionDeviceId,\n        trust: devices.trustOf(sessionDeviceId),\n        body,\n      });\n      if (!verdict.ok) return { ok: false, reason: verdict.reason === 'not-pairing' ? 'forbidden' : 'invalid' };\n      if (options.store.trustedDevices().length >= TRUSTED_DEVICE_LIMIT) return { ok: false, reason: 'full' };\n      const at = now();\n      const trustedDeviceId = randomBytes(TRUSTED_DEVICE_ID_BYTES).toString('base64url');\n      const saved = options.store.saveTrustedDevice({\n        id: trustedDeviceId,\n        identityPublicKey: verdict.identityPublicKey,\n        stepUpPublicKey: verdict.stepUpPublicKey,\n        label: verdict.label,\n        platform: verdict.platform,\n        createdAt: at,\n        lastSeenAt: at,\n      });\n      if (!saved) return { ok: false, reason: 'full' };\n      // The pairing session becomes a device-key session, so it cannot register a second time and\n      // every gated action from it now needs the biometric key.\n      devices.setTrust(sessionDeviceId, { kind: 'device-key', trustedDeviceId });\n      notice(`trusted ${verdict.label} (${trustedDeviceId})`);\n      publish();\n      return { ok: true, trustedDeviceId };\n    },\n\n    beginDeviceAuth(input) {\n      if (!isOpaqueId(input.trustedDeviceId) || !isDeviceNonce(input.nonce)) return { ok: false, reason: 'invalid' };\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined || options.attestHost === undefined)\n        return { ok: false, reason: 'unavailable' };\n      const attest = options.attestHost;\n      const begun = deviceAuthChallenge({\n        challenges: deviceChallenges,\n        trustedDeviceId: input.trustedDeviceId,\n        nonce: input.nonce,\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        attest: (fields) => attest(fields),\n      });\n      return begun === undefined ? { ok: false, reason: 'unavailable' } : { ok: true, ...begun };\n    },\n\n    finishDeviceAuth(body) {\n      if (status !== 'on' || publicOrigin === undefined || handshake === undefined) return undefined;\n      const verdict = verifyAuthentication({\n        challenges: deviceChallenges,\n        origin: publicOrigin,\n        hostPublicKey: handshake.publicKey,\n        find: (id) => options.store.trustedDevices().find((record) => record.id === id),\n        body,\n      });\n      if (!verdict.ok) return undefined;\n      const enrolled = devices.enrol({\n        userAgent: verdict.record.label,\n        trust: { kind: 'device-key', trustedDeviceId: verdict.record.id },\n      });\n      // All three channels open together or the session goes: a relay holding the cookie must never\n      // be able to add a channel of its own.\n      const opened: [RemoteChannelScope, SealedChannel | undefined][] = [\n        ['session', handshake.accept(verdict.channels.session)],\n        ['protocol', handshake.accept(verdict.channels.protocol)],\n        ['http', handshake.accept(verdict.channels.http)],\n      ];\n      if (opened.some(([, channel]) => channel === undefined)) {\n        devices.revoke(enrolled.record.id);\n        return undefined;\n      }\n      for (const [scope, channel] of opened) {\n        if (channel !== undefined) channels.set(channelKey(enrolled.record.id, scope), channel);\n      }\n      options.store.saveTrustedDevice({ ...verdict.record, lastSeenAt: now() });\n      publish();\n      return { ...enrolled, maxAgeSeconds: cookieMaxAgeSeconds(settings, COOKIE_CEILING_SECONDS) };\n    },\n\n    beginDeviceStepUp(sessionDeviceId, action) {\n      if (handshake === undefined || devices.trustOf(sessionDeviceId)?.kind !== 'device-key') return undefined;\n      return deviceStepUpChallenge({\n        challenges: deviceChallenges,\n        sessionDeviceId,\n        action,\n        hostPublicKey: handshake.publicKey,\n      });\n    },\n\n    finishDeviceStepUp(sessionDeviceId, action, ceremonyId, signature) {\n      const trust = devices.trustOf(sessionDeviceId);\n      if (trust?.kind !== 'device-key' || publicOrigin === undefined) return false;\n      const record = options.store.trustedDevices().find((held) => held.id === trust.trustedDeviceId);\n      if (record === undefined) return false;\n      return verifyStepUp({\n        challenges: deviceChallenges,\n        origin: publicOrigin,\n        hostPublicKey: handshake?.publicKey,\n        sessionDeviceId,\n        action,\n        ceremonyId,\n        signature,\n        stepUpPublicKey: record.stepUpPublicKey,\n      });\n    },\n\n    revokeTrustedDevice(id) {\n      const heldBy = (record: { trust: DeviceTrust }): boolean =>\n        record.trust.kind === 'device-key' && record.trust.trustedDeviceId === id;\n      const removed = options.store.removeTrustedDevice(id);\n      const endedIds = new Set(\n        devices\n          .list()\n          .filter(heldBy)\n          .map((record) => record.id),\n      );\n      // The drop path deletes channels and closes sockets with 1008, exactly as a session revoke does.\n      const ended = devices.revokeWhere(heldBy);\n      deviceChallenges.dropWhere(\n        (challenge) =>\n          (challenge.purpose.kind === 'auth' && challenge.purpose.trustedDeviceId === id) ||\n          (challenge.purpose.kind === 'step-up' && endedIds.has(challenge.purpose.sessionDeviceId)),\n      );\n      if (!removed && ended === 0) return false;\n      notice(`revoked trusted device ${id}`);\n      publish();\n      return true;\n    },\n\n    trustKind: (deviceId) => devices.trustOf(deviceId)?.kind,\n\n    // A device-key session always steps up with its biometric key, on every tunnel. Otherwise this is\n    // only meaningful where passkeys are: a quick tunnel has no stable rpID, so there is nothing to\n    // step up with and the session cookie is all there is.\n    stepUpRequired: (_action, deviceId) =>\n      (deviceId !== undefined && devices.trustOf(deviceId)?.kind === 'device-key') || webauthn.support().supported,\n\n    channelPublicKey: () => handshake?.publicKey,\n\n    openChannel(deviceId, scope, clientPublicKey) {\n      const channel = handshake?.accept(clientPublicKey);\n      if (channel === undefined) return false;\n      channels.set(channelKey(deviceId, scope), channel);\n      return true;\n    },\n\n    channelFor: (deviceId, scope) => channels.get(channelKey(deviceId, scope)),\n\n    revokeDevice(id) {\n      const revoked = devices.revoke(id);\n      if (revoked) publish();\n      return revoked;\n    },\n\n    isDeviceConnected: (deviceId) => (sockets.get(deviceId)?.size ?? 0) > 0,\n\n    trackSocket(deviceId, close) {\n      const held = sockets.get(deviceId) ?? new Set();\n      held.add(close);\n      sockets.set(deviceId, held);\n      return () => {\n        held.delete(close);\n        if (held.size === 0) sockets.delete(deviceId);\n      };\n    },\n\n    async close() {\n      clearInterval(sweeper);\n      await teardown();\n      status = 'off';\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AA6CA,MAAM,cAAc;AACpB,MAAM,0BAA0B;AAChC,MAAM,gBAA6B,EAAE,MAAM,UAAU;AACrD,MAAM,gBAA6B,EAAE,MAAM,UAAU;AACrD,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AAoItB,SAAS,mBACP,OACgC;CAChC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EACL,GAAG;EACH,aAAa,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK;CAClG;AACF;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,iBAAiB,QAAQ,yBAA+B,CAAC;CAC/D,MAAM,eAAe,QAAQ,uBAA6B,CAAC;CAE3D,IAAI,WAAW,QAAQ,MAAM,SAAS;CACtC,IAAI,SAA6B;CACjC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,uBAAuB;CAC3B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,IAAI;;CAEJ,IAAI;CACJ,MAAM,2BAAW,IAAI,IAA2B;CAChD,MAAM,mBAAqC,uBAAuB,EAAE,IAAI,CAAC;CACzE,MAAM,0BAAU,IAAI,IAAyD;CAE7E,MAAM,cAAc,UAAkB,UAAsC,GAAG,SAAS,GAAG;CAC3F,MAAM,oBAAoB,UAAkB,WAAwC;EAClF,QAAQ,kBAAkB,QAAQ;EAClC,KAAK,MAAM,SAAS;GAAC;GAAW;GAAY;EAAM,GAAY,SAAS,OAAO,WAAW,UAAU,KAAK,CAAC;EACzG,MAAM,OAAO,QAAQ,IAAI,QAAQ;EACjC,QAAQ,OAAO,QAAQ;EACvB,KAAK,MAAM,SAAS,QAAQ,CAAC,GAC3B,IAAI;GACF,MAAM,MAAM,UAAU,QAAQ;EAChC,QAAQ,CAER;CAEJ;CAEA,MAAM,UAAsB,iBAAiB;EAC3C,gBAAgB;EAChB;EACA,UAAU;EACV,SAAS,QAAQ,WAAW,iBAAiB,OAAO,IAAI,MAAM;CAChE,CAAC;CAED,MAAM,WAAqB,eAAe;EACxC,oBAAoB;EACpB,mBAAmB,QAAQ,MAAM,YAAY;EAC7C,iBAAiB,eAAe,QAAQ,MAAM,eAAe,UAAU;EACvE,mBAAmB,OAAO,QAAQ,MAAM,iBAAiB,EAAE;EAC3D;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAuB,kBAAkB;EAC7C,mBAAmB,YAAY,WAAW,CAAC,CAAC,SAAS,WAAW;EAChE,wBAAwB,UAAU,GAAW,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACzE,SAAS,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAClE;EACA,UAAU;CACZ,CAAC;CAED,MAAM,UAAU,kBAAkB;EAChC,QAAQ,MAAM;EACd,QAAQ,MAAM;CAChB,GAAG,iBAAiB;CACpB,QAAQ,MAAM;CAEd,SAAS,UAAgB;EACvB,aAAa;GAAE,MAAM;GAAmB,OAAO,KAAK,KAAA,GAAW,KAAK;EAAE,CAAC;CACzE;CAEA,SAAS,KAAK,cAAkC,gBAAgD;EAC9F,MAAM,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,QAAQ,YAAY;EACvF,MAAM,sBAAsB,WAAW,SAAS,eAAe,UAAU,kBAAkB,KAAA;EAC3F,OAAO;GACL;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,aAAa;GAChE,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY,EAAE;GAClF,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,YAAY,EAAE;GAC/E,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ;GAClD,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,YAAY;IACvC,IAAI,OAAO;IACX,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,OAAO,OAAO;GACtB,EAAE;GAIF,SAAS,iBACL,QAAQ,QAAQ,CAAC,CAAC,KAAK,aAAa;IAClC,IAAI,QAAQ;IACZ,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB,WAAW,IAAI,KAAK,QAAQ,SAAS,CAAC,CAAC,YAAY;IACnD,WAAW,IAAI,KAAK,QAAQ,YAAY,IAAO,CAAC,CAAC,YAAY;GAC/D,EAAE,IACF,CAAC;GACL,gBAAgB,QAAQ,MAAM,eAAe,CAAC,CAAC,KAAK,YAAY;IAC9D,IAAI,OAAO;IACX,OAAO,OAAO;IACd,UAAU,OAAO;IACjB,WAAW,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY;IAClD,YAAY,IAAI,KAAK,OAAO,UAAU,CAAC,CAAC,YAAY;IACpD,MAAM,wBAAwB,KAAA,KAAa,OAAO,OAAO;GAC3D,EAAE;GACF;EACF;CACF;CAEA,SAAS,eAAqB;EAC5B,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EACX,IAAI,CAAC,SAAS,oBAAoB,WAAW,MAAM;EAEnD,WADW,IAAI,IAAI,SAAS,mBAAmB;EAE/C,iBAAiB,iBAAiB;GAChC,OAAO,+CAA+C;GACtD,QAAa;EACf,GAAG,SAAS,mBAAmB,aAAa;EAC5C,eAAe,MAAM;CACvB;;CAGA,eAAe,WAA0B;EACvC,aAAa,cAAc;EAC3B,iBAAiB,KAAA;EACjB,WAAW,KAAA;EAIX,KAAK,MAAM,QAAQ,QAAQ,OAAO,GAChC,KAAK,MAAM,SAAS,MAClB,IAAI;GACF,MAAM,MAAM,uBAAuB;EACrC,QAAQ,CAER;EAGJ,QAAQ,MAAM;EACd,MAAM,WAAW;EACjB,gBAAgB,KAAA;EAChB,UAAU,WAAW,MAAM;EAC3B,MAAM,kBAAkB,MAAM,UAAU,QAAQ,YAAY,KAAA,CAAS;EACrE,IAAI,iBAAiB,OAAO,MAAM,MAAM,gBAAgB,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EACpF,MAAM,aAAa,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C,aAAa,KAAA;EACb,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,WAAW,KAAA;EACX,IAAI,iBAAiB,KAAA,GAAW,wBAAwB;EACxD,eAAe,KAAA;EACf,SAAS,KAAA;EACT,YAAY,KAAA;EACZ,QAAQ,MAAM;EACd,SAAS,gBAAgB;EAEzB,iBAAiB,MAAM;EACvB,YAAY,KAAA;EACZ,SAAS,MAAM;EAGf,QAAQ,UAAU;CACpB;CAEA,eAAe,UAAyB;EACtC,IAAI,WAAW,OAAO;EACtB,MAAM,SAAS;EACf,SAAS;EACT,UAAU,KAAA;EACV,OAAO,mBAAmB;EAC1B,QAAQ;CACV;CAEA,OAAO;EACL,QAAQ,cAAc,iBAAiB,UAAU,KAAK,cAAc,cAAc;EAClF,gBAAgB;EAChB,oBAAoB;EACpB,4BAA4B;EAE5B,eAAe,OAAO;GAGpB,MAAM,SAAS,0BACb,8BAA8B;IAAE,GAAG;IAAU,GAAG;GAAM,CAAC,CACzD;GACA,KAAK,MAAM,WAAW,OAAO,UAAU,OAAO,2BAA2B,SAAS;GAClF,WAAW,OAAO;GAClB,QAAQ,MAAM,KAAK,QAAQ;GAG3B,QAAQ,WAAW;GACnB,aAAa;GACb,QAAQ;GACR,OAAO;EACT;;;;;;;;EASA,iBAAiB;GACf,MAAM,UAAU;GAChB,IAAI,YAAY,KAAA,GAAW;GAC3B,kBAAkB,KAAA;GAClB,OAAO,yCAAyC;GAChD,QAAQ,kBAAkB,OAAO;EACnC;;EAGA,uBAAuB,oBAAoB,KAAA;EAE3C,kBAAkB,UAAU;EAC5B,oBAAoB;EAEpB,MAAM,SAAS;GACb,IAAI,WAAW,QAAQ,WAAW,YAAY,OAAO,EAAE,IAAI,KAAK;GAChE,SAAS;GACT,UAAU,KAAA;GACV,QAAQ;GAKR,IAAI,SAAS,QAAQ,WAAW,QAAQ,cAAc,MAAM;IAC1D,IAAI,SAAS,QAAQ,WAAW,WAAW,GAAG;KAC5C,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IACA,IAAI,QAAQ,oBAAoB,KAAA,GAAW;KACzC,SAAS;KACT,UAAU;KACV,QAAQ;KACR,OAAO;MAAE,IAAI;MAAO,OAAO;KAAQ;IACrC;IAGA,kBAAkB;IAClB,OAAO,EAAE,IAAI,KAAK;GACpB;GACA,IAAI;GACJ,IAAI;IACF,QAAQ,MAAM,QAAQ,aAAa;GACrC,SAAS,OAAO;IACd,SAAS;IACT,UAAU,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IACtG,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO;IAAQ;GACrC;GACA,WAAW;GACX,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,YAAY,QAAQ,aAAa;IACrC,MAAM,MAAM;IACZ,QAAQ,SAAS;IACjB,QAAQ,WAAW;IACnB,eAAe,WAAW;KACxB,SAAS,mBAAmB,MAAM;IACpC;GACF,CAAC;GACD,MAAM,UAAU;IAAE;IAAY,SAAS;GAAU;GACjD,gBAAgB;GAChB,MAAM,UAAU,MAAM;GACtB,IAAI,kBAAkB,WAAW,WAAW,OAAO,SACjD,OAAO;IAAE,IAAI;IAAO,OAAO;GAAgC;GAE7D,gBAAgB,KAAA;GAChB,IAAI,CAAC,QAAQ,IAAI;IACf,MAAM,SAAS;IACf,SAAS;IACT,UAAU,QAAQ;IAClB,OAAO,yBAAyB,QAAQ,SAAS;IACjD,QAAQ;IACR,OAAO;KAAE,IAAI;KAAO,OAAO,QAAQ;IAAQ;GAC7C;GACA,aAAa,QAAQ;GAGrB,YAAY,oBAAoB;GAChC,eAAe,QAAQ;GACvB,SAAS,mBAAmB,QAAQ,YAAY;GAChD,YAAY,IAAI;GAChB,SAAS;GACT,aAAa;GACb,OAAO,uBAAuB,QAAQ,cAAc;GACpD,QAAQ;GACR,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA;EAEA,cAAc;GACZ,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,QAAQ,mBAAmB,QAAQ,cAAc,CAAC;GACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,EAAE,MAAM,YAAY,cAAc,QAAQ,SAAS;GAGzD,MAAM,WAAW,IAAI,gBAAgB;IACnC,GAAG;KACF,mBAAmB,UAAU;KACF,MAAA,MAAM;KACD,MAAA,OAAO,MAAM,QAAQ;GACxD,CAAC;GACD,OAAO;IACL;IACA;IACA,SAAS,GAAG,eAAe,mBAAmB,GAAG,SAAS,SAAS;IACnE,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY;IAC3C,GAAG;GACL;EACF;EAEA,mBAAmB,mBAAmB,QAAQ,cAAc,CAAC;EAE7D,MAAM,OAAO;GACX,MAAM,UAAU,QAAQ,MAAM,KAAK;GACnC,IAAI,QAAQ,IACV,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAEpF,OAAO;EACT;EAEA,gBAAgB,cAAc,QAAQ,OAAO,SAAS;EAEtD,QAAQ,WAAW;GACjB,MAAM,UAAU,QAAQ,QAAQ,SAAS;GACzC,IAAI,YAAY,YAAY,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC9G,OAAO;EACT;EAEA,KAAK,WAAW;GACd,MAAM,UAAU,QAAQ,KAAK,SAAS;GACtC,IAAI,YAAY,UAAU,eAAe;IAAE,MAAM;IAA6B,OAAO,KAAK,KAAA,GAAW,IAAI;GAAE,CAAC;GAC5G,OAAO;EACT;EAEA,OAAO,WAAW;GAChB,MAAM,WAAW,QAAQ,QAAQ,SAAS;GAC1C,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,WAAW,QAAQ,MAAM;IAAE,WAAW,SAAS;IAAW,OAAO;GAAc,CAAC;GACtF,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAe,oBAAoB,UAAU,sBAAsB;GAAE;EAC7F;EAEA,YAAY,UAAU,QAAQ,OAAO,KAAK,CAAC,EAAE;EAC7C,mBAAmB,UAAU;GAC3B,QAAQ,MAAM;GACd,OAAO,aAAa,KAAA,KAAa,QAAQ,KAAK,CAAC,CAAC,MAAM,WAAW,OAAO,OAAO,QAAQ;EACzF;EAEA,kBAAkB,OAAO;GACvB,MAAM,WAAW,QAAQ,MAAM;IAAE,WAAW;IAAO,OAAO;GAAc,CAAC;GACzE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAe,oBAAoB,UAAU,sBAAsB;GAAE;EAC7F;EAEA,iBAAiB;GACf,eAAe,SAAS,QAAQ;GAChC,YAAY,QAAQ,MAAM,YAAY;GAGtC,mBAAmB,OAAO,QAAQ,UAAU,MAAM,SAAS,kBAAkB,QAAQ,KAAK;GAC1F,oBAAoB,OAAO,YAAY,QAAQ,UAAU,UACvD,MAAM,SAAS,mBAAmB,YAAY,QAAQ,UAAU,KAAK;GACvE,qBAAqB,OAAO,WAAW,MAAM,SAAS,oBAAoB,MAAM;GAChF,sBAAsB,OAAO,YAAY,QAAQ,aAC/C,MAAM,SAAS,qBAAqB,YAAY,QAAQ,QAAQ;GAClE,aAAa,OAAO,QAAQ,WAAW,MAAM,SAAS,YAAY,QAAQ,MAAM;GAChF,cAAc,OAAO,YAAY,QAAQ,QAAQ,aAC/C,MAAM,SAAS,aAAa,YAAY,QAAQ,QAAQ,QAAQ;GAClE,SAAS,OAAO;IACd,MAAM,YAAY,QAAQ,MAAM,iBAAiB,EAAE;IACnD,IAAI,WAAW,QAAQ;IACvB,OAAO;GACT;EACF;EAEA,sBAAsB,iBAAiB,MAAM;GAC3C,IAAI,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAc;GACrG,MAAM,UAAU,mBAAmB;IACjC,QAAQ;IACR,eAAe,UAAU;IACzB;IACA,OAAO,QAAQ,QAAQ,eAAe;IACtC;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI,OAAO;IAAE,IAAI;IAAO,QAAQ,QAAQ,WAAW,gBAAgB,cAAc;GAAU;GACxG,IAAI,QAAQ,MAAM,eAAe,CAAC,CAAC,UAAA,IAAgC,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAO;GACtG,MAAM,KAAK,IAAI;GACf,MAAM,kBAAkB,YAAY,uBAAuB,CAAC,CAAC,SAAS,WAAW;GAUjF,IAAI,CATU,QAAQ,MAAM,kBAAkB;IAC5C,IAAI;IACJ,mBAAmB,QAAQ;IAC3B,iBAAiB,QAAQ;IACzB,OAAO,QAAQ;IACf,UAAU,QAAQ;IAClB,WAAW;IACX,YAAY;GACd,CACS,GAAG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAO;GAG/C,QAAQ,SAAS,iBAAiB;IAAE,MAAM;IAAc;GAAgB,CAAC;GACzE,OAAO,WAAW,QAAQ,MAAM,IAAI,gBAAgB,EAAE;GACtD,QAAQ;GACR,OAAO;IAAE,IAAI;IAAM;GAAgB;EACrC;EAEA,gBAAgB,OAAO;GACrB,IAAI,CAAC,WAAW,MAAM,eAAe,KAAK,CAAC,cAAc,MAAM,KAAK,GAAG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAC7G,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,KAAa,QAAQ,eAAe,KAAA,GACrG,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAc;GAC5C,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,oBAAoB;IAChC,YAAY;IACZ,iBAAiB,MAAM;IACvB,OAAO,MAAM;IACb,QAAQ;IACR,eAAe,UAAU;IACzB,SAAS,WAAW,OAAO,MAAM;GACnC,CAAC;GACD,OAAO,UAAU,KAAA,IAAY;IAAE,IAAI;IAAO,QAAQ;GAAc,IAAI;IAAE,IAAI;IAAM,GAAG;GAAM;EAC3F;EAEA,iBAAiB,MAAM;GACrB,IAAI,WAAW,QAAQ,iBAAiB,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO,KAAA;GACrF,MAAM,UAAU,qBAAqB;IACnC,YAAY;IACZ,QAAQ;IACR,eAAe,UAAU;IACzB,OAAO,OAAO,QAAQ,MAAM,eAAe,CAAC,CAAC,MAAM,WAAW,OAAO,OAAO,EAAE;IAC9E;GACF,CAAC;GACD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAA;GACxB,MAAM,WAAW,QAAQ,MAAM;IAC7B,WAAW,QAAQ,OAAO;IAC1B,OAAO;KAAE,MAAM;KAAc,iBAAiB,QAAQ,OAAO;IAAG;GAClE,CAAC;GAGD,MAAM,SAA4D;IAChE,CAAC,WAAW,UAAU,OAAO,QAAQ,SAAS,OAAO,CAAC;IACtD,CAAC,YAAY,UAAU,OAAO,QAAQ,SAAS,QAAQ,CAAC;IACxD,CAAC,QAAQ,UAAU,OAAO,QAAQ,SAAS,IAAI,CAAC;GAClD;GACA,IAAI,OAAO,MAAM,GAAG,aAAa,YAAY,KAAA,CAAS,GAAG;IACvD,QAAQ,OAAO,SAAS,OAAO,EAAE;IACjC;GACF;GACA,KAAK,MAAM,CAAC,OAAO,YAAY,QAC7B,IAAI,YAAY,KAAA,GAAW,SAAS,IAAI,WAAW,SAAS,OAAO,IAAI,KAAK,GAAG,OAAO;GAExF,QAAQ,MAAM,kBAAkB;IAAE,GAAG,QAAQ;IAAQ,YAAY,IAAI;GAAE,CAAC;GACxE,QAAQ;GACR,OAAO;IAAE,GAAG;IAAU,eAAe,oBAAoB,UAAU,sBAAsB;GAAE;EAC7F;EAEA,kBAAkB,iBAAiB,QAAQ;GACzC,IAAI,cAAc,KAAA,KAAa,QAAQ,QAAQ,eAAe,CAAC,EAAE,SAAS,cAAc,OAAO,KAAA;GAC/F,OAAO,sBAAsB;IAC3B,YAAY;IACZ;IACA;IACA,eAAe,UAAU;GAC3B,CAAC;EACH;EAEA,mBAAmB,iBAAiB,QAAQ,YAAY,WAAW;GACjE,MAAM,QAAQ,QAAQ,QAAQ,eAAe;GAC7C,IAAI,OAAO,SAAS,gBAAgB,iBAAiB,KAAA,GAAW,OAAO;GACvE,MAAM,SAAS,QAAQ,MAAM,eAAe,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,MAAM,eAAe;GAC9F,IAAI,WAAW,KAAA,GAAW,OAAO;GACjC,OAAO,aAAa;IAClB,YAAY;IACZ,QAAQ;IACR,eAAe,WAAW;IAC1B;IACA;IACA;IACA;IACA,iBAAiB,OAAO;GAC1B,CAAC;EACH;EAEA,oBAAoB,IAAI;GACtB,MAAM,UAAU,WACd,OAAO,MAAM,SAAS,gBAAgB,OAAO,MAAM,oBAAoB;GACzE,MAAM,UAAU,QAAQ,MAAM,oBAAoB,EAAE;GACpD,MAAM,WAAW,IAAI,IACnB,QACG,KAAK,CAAC,CACN,OAAO,MAAM,CAAC,CACd,KAAK,WAAW,OAAO,EAAE,CAC9B;GAEA,MAAM,QAAQ,QAAQ,YAAY,MAAM;GACxC,iBAAiB,WACd,cACE,UAAU,QAAQ,SAAS,UAAU,UAAU,QAAQ,oBAAoB,MAC3E,UAAU,QAAQ,SAAS,aAAa,SAAS,IAAI,UAAU,QAAQ,eAAe,CAC3F;GACA,IAAI,CAAC,WAAW,UAAU,GAAG,OAAO;GACpC,OAAO,0BAA0B,IAAI;GACrC,QAAQ;GACR,OAAO;EACT;EAEA,YAAY,aAAa,QAAQ,QAAQ,QAAQ,CAAC,EAAE;EAKpD,iBAAiB,SAAS,aACvB,aAAa,KAAA,KAAa,QAAQ,QAAQ,QAAQ,CAAC,EAAE,SAAS,gBAAiB,SAAS,QAAQ,CAAC,CAAC;EAErG,wBAAwB,WAAW;EAEnC,YAAY,UAAU,OAAO,iBAAiB;GAC5C,MAAM,UAAU,WAAW,OAAO,eAAe;GACjD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,SAAS,IAAI,WAAW,UAAU,KAAK,GAAG,OAAO;GACjD,OAAO;EACT;EAEA,aAAa,UAAU,UAAU,SAAS,IAAI,WAAW,UAAU,KAAK,CAAC;EAEzE,aAAa,IAAI;GACf,MAAM,UAAU,QAAQ,OAAO,EAAE;GACjC,IAAI,SAAS,QAAQ;GACrB,OAAO;EACT;EAEA,oBAAoB,cAAc,QAAQ,IAAI,QAAQ,CAAC,EAAE,QAAQ,KAAK;EAEtE,YAAY,UAAU,OAAO;GAC3B,MAAM,OAAO,QAAQ,IAAI,QAAQ,qBAAK,IAAI,IAAI;GAC9C,KAAK,IAAI,KAAK;GACd,QAAQ,IAAI,UAAU,IAAI;GAC1B,aAAa;IACX,KAAK,OAAO,KAAK;IACjB,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,QAAQ;GAC9C;EACF;EAEA,MAAM,QAAQ;GACZ,cAAc,OAAO;GACrB,MAAM,SAAS;GACf,SAAS;EACX;CACF;AACF"}

package/dist/src/services/remoteAccessSettings/index.cjs

@@ -0,0 +1,151 @@
+const MIN_MINUTES = 1;
+const MAX_MINUTES = 1440;
+const MIN_HOURS = 1;
+const MAX_HOURS = 720;
+/**
+* Both time limits start off.
+*
+* The durations are still here so switching one on lands on a sensible number
+* rather than an empty field. What being off actually means: a tunnel stays up
+* until it is closed or the hub restarts, and a paired session lasts until it
+* is revoked or remote access is switched off. Those two events are the only
+* expiry there is by default.
+*/
+const DEFAULT_REMOTE_SETTINGS = {
+	autoCloseEnabled: false,
+	autoCloseMinutes: 60,
+	sessionExpiryEnabled: false,
+	idleMinutes: 30,
+	absoluteHours: 12,
+	tunnel: { kind: "quick" },
+	sandbox: {
+		enabled: false,
+		workspaces: []
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBoolean(raw, fallback, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "boolean") {
+		warnings.push(`${field} must be true or false; using ${String(fallback)}.`);
+		return fallback;
+	}
+	return raw;
+}
+function readClamped(raw, fallback, bounds, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) {
+		warnings.push(`${field} must be a number; using ${String(fallback)}.`);
+		return fallback;
+	}
+	const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));
+	if (clamped !== raw) warnings.push(`${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`);
+	return clamped;
+}
+/**
+* A tunnel configuration is only accepted whole.
+*
+* A named tunnel missing its hostname is not a named tunnel with a default, it
+* is a misconfiguration, and quietly falling back to a quick tunnel would swap
+* a stable origin for a rotating one without telling anybody.
+*/
+function readTunnel(raw, warnings) {
+	if (raw === void 0) return DEFAULT_REMOTE_SETTINGS.tunnel;
+	if (!isRecord(raw)) {
+		warnings.push("tunnel must be an object; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	if (raw.kind === "quick") return { kind: "quick" };
+	if (raw.kind !== "named") {
+		warnings.push(`tunnel.kind must be "quick" or "named"; using a quick tunnel.`);
+		return { kind: "quick" };
+	}
+	if (typeof raw.hostname !== "string" || raw.hostname === "") {
+		warnings.push("A named tunnel needs a hostname; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	return {
+		kind: "named",
+		hostname: raw.hostname,
+		...typeof raw.name === "string" && raw.name !== "" ? { name: raw.name } : {},
+		...typeof raw.tokenFile === "string" && raw.tokenFile !== "" ? { tokenFile: raw.tokenFile } : {},
+		...typeof raw.configFile === "string" && raw.configFile !== "" ? { configFile: raw.configFile } : {}
+	};
+}
+/**
+* Reads the container settings, keeping only absolute workspace paths.
+*
+* A relative path would resolve against the container's working directory
+* rather than the host's, which is a mount that silently points somewhere else.
+* Refusing one is better than mounting the wrong directory.
+*/
+function readSandbox(raw, warnings) {
+	const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;
+	if (raw === void 0) return fallback;
+	if (!isRecord(raw)) {
+		warnings.push("sandbox must be an object; the cockpit will not be contained.");
+		return fallback;
+	}
+	const workspaces = [];
+	for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {
+		if (typeof entry !== "string" || !entry.startsWith("/")) {
+			warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);
+			continue;
+		}
+		if (!workspaces.includes(entry)) workspaces.push(entry);
+	}
+	return {
+		enabled: readBoolean(raw.enabled, fallback.enabled, "sandbox.enabled", warnings),
+		workspaces
+	};
+}
+function parseRemoteAccessSettings(raw) {
+	const warnings = [];
+	if (!isRecord(raw)) return {
+		settings: DEFAULT_REMOTE_SETTINGS,
+		warnings
+	};
+	if (raw.version !== 1) {
+		warnings.push(`Settings version ${String(raw.version)} is not version ${String(1)}; using defaults.`);
+		return {
+			settings: DEFAULT_REMOTE_SETTINGS,
+			warnings
+		};
+	}
+	const defaults = DEFAULT_REMOTE_SETTINGS;
+	return {
+		settings: {
+			autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, "autoCloseEnabled", warnings),
+			autoCloseMinutes: readClamped(raw.autoCloseMinutes, defaults.autoCloseMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "autoCloseMinutes", warnings),
+			sessionExpiryEnabled: readBoolean(raw.sessionExpiryEnabled, defaults.sessionExpiryEnabled, "sessionExpiryEnabled", warnings),
+			idleMinutes: readClamped(raw.idleMinutes, defaults.idleMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "idleMinutes", warnings),
+			absoluteHours: readClamped(raw.absoluteHours, defaults.absoluteHours, {
+				min: MIN_HOURS,
+				max: MAX_HOURS
+			}, "absoluteHours", warnings),
+			tunnel: readTunnel(raw.tunnel, warnings),
+			sandbox: readSandbox(raw.sandbox, warnings)
+		},
+		warnings
+	};
+}
+function serializeRemoteAccessSettings(settings) {
+	return {
+		version: 1,
+		...settings
+	};
+}
+//#endregion
+exports.DEFAULT_REMOTE_SETTINGS = DEFAULT_REMOTE_SETTINGS;
+exports.parseRemoteAccessSettings = parseRemoteAccessSettings;
+exports.serializeRemoteAccessSettings = serializeRemoteAccessSettings;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/remoteAccessSettings/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/remoteAccessSettings/index.ts"],"sourcesContent":["/**\n * The persisted remote-access settings, and how a bad file becomes a good one.\n *\n * Every failure here is recoverable by falling back, never by throwing: a\n * corrupt settings file must not stop the cockpit from starting, because the\n * cockpit is how you would fix it.\n */\n\nimport type { RemoteAccessSettings, SandboxSettings, TunnelConfig } from '../../types/remote';\n\n/** Bumped when a field changes meaning; an unrecognised version falls back to defaults. */\nexport const REMOTE_SETTINGS_VERSION = 1;\n\nconst MIN_MINUTES = 1;\nconst MAX_MINUTES = 1440;\nconst MIN_HOURS = 1;\nconst MAX_HOURS = 720;\n\n/**\n * Both time limits start off.\n *\n * The durations are still here so switching one on lands on a sensible number\n * rather than an empty field. What being off actually means: a tunnel stays up\n * until it is closed or the hub restarts, and a paired session lasts until it\n * is revoked or remote access is switched off. Those two events are the only\n * expiry there is by default.\n */\nexport const DEFAULT_REMOTE_SETTINGS: RemoteAccessSettings = {\n  autoCloseEnabled: false,\n  autoCloseMinutes: 60,\n  sessionExpiryEnabled: false,\n  idleMinutes: 30,\n  absoluteHours: 12,\n  tunnel: { kind: 'quick' },\n  sandbox: { enabled: false, workspaces: [] },\n};\n\nexport interface ParsedRemoteSettings {\n  settings: RemoteAccessSettings;\n  /** Everything that had to be corrected, so the host can say so once rather than silently differ. */\n  warnings: string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readBoolean(raw: unknown, fallback: boolean, field: string, warnings: string[]): boolean {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'boolean') {\n    warnings.push(`${field} must be true or false; using ${String(fallback)}.`);\n    return fallback;\n  }\n  return raw;\n}\n\nfunction readClamped(\n  raw: unknown,\n  fallback: number,\n  bounds: { min: number; max: number },\n  field: string,\n  warnings: string[],\n): number {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n    warnings.push(`${field} must be a number; using ${String(fallback)}.`);\n    return fallback;\n  }\n  const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));\n  if (clamped !== raw) {\n    warnings.push(\n      `${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`,\n    );\n  }\n  return clamped;\n}\n\n/**\n * A tunnel configuration is only accepted whole.\n *\n * A named tunnel missing its hostname is not a named tunnel with a default, it\n * is a misconfiguration, and quietly falling back to a quick tunnel would swap\n * a stable origin for a rotating one without telling anybody.\n */\nfunction readTunnel(raw: unknown, warnings: string[]): TunnelConfig {\n  if (raw === undefined) return DEFAULT_REMOTE_SETTINGS.tunnel;\n  if (!isRecord(raw)) {\n    warnings.push('tunnel must be an object; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  if (raw.kind === 'quick') return { kind: 'quick' };\n  if (raw.kind !== 'named') {\n    warnings.push(`tunnel.kind must be \"quick\" or \"named\"; using a quick tunnel.`);\n    return { kind: 'quick' };\n  }\n  if (typeof raw.hostname !== 'string' || raw.hostname === '') {\n    warnings.push('A named tunnel needs a hostname; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  return {\n    kind: 'named',\n    hostname: raw.hostname,\n    ...(typeof raw.name === 'string' && raw.name !== '' ? { name: raw.name } : {}),\n    ...(typeof raw.tokenFile === 'string' && raw.tokenFile !== '' ? { tokenFile: raw.tokenFile } : {}),\n    ...(typeof raw.configFile === 'string' && raw.configFile !== '' ? { configFile: raw.configFile } : {}),\n  };\n}\n\n/**\n * Reads the container settings, keeping only absolute workspace paths.\n *\n * A relative path would resolve against the container's working directory\n * rather than the host's, which is a mount that silently points somewhere else.\n * Refusing one is better than mounting the wrong directory.\n */\nfunction readSandbox(raw: unknown, warnings: string[]): SandboxSettings {\n  const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;\n  if (raw === undefined) return fallback;\n  if (!isRecord(raw)) {\n    warnings.push('sandbox must be an object; the cockpit will not be contained.');\n    return fallback;\n  }\n  const workspaces: string[] = [];\n  for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {\n    if (typeof entry !== 'string' || !entry.startsWith('/')) {\n      warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);\n      continue;\n    }\n    if (!workspaces.includes(entry)) workspaces.push(entry);\n  }\n  return { enabled: readBoolean(raw.enabled, fallback.enabled, 'sandbox.enabled', warnings), workspaces };\n}\n\nexport function parseRemoteAccessSettings(raw: unknown): ParsedRemoteSettings {\n  const warnings: string[] = [];\n  if (!isRecord(raw)) {\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  if (raw.version !== REMOTE_SETTINGS_VERSION) {\n    warnings.push(\n      `Settings version ${String(raw.version)} is not version ${String(REMOTE_SETTINGS_VERSION)}; using defaults.`,\n    );\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  const defaults = DEFAULT_REMOTE_SETTINGS;\n  return {\n    settings: {\n      autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, 'autoCloseEnabled', warnings),\n      autoCloseMinutes: readClamped(\n        raw.autoCloseMinutes,\n        defaults.autoCloseMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'autoCloseMinutes',\n        warnings,\n      ),\n      sessionExpiryEnabled: readBoolean(\n        raw.sessionExpiryEnabled,\n        defaults.sessionExpiryEnabled,\n        'sessionExpiryEnabled',\n        warnings,\n      ),\n      idleMinutes: readClamped(\n        raw.idleMinutes,\n        defaults.idleMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'idleMinutes',\n        warnings,\n      ),\n      absoluteHours: readClamped(\n        raw.absoluteHours,\n        defaults.absoluteHours,\n        { min: MIN_HOURS, max: MAX_HOURS },\n        'absoluteHours',\n        warnings,\n      ),\n      tunnel: readTunnel(raw.tunnel, warnings),\n      sandbox: readSandbox(raw.sandbox, warnings),\n    },\n    warnings,\n  };\n}\n\nexport function serializeRemoteAccessSettings(settings: RemoteAccessSettings): unknown {\n  return { version: REMOTE_SETTINGS_VERSION, ...settings };\n}\n"],"mappings":"AAaA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;;;;;;;;;;AAWlB,MAAa,0BAAgD;CAC3D,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CACtB,aAAa;CACb,eAAe;CACf,QAAQ,EAAE,MAAM,QAAQ;CACxB,SAAS;EAAE,SAAS;EAAO,YAAY,CAAC;CAAE;AAC5C;AAQA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,KAAc,UAAmB,OAAe,UAA6B;CAChG,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,WAAW;EAC5B,SAAS,KAAK,GAAG,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;EAC1E,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,YACP,KACA,UACA,QACA,OACA,UACQ;CACR,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;EACpD,SAAS,KAAK,GAAG,MAAM,2BAA2B,OAAO,QAAQ,EAAE,EAAE;EACrE,OAAO;CACT;CACA,MAAM,UAAU,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;CAC1E,IAAI,YAAY,KACd,SAAS,KACP,GAAG,MAAM,mBAAmB,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,EACrG;CAEF,OAAO;AACT;;;;;;;;AASA,SAAS,WAAW,KAAc,UAAkC;CAClE,IAAI,QAAQ,KAAA,GAAW,OAAO,wBAAwB;CACtD,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,iDAAiD;EAC/D,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CACjD,IAAI,IAAI,SAAS,SAAS;EACxB,SAAS,KAAK,+DAA+D;EAC7E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,IAAI;EAC3D,SAAS,KAAK,wDAAwD;EACtE,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,OAAO;EACL,MAAM;EACN,UAAU,IAAI;EACd,GAAI,OAAO,IAAI,SAAS,YAAY,IAAI,SAAS,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EAC5E,GAAI,OAAO,IAAI,cAAc,YAAY,IAAI,cAAc,KAAK,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EAChG,GAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,KAAK,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;CACtG;AACF;;;;;;;;AASA,SAAS,YAAY,KAAc,UAAqC;CACtE,MAAM,WAAW,wBAAwB;CACzC,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,+DAA+D;EAC7E,OAAO;CACT;CACA,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC,GAAG;EACvE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,GAAG;GACvD,SAAS,KAAK,kDAAkD,OAAO,KAAK,EAAE,EAAE;GAChF;EACF;EACA,IAAI,CAAC,WAAW,SAAS,KAAK,GAAG,WAAW,KAAK,KAAK;CACxD;CACA,OAAO;EAAE,SAAS,YAAY,IAAI,SAAS,SAAS,SAAS,mBAAmB,QAAQ;EAAG;CAAW;AACxG;AAEA,SAAgB,0BAA0B,KAAoC;CAC5E,MAAM,WAAqB,CAAC;CAC5B,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAAE,UAAU;EAAyB;CAAS;CAEvD,IAAI,IAAI,YAAA,GAAqC;EAC3C,SAAS,KACP,oBAAoB,OAAO,IAAI,OAAO,EAAE,kBAAkB,OAAA,CAA8B,EAAE,kBAC5F;EACA,OAAO;GAAE,UAAU;GAAyB;EAAS;CACvD;CACA,MAAM,WAAW;CACjB,OAAO;EACL,UAAU;GACR,kBAAkB,YAAY,IAAI,kBAAkB,SAAS,kBAAkB,oBAAoB,QAAQ;GAC3G,kBAAkB,YAChB,IAAI,kBACJ,SAAS,kBACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,oBACA,QACF;GACA,sBAAsB,YACpB,IAAI,sBACJ,SAAS,sBACT,wBACA,QACF;GACA,aAAa,YACX,IAAI,aACJ,SAAS,aACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,eACA,QACF;GACA,eAAe,YACb,IAAI,eACJ,SAAS,eACT;IAAE,KAAK;IAAW,KAAK;GAAU,GACjC,iBACA,QACF;GACA,QAAQ,WAAW,IAAI,QAAQ,QAAQ;GACvC,SAAS,YAAY,IAAI,SAAS,QAAQ;EAC5C;EACA;CACF;AACF;AAEA,SAAgB,8BAA8B,UAAyC;CACrF,OAAO;EAAE,SAAA;EAAkC,GAAG;CAAS;AACzD"}

package/dist/src/services/remoteAccessSettings/index.mjs

@@ -0,0 +1,149 @@
+const MIN_MINUTES = 1;
+const MAX_MINUTES = 1440;
+const MIN_HOURS = 1;
+const MAX_HOURS = 720;
+/**
+* Both time limits start off.
+*
+* The durations are still here so switching one on lands on a sensible number
+* rather than an empty field. What being off actually means: a tunnel stays up
+* until it is closed or the hub restarts, and a paired session lasts until it
+* is revoked or remote access is switched off. Those two events are the only
+* expiry there is by default.
+*/
+const DEFAULT_REMOTE_SETTINGS = {
+	autoCloseEnabled: false,
+	autoCloseMinutes: 60,
+	sessionExpiryEnabled: false,
+	idleMinutes: 30,
+	absoluteHours: 12,
+	tunnel: { kind: "quick" },
+	sandbox: {
+		enabled: false,
+		workspaces: []
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBoolean(raw, fallback, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "boolean") {
+		warnings.push(`${field} must be true or false; using ${String(fallback)}.`);
+		return fallback;
+	}
+	return raw;
+}
+function readClamped(raw, fallback, bounds, field, warnings) {
+	if (raw === void 0) return fallback;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) {
+		warnings.push(`${field} must be a number; using ${String(fallback)}.`);
+		return fallback;
+	}
+	const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));
+	if (clamped !== raw) warnings.push(`${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`);
+	return clamped;
+}
+/**
+* A tunnel configuration is only accepted whole.
+*
+* A named tunnel missing its hostname is not a named tunnel with a default, it
+* is a misconfiguration, and quietly falling back to a quick tunnel would swap
+* a stable origin for a rotating one without telling anybody.
+*/
+function readTunnel(raw, warnings) {
+	if (raw === void 0) return DEFAULT_REMOTE_SETTINGS.tunnel;
+	if (!isRecord(raw)) {
+		warnings.push("tunnel must be an object; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	if (raw.kind === "quick") return { kind: "quick" };
+	if (raw.kind !== "named") {
+		warnings.push(`tunnel.kind must be "quick" or "named"; using a quick tunnel.`);
+		return { kind: "quick" };
+	}
+	if (typeof raw.hostname !== "string" || raw.hostname === "") {
+		warnings.push("A named tunnel needs a hostname; using a quick tunnel.");
+		return { kind: "quick" };
+	}
+	return {
+		kind: "named",
+		hostname: raw.hostname,
+		...typeof raw.name === "string" && raw.name !== "" ? { name: raw.name } : {},
+		...typeof raw.tokenFile === "string" && raw.tokenFile !== "" ? { tokenFile: raw.tokenFile } : {},
+		...typeof raw.configFile === "string" && raw.configFile !== "" ? { configFile: raw.configFile } : {}
+	};
+}
+/**
+* Reads the container settings, keeping only absolute workspace paths.
+*
+* A relative path would resolve against the container's working directory
+* rather than the host's, which is a mount that silently points somewhere else.
+* Refusing one is better than mounting the wrong directory.
+*/
+function readSandbox(raw, warnings) {
+	const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;
+	if (raw === void 0) return fallback;
+	if (!isRecord(raw)) {
+		warnings.push("sandbox must be an object; the cockpit will not be contained.");
+		return fallback;
+	}
+	const workspaces = [];
+	for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {
+		if (typeof entry !== "string" || !entry.startsWith("/")) {
+			warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);
+			continue;
+		}
+		if (!workspaces.includes(entry)) workspaces.push(entry);
+	}
+	return {
+		enabled: readBoolean(raw.enabled, fallback.enabled, "sandbox.enabled", warnings),
+		workspaces
+	};
+}
+function parseRemoteAccessSettings(raw) {
+	const warnings = [];
+	if (!isRecord(raw)) return {
+		settings: DEFAULT_REMOTE_SETTINGS,
+		warnings
+	};
+	if (raw.version !== 1) {
+		warnings.push(`Settings version ${String(raw.version)} is not version ${String(1)}; using defaults.`);
+		return {
+			settings: DEFAULT_REMOTE_SETTINGS,
+			warnings
+		};
+	}
+	const defaults = DEFAULT_REMOTE_SETTINGS;
+	return {
+		settings: {
+			autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, "autoCloseEnabled", warnings),
+			autoCloseMinutes: readClamped(raw.autoCloseMinutes, defaults.autoCloseMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "autoCloseMinutes", warnings),
+			sessionExpiryEnabled: readBoolean(raw.sessionExpiryEnabled, defaults.sessionExpiryEnabled, "sessionExpiryEnabled", warnings),
+			idleMinutes: readClamped(raw.idleMinutes, defaults.idleMinutes, {
+				min: MIN_MINUTES,
+				max: MAX_MINUTES
+			}, "idleMinutes", warnings),
+			absoluteHours: readClamped(raw.absoluteHours, defaults.absoluteHours, {
+				min: MIN_HOURS,
+				max: MAX_HOURS
+			}, "absoluteHours", warnings),
+			tunnel: readTunnel(raw.tunnel, warnings),
+			sandbox: readSandbox(raw.sandbox, warnings)
+		},
+		warnings
+	};
+}
+function serializeRemoteAccessSettings(settings) {
+	return {
+		version: 1,
+		...settings
+	};
+}
+//#endregion
+export { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings, serializeRemoteAccessSettings };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/remoteAccessSettings/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/remoteAccessSettings/index.ts"],"sourcesContent":["/**\n * The persisted remote-access settings, and how a bad file becomes a good one.\n *\n * Every failure here is recoverable by falling back, never by throwing: a\n * corrupt settings file must not stop the cockpit from starting, because the\n * cockpit is how you would fix it.\n */\n\nimport type { RemoteAccessSettings, SandboxSettings, TunnelConfig } from '../../types/remote';\n\n/** Bumped when a field changes meaning; an unrecognised version falls back to defaults. */\nexport const REMOTE_SETTINGS_VERSION = 1;\n\nconst MIN_MINUTES = 1;\nconst MAX_MINUTES = 1440;\nconst MIN_HOURS = 1;\nconst MAX_HOURS = 720;\n\n/**\n * Both time limits start off.\n *\n * The durations are still here so switching one on lands on a sensible number\n * rather than an empty field. What being off actually means: a tunnel stays up\n * until it is closed or the hub restarts, and a paired session lasts until it\n * is revoked or remote access is switched off. Those two events are the only\n * expiry there is by default.\n */\nexport const DEFAULT_REMOTE_SETTINGS: RemoteAccessSettings = {\n  autoCloseEnabled: false,\n  autoCloseMinutes: 60,\n  sessionExpiryEnabled: false,\n  idleMinutes: 30,\n  absoluteHours: 12,\n  tunnel: { kind: 'quick' },\n  sandbox: { enabled: false, workspaces: [] },\n};\n\nexport interface ParsedRemoteSettings {\n  settings: RemoteAccessSettings;\n  /** Everything that had to be corrected, so the host can say so once rather than silently differ. */\n  warnings: string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readBoolean(raw: unknown, fallback: boolean, field: string, warnings: string[]): boolean {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'boolean') {\n    warnings.push(`${field} must be true or false; using ${String(fallback)}.`);\n    return fallback;\n  }\n  return raw;\n}\n\nfunction readClamped(\n  raw: unknown,\n  fallback: number,\n  bounds: { min: number; max: number },\n  field: string,\n  warnings: string[],\n): number {\n  if (raw === undefined) return fallback;\n  if (typeof raw !== 'number' || !Number.isFinite(raw)) {\n    warnings.push(`${field} must be a number; using ${String(fallback)}.`);\n    return fallback;\n  }\n  const clamped = Math.min(bounds.max, Math.max(bounds.min, Math.round(raw)));\n  if (clamped !== raw) {\n    warnings.push(\n      `${field} must be between ${String(bounds.min)} and ${String(bounds.max)}; using ${String(clamped)}.`,\n    );\n  }\n  return clamped;\n}\n\n/**\n * A tunnel configuration is only accepted whole.\n *\n * A named tunnel missing its hostname is not a named tunnel with a default, it\n * is a misconfiguration, and quietly falling back to a quick tunnel would swap\n * a stable origin for a rotating one without telling anybody.\n */\nfunction readTunnel(raw: unknown, warnings: string[]): TunnelConfig {\n  if (raw === undefined) return DEFAULT_REMOTE_SETTINGS.tunnel;\n  if (!isRecord(raw)) {\n    warnings.push('tunnel must be an object; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  if (raw.kind === 'quick') return { kind: 'quick' };\n  if (raw.kind !== 'named') {\n    warnings.push(`tunnel.kind must be \"quick\" or \"named\"; using a quick tunnel.`);\n    return { kind: 'quick' };\n  }\n  if (typeof raw.hostname !== 'string' || raw.hostname === '') {\n    warnings.push('A named tunnel needs a hostname; using a quick tunnel.');\n    return { kind: 'quick' };\n  }\n  return {\n    kind: 'named',\n    hostname: raw.hostname,\n    ...(typeof raw.name === 'string' && raw.name !== '' ? { name: raw.name } : {}),\n    ...(typeof raw.tokenFile === 'string' && raw.tokenFile !== '' ? { tokenFile: raw.tokenFile } : {}),\n    ...(typeof raw.configFile === 'string' && raw.configFile !== '' ? { configFile: raw.configFile } : {}),\n  };\n}\n\n/**\n * Reads the container settings, keeping only absolute workspace paths.\n *\n * A relative path would resolve against the container's working directory\n * rather than the host's, which is a mount that silently points somewhere else.\n * Refusing one is better than mounting the wrong directory.\n */\nfunction readSandbox(raw: unknown, warnings: string[]): SandboxSettings {\n  const fallback = DEFAULT_REMOTE_SETTINGS.sandbox;\n  if (raw === undefined) return fallback;\n  if (!isRecord(raw)) {\n    warnings.push('sandbox must be an object; the cockpit will not be contained.');\n    return fallback;\n  }\n  const workspaces: string[] = [];\n  for (const entry of Array.isArray(raw.workspaces) ? raw.workspaces : []) {\n    if (typeof entry !== 'string' || !entry.startsWith('/')) {\n      warnings.push(`A workspace must be an absolute path; ignoring ${String(entry)}.`);\n      continue;\n    }\n    if (!workspaces.includes(entry)) workspaces.push(entry);\n  }\n  return { enabled: readBoolean(raw.enabled, fallback.enabled, 'sandbox.enabled', warnings), workspaces };\n}\n\nexport function parseRemoteAccessSettings(raw: unknown): ParsedRemoteSettings {\n  const warnings: string[] = [];\n  if (!isRecord(raw)) {\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  if (raw.version !== REMOTE_SETTINGS_VERSION) {\n    warnings.push(\n      `Settings version ${String(raw.version)} is not version ${String(REMOTE_SETTINGS_VERSION)}; using defaults.`,\n    );\n    return { settings: DEFAULT_REMOTE_SETTINGS, warnings };\n  }\n  const defaults = DEFAULT_REMOTE_SETTINGS;\n  return {\n    settings: {\n      autoCloseEnabled: readBoolean(raw.autoCloseEnabled, defaults.autoCloseEnabled, 'autoCloseEnabled', warnings),\n      autoCloseMinutes: readClamped(\n        raw.autoCloseMinutes,\n        defaults.autoCloseMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'autoCloseMinutes',\n        warnings,\n      ),\n      sessionExpiryEnabled: readBoolean(\n        raw.sessionExpiryEnabled,\n        defaults.sessionExpiryEnabled,\n        'sessionExpiryEnabled',\n        warnings,\n      ),\n      idleMinutes: readClamped(\n        raw.idleMinutes,\n        defaults.idleMinutes,\n        { min: MIN_MINUTES, max: MAX_MINUTES },\n        'idleMinutes',\n        warnings,\n      ),\n      absoluteHours: readClamped(\n        raw.absoluteHours,\n        defaults.absoluteHours,\n        { min: MIN_HOURS, max: MAX_HOURS },\n        'absoluteHours',\n        warnings,\n      ),\n      tunnel: readTunnel(raw.tunnel, warnings),\n      sandbox: readSandbox(raw.sandbox, warnings),\n    },\n    warnings,\n  };\n}\n\nexport function serializeRemoteAccessSettings(settings: RemoteAccessSettings): unknown {\n  return { version: REMOTE_SETTINGS_VERSION, ...settings };\n}\n"],"mappings":"AAaA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;;;;;;;;;;AAWlB,MAAa,0BAAgD;CAC3D,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CACtB,aAAa;CACb,eAAe;CACf,QAAQ,EAAE,MAAM,QAAQ;CACxB,SAAS;EAAE,SAAS;EAAO,YAAY,CAAC;CAAE;AAC5C;AAQA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,KAAc,UAAmB,OAAe,UAA6B;CAChG,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,WAAW;EAC5B,SAAS,KAAK,GAAG,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;EAC1E,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,YACP,KACA,UACA,QACA,OACA,UACQ;CACR,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;EACpD,SAAS,KAAK,GAAG,MAAM,2BAA2B,OAAO,QAAQ,EAAE,EAAE;EACrE,OAAO;CACT;CACA,MAAM,UAAU,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;CAC1E,IAAI,YAAY,KACd,SAAS,KACP,GAAG,MAAM,mBAAmB,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,EACrG;CAEF,OAAO;AACT;;;;;;;;AASA,SAAS,WAAW,KAAc,UAAkC;CAClE,IAAI,QAAQ,KAAA,GAAW,OAAO,wBAAwB;CACtD,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,iDAAiD;EAC/D,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CACjD,IAAI,IAAI,SAAS,SAAS;EACxB,SAAS,KAAK,+DAA+D;EAC7E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,IAAI;EAC3D,SAAS,KAAK,wDAAwD;EACtE,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,OAAO;EACL,MAAM;EACN,UAAU,IAAI;EACd,GAAI,OAAO,IAAI,SAAS,YAAY,IAAI,SAAS,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EAC5E,GAAI,OAAO,IAAI,cAAc,YAAY,IAAI,cAAc,KAAK,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EAChG,GAAI,OAAO,IAAI,eAAe,YAAY,IAAI,eAAe,KAAK,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;CACtG;AACF;;;;;;;;AASA,SAAS,YAAY,KAAc,UAAqC;CACtE,MAAM,WAAW,wBAAwB;CACzC,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,SAAS,KAAK,+DAA+D;EAC7E,OAAO;CACT;CACA,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC,GAAG;EACvE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,GAAG;GACvD,SAAS,KAAK,kDAAkD,OAAO,KAAK,EAAE,EAAE;GAChF;EACF;EACA,IAAI,CAAC,WAAW,SAAS,KAAK,GAAG,WAAW,KAAK,KAAK;CACxD;CACA,OAAO;EAAE,SAAS,YAAY,IAAI,SAAS,SAAS,SAAS,mBAAmB,QAAQ;EAAG;CAAW;AACxG;AAEA,SAAgB,0BAA0B,KAAoC;CAC5E,MAAM,WAAqB,CAAC;CAC5B,IAAI,CAAC,SAAS,GAAG,GACf,OAAO;EAAE,UAAU;EAAyB;CAAS;CAEvD,IAAI,IAAI,YAAA,GAAqC;EAC3C,SAAS,KACP,oBAAoB,OAAO,IAAI,OAAO,EAAE,kBAAkB,OAAA,CAA8B,EAAE,kBAC5F;EACA,OAAO;GAAE,UAAU;GAAyB;EAAS;CACvD;CACA,MAAM,WAAW;CACjB,OAAO;EACL,UAAU;GACR,kBAAkB,YAAY,IAAI,kBAAkB,SAAS,kBAAkB,oBAAoB,QAAQ;GAC3G,kBAAkB,YAChB,IAAI,kBACJ,SAAS,kBACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,oBACA,QACF;GACA,sBAAsB,YACpB,IAAI,sBACJ,SAAS,sBACT,wBACA,QACF;GACA,aAAa,YACX,IAAI,aACJ,SAAS,aACT;IAAE,KAAK;IAAa,KAAK;GAAY,GACrC,eACA,QACF;GACA,eAAe,YACb,IAAI,eACJ,SAAS,eACT;IAAE,KAAK;IAAW,KAAK;GAAU,GACjC,iBACA,QACF;GACA,QAAQ,WAAW,IAAI,QAAQ,QAAQ;GACvC,SAAS,YAAY,IAAI,SAAS,QAAQ;EAC5C;EACA;CACF;AACF;AAEA,SAAgB,8BAA8B,UAAyC;CACrF,OAAO;EAAE,SAAA;EAAkC,GAAG;CAAS;AACzD"}

package/dist/src/services/remoteAccessStore/index.cjs

@@ -0,0 +1,197 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_runtimePiSettings = require("../../../runtimePiSettings.cjs");
+require("../../constants/remote.cjs");
+const require_index = require("../remoteAccessSettings/index.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_os = require("node:os");
+node_os = require_runtime.__toESM(node_os, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/services/remoteAccessStore/index.ts
+/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */
+const STATE_DIRECTORY = "web";
+const SETTINGS_FILE = "remote-access.json";
+const CREDENTIALS_FILE = "credentials.json";
+const TRUSTED_DEVICES_FILE = "trusted-devices.json";
+const TRUSTED_DEVICE_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
+const STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;
+const STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;
+const MAX_STORED_LABEL = 200;
+const DIRECTORY_MODE = 448;
+const FILE_MODE = 384;
+/** Any bit set for group or other; a state file readable by another account is worth repairing. */
+const LOOSE_MODE_MASK = 63;
+function defaultRemoteStateDir(homeDir = node_os.default.homedir()) {
+	return node_path.default.join(require_runtimePiSettings.poHomeDirectory(homeDir), STATE_DIRECTORY);
+}
+/**
+* Repairs a state file another account can read.
+*
+* Cheap, and it catches the cases a fresh write never would: a file restored
+* from a backup, copied with a permissive umask, or checked out of somewhere it
+* should not have been.
+*/
+function tightenMode(filePath, notice) {
+	try {
+		if ((node_fs.default.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;
+		node_fs.default.chmodSync(filePath, FILE_MODE);
+		notice(`tightened permissions on ${filePath}`);
+	} catch {}
+}
+/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */
+function isTrustedDeviceRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && STORED_ID.test(record.id) && typeof record.identityPublicKey === "string" && STORED_KEY.test(record.identityPublicKey) && typeof record.stepUpPublicKey === "string" && STORED_KEY.test(record.stepUpPublicKey) && record.identityPublicKey !== record.stepUpPublicKey && typeof record.label === "string" && record.label.length <= MAX_STORED_LABEL && typeof record.platform === "string" && TRUSTED_DEVICE_PLATFORMS.has(record.platform) && Number.isFinite(record.createdAt) && Number.isFinite(record.lastSeenAt);
+}
+/**
+* Settings and passkeys on disk. Sessions deliberately not.
+*
+* A session is revoked when remote access is switched off, and a hub restart is
+* a switch-off, so persisting one would buy nothing while creating a bearer
+* secret worth stealing. A passkey is the opposite: surviving is its whole
+* point, and what is stored is a public key.
+*/
+function createRemoteAccessStore(options = {}) {
+	const directory = options.stateDir ?? defaultRemoteStateDir();
+	const notice = options.onNotice ?? (() => {});
+	const settingsPath = node_path.default.join(directory, SETTINGS_FILE);
+	const credentialsPath = node_path.default.join(directory, CREDENTIALS_FILE);
+	const trustedDevicesPath = node_path.default.join(directory, TRUSTED_DEVICES_FILE);
+	let current = load();
+	let registered = loadCredentials();
+	let trusted = loadTrustedDevices();
+	function load() {
+		let raw;
+		try {
+			raw = node_fs.default.readFileSync(settingsPath, "utf8");
+		} catch {
+			return require_index.DEFAULT_REMOTE_SETTINGS;
+		}
+		tightenMode(settingsPath, notice);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
+			return require_index.DEFAULT_REMOTE_SETTINGS;
+		}
+		const outcome = require_index.parseRemoteAccessSettings(parsed);
+		for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
+		return outcome.settings;
+	}
+	function loadCredentials() {
+		let raw;
+		try {
+			raw = node_fs.default.readFileSync(credentialsPath, "utf8");
+		} catch {
+			return [];
+		}
+		tightenMode(credentialsPath, notice);
+		try {
+			const parsed = JSON.parse(raw);
+			return Array.isArray(parsed) ? parsed : [];
+		} catch {
+			notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
+			return [];
+		}
+	}
+	function loadTrustedDevices() {
+		let raw;
+		try {
+			raw = node_fs.default.readFileSync(trustedDevicesPath, "utf8");
+		} catch {
+			return [];
+		}
+		tightenMode(trustedDevicesPath, notice);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);
+			return [];
+		}
+		if (!Array.isArray(parsed)) {
+			notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);
+			return [];
+		}
+		const loaded = [];
+		for (const entry of parsed) {
+			if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {
+				notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);
+				continue;
+			}
+			if (loaded.length >= 32) {
+				notice(`dropped trusted devices beyond the limit of ${String(32)} from ${trustedDevicesPath}`);
+				break;
+			}
+			loaded.push({
+				id: entry.id,
+				identityPublicKey: entry.identityPublicKey,
+				stepUpPublicKey: entry.stepUpPublicKey,
+				label: entry.label,
+				platform: entry.platform,
+				createdAt: entry.createdAt,
+				lastSeenAt: entry.lastSeenAt
+			});
+		}
+		return loaded;
+	}
+	function writeJson(target, body) {
+		const temporary = `${target}.${String(process.pid)}.tmp`;
+		try {
+			node_fs.default.mkdirSync(directory, {
+				recursive: true,
+				mode: DIRECTORY_MODE
+			});
+			node_fs.default.writeFileSync(temporary, `${JSON.stringify(body, void 0, 2)}\n`, { mode: FILE_MODE });
+			node_fs.default.renameSync(temporary, target);
+		} catch (error) {
+			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
+			try {
+				node_fs.default.rmSync(temporary, { force: true });
+			} catch {}
+		}
+	}
+	return {
+		directory,
+		settings: () => current,
+		credentials: () => registered,
+		saveCredential(credential) {
+			registered = [...registered.filter((held) => held.id !== credential.id), credential];
+			writeJson(credentialsPath, registered);
+		},
+		removeCredential(id) {
+			const next = registered.filter((held) => held.id !== id);
+			if (next.length === registered.length) return false;
+			registered = next;
+			writeJson(credentialsPath, registered);
+			return true;
+		},
+		trustedDevices: () => trusted,
+		saveTrustedDevice(record) {
+			const others = trusted.filter((held) => held.id !== record.id);
+			if (others.length === trusted.length && trusted.length >= 32) return false;
+			trusted = [...others, record];
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		removeTrustedDevice(id) {
+			const next = trusted.filter((held) => held.id !== id);
+			if (next.length === trusted.length) return false;
+			trusted = next;
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		save(settings) {
+			current = settings;
+			writeJson(settingsPath, require_index.serializeRemoteAccessSettings(settings));
+		}
+	};
+}
+//#endregion
+exports.createRemoteAccessStore = createRemoteAccessStore;
+exports.defaultRemoteStateDir = defaultRemoteStateDir;
+
+//# sourceMappingURL=index.cjs.map