@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/src/services/remoteAccessStore/index.cjs

@@ -1,197 +1,15 @@
 const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
-const require_runtimePiSettings = require("../../../runtimePiSettings.cjs");
+require("../platformFiles/index.cjs");
+const require_index$1 = require("../serialRunner/index.cjs");
 require("../../constants/remote.cjs");
-const require_index = require("../remoteAccessSettings/index.cjs");
-let node_fs = require("node:fs");
-node_fs = require_runtime.__toESM(node_fs, 1);
-let node_os = require("node:os");
-node_os = require_runtime.__toESM(node_os, 1);
+const require_remoteAccessRecords = require("./remoteAccessRecords.cjs");
+const require_sync = require("./sync.cjs");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
-//#region src/services/remoteAccessStore/index.ts
-/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */
-const STATE_DIRECTORY = "web";
-const SETTINGS_FILE = "remote-access.json";
-const CREDENTIALS_FILE = "credentials.json";
-const TRUSTED_DEVICES_FILE = "trusted-devices.json";
-const TRUSTED_DEVICE_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
-const STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;
-const STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;
-const MAX_STORED_LABEL = 200;
-const DIRECTORY_MODE = 448;
-const FILE_MODE = 384;
-/** Any bit set for group or other; a state file readable by another account is worth repairing. */
-const LOOSE_MODE_MASK = 63;
-function defaultRemoteStateDir(homeDir = node_os.default.homedir()) {
-	return node_path.default.join(require_runtimePiSettings.poHomeDirectory(homeDir), STATE_DIRECTORY);
-}
-/**
-* Repairs a state file another account can read.
-*
-* Cheap, and it catches the cases a fresh write never would: a file restored
-* from a backup, copied with a permissive umask, or checked out of somewhere it
-* should not have been.
-*/
-function tightenMode(filePath, notice) {
-	try {
-		if ((node_fs.default.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;
-		node_fs.default.chmodSync(filePath, FILE_MODE);
-		notice(`tightened permissions on ${filePath}`);
-	} catch {}
-}
-/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */
-function isTrustedDeviceRecord(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const record = value;
-	return typeof record.id === "string" && STORED_ID.test(record.id) && typeof record.identityPublicKey === "string" && STORED_KEY.test(record.identityPublicKey) && typeof record.stepUpPublicKey === "string" && STORED_KEY.test(record.stepUpPublicKey) && record.identityPublicKey !== record.stepUpPublicKey && typeof record.label === "string" && record.label.length <= MAX_STORED_LABEL && typeof record.platform === "string" && TRUSTED_DEVICE_PLATFORMS.has(record.platform) && Number.isFinite(record.createdAt) && Number.isFinite(record.lastSeenAt);
-}
-/**
-* Settings and passkeys on disk. Sessions deliberately not.
-*
-* A session is revoked when remote access is switched off, and a hub restart is
-* a switch-off, so persisting one would buy nothing while creating a bearer
-* secret worth stealing. A passkey is the opposite: surviving is its whole
-* point, and what is stored is a public key.
-*/
-function createRemoteAccessStore(options = {}) {
-	const directory = options.stateDir ?? defaultRemoteStateDir();
-	const notice = options.onNotice ?? (() => {});
-	const settingsPath = node_path.default.join(directory, SETTINGS_FILE);
-	const credentialsPath = node_path.default.join(directory, CREDENTIALS_FILE);
-	const trustedDevicesPath = node_path.default.join(directory, TRUSTED_DEVICES_FILE);
-	let current = load();
-	let registered = loadCredentials();
-	let trusted = loadTrustedDevices();
-	function load() {
-		let raw;
-		try {
-			raw = node_fs.default.readFileSync(settingsPath, "utf8");
-		} catch {
-			return require_index.DEFAULT_REMOTE_SETTINGS;
-		}
-		tightenMode(settingsPath, notice);
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
-			return require_index.DEFAULT_REMOTE_SETTINGS;
-		}
-		const outcome = require_index.parseRemoteAccessSettings(parsed);
-		for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
-		return outcome.settings;
-	}
-	function loadCredentials() {
-		let raw;
-		try {
-			raw = node_fs.default.readFileSync(credentialsPath, "utf8");
-		} catch {
-			return [];
-		}
-		tightenMode(credentialsPath, notice);
-		try {
-			const parsed = JSON.parse(raw);
-			return Array.isArray(parsed) ? parsed : [];
-		} catch {
-			notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
-			return [];
-		}
-	}
-	function loadTrustedDevices() {
-		let raw;
-		try {
-			raw = node_fs.default.readFileSync(trustedDevicesPath, "utf8");
-		} catch {
-			return [];
-		}
-		tightenMode(trustedDevicesPath, notice);
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);
-			return [];
-		}
-		if (!Array.isArray(parsed)) {
-			notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);
-			return [];
-		}
-		const loaded = [];
-		for (const entry of parsed) {
-			if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {
-				notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);
-				continue;
-			}
-			if (loaded.length >= 32) {
-				notice(`dropped trusted devices beyond the limit of ${String(32)} from ${trustedDevicesPath}`);
-				break;
-			}
-			loaded.push({
-				id: entry.id,
-				identityPublicKey: entry.identityPublicKey,
-				stepUpPublicKey: entry.stepUpPublicKey,
-				label: entry.label,
-				platform: entry.platform,
-				createdAt: entry.createdAt,
-				lastSeenAt: entry.lastSeenAt
-			});
-		}
-		return loaded;
-	}
-	function writeJson(target, body) {
-		const temporary = `${target}.${String(process.pid)}.tmp`;
-		try {
-			node_fs.default.mkdirSync(directory, {
-				recursive: true,
-				mode: DIRECTORY_MODE
-			});
-			node_fs.default.writeFileSync(temporary, `${JSON.stringify(body, void 0, 2)}\n`, { mode: FILE_MODE });
-			node_fs.default.renameSync(temporary, target);
-		} catch (error) {
-			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
-			try {
-				node_fs.default.rmSync(temporary, { force: true });
-			} catch {}
-		}
-	}
-	return {
-		directory,
-		settings: () => current,
-		credentials: () => registered,
-		saveCredential(credential) {
-			registered = [...registered.filter((held) => held.id !== credential.id), credential];
-			writeJson(credentialsPath, registered);
-		},
-		removeCredential(id) {
-			const next = registered.filter((held) => held.id !== id);
-			if (next.length === registered.length) return false;
-			registered = next;
-			writeJson(credentialsPath, registered);
-			return true;
-		},
-		trustedDevices: () => trusted,
-		saveTrustedDevice(record) {
-			const others = trusted.filter((held) => held.id !== record.id);
-			if (others.length === trusted.length && trusted.length >= 32) return false;
-			trusted = [...others, record];
-			writeJson(trustedDevicesPath, trusted);
-			return true;
-		},
-		removeTrustedDevice(id) {
-			const next = trusted.filter((held) => held.id !== id);
-			if (next.length === trusted.length) return false;
-			trusted = next;
-			writeJson(trustedDevicesPath, trusted);
-			return true;
-		},
-		save(settings) {
-			current = settings;
-			writeJson(settingsPath, require_index.serializeRemoteAccessSettings(settings));
-		}
-	};
-}
+require("@earendil-works/pi-durable/env");
+require_index$1.createSerialRunner();
 //#endregion
-exports.createRemoteAccessStore = createRemoteAccessStore;
-exports.defaultRemoteStateDir = defaultRemoteStateDir;
+exports.createRemoteAccessStore = require_sync.createRemoteAccessStore;
+exports.defaultRemoteStateDir = require_remoteAccessRecords.defaultRemoteStateDir;
 
 //# sourceMappingURL=index.cjs.map

package/dist/src/services/remoteAccessStore/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["os","path","poHomeDirectory","fs","DEFAULT_REMOTE_SETTINGS","parseRemoteAccessSettings","serializeRemoteAccessSettings"],"sources":["../../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { poHomeDirectory } from '../piSettings';\nimport {\n  DEFAULT_REMOTE_SETTINGS,\n  parseRemoteAccessSettings,\n  serializeRemoteAccessSettings,\n} from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */\nconst STATE_DIRECTORY = 'web';\nconst SETTINGS_FILE = 'remote-access.json';\nconst CREDENTIALS_FILE = 'credentials.json';\nconst TRUSTED_DEVICES_FILE = 'trusted-devices.json';\nconst TRUSTED_DEVICE_PLATFORMS: ReadonlySet<string> = new Set(['ios', 'android']);\nconst STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;\nconst STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;\nconst MAX_STORED_LABEL = 200;\nconst DIRECTORY_MODE = 0o700;\nconst FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nconst LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.po/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): boolean;\n  removeTrustedDevice(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = os.homedir()): string {\n  return path.join(poHomeDirectory(homeDir), STATE_DIRECTORY);\n}\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\n/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */\nfunction isTrustedDeviceRecord(value: unknown): value is TrustedDeviceRecord {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.id === 'string' &&\n    STORED_ID.test(record.id) &&\n    typeof record.identityPublicKey === 'string' &&\n    STORED_KEY.test(record.identityPublicKey) &&\n    typeof record.stepUpPublicKey === 'string' &&\n    STORED_KEY.test(record.stepUpPublicKey) &&\n    record.identityPublicKey !== record.stepUpPublicKey &&\n    typeof record.label === 'string' &&\n    record.label.length <= MAX_STORED_LABEL &&\n    typeof record.platform === 'string' &&\n    TRUSTED_DEVICE_PLATFORMS.has(record.platform) &&\n    Number.isFinite(record.createdAt) &&\n    Number.isFinite(record.lastSeenAt)\n  );\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  let current = load();\n  let registered = loadCredentials();\n  let trusted = loadTrustedDevices();\n\n  function load(): RemoteAccessSettings {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(settingsPath, 'utf8');\n    } catch {\n      // No file is the normal first run, so this is not worth a notice.\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    tightenMode(settingsPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Left in place rather than rewritten: silently overwriting a file\n      // somebody hand-edited is worse than ignoring it for this run.\n      notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    const outcome = parseRemoteAccessSettings(parsed);\n    for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n    return outcome.settings;\n  }\n\n  function loadCredentials(): StoredCredential[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(credentialsPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(credentialsPath, notice);\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n    } catch {\n      // Fails closed: a half-readable credential file means enrolling again,\n      // not guessing which entries survived.\n      notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n      return [];\n    }\n  }\n\n  function loadTrustedDevices(): TrustedDeviceRecord[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(trustedDevicesPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(trustedDevicesPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Fails closed like passkeys: a device signs in only from a record read whole.\n      notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);\n      return [];\n    }\n    if (!Array.isArray(parsed)) {\n      notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);\n      return [];\n    }\n    const loaded: TrustedDeviceRecord[] = [];\n    for (const entry of parsed) {\n      if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {\n        notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);\n        continue;\n      }\n      if (loaded.length >= TRUSTED_DEVICE_LIMIT) {\n        notice(\n          `dropped trusted devices beyond the limit of ${String(TRUSTED_DEVICE_LIMIT)} from ${trustedDevicesPath}`,\n        );\n        break;\n      }\n      loaded.push({\n        id: entry.id,\n        identityPublicKey: entry.identityPublicKey,\n        stepUpPublicKey: entry.stepUpPublicKey,\n        label: entry.label,\n        platform: entry.platform,\n        createdAt: entry.createdAt,\n        lastSeenAt: entry.lastSeenAt,\n      });\n    }\n    return loaded;\n  }\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, `${JSON.stringify(body, undefined, 2)}\\n`, { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice(record) {\n      const others = trusted.filter((held) => held.id !== record.id);\n      if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n      trusted = [...others, record];\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    removeTrustedDevice(id) {\n      const next = trusted.filter((held) => held.id !== id);\n      if (next.length === trusted.length) return false;\n      trusted = next;\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAeA,MAAM,kBAAkB;AACxB,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,2CAAgD,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAChF,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,YAAY;;AAElB,MAAM,kBAAkB;AA0BxB,SAAgB,sBAAsB,UAAkBA,QAAAA,QAAG,QAAQ,GAAW;CAC5E,OAAOC,UAAAA,QAAK,KAAKC,0BAAAA,gBAAgB,OAAO,GAAG,eAAe;AAC5D;;;;;;;;AASA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,KAAKC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,qBAAqB,GAAG;EAC1D,QAAA,QAAG,UAAU,UAAU,SAAS;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;;AAGA,SAAS,sBAAsB,OAA8C;CAC3E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,OAAO,OAAO,YACrB,UAAU,KAAK,OAAO,EAAE,KACxB,OAAO,OAAO,sBAAsB,YACpC,WAAW,KAAK,OAAO,iBAAiB,KACxC,OAAO,OAAO,oBAAoB,YAClC,WAAW,KAAK,OAAO,eAAe,KACtC,OAAO,sBAAsB,OAAO,mBACpC,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,UAAU,oBACvB,OAAO,OAAO,aAAa,YAC3B,yBAAyB,IAAI,OAAO,QAAQ,KAC5C,OAAO,SAAS,OAAO,SAAS,KAChC,OAAO,SAAS,OAAO,UAAU;AAErC;;;;;;;;;AAUA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAY,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAeF,UAAAA,QAAK,KAAK,WAAW,aAAa;CACvD,MAAM,kBAAkBA,UAAAA,QAAK,KAAK,WAAW,gBAAgB;CAC7D,MAAM,qBAAqBA,UAAAA,QAAK,KAAK,WAAW,oBAAoB;CAEpE,IAAI,UAAU,KAAK;CACnB,IAAI,aAAa,gBAAgB;CACjC,IAAI,UAAU,mBAAmB;CAEjC,SAAS,OAA6B;EACpC,IAAI;EACJ,IAAI;GACF,MAAME,QAAAA,QAAG,aAAa,cAAc,MAAM;EAC5C,QAAQ;GAEN,OAAOC,cAAAA;EACT;EACA,YAAY,cAAc,MAAM;EAChC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAGN,OAAO,6BAA6B,aAAa,oCAAoC;GACrF,OAAOA,cAAAA;EACT;EACA,MAAM,UAAUC,cAAAA,0BAA0B,MAAM;EAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;EACnF,OAAO,QAAQ;CACjB;CAEA,SAAS,kBAAsC;EAC7C,IAAI;EACJ,IAAI;GACF,MAAMF,QAAAA,QAAG,aAAa,iBAAiB,MAAM;EAC/C,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,iBAAiB,MAAM;EACnC,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,GAAG;GACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;EACnE,QAAQ;GAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;GACrF,OAAO,CAAC;EACV;CACF;CAEA,SAAS,qBAA4C;EACnD,IAAI;EACJ,IAAI;GACF,MAAMA,QAAAA,QAAG,aAAa,oBAAoB,MAAM;EAClD,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,oBAAoB,MAAM;EACtC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAEN,OAAO,sBAAsB,mBAAmB,oCAAoC;GACpF,OAAO,CAAC;EACV;EACA,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;GAC1B,OAAO,sBAAsB,mBAAmB,gCAAgC;GAChF,OAAO,CAAC;EACV;EACA,MAAM,SAAgC,CAAC;EACvC,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,CAAC,sBAAsB,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK,OAAO,MAAM,EAAE,GAAG;IAChF,OAAO,iDAAiD,oBAAoB;IAC5E;GACF;GACA,IAAI,OAAO,UAAA,IAAgC;IACzC,OACE,+CAA+C,OAAA,EAA2B,EAAE,QAAQ,oBACtF;IACA;GACF;GACA,OAAO,KAAK;IACV,IAAI,MAAM;IACV,mBAAmB,MAAM;IACzB,iBAAiB,MAAM;IACvB,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;GACpB,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,QAAA,QAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAM;GAAe,CAAC;GACjE,QAAA,QAAG,cAAc,WAAW,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;GAG1F,QAAA,QAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,sBAAsB;EAEtB,kBAAkB,QAAQ;GACxB,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO,OAAO,EAAE;GAC7D,IAAI,OAAO,WAAW,QAAQ,UAAU,QAAQ,UAAA,IAAgC,OAAO;GACvF,UAAU,CAAC,GAAG,QAAQ,MAAM;GAC5B,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,oBAAoB,IAAI;GACtB,MAAM,OAAO,QAAQ,QAAQ,SAAS,KAAK,OAAO,EAAE;GACpD,IAAI,KAAK,WAAW,QAAQ,QAAQ,OAAO;GAC3C,UAAU;GACV,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAcG,cAAAA,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}
+{"version":3,"file":"index.cjs","names":["createSerialRunner"],"sources":["../../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import path from 'node:path';\n\nimport type { Context } from '@earendil-works/chord';\nimport { getOrThrow, type FileSystem } from '@earendil-works/pi-durable/env';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { nodeHost } from '../nodeHost';\nimport { writeFileAtomic } from '../platformFiles';\nimport { DEFAULT_REMOTE_SETTINGS, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport { createSerialRunner } from '../serialRunner';\nimport type { StoredCredential } from '../webauthnPolicy';\nimport {\n  CREDENTIALS_FILE,\n  defaultRemoteStateDir,\n  DIRECTORY_MODE,\n  FILE_MODE,\n  isLooseMode,\n  parseCredentialsFile,\n  parseSettingsFile,\n  parseTrustedDevicesFile,\n  serializeStateFile,\n  SETTINGS_FILE,\n  TRUSTED_DEVICES_FILE,\n  type RemoteAccessStoreOptions,\n} from './remoteAccessRecords';\n\nexport type { RemoteAccessStore, RemoteAccessStoreOptions } from './remoteAccessRecords';\nexport { defaultRemoteStateDir } from './remoteAccessRecords';\nexport { createRemoteAccessStore } from './sync';\n\n/** One queue per state file, so concurrent writes in this process never interleave. */\nconst stateWrites = createSerialRunner();\n\n/** The async twin of `RemoteAccessStore`: reads stay in memory, every write resolves once it is on disk. */\nexport interface RemoteAccessStoreAsync {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): Promise<void>;\n  /** Registered passkeys. Public keys only. */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): Promise<void>;\n  removeCredential(id: string): Promise<boolean>;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): Promise<boolean>;\n  removeTrustedDevice(id: string): Promise<boolean>;\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key. A failed write is reported and\n * never thrown, as in the sync store.\n */\nexport async function createRemoteAccessStoreAsync(\n  fs: FileSystem,\n  options: RemoteAccessStoreOptions,\n  context: Context,\n): Promise<RemoteAccessStoreAsync> {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  const readState = async (filePath: string): Promise<string | undefined> => {\n    const raw = await fs.readTextFile(filePath, context);\n    // No file is the normal first run, so this is not worth a notice.\n    if (!raw.ok) return undefined;\n    // Repairs a state file another account can read: a file restored from a backup,\n    // copied with a permissive umask, or checked out of somewhere it should not have been.\n    try {\n      const mode = await nodeHost.fileMode(filePath);\n      if (mode !== undefined && isLooseMode(mode)) {\n        await nodeHost.setMode(filePath, FILE_MODE);\n        notice(`tightened permissions on ${filePath}`);\n      }\n    } catch {\n      // The file vanished or is unreadable between the read and the check; the read above already won.\n    }\n    return raw.value;\n  };\n\n  const settingsRaw = await readState(settingsPath);\n  let current: RemoteAccessSettings =\n    settingsRaw === undefined ? DEFAULT_REMOTE_SETTINGS : parseSettingsFile(settingsRaw, settingsPath, notice);\n  const credentialsRaw = await readState(credentialsPath);\n  let registered = credentialsRaw === undefined ? [] : parseCredentialsFile(credentialsRaw, credentialsPath, notice);\n  const devicesRaw = await readState(trustedDevicesPath);\n  let trusted = devicesRaw === undefined ? [] : parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);\n\n  const writeJson = async (target: string, body: unknown): Promise<void> => {\n    try {\n      if (!getOrThrow(await fs.exists(directory, context))) {\n        getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n        await nodeHost.setMode(directory, DIRECTORY_MODE);\n      }\n      await writeFileAtomic(fs, target, serializeStateFile(body), context);\n      await nodeHost.setMode(target, FILE_MODE);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  };\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential: (credential) =>\n      stateWrites.forKey(credentialsPath)(async () => {\n        registered = [...registered.filter((held) => held.id !== credential.id), credential];\n        await writeJson(credentialsPath, registered);\n      }),\n\n    removeCredential: (id) =>\n      stateWrites.forKey(credentialsPath)(async () => {\n        const next = registered.filter((held) => held.id !== id);\n        if (next.length === registered.length) return false;\n        registered = next;\n        await writeJson(credentialsPath, registered);\n        return true;\n      }),\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice: (record) =>\n      stateWrites.forKey(trustedDevicesPath)(async () => {\n        const others = trusted.filter((held) => held.id !== record.id);\n        if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n        trusted = [...others, record];\n        await writeJson(trustedDevicesPath, trusted);\n        return true;\n      }),\n\n    removeTrustedDevice: (id) =>\n      stateWrites.forKey(trustedDevicesPath)(async () => {\n        const next = trusted.filter((held) => held.id !== id);\n        if (next.length === trusted.length) return false;\n        trusted = next;\n        await writeJson(trustedDevicesPath, trusted);\n        return true;\n      }),\n\n    save: (settings) =>\n      stateWrites.forKey(settingsPath)(async () => {\n        current = settings;\n        await writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;AAgCoBA,gBAAAA,mBAAmB"}

package/dist/src/services/remoteAccessStore/index.d.mts

@@ -0,0 +1,2 @@
+import { FileSystem } from "@earendil-works/pi-durable/env";
+import { Context } from "@earendil-works/chord";

package/dist/src/services/remoteAccessStore/index.mjs

@@ -1,191 +1,11 @@
-import { poHomeDirectory } from "../../../runtimePiSettings.mjs";
+import "../platformFiles/index.mjs";
+import { createSerialRunner } from "../serialRunner/index.mjs";
 import "../../constants/remote.mjs";
-import { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings, serializeRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-//#region src/services/remoteAccessStore/index.ts
-/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */
-const STATE_DIRECTORY = "web";
-const SETTINGS_FILE = "remote-access.json";
-const CREDENTIALS_FILE = "credentials.json";
-const TRUSTED_DEVICES_FILE = "trusted-devices.json";
-const TRUSTED_DEVICE_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
-const STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;
-const STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;
-const MAX_STORED_LABEL = 200;
-const DIRECTORY_MODE = 448;
-const FILE_MODE = 384;
-/** Any bit set for group or other; a state file readable by another account is worth repairing. */
-const LOOSE_MODE_MASK = 63;
-function defaultRemoteStateDir(homeDir = os.homedir()) {
-	return path.join(poHomeDirectory(homeDir), STATE_DIRECTORY);
-}
-/**
-* Repairs a state file another account can read.
-*
-* Cheap, and it catches the cases a fresh write never would: a file restored
-* from a backup, copied with a permissive umask, or checked out of somewhere it
-* should not have been.
-*/
-function tightenMode(filePath, notice) {
-	try {
-		if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;
-		fs.chmodSync(filePath, FILE_MODE);
-		notice(`tightened permissions on ${filePath}`);
-	} catch {}
-}
-/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */
-function isTrustedDeviceRecord(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const record = value;
-	return typeof record.id === "string" && STORED_ID.test(record.id) && typeof record.identityPublicKey === "string" && STORED_KEY.test(record.identityPublicKey) && typeof record.stepUpPublicKey === "string" && STORED_KEY.test(record.stepUpPublicKey) && record.identityPublicKey !== record.stepUpPublicKey && typeof record.label === "string" && record.label.length <= MAX_STORED_LABEL && typeof record.platform === "string" && TRUSTED_DEVICE_PLATFORMS.has(record.platform) && Number.isFinite(record.createdAt) && Number.isFinite(record.lastSeenAt);
-}
-/**
-* Settings and passkeys on disk. Sessions deliberately not.
-*
-* A session is revoked when remote access is switched off, and a hub restart is
-* a switch-off, so persisting one would buy nothing while creating a bearer
-* secret worth stealing. A passkey is the opposite: surviving is its whole
-* point, and what is stored is a public key.
-*/
-function createRemoteAccessStore(options = {}) {
-	const directory = options.stateDir ?? defaultRemoteStateDir();
-	const notice = options.onNotice ?? (() => {});
-	const settingsPath = path.join(directory, SETTINGS_FILE);
-	const credentialsPath = path.join(directory, CREDENTIALS_FILE);
-	const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);
-	let current = load();
-	let registered = loadCredentials();
-	let trusted = loadTrustedDevices();
-	function load() {
-		let raw;
-		try {
-			raw = fs.readFileSync(settingsPath, "utf8");
-		} catch {
-			return DEFAULT_REMOTE_SETTINGS;
-		}
-		tightenMode(settingsPath, notice);
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
-			return DEFAULT_REMOTE_SETTINGS;
-		}
-		const outcome = parseRemoteAccessSettings(parsed);
-		for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
-		return outcome.settings;
-	}
-	function loadCredentials() {
-		let raw;
-		try {
-			raw = fs.readFileSync(credentialsPath, "utf8");
-		} catch {
-			return [];
-		}
-		tightenMode(credentialsPath, notice);
-		try {
-			const parsed = JSON.parse(raw);
-			return Array.isArray(parsed) ? parsed : [];
-		} catch {
-			notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
-			return [];
-		}
-	}
-	function loadTrustedDevices() {
-		let raw;
-		try {
-			raw = fs.readFileSync(trustedDevicesPath, "utf8");
-		} catch {
-			return [];
-		}
-		tightenMode(trustedDevicesPath, notice);
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);
-			return [];
-		}
-		if (!Array.isArray(parsed)) {
-			notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);
-			return [];
-		}
-		const loaded = [];
-		for (const entry of parsed) {
-			if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {
-				notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);
-				continue;
-			}
-			if (loaded.length >= 32) {
-				notice(`dropped trusted devices beyond the limit of ${String(32)} from ${trustedDevicesPath}`);
-				break;
-			}
-			loaded.push({
-				id: entry.id,
-				identityPublicKey: entry.identityPublicKey,
-				stepUpPublicKey: entry.stepUpPublicKey,
-				label: entry.label,
-				platform: entry.platform,
-				createdAt: entry.createdAt,
-				lastSeenAt: entry.lastSeenAt
-			});
-		}
-		return loaded;
-	}
-	function writeJson(target, body) {
-		const temporary = `${target}.${String(process.pid)}.tmp`;
-		try {
-			fs.mkdirSync(directory, {
-				recursive: true,
-				mode: DIRECTORY_MODE
-			});
-			fs.writeFileSync(temporary, `${JSON.stringify(body, void 0, 2)}\n`, { mode: FILE_MODE });
-			fs.renameSync(temporary, target);
-		} catch (error) {
-			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
-			try {
-				fs.rmSync(temporary, { force: true });
-			} catch {}
-		}
-	}
-	return {
-		directory,
-		settings: () => current,
-		credentials: () => registered,
-		saveCredential(credential) {
-			registered = [...registered.filter((held) => held.id !== credential.id), credential];
-			writeJson(credentialsPath, registered);
-		},
-		removeCredential(id) {
-			const next = registered.filter((held) => held.id !== id);
-			if (next.length === registered.length) return false;
-			registered = next;
-			writeJson(credentialsPath, registered);
-			return true;
-		},
-		trustedDevices: () => trusted,
-		saveTrustedDevice(record) {
-			const others = trusted.filter((held) => held.id !== record.id);
-			if (others.length === trusted.length && trusted.length >= 32) return false;
-			trusted = [...others, record];
-			writeJson(trustedDevicesPath, trusted);
-			return true;
-		},
-		removeTrustedDevice(id) {
-			const next = trusted.filter((held) => held.id !== id);
-			if (next.length === trusted.length) return false;
-			trusted = next;
-			writeJson(trustedDevicesPath, trusted);
-			return true;
-		},
-		save(settings) {
-			current = settings;
-			writeJson(settingsPath, serializeRemoteAccessSettings(settings));
-		}
-	};
-}
+import { defaultRemoteStateDir } from "./remoteAccessRecords.mjs";
+import { createRemoteAccessStore } from "./sync.mjs";
+import "node:path";
+import "@earendil-works/pi-durable/env";
+createSerialRunner();
 //#endregion
 export { createRemoteAccessStore, defaultRemoteStateDir };
 

package/dist/src/services/remoteAccessStore/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { poHomeDirectory } from '../piSettings';\nimport {\n  DEFAULT_REMOTE_SETTINGS,\n  parseRemoteAccessSettings,\n  serializeRemoteAccessSettings,\n} from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */\nconst STATE_DIRECTORY = 'web';\nconst SETTINGS_FILE = 'remote-access.json';\nconst CREDENTIALS_FILE = 'credentials.json';\nconst TRUSTED_DEVICES_FILE = 'trusted-devices.json';\nconst TRUSTED_DEVICE_PLATFORMS: ReadonlySet<string> = new Set(['ios', 'android']);\nconst STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;\nconst STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;\nconst MAX_STORED_LABEL = 200;\nconst DIRECTORY_MODE = 0o700;\nconst FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nconst LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.po/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): boolean;\n  removeTrustedDevice(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = os.homedir()): string {\n  return path.join(poHomeDirectory(homeDir), STATE_DIRECTORY);\n}\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if ((fs.statSync(filePath).mode & LOOSE_MODE_MASK) === 0) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\n/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */\nfunction isTrustedDeviceRecord(value: unknown): value is TrustedDeviceRecord {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.id === 'string' &&\n    STORED_ID.test(record.id) &&\n    typeof record.identityPublicKey === 'string' &&\n    STORED_KEY.test(record.identityPublicKey) &&\n    typeof record.stepUpPublicKey === 'string' &&\n    STORED_KEY.test(record.stepUpPublicKey) &&\n    record.identityPublicKey !== record.stepUpPublicKey &&\n    typeof record.label === 'string' &&\n    record.label.length <= MAX_STORED_LABEL &&\n    typeof record.platform === 'string' &&\n    TRUSTED_DEVICE_PLATFORMS.has(record.platform) &&\n    Number.isFinite(record.createdAt) &&\n    Number.isFinite(record.lastSeenAt)\n  );\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  let current = load();\n  let registered = loadCredentials();\n  let trusted = loadTrustedDevices();\n\n  function load(): RemoteAccessSettings {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(settingsPath, 'utf8');\n    } catch {\n      // No file is the normal first run, so this is not worth a notice.\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    tightenMode(settingsPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Left in place rather than rewritten: silently overwriting a file\n      // somebody hand-edited is worse than ignoring it for this run.\n      notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n      return DEFAULT_REMOTE_SETTINGS;\n    }\n    const outcome = parseRemoteAccessSettings(parsed);\n    for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n    return outcome.settings;\n  }\n\n  function loadCredentials(): StoredCredential[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(credentialsPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(credentialsPath, notice);\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n    } catch {\n      // Fails closed: a half-readable credential file means enrolling again,\n      // not guessing which entries survived.\n      notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n      return [];\n    }\n  }\n\n  function loadTrustedDevices(): TrustedDeviceRecord[] {\n    let raw: string;\n    try {\n      raw = fs.readFileSync(trustedDevicesPath, 'utf8');\n    } catch {\n      return [];\n    }\n    tightenMode(trustedDevicesPath, notice);\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Fails closed like passkeys: a device signs in only from a record read whole.\n      notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);\n      return [];\n    }\n    if (!Array.isArray(parsed)) {\n      notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);\n      return [];\n    }\n    const loaded: TrustedDeviceRecord[] = [];\n    for (const entry of parsed) {\n      if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {\n        notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);\n        continue;\n      }\n      if (loaded.length >= TRUSTED_DEVICE_LIMIT) {\n        notice(\n          `dropped trusted devices beyond the limit of ${String(TRUSTED_DEVICE_LIMIT)} from ${trustedDevicesPath}`,\n        );\n        break;\n      }\n      loaded.push({\n        id: entry.id,\n        identityPublicKey: entry.identityPublicKey,\n        stepUpPublicKey: entry.stepUpPublicKey,\n        label: entry.label,\n        platform: entry.platform,\n        createdAt: entry.createdAt,\n        lastSeenAt: entry.lastSeenAt,\n      });\n    }\n    return loaded;\n  }\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, `${JSON.stringify(body, undefined, 2)}\\n`, { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice(record) {\n      const others = trusted.filter((held) => held.id !== record.id);\n      if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n      trusted = [...others, record];\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    removeTrustedDevice(id) {\n      const next = trusted.filter((held) => held.id !== id);\n      if (next.length === trusted.length) return false;\n      trusted = next;\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;;;AAeA,MAAM,kBAAkB;AACxB,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,2CAAgD,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAChF,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,YAAY;;AAElB,MAAM,kBAAkB;AA0BxB,SAAgB,sBAAsB,UAAkB,GAAG,QAAQ,GAAW;CAC5E,OAAO,KAAK,KAAK,gBAAgB,OAAO,GAAG,eAAe;AAC5D;;;;;;;;AASA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,KAAK,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,qBAAqB,GAAG;EAC1D,GAAG,UAAU,UAAU,SAAS;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;;AAGA,SAAS,sBAAsB,OAA8C;CAC3E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,OAAO,OAAO,YACrB,UAAU,KAAK,OAAO,EAAE,KACxB,OAAO,OAAO,sBAAsB,YACpC,WAAW,KAAK,OAAO,iBAAiB,KACxC,OAAO,OAAO,oBAAoB,YAClC,WAAW,KAAK,OAAO,eAAe,KACtC,OAAO,sBAAsB,OAAO,mBACpC,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,UAAU,oBACvB,OAAO,OAAO,aAAa,YAC3B,yBAAyB,IAAI,OAAO,QAAQ,KAC5C,OAAO,SAAS,OAAO,SAAS,KAChC,OAAO,SAAS,OAAO,UAAU;AAErC;;;;;;;;;AAUA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAY,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAe,KAAK,KAAK,WAAW,aAAa;CACvD,MAAM,kBAAkB,KAAK,KAAK,WAAW,gBAAgB;CAC7D,MAAM,qBAAqB,KAAK,KAAK,WAAW,oBAAoB;CAEpE,IAAI,UAAU,KAAK;CACnB,IAAI,aAAa,gBAAgB;CACjC,IAAI,UAAU,mBAAmB;CAEjC,SAAS,OAA6B;EACpC,IAAI;EACJ,IAAI;GACF,MAAM,GAAG,aAAa,cAAc,MAAM;EAC5C,QAAQ;GAEN,OAAO;EACT;EACA,YAAY,cAAc,MAAM;EAChC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAGN,OAAO,6BAA6B,aAAa,oCAAoC;GACrF,OAAO;EACT;EACA,MAAM,UAAU,0BAA0B,MAAM;EAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;EACnF,OAAO,QAAQ;CACjB;CAEA,SAAS,kBAAsC;EAC7C,IAAI;EACJ,IAAI;GACF,MAAM,GAAG,aAAa,iBAAiB,MAAM;EAC/C,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,iBAAiB,MAAM;EACnC,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,GAAG;GACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;EACnE,QAAQ;GAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;GACrF,OAAO,CAAC;EACV;CACF;CAEA,SAAS,qBAA4C;EACnD,IAAI;EACJ,IAAI;GACF,MAAM,GAAG,aAAa,oBAAoB,MAAM;EAClD,QAAQ;GACN,OAAO,CAAC;EACV;EACA,YAAY,oBAAoB,MAAM;EACtC,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GAEN,OAAO,sBAAsB,mBAAmB,oCAAoC;GACpF,OAAO,CAAC;EACV;EACA,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;GAC1B,OAAO,sBAAsB,mBAAmB,gCAAgC;GAChF,OAAO,CAAC;EACV;EACA,MAAM,SAAgC,CAAC;EACvC,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,CAAC,sBAAsB,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK,OAAO,MAAM,EAAE,GAAG;IAChF,OAAO,iDAAiD,oBAAoB;IAC5E;GACF;GACA,IAAI,OAAO,UAAA,IAAgC;IACzC,OACE,+CAA+C,OAAA,EAA2B,EAAE,QAAQ,oBACtF;IACA;GACF;GACA,OAAO,KAAK;IACV,IAAI,MAAM;IACV,mBAAmB,MAAM;IACzB,iBAAiB,MAAM;IACvB,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;GACpB,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,GAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAM;GAAe,CAAC;GACjE,GAAG,cAAc,WAAW,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;GAG1F,GAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,sBAAsB;EAEtB,kBAAkB,QAAQ;GACxB,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO,OAAO,EAAE;GAC7D,IAAI,OAAO,WAAW,QAAQ,UAAU,QAAQ,UAAA,IAAgC,OAAO;GACvF,UAAU,CAAC,GAAG,QAAQ,MAAM;GAC5B,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,oBAAoB,IAAI;GACtB,MAAM,OAAO,QAAQ,QAAQ,SAAS,KAAK,OAAO,EAAE;GACpD,IAAI,KAAK,WAAW,QAAQ,QAAQ,OAAO;GAC3C,UAAU;GACV,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAc,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/remoteAccessStore/index.ts"],"sourcesContent":["import path from 'node:path';\n\nimport type { Context } from '@earendil-works/chord';\nimport { getOrThrow, type FileSystem } from '@earendil-works/pi-durable/env';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { nodeHost } from '../nodeHost';\nimport { writeFileAtomic } from '../platformFiles';\nimport { DEFAULT_REMOTE_SETTINGS, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport { createSerialRunner } from '../serialRunner';\nimport type { StoredCredential } from '../webauthnPolicy';\nimport {\n  CREDENTIALS_FILE,\n  defaultRemoteStateDir,\n  DIRECTORY_MODE,\n  FILE_MODE,\n  isLooseMode,\n  parseCredentialsFile,\n  parseSettingsFile,\n  parseTrustedDevicesFile,\n  serializeStateFile,\n  SETTINGS_FILE,\n  TRUSTED_DEVICES_FILE,\n  type RemoteAccessStoreOptions,\n} from './remoteAccessRecords';\n\nexport type { RemoteAccessStore, RemoteAccessStoreOptions } from './remoteAccessRecords';\nexport { defaultRemoteStateDir } from './remoteAccessRecords';\nexport { createRemoteAccessStore } from './sync';\n\n/** One queue per state file, so concurrent writes in this process never interleave. */\nconst stateWrites = createSerialRunner();\n\n/** The async twin of `RemoteAccessStore`: reads stay in memory, every write resolves once it is on disk. */\nexport interface RemoteAccessStoreAsync {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): Promise<void>;\n  /** Registered passkeys. Public keys only. */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): Promise<void>;\n  removeCredential(id: string): Promise<boolean>;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): Promise<boolean>;\n  removeTrustedDevice(id: string): Promise<boolean>;\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key. A failed write is reported and\n * never thrown, as in the sync store.\n */\nexport async function createRemoteAccessStoreAsync(\n  fs: FileSystem,\n  options: RemoteAccessStoreOptions,\n  context: Context,\n): Promise<RemoteAccessStoreAsync> {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  const readState = async (filePath: string): Promise<string | undefined> => {\n    const raw = await fs.readTextFile(filePath, context);\n    // No file is the normal first run, so this is not worth a notice.\n    if (!raw.ok) return undefined;\n    // Repairs a state file another account can read: a file restored from a backup,\n    // copied with a permissive umask, or checked out of somewhere it should not have been.\n    try {\n      const mode = await nodeHost.fileMode(filePath);\n      if (mode !== undefined && isLooseMode(mode)) {\n        await nodeHost.setMode(filePath, FILE_MODE);\n        notice(`tightened permissions on ${filePath}`);\n      }\n    } catch {\n      // The file vanished or is unreadable between the read and the check; the read above already won.\n    }\n    return raw.value;\n  };\n\n  const settingsRaw = await readState(settingsPath);\n  let current: RemoteAccessSettings =\n    settingsRaw === undefined ? DEFAULT_REMOTE_SETTINGS : parseSettingsFile(settingsRaw, settingsPath, notice);\n  const credentialsRaw = await readState(credentialsPath);\n  let registered = credentialsRaw === undefined ? [] : parseCredentialsFile(credentialsRaw, credentialsPath, notice);\n  const devicesRaw = await readState(trustedDevicesPath);\n  let trusted = devicesRaw === undefined ? [] : parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);\n\n  const writeJson = async (target: string, body: unknown): Promise<void> => {\n    try {\n      if (!getOrThrow(await fs.exists(directory, context))) {\n        getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n        await nodeHost.setMode(directory, DIRECTORY_MODE);\n      }\n      await writeFileAtomic(fs, target, serializeStateFile(body), context);\n      await nodeHost.setMode(target, FILE_MODE);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  };\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential: (credential) =>\n      stateWrites.forKey(credentialsPath)(async () => {\n        registered = [...registered.filter((held) => held.id !== credential.id), credential];\n        await writeJson(credentialsPath, registered);\n      }),\n\n    removeCredential: (id) =>\n      stateWrites.forKey(credentialsPath)(async () => {\n        const next = registered.filter((held) => held.id !== id);\n        if (next.length === registered.length) return false;\n        registered = next;\n        await writeJson(credentialsPath, registered);\n        return true;\n      }),\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice: (record) =>\n      stateWrites.forKey(trustedDevicesPath)(async () => {\n        const others = trusted.filter((held) => held.id !== record.id);\n        if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n        trusted = [...others, record];\n        await writeJson(trustedDevicesPath, trusted);\n        return true;\n      }),\n\n    removeTrustedDevice: (id) =>\n      stateWrites.forKey(trustedDevicesPath)(async () => {\n        const next = trusted.filter((held) => held.id !== id);\n        if (next.length === trusted.length) return false;\n        trusted = next;\n        await writeJson(trustedDevicesPath, trusted);\n        return true;\n      }),\n\n    save: (settings) =>\n      stateWrites.forKey(settingsPath)(async () => {\n        current = settings;\n        await writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n      }),\n  };\n}\n"],"mappings":";;;;;;;AAgCoB,mBAAmB"}

package/dist/src/services/remoteAccessStore/remoteAccessRecords.cjs

@@ -0,0 +1,98 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_index = require("../nodeHost/index.cjs");
+const require_core = require("../piSettings/core.cjs");
+require("../../../runtimePiSettings.cjs");
+require("../../constants/remote.cjs");
+const require_index$1 = require("../remoteAccessSettings/index.cjs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+const SETTINGS_FILE = "remote-access.json";
+const CREDENTIALS_FILE = "credentials.json";
+const TRUSTED_DEVICES_FILE = "trusted-devices.json";
+const TRUSTED_DEVICE_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
+const STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;
+const STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;
+const MAX_STORED_LABEL = 200;
+function defaultRemoteStateDir(homeDir = require_index.nodeHost.homeDirectory()) {
+	return node_path.default.join(require_core.poHomeDirectory(homeDir), "web");
+}
+/** Whether a file mode lets another account read the file. */
+function isLooseMode(mode) {
+	return (mode & 63) !== 0;
+}
+/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */
+function isTrustedDeviceRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && STORED_ID.test(record.id) && typeof record.identityPublicKey === "string" && STORED_KEY.test(record.identityPublicKey) && typeof record.stepUpPublicKey === "string" && STORED_KEY.test(record.stepUpPublicKey) && record.identityPublicKey !== record.stepUpPublicKey && typeof record.label === "string" && record.label.length <= MAX_STORED_LABEL && typeof record.platform === "string" && TRUSTED_DEVICE_PLATFORMS.has(record.platform) && Number.isFinite(record.createdAt) && Number.isFinite(record.lastSeenAt);
+}
+function parseSettingsFile(raw, settingsPath, notice) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
+		return require_index$1.DEFAULT_REMOTE_SETTINGS;
+	}
+	const outcome = require_index$1.parseRemoteAccessSettings(parsed);
+	for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
+	return outcome.settings;
+}
+function parseCredentialsFile(raw, credentialsPath, notice) {
+	try {
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? parsed : [];
+	} catch {
+		notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
+		return [];
+	}
+}
+function parseTrustedDevicesFile(raw, trustedDevicesPath, notice) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);
+		return [];
+	}
+	if (!Array.isArray(parsed)) {
+		notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);
+		return [];
+	}
+	const loaded = [];
+	for (const entry of parsed) {
+		if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {
+			notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);
+			continue;
+		}
+		if (loaded.length >= 32) {
+			notice(`dropped trusted devices beyond the limit of ${String(32)} from ${trustedDevicesPath}`);
+			break;
+		}
+		loaded.push({
+			id: entry.id,
+			identityPublicKey: entry.identityPublicKey,
+			stepUpPublicKey: entry.stepUpPublicKey,
+			label: entry.label,
+			platform: entry.platform,
+			createdAt: entry.createdAt,
+			lastSeenAt: entry.lastSeenAt
+		});
+	}
+	return loaded;
+}
+function serializeStateFile(body) {
+	return `${JSON.stringify(body, void 0, 2)}\n`;
+}
+//#endregion
+exports.CREDENTIALS_FILE = CREDENTIALS_FILE;
+exports.SETTINGS_FILE = SETTINGS_FILE;
+exports.TRUSTED_DEVICES_FILE = TRUSTED_DEVICES_FILE;
+exports.defaultRemoteStateDir = defaultRemoteStateDir;
+exports.isLooseMode = isLooseMode;
+exports.parseCredentialsFile = parseCredentialsFile;
+exports.parseSettingsFile = parseSettingsFile;
+exports.parseTrustedDevicesFile = parseTrustedDevicesFile;
+exports.serializeStateFile = serializeStateFile;
+
+//# sourceMappingURL=remoteAccessRecords.cjs.map

package/dist/src/services/remoteAccessStore/remoteAccessRecords.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccessRecords.cjs","names":["nodeHost","path","poHomeDirectory","DEFAULT_REMOTE_SETTINGS","parseRemoteAccessSettings"],"sources":["../../../../src/services/remoteAccessStore/remoteAccessRecords.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { nodeHost } from '../nodeHost';\nimport { poHomeDirectory } from '../piSettings';\nimport { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */\nexport const STATE_DIRECTORY = 'web';\nexport const SETTINGS_FILE = 'remote-access.json';\nexport const CREDENTIALS_FILE = 'credentials.json';\nexport const TRUSTED_DEVICES_FILE = 'trusted-devices.json';\nconst TRUSTED_DEVICE_PLATFORMS: ReadonlySet<string> = new Set(['ios', 'android']);\nconst STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;\nconst STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;\nconst MAX_STORED_LABEL = 200;\nexport const DIRECTORY_MODE = 0o700;\nexport const FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nexport const LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.po/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): boolean;\n  removeTrustedDevice(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = nodeHost.homeDirectory()): string {\n  return path.join(poHomeDirectory(homeDir), STATE_DIRECTORY);\n}\n\n/** Whether a file mode lets another account read the file. */\nexport function isLooseMode(mode: number): boolean {\n  return (mode & LOOSE_MODE_MASK) !== 0;\n}\n\n/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */\nfunction isTrustedDeviceRecord(value: unknown): value is TrustedDeviceRecord {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.id === 'string' &&\n    STORED_ID.test(record.id) &&\n    typeof record.identityPublicKey === 'string' &&\n    STORED_KEY.test(record.identityPublicKey) &&\n    typeof record.stepUpPublicKey === 'string' &&\n    STORED_KEY.test(record.stepUpPublicKey) &&\n    record.identityPublicKey !== record.stepUpPublicKey &&\n    typeof record.label === 'string' &&\n    record.label.length <= MAX_STORED_LABEL &&\n    typeof record.platform === 'string' &&\n    TRUSTED_DEVICE_PLATFORMS.has(record.platform) &&\n    Number.isFinite(record.createdAt) &&\n    Number.isFinite(record.lastSeenAt)\n  );\n}\n\nexport function parseSettingsFile(\n  raw: string,\n  settingsPath: string,\n  notice: (message: string) => void,\n): RemoteAccessSettings {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // Left in place rather than rewritten: silently overwriting a file\n    // somebody hand-edited is worse than ignoring it for this run.\n    notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n    return DEFAULT_REMOTE_SETTINGS;\n  }\n  const outcome = parseRemoteAccessSettings(parsed);\n  for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n  return outcome.settings;\n}\n\nexport function parseCredentialsFile(\n  raw: string,\n  credentialsPath: string,\n  notice: (message: string) => void,\n): StoredCredential[] {\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n  } catch {\n    // Fails closed: a half-readable credential file means enrolling again,\n    // not guessing which entries survived.\n    notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n    return [];\n  }\n}\n\nexport function parseTrustedDevicesFile(\n  raw: string,\n  trustedDevicesPath: string,\n  notice: (message: string) => void,\n): TrustedDeviceRecord[] {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // Fails closed like passkeys: a device signs in only from a record read whole.\n    notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);\n    return [];\n  }\n  if (!Array.isArray(parsed)) {\n    notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);\n    return [];\n  }\n  const loaded: TrustedDeviceRecord[] = [];\n  for (const entry of parsed) {\n    if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {\n      notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);\n      continue;\n    }\n    if (loaded.length >= TRUSTED_DEVICE_LIMIT) {\n      notice(`dropped trusted devices beyond the limit of ${String(TRUSTED_DEVICE_LIMIT)} from ${trustedDevicesPath}`);\n      break;\n    }\n    loaded.push({\n      id: entry.id,\n      identityPublicKey: entry.identityPublicKey,\n      stepUpPublicKey: entry.stepUpPublicKey,\n      label: entry.label,\n      platform: entry.platform,\n      createdAt: entry.createdAt,\n      lastSeenAt: entry.lastSeenAt,\n    });\n  }\n  return loaded;\n}\n\nexport function serializeStateFile(body: unknown): string {\n  return `${JSON.stringify(body, undefined, 2)}\\n`;\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,gBAAgB;AAC7B,MAAa,mBAAmB;AAChC,MAAa,uBAAuB;AACpC,MAAM,2CAAgD,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAChF,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AA8BzB,SAAgB,sBAAsB,UAAkBA,cAAAA,SAAS,cAAc,GAAW;CACxF,OAAOC,UAAAA,QAAK,KAAKC,aAAAA,gBAAgB,OAAO,GAAA,KAAkB;AAC5D;;AAGA,SAAgB,YAAY,MAAuB;CACjD,QAAQ,OAAA,QAA4B;AACtC;;AAGA,SAAS,sBAAsB,OAA8C;CAC3E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,OAAO,OAAO,YACrB,UAAU,KAAK,OAAO,EAAE,KACxB,OAAO,OAAO,sBAAsB,YACpC,WAAW,KAAK,OAAO,iBAAiB,KACxC,OAAO,OAAO,oBAAoB,YAClC,WAAW,KAAK,OAAO,eAAe,KACtC,OAAO,sBAAsB,OAAO,mBACpC,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,UAAU,oBACvB,OAAO,OAAO,aAAa,YAC3B,yBAAyB,IAAI,OAAO,QAAQ,KAC5C,OAAO,SAAS,OAAO,SAAS,KAChC,OAAO,SAAS,OAAO,UAAU;AAErC;AAEA,SAAgB,kBACd,KACA,cACA,QACsB;CACtB,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EAGN,OAAO,6BAA6B,aAAa,oCAAoC;EACrF,OAAOC,gBAAAA;CACT;CACA,MAAM,UAAUC,gBAAAA,0BAA0B,MAAM;CAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;CACnF,OAAO,QAAQ;AACjB;AAEA,SAAgB,qBACd,KACA,iBACA,QACoB;CACpB,IAAI;EACF,MAAM,SAAkB,KAAK,MAAM,GAAG;EACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;CACnE,QAAQ;EAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;EACrF,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,wBACd,KACA,oBACA,QACuB;CACvB,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EAEN,OAAO,sBAAsB,mBAAmB,oCAAoC;EACpF,OAAO,CAAC;CACV;CACA,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;EAC1B,OAAO,sBAAsB,mBAAmB,gCAAgC;EAChF,OAAO,CAAC;CACV;CACA,MAAM,SAAgC,CAAC;CACvC,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,CAAC,sBAAsB,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK,OAAO,MAAM,EAAE,GAAG;GAChF,OAAO,iDAAiD,oBAAoB;GAC5E;EACF;EACA,IAAI,OAAO,UAAA,IAAgC;GACzC,OAAO,+CAA+C,OAAA,EAA2B,EAAE,QAAQ,oBAAoB;GAC/G;EACF;EACA,OAAO,KAAK;GACV,IAAI,MAAM;GACV,mBAAmB,MAAM;GACzB,iBAAiB,MAAM;GACvB,OAAO,MAAM;GACb,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB,CAAC;CACH;CACA,OAAO;AACT;AAEA,SAAgB,mBAAmB,MAAuB;CACxD,OAAO,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE;AAC/C"}