@agimon-ai/po-web-dashboard 0.0.0-alpha.0

package/dist/web/lib/transport.d.mts

@@ -0,0 +1,40 @@
+import { requestSessionProtocolFrame } from "./sessionProtocolCommands.mjs";
+//#region src/web/lib/transport.d.ts
+type Frame = Record<string, unknown>;
+declare let invokePlugin: ((call: {
+  mount: {
+    scope: 'global';
+  } | {
+    scope: 'workspace';
+    workspaceId: string;
+  } | {
+    scope: 'session';
+    sessionId: string;
+  };
+  service: string;
+  method: string;
+  input: unknown;
+}) => Promise<unknown>) | undefined;
+/**
+ * Holds the live socket sender.
+ *
+ * The socket is owned by the composition root but commands are issued from
+ * feature code, and this keeps that one indirection explicit instead of
+ * threading a sender through every component.
+ */
+export declare function bindTransport(sender: (frame: object) => void, pluginInvoker?: typeof invokePlugin): void;
+export declare function releaseTransport(): void;
+/** Sends one command frame to a session's agent, enveloped for the hub. */
+export declare function sendFrame(sessionId: string, frame: Frame): void;
+/** Resolves when a session command is accepted or explicitly refused, never when a turn finishes. */
+export declare function sendFrameWithAck(sessionId: string, frame: Frame): ReturnType<typeof requestSessionProtocolFrame>;
+/** Sends one hub-level frame (subscribe, unsubscribe) as-is. */
+export declare function sendHubFrame(frame: object): void;
+/** Calls an exact-scope typed server method through the authenticated Chord binding. */
+export declare function invokeServerMethod(call: Parameters<NonNullable<typeof invokePlugin>>[0]): Promise<unknown>;
+/** Subscribes to fresh page socket connections. */
+export declare function onHubConnected(listener: () => void): () => void;
+/** Notifies page socket consumers after the hub establishes a fresh connection. */
+export declare function notifyHubConnected(): void;
+//#endregion
+//# sourceMappingURL=transport.d.mts.map

package/dist/web/lib/transport.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.mts","names":[],"sources":["../../../src/web/lib/transport.ts"],"mappings":";;KAEK,QAAQ;YAGT,gBACE;EACA;IACM;;IACA;IAAoB;;IACpB;IAAkB;;EACxB;EACA;EACA;MACI;;;;;;;;wBAWM,cAAc,SAAS,wBAAwB,uBAAuB;wBAKtE;;wBAMA,UAAU,mBAAmB,OAAO;;wBAKpC,iBAAiB,mBAAmB,OAAO,QAAQ,kBAAkB;;wBAKrE,aAAa;;wBAKb,mBAAmB,MAAM,WAAW,mBAAmB,oBAAoB;;wBAM3E,eAAe;;wBAMf"}

package/dist/web/lib/transport.mjs

@@ -0,0 +1,50 @@
+import { requestSessionProtocolFrame, sendSessionProtocolFrame } from "./sessionProtocolCommands.mjs";
+//#region src/web/lib/transport.ts
+let send;
+let invokePlugin;
+const hubConnectedListeners = /* @__PURE__ */ new Set();
+/**
+* Holds the live socket sender.
+*
+* The socket is owned by the composition root but commands are issued from
+* feature code, and this keeps that one indirection explicit instead of
+* threading a sender through every component.
+*/
+function bindTransport(sender, pluginInvoker) {
+	send = sender;
+	invokePlugin = pluginInvoker;
+}
+function releaseTransport() {
+	send = void 0;
+	invokePlugin = void 0;
+}
+/** Sends one command frame to a session's agent, enveloped for the hub. */
+function sendFrame(sessionId, frame) {
+	sendSessionProtocolFrame(sessionId, frame);
+}
+/** Resolves when a session command is accepted or explicitly refused, never when a turn finishes. */
+function sendFrameWithAck(sessionId, frame) {
+	return requestSessionProtocolFrame(sessionId, frame);
+}
+/** Sends one hub-level frame (subscribe, unsubscribe) as-is. */
+function sendHubFrame(frame) {
+	send?.(frame);
+}
+/** Calls an exact-scope typed server method through the authenticated Chord binding. */
+function invokeServerMethod(call) {
+	if (!invokePlugin) return Promise.reject(/* @__PURE__ */ new Error("The plugin protocol is not connected."));
+	return invokePlugin(call);
+}
+/** Subscribes to fresh page socket connections. */
+function onHubConnected(listener) {
+	hubConnectedListeners.add(listener);
+	return () => hubConnectedListeners.delete(listener);
+}
+/** Notifies page socket consumers after the hub establishes a fresh connection. */
+function notifyHubConnected() {
+	for (const listener of hubConnectedListeners) listener();
+}
+//#endregion
+export { bindTransport, invokeServerMethod, notifyHubConnected, onHubConnected, releaseTransport, sendFrame, sendFrameWithAck, sendHubFrame };
+
+//# sourceMappingURL=transport.mjs.map

package/dist/web/lib/transport.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.mjs","names":[],"sources":["../../../src/web/lib/transport.ts"],"sourcesContent":["import { requestSessionProtocolFrame, sendSessionProtocolFrame } from './sessionProtocolCommands';\n\ntype Frame = Record<string, unknown>;\n\nlet send: ((frame: object) => void) | undefined;\nlet invokePlugin:\n  | ((call: {\n      mount:\n        | { scope: 'global' }\n        | { scope: 'workspace'; workspaceId: string }\n        | { scope: 'session'; sessionId: string };\n      service: string;\n      method: string;\n      input: unknown;\n    }) => Promise<unknown>)\n  | undefined;\nconst hubConnectedListeners = new Set<() => void>();\n\n/**\n * Holds the live socket sender.\n *\n * The socket is owned by the composition root but commands are issued from\n * feature code, and this keeps that one indirection explicit instead of\n * threading a sender through every component.\n */\nexport function bindTransport(sender: (frame: object) => void, pluginInvoker?: typeof invokePlugin): void {\n  send = sender;\n  invokePlugin = pluginInvoker;\n}\n\nexport function releaseTransport(): void {\n  send = undefined;\n  invokePlugin = undefined;\n}\n\n/** Sends one command frame to a session's agent, enveloped for the hub. */\nexport function sendFrame(sessionId: string, frame: Frame): void {\n  sendSessionProtocolFrame(sessionId, frame);\n}\n\n/** Resolves when a session command is accepted or explicitly refused, never when a turn finishes. */\nexport function sendFrameWithAck(sessionId: string, frame: Frame): ReturnType<typeof requestSessionProtocolFrame> {\n  return requestSessionProtocolFrame(sessionId, frame);\n}\n\n/** Sends one hub-level frame (subscribe, unsubscribe) as-is. */\nexport function sendHubFrame(frame: object): void {\n  send?.(frame);\n}\n\n/** Calls an exact-scope typed server method through the authenticated Chord binding. */\nexport function invokeServerMethod(call: Parameters<NonNullable<typeof invokePlugin>>[0]): Promise<unknown> {\n  if (!invokePlugin) return Promise.reject(new Error('The plugin protocol is not connected.'));\n  return invokePlugin(call);\n}\n\n/** Subscribes to fresh page socket connections. */\nexport function onHubConnected(listener: () => void): () => void {\n  hubConnectedListeners.add(listener);\n  return () => hubConnectedListeners.delete(listener);\n}\n\n/** Notifies page socket consumers after the hub establishes a fresh connection. */\nexport function notifyHubConnected(): void {\n  for (const listener of hubConnectedListeners) listener();\n}\n"],"mappings":";;AAIA,IAAI;AACJ,IAAI;AAWJ,MAAM,wCAAwB,IAAI,IAAgB;;;;;;;;AASlD,SAAgB,cAAc,QAAiC,eAA2C;CACxG,OAAO;CACP,eAAe;AACjB;AAEA,SAAgB,mBAAyB;CACvC,OAAO,KAAA;CACP,eAAe,KAAA;AACjB;;AAGA,SAAgB,UAAU,WAAmB,OAAoB;CAC/D,yBAAyB,WAAW,KAAK;AAC3C;;AAGA,SAAgB,iBAAiB,WAAmB,OAA8D;CAChH,OAAO,4BAA4B,WAAW,KAAK;AACrD;;AAGA,SAAgB,aAAa,OAAqB;CAChD,OAAO,KAAK;AACd;;AAGA,SAAgB,mBAAmB,MAAyE;CAC1G,IAAI,CAAC,cAAc,OAAO,QAAQ,uBAAO,IAAI,MAAM,uCAAuC,CAAC;CAC3F,OAAO,aAAa,IAAI;AAC1B;;AAGA,SAAgB,eAAe,UAAkC;CAC/D,sBAAsB,IAAI,QAAQ;CAClC,aAAa,sBAAsB,OAAO,QAAQ;AACpD;;AAGA,SAAgB,qBAA2B;CACzC,KAAK,MAAM,YAAY,uBAAuB,SAAS;AACzD"}

package/dist/web/lib/useSessionMcp.cjs

@@ -0,0 +1,65 @@
+const require_sessionMcpApi = require("./sessionMcpApi.cjs");
+let react = require("react");
+//#region src/web/lib/useSessionMcp.ts
+const REFRESH_MS = 2e3;
+/** One host request stream feeds both MCP surfaces. Old session responses never cross a route change. */
+function useSessionMcp(workspaceId, sessionId) {
+	const key = JSON.stringify([workspaceId, sessionId]);
+	const [page, setPage] = (0, react.useState)({ key });
+	const before = page.key === key ? page.before : void 0;
+	const [retry, setRetry] = (0, react.useState)(0);
+	const [result, setResult] = (0, react.useState)();
+	(0, react.useEffect)(() => {
+		if (workspaceId === void 0 || sessionId === void 0) return;
+		let disposed = false;
+		let timer;
+		const read = async () => {
+			const response = await require_sessionMcpApi.readSessionMcpActivity(workspaceId, sessionId, before);
+			if (disposed) return;
+			setResult((previous) => "activity" in response ? {
+				key,
+				before,
+				snapshot: response.activity
+			} : {
+				key,
+				before,
+				snapshot: previous?.key === key ? previous.snapshot : void 0,
+				error: response.error
+			});
+			timer = setTimeout(() => {
+				if (document.visibilityState === "hidden") timer = setTimeout(() => void read(), REFRESH_MS);
+				else read();
+			}, REFRESH_MS);
+		};
+		read();
+		return () => {
+			disposed = true;
+			clearTimeout(timer);
+		};
+	}, [
+		key,
+		workspaceId,
+		sessionId,
+		before,
+		retry
+	]);
+	const current = result?.key === key ? result : void 0;
+	return {
+		snapshot: current?.snapshot,
+		loading: current === void 0 || current.before !== before,
+		error: current?.error,
+		before,
+		showLatest: () => setPage({ key }),
+		loadOlder: () => {
+			if (current?.snapshot?.nextBefore !== void 0) setPage({
+				key,
+				before: current.snapshot.nextBefore
+			});
+		},
+		refresh: () => setRetry((value) => value + 1)
+	};
+}
+//#endregion
+exports.useSessionMcp = useSessionMcp;
+
+//# sourceMappingURL=useSessionMcp.cjs.map

package/dist/web/lib/useSessionMcp.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionMcp.cjs","names":["useState","readSessionMcpActivity"],"sources":["../../../src/web/lib/useSessionMcp.ts"],"sourcesContent":["import type { SessionMcpActivitySnapshot } from '@agimon-ai/po-core/sessionMcp';\nimport { useEffect, useState } from 'react';\n\nimport { readSessionMcpActivity } from './sessionMcpApi';\n\nconst REFRESH_MS = 2000;\n\nexport interface SessionMcpViewState {\n  snapshot?: SessionMcpActivitySnapshot;\n  loading: boolean;\n  error?: string;\n  before?: number;\n  showLatest: () => void;\n  loadOlder: () => void;\n  refresh: () => void;\n}\n\n/** One host request stream feeds both MCP surfaces. Old session responses never cross a route change. */\nexport function useSessionMcp(workspaceId: string | undefined, sessionId: string | undefined): SessionMcpViewState {\n  const key = JSON.stringify([workspaceId, sessionId]);\n  const [page, setPage] = useState<{ key: string; before?: number }>({ key });\n  const before = page.key === key ? page.before : undefined;\n  const [retry, setRetry] = useState(0);\n  const [result, setResult] = useState<{\n    key: string;\n    before?: number;\n    snapshot?: SessionMcpActivitySnapshot;\n    error?: string;\n  }>();\n  useEffect(() => {\n    if (workspaceId === undefined || sessionId === undefined) return;\n    let disposed = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const read = async (): Promise<void> => {\n      const response = await readSessionMcpActivity(workspaceId, sessionId, before);\n      if (disposed) return;\n      setResult((previous) =>\n        'activity' in response\n          ? { key, before, snapshot: response.activity }\n          : { key, before, snapshot: previous?.key === key ? previous.snapshot : undefined, error: response.error },\n      );\n      timer = setTimeout(() => {\n        if (document.visibilityState === 'hidden') timer = setTimeout(() => void read(), REFRESH_MS);\n        else void read();\n      }, REFRESH_MS);\n    };\n    void read();\n    return () => {\n      disposed = true;\n      clearTimeout(timer);\n    };\n  }, [key, workspaceId, sessionId, before, retry]);\n  const current = result?.key === key ? result : undefined;\n  return {\n    snapshot: current?.snapshot,\n    loading: current === undefined || current.before !== before,\n    error: current?.error,\n    before,\n    showLatest: () => setPage({ key }),\n    loadOlder: () => {\n      if (current?.snapshot?.nextBefore !== undefined) setPage({ key, before: current.snapshot.nextBefore });\n    },\n    refresh: () => setRetry((value) => value + 1),\n  };\n}\n"],"mappings":";;;AAKA,MAAM,aAAa;;AAanB,SAAgB,cAAc,aAAiC,WAAoD;CACjH,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,SAAS,CAAC;CACnD,MAAM,CAAC,MAAM,YAAA,GAAWA,MAAAA,SAAAA,CAA2C,EAAE,IAAI,CAAC;CAC1E,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,SAAS,KAAA;CAChD,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAAS,CAAC;CACpC,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAKzB;CACH,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,IAAI,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAAW;EAC1D,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,OAAO,YAA2B;GACtC,MAAM,WAAW,MAAMC,sBAAAA,uBAAuB,aAAa,WAAW,MAAM;GAC5E,IAAI,UAAU;GACd,WAAW,aACT,cAAc,WACV;IAAE;IAAK;IAAQ,UAAU,SAAS;GAAS,IAC3C;IAAE;IAAK;IAAQ,UAAU,UAAU,QAAQ,MAAM,SAAS,WAAW,KAAA;IAAW,OAAO,SAAS;GAAM,CAC5G;GACA,QAAQ,iBAAiB;IACvB,IAAI,SAAS,oBAAoB,UAAU,QAAQ,iBAAiB,KAAK,KAAK,GAAG,UAAU;SACtF,KAAU;GACjB,GAAG,UAAU;EACf;EACA,KAAU;EACV,aAAa;GACX,WAAW;GACX,aAAa,KAAK;EACpB;CACF,GAAG;EAAC;EAAK;EAAa;EAAW;EAAQ;CAAK,CAAC;CAC/C,MAAM,UAAU,QAAQ,QAAQ,MAAM,SAAS,KAAA;CAC/C,OAAO;EACL,UAAU,SAAS;EACnB,SAAS,YAAY,KAAA,KAAa,QAAQ,WAAW;EACrD,OAAO,SAAS;EAChB;EACA,kBAAkB,QAAQ,EAAE,IAAI,CAAC;EACjC,iBAAiB;GACf,IAAI,SAAS,UAAU,eAAe,KAAA,GAAW,QAAQ;IAAE;IAAK,QAAQ,QAAQ,SAAS;GAAW,CAAC;EACvG;EACA,eAAe,UAAU,UAAU,QAAQ,CAAC;CAC9C;AACF"}

package/dist/web/lib/useSessionMcp.d.mts

@@ -0,0 +1,15 @@
+import { SessionMcpActivitySnapshot } from "@agimon-ai/po-core/sessionMcp";
+//#region src/web/lib/useSessionMcp.d.ts
+export interface SessionMcpViewState {
+  snapshot?: SessionMcpActivitySnapshot;
+  loading: boolean;
+  error?: string;
+  before?: number;
+  showLatest: () => void;
+  loadOlder: () => void;
+  refresh: () => void;
+}
+/** One host request stream feeds both MCP surfaces. Old session responses never cross a route change. */
+export declare function useSessionMcp(workspaceId: string | undefined, sessionId: string | undefined): SessionMcpViewState;
+//#endregion
+//# sourceMappingURL=useSessionMcp.d.mts.map

package/dist/web/lib/useSessionMcp.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionMcp.d.mts","names":[],"sources":["../../../src/web/lib/useSessionMcp.ts"],"mappings":";;iBAOiB;EACf,WAAW;EACX;EACA;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,iCAAiC,gCAAgC"}

package/dist/web/lib/useSessionMcp.mjs

@@ -0,0 +1,65 @@
+import { readSessionMcpActivity } from "./sessionMcpApi.mjs";
+import { useEffect, useState } from "react";
+//#region src/web/lib/useSessionMcp.ts
+const REFRESH_MS = 2e3;
+/** One host request stream feeds both MCP surfaces. Old session responses never cross a route change. */
+function useSessionMcp(workspaceId, sessionId) {
+	const key = JSON.stringify([workspaceId, sessionId]);
+	const [page, setPage] = useState({ key });
+	const before = page.key === key ? page.before : void 0;
+	const [retry, setRetry] = useState(0);
+	const [result, setResult] = useState();
+	useEffect(() => {
+		if (workspaceId === void 0 || sessionId === void 0) return;
+		let disposed = false;
+		let timer;
+		const read = async () => {
+			const response = await readSessionMcpActivity(workspaceId, sessionId, before);
+			if (disposed) return;
+			setResult((previous) => "activity" in response ? {
+				key,
+				before,
+				snapshot: response.activity
+			} : {
+				key,
+				before,
+				snapshot: previous?.key === key ? previous.snapshot : void 0,
+				error: response.error
+			});
+			timer = setTimeout(() => {
+				if (document.visibilityState === "hidden") timer = setTimeout(() => void read(), REFRESH_MS);
+				else read();
+			}, REFRESH_MS);
+		};
+		read();
+		return () => {
+			disposed = true;
+			clearTimeout(timer);
+		};
+	}, [
+		key,
+		workspaceId,
+		sessionId,
+		before,
+		retry
+	]);
+	const current = result?.key === key ? result : void 0;
+	return {
+		snapshot: current?.snapshot,
+		loading: current === void 0 || current.before !== before,
+		error: current?.error,
+		before,
+		showLatest: () => setPage({ key }),
+		loadOlder: () => {
+			if (current?.snapshot?.nextBefore !== void 0) setPage({
+				key,
+				before: current.snapshot.nextBefore
+			});
+		},
+		refresh: () => setRetry((value) => value + 1)
+	};
+}
+//#endregion
+export { useSessionMcp };
+
+//# sourceMappingURL=useSessionMcp.mjs.map

package/dist/web/lib/useSessionMcp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionMcp.mjs","names":[],"sources":["../../../src/web/lib/useSessionMcp.ts"],"sourcesContent":["import type { SessionMcpActivitySnapshot } from '@agimon-ai/po-core/sessionMcp';\nimport { useEffect, useState } from 'react';\n\nimport { readSessionMcpActivity } from './sessionMcpApi';\n\nconst REFRESH_MS = 2000;\n\nexport interface SessionMcpViewState {\n  snapshot?: SessionMcpActivitySnapshot;\n  loading: boolean;\n  error?: string;\n  before?: number;\n  showLatest: () => void;\n  loadOlder: () => void;\n  refresh: () => void;\n}\n\n/** One host request stream feeds both MCP surfaces. Old session responses never cross a route change. */\nexport function useSessionMcp(workspaceId: string | undefined, sessionId: string | undefined): SessionMcpViewState {\n  const key = JSON.stringify([workspaceId, sessionId]);\n  const [page, setPage] = useState<{ key: string; before?: number }>({ key });\n  const before = page.key === key ? page.before : undefined;\n  const [retry, setRetry] = useState(0);\n  const [result, setResult] = useState<{\n    key: string;\n    before?: number;\n    snapshot?: SessionMcpActivitySnapshot;\n    error?: string;\n  }>();\n  useEffect(() => {\n    if (workspaceId === undefined || sessionId === undefined) return;\n    let disposed = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const read = async (): Promise<void> => {\n      const response = await readSessionMcpActivity(workspaceId, sessionId, before);\n      if (disposed) return;\n      setResult((previous) =>\n        'activity' in response\n          ? { key, before, snapshot: response.activity }\n          : { key, before, snapshot: previous?.key === key ? previous.snapshot : undefined, error: response.error },\n      );\n      timer = setTimeout(() => {\n        if (document.visibilityState === 'hidden') timer = setTimeout(() => void read(), REFRESH_MS);\n        else void read();\n      }, REFRESH_MS);\n    };\n    void read();\n    return () => {\n      disposed = true;\n      clearTimeout(timer);\n    };\n  }, [key, workspaceId, sessionId, before, retry]);\n  const current = result?.key === key ? result : undefined;\n  return {\n    snapshot: current?.snapshot,\n    loading: current === undefined || current.before !== before,\n    error: current?.error,\n    before,\n    showLatest: () => setPage({ key }),\n    loadOlder: () => {\n      if (current?.snapshot?.nextBefore !== undefined) setPage({ key, before: current.snapshot.nextBefore });\n    },\n    refresh: () => setRetry((value) => value + 1),\n  };\n}\n"],"mappings":";;;AAKA,MAAM,aAAa;;AAanB,SAAgB,cAAc,aAAiC,WAAoD;CACjH,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,SAAS,CAAC;CACnD,MAAM,CAAC,MAAM,WAAW,SAA2C,EAAE,IAAI,CAAC;CAC1E,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,SAAS,KAAA;CAChD,MAAM,CAAC,OAAO,YAAY,SAAS,CAAC;CACpC,MAAM,CAAC,QAAQ,aAAa,SAKzB;CACH,gBAAgB;EACd,IAAI,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAAW;EAC1D,IAAI,WAAW;EACf,IAAI;EACJ,MAAM,OAAO,YAA2B;GACtC,MAAM,WAAW,MAAM,uBAAuB,aAAa,WAAW,MAAM;GAC5E,IAAI,UAAU;GACd,WAAW,aACT,cAAc,WACV;IAAE;IAAK;IAAQ,UAAU,SAAS;GAAS,IAC3C;IAAE;IAAK;IAAQ,UAAU,UAAU,QAAQ,MAAM,SAAS,WAAW,KAAA;IAAW,OAAO,SAAS;GAAM,CAC5G;GACA,QAAQ,iBAAiB;IACvB,IAAI,SAAS,oBAAoB,UAAU,QAAQ,iBAAiB,KAAK,KAAK,GAAG,UAAU;SACtF,KAAU;GACjB,GAAG,UAAU;EACf;EACA,KAAU;EACV,aAAa;GACX,WAAW;GACX,aAAa,KAAK;EACpB;CACF,GAAG;EAAC;EAAK;EAAa;EAAW;EAAQ;CAAK,CAAC;CAC/C,MAAM,UAAU,QAAQ,QAAQ,MAAM,SAAS,KAAA;CAC/C,OAAO;EACL,UAAU,SAAS;EACnB,SAAS,YAAY,KAAA,KAAa,QAAQ,WAAW;EACrD,OAAO,SAAS;EAChB;EACA,kBAAkB,QAAQ,EAAE,IAAI,CAAC;EACjC,iBAAiB;GACf,IAAI,SAAS,UAAU,eAAe,KAAA,GAAW,QAAQ;IAAE;IAAK,QAAQ,QAAQ,SAAS;GAAW,CAAC;EACvG;EACA,eAAe,UAAU,UAAU,QAAQ,CAAC;CAC9C;AACF"}

package/dist/web/lib/webauthnClient.cjs

@@ -0,0 +1,110 @@
+const require_remoteAccess = require("../../types/remoteAccess.cjs");
+const require_sealedSession = require("./sealedSession.cjs");
+let _simplewebauthn_browser = require("@simplewebauthn/browser");
+//#region src/web/lib/webauthnClient.ts
+function describe(error) {
+	if (error instanceof Error) return error.name === "NotAllowedError" ? "That was cancelled." : error.message;
+	return String(error);
+}
+function passkeysAvailable() {
+	return (0, _simplewebauthn_browser.browserSupportsWebAuthn)();
+}
+async function postJson(route, body) {
+	const response = await require_sealedSession.sealedHttpSession.fetch(route, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		credentials: "same-origin",
+		body: JSON.stringify(body ?? {})
+	});
+	if (!response.ok) return void 0;
+	const parsed = await response.json();
+	return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+}
+/** Enrols this device's passkey. Local-only on the server, so this runs at the machine. */
+async function registerPasskey() {
+	if (!passkeysAvailable()) return {
+		ok: false,
+		error: "This browser has no passkey support."
+	};
+	try {
+		const begun = await postJson(`${require_remoteAccess.REMOTE_API_ROUTE}/passkeys/register/begin`, {});
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return {
+			ok: false,
+			error: "Passkeys are unavailable on this tunnel."
+		};
+		const response = await (0, _simplewebauthn_browser.startRegistration)({ optionsJSON: begun.options });
+		return await postJson(`/api/remote/passkeys/register/finish`, {
+			ceremonyId: begun.ceremonyId,
+			response
+		}) === void 0 ? {
+			ok: false,
+			error: "That passkey was not accepted."
+		} : { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describe(error)
+		};
+	}
+}
+/** Trades a registered passkey for a session, so a return visit needs no QR. */
+async function signInWithPasskey() {
+	if (!passkeysAvailable()) return {
+		ok: false,
+		error: "This browser has no passkey support."
+	};
+	try {
+		const begun = await postJson(`${require_remoteAccess.REMOTE_API_ROUTE}/passkeys/authenticate/begin`, {});
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return {
+			ok: false,
+			error: "Passkeys are unavailable on this tunnel."
+		};
+		const response = await (0, _simplewebauthn_browser.startAuthentication)({ optionsJSON: begun.options });
+		const finished = await postJson(`${require_remoteAccess.REMOTE_API_ROUTE}/passkeys/authenticate/finish`, {
+			ceremonyId: begun.ceremonyId,
+			response
+		});
+		if (typeof finished?.hostPublicKey !== "string" || finished.hostPublicKey === "") return {
+			ok: false,
+			error: "That passkey was not accepted."
+		};
+		require_sealedSession.rememberHostChannelKey(finished.hostPublicKey);
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describe(error)
+		};
+	}
+}
+/**
+* Runs one gesture for one action and returns the header value that proves it.
+*
+* The assertion is base64url JSON because a WebAuthn response carries binary,
+* and it travels in a header rather than a body so the retry can replay the
+* original request untouched.
+*/
+async function assertionFor(action) {
+	if (!passkeysAvailable()) return void 0;
+	try {
+		const begun = await postJson(`${require_remoteAccess.REMOTE_API_ROUTE}/challenge`, { action });
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return void 0;
+		const response = await (0, _simplewebauthn_browser.startAuthentication)({ optionsJSON: begun.options });
+		return btoa(JSON.stringify({
+			ceremonyId: begun.ceremonyId,
+			response
+		})).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+	} catch {
+		return;
+	}
+}
+/** The header name a caller attaches an assertion under. */
+const STEP_UP_HEADER_NAME = require_remoteAccess.STEP_UP_HEADER;
+//#endregion
+exports.STEP_UP_HEADER_NAME = STEP_UP_HEADER_NAME;
+exports.assertionFor = assertionFor;
+exports.passkeysAvailable = passkeysAvailable;
+exports.registerPasskey = registerPasskey;
+exports.signInWithPasskey = signInWithPasskey;
+
+//# sourceMappingURL=webauthnClient.cjs.map

package/dist/web/lib/webauthnClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnClient.cjs","names":["browserSupportsWebAuthn","sealedHttpSession","REMOTE_API_ROUTE","startRegistration","startAuthentication","STEP_UP_HEADER"],"sources":["../../../src/web/lib/webauthnClient.ts"],"sourcesContent":["import { browserSupportsWebAuthn, startAuthentication, startRegistration } from '@simplewebauthn/browser';\n\nimport { REMOTE_API_ROUTE, STEP_UP_HEADER } from '../../types/remoteAccess';\nimport { rememberHostChannelKey, sealedHttpSession } from './sealedSession';\n\n/**\n * The browser half of the passkey ceremonies.\n *\n * A session cookie is a bearer token: whoever holds the bytes is you. A passkey\n * is a key in this device's secure enclave that never leaves it, so the two\n * actions that escalate out of \"drive the agent\" into \"own the machine\" can ask\n * for a gesture instead of trusting the cookie alone.\n */\n\nexport type PasskeyOutcome = { ok: true } | { ok: false; error: string };\n\nfunction describe(error: unknown): string {\n  if (error instanceof Error) {\n    // The user dismissing Face ID is not an error worth a stack trace.\n    return error.name === 'NotAllowedError' ? 'That was cancelled.' : error.message;\n  }\n  return String(error);\n}\n\nexport function passkeysAvailable(): boolean {\n  return browserSupportsWebAuthn();\n}\n\nasync function postJson(route: string, body: unknown): Promise<Record<string, unknown> | undefined> {\n  const response = await sealedHttpSession.fetch(route, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    credentials: 'same-origin',\n    body: JSON.stringify(body ?? {}),\n  });\n  if (!response.ok) return undefined;\n  const parsed: unknown = await response.json();\n  return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : undefined;\n}\n\n/** Enrols this device's passkey. Local-only on the server, so this runs at the machine. */\nexport async function registerPasskey(): Promise<PasskeyOutcome> {\n  if (!passkeysAvailable()) return { ok: false, error: 'This browser has no passkey support.' };\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/register/begin`, {});\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) {\n      return { ok: false, error: 'Passkeys are unavailable on this tunnel.' };\n    }\n    const response = await startRegistration({ optionsJSON: begun.options as never });\n    const finished = await postJson(`${REMOTE_API_ROUTE}/passkeys/register/finish`, {\n      ceremonyId: begun.ceremonyId,\n      response,\n    });\n    return finished === undefined ? { ok: false, error: 'That passkey was not accepted.' } : { ok: true };\n  } catch (error) {\n    return { ok: false, error: describe(error) };\n  }\n}\n\n/** Trades a registered passkey for a session, so a return visit needs no QR. */\nexport async function signInWithPasskey(): Promise<PasskeyOutcome> {\n  if (!passkeysAvailable()) return { ok: false, error: 'This browser has no passkey support.' };\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/begin`, {});\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) {\n      return { ok: false, error: 'Passkeys are unavailable on this tunnel.' };\n    }\n    const response = await startAuthentication({ optionsJSON: begun.options as never });\n    const finished = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/finish`, {\n      ceremonyId: begun.ceremonyId,\n      response,\n    });\n    if (typeof finished?.hostPublicKey !== 'string' || finished.hostPublicKey === '') {\n      return { ok: false, error: 'That passkey was not accepted.' };\n    }\n    rememberHostChannelKey(finished.hostPublicKey);\n    return { ok: true };\n  } catch (error) {\n    return { ok: false, error: describe(error) };\n  }\n}\n\n/**\n * Runs one gesture for one action and returns the header value that proves it.\n *\n * The assertion is base64url JSON because a WebAuthn response carries binary,\n * and it travels in a header rather than a body so the retry can replay the\n * original request untouched.\n */\nexport async function assertionFor(action: string): Promise<string | undefined> {\n  if (!passkeysAvailable()) return undefined;\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/challenge`, { action });\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) return undefined;\n    const response = await startAuthentication({ optionsJSON: begun.options as never });\n    return btoa(JSON.stringify({ ceremonyId: begun.ceremonyId, response }))\n      .replaceAll('+', '-')\n      .replaceAll('/', '_')\n      .replaceAll('=', '');\n  } catch {\n    // A dismissed or failed gesture means the action does not proceed, which\n    // the caller reports; there is nothing to log here.\n    return undefined;\n  }\n}\n\n/** The header name a caller attaches an assertion under. */\nexport const STEP_UP_HEADER_NAME = STEP_UP_HEADER;\n"],"mappings":";;;;AAgBA,SAAS,SAAS,OAAwB;CACxC,IAAI,iBAAiB,OAEnB,OAAO,MAAM,SAAS,oBAAoB,wBAAwB,MAAM;CAE1E,OAAO,OAAO,KAAK;AACrB;AAEA,SAAgB,oBAA6B;CAC3C,QAAA,GAAOA,wBAAAA,wBAAAA,CAAwB;AACjC;AAEA,eAAe,SAAS,OAAe,MAA6D;CAClG,MAAM,WAAW,MAAMC,sBAAAA,kBAAkB,MAAM,OAAO;EACpD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,aAAa;EACb,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC;CACjC,CAAC;CACD,IAAI,CAAC,SAAS,IAAI,OAAO,KAAA;CACzB,MAAM,SAAkB,MAAM,SAAS,KAAK;CAC5C,OAAO,OAAO,WAAW,YAAY,WAAW,OAAQ,SAAqC,KAAA;AAC/F;;AAGA,eAAsB,kBAA2C;CAC/D,IAAI,CAAC,kBAAkB,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO;CAAuC;CAC5F,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAGC,qBAAAA,iBAAiB,2BAA2B,CAAC,CAAC;EAC9E,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAC7D,OAAO;GAAE,IAAI;GAAO,OAAO;EAA2C;EAExE,MAAM,WAAW,OAAA,GAAMC,wBAAAA,kBAAAA,CAAkB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAKhF,OAAO,MAJgB,SAAS,wCAAgD;GAC9E,YAAY,MAAM;GAClB;EACF,CAAC,MACmB,KAAA,IAAY;GAAE,IAAI;GAAO,OAAO;EAAiC,IAAI,EAAE,IAAI,KAAK;CACtG,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,SAAS,KAAK;EAAE;CAC7C;AACF;;AAGA,eAAsB,oBAA6C;CACjE,IAAI,CAAC,kBAAkB,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO;CAAuC;CAC5F,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAGD,qBAAAA,iBAAiB,+BAA+B,CAAC,CAAC;EAClF,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAC7D,OAAO;GAAE,IAAI;GAAO,OAAO;EAA2C;EAExE,MAAM,WAAW,OAAA,GAAME,wBAAAA,oBAAAA,CAAoB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAClF,MAAM,WAAW,MAAM,SAAS,GAAGF,qBAAAA,iBAAiB,gCAAgC;GAClF,YAAY,MAAM;GAClB;EACF,CAAC;EACD,IAAI,OAAO,UAAU,kBAAkB,YAAY,SAAS,kBAAkB,IAC5E,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiC;EAE9D,sBAAA,uBAAuB,SAAS,aAAa;EAC7C,OAAO,EAAE,IAAI,KAAK;CACpB,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,SAAS,KAAK;EAAE;CAC7C;AACF;;;;;;;;AASA,eAAsB,aAAa,QAA6C;CAC9E,IAAI,CAAC,kBAAkB,GAAG,OAAO,KAAA;CACjC,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAGA,qBAAAA,iBAAiB,aAAa,EAAE,OAAO,CAAC;EACxE,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAAW,OAAO,KAAA;EACjF,MAAM,WAAW,OAAA,GAAME,wBAAAA,oBAAAA,CAAoB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAClF,OAAO,KAAK,KAAK,UAAU;GAAE,YAAY,MAAM;GAAY;EAAS,CAAC,CAAC,CAAC,CACpE,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,EAAE;CACvB,QAAQ;EAGN;CACF;AACF;;AAGA,MAAa,sBAAsBC,qBAAAA"}

package/dist/web/lib/webauthnClient.d.mts

@@ -0,0 +1,32 @@
+//#region src/web/lib/webauthnClient.d.ts
+/**
+ * The browser half of the passkey ceremonies.
+ *
+ * A session cookie is a bearer token: whoever holds the bytes is you. A passkey
+ * is a key in this device's secure enclave that never leaves it, so the two
+ * actions that escalate out of "drive the agent" into "own the machine" can ask
+ * for a gesture instead of trusting the cookie alone.
+ */
+export type PasskeyOutcome = {
+  ok: true;
+} | {
+  ok: false;
+  error: string;
+};
+export declare function passkeysAvailable(): boolean;
+/** Enrols this device's passkey. Local-only on the server, so this runs at the machine. */
+export declare function registerPasskey(): Promise<PasskeyOutcome>;
+/** Trades a registered passkey for a session, so a return visit needs no QR. */
+export declare function signInWithPasskey(): Promise<PasskeyOutcome>;
+/**
+ * Runs one gesture for one action and returns the header value that proves it.
+ *
+ * The assertion is base64url JSON because a WebAuthn response carries binary,
+ * and it travels in a header rather than a body so the retry can replay the
+ * original request untouched.
+ */
+export declare function assertionFor(action: string): Promise<string | undefined>;
+/** The header name a caller attaches an assertion under. */
+export declare const STEP_UP_HEADER_NAME = "x-po-assertion";
+//#endregion
+//# sourceMappingURL=webauthnClient.d.mts.map

package/dist/web/lib/webauthnClient.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnClient.d.mts","names":[],"sources":["../../../src/web/lib/webauthnClient.ts"],"mappings":";;;;;;;;;YAcY;EAAmB;;EAAe;EAAW;;wBAUzC;;wBAiBM,mBAAmB,QAAQ;;wBAmB3B,qBAAqB,QAAQ;;;;;;;;wBA6B7B,aAAa,iBAAiB;;qBAkBvC"}

package/dist/web/lib/webauthnClient.mjs

@@ -0,0 +1,106 @@
+import { REMOTE_API_ROUTE, STEP_UP_HEADER } from "../../types/remoteAccess.mjs";
+import { rememberHostChannelKey, sealedHttpSession } from "./sealedSession.mjs";
+import { browserSupportsWebAuthn, startAuthentication, startRegistration } from "@simplewebauthn/browser";
+//#region src/web/lib/webauthnClient.ts
+function describe(error) {
+	if (error instanceof Error) return error.name === "NotAllowedError" ? "That was cancelled." : error.message;
+	return String(error);
+}
+function passkeysAvailable() {
+	return browserSupportsWebAuthn();
+}
+async function postJson(route, body) {
+	const response = await sealedHttpSession.fetch(route, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		credentials: "same-origin",
+		body: JSON.stringify(body ?? {})
+	});
+	if (!response.ok) return void 0;
+	const parsed = await response.json();
+	return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+}
+/** Enrols this device's passkey. Local-only on the server, so this runs at the machine. */
+async function registerPasskey() {
+	if (!passkeysAvailable()) return {
+		ok: false,
+		error: "This browser has no passkey support."
+	};
+	try {
+		const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/register/begin`, {});
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return {
+			ok: false,
+			error: "Passkeys are unavailable on this tunnel."
+		};
+		const response = await startRegistration({ optionsJSON: begun.options });
+		return await postJson(`/api/remote/passkeys/register/finish`, {
+			ceremonyId: begun.ceremonyId,
+			response
+		}) === void 0 ? {
+			ok: false,
+			error: "That passkey was not accepted."
+		} : { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describe(error)
+		};
+	}
+}
+/** Trades a registered passkey for a session, so a return visit needs no QR. */
+async function signInWithPasskey() {
+	if (!passkeysAvailable()) return {
+		ok: false,
+		error: "This browser has no passkey support."
+	};
+	try {
+		const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/begin`, {});
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return {
+			ok: false,
+			error: "Passkeys are unavailable on this tunnel."
+		};
+		const response = await startAuthentication({ optionsJSON: begun.options });
+		const finished = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/finish`, {
+			ceremonyId: begun.ceremonyId,
+			response
+		});
+		if (typeof finished?.hostPublicKey !== "string" || finished.hostPublicKey === "") return {
+			ok: false,
+			error: "That passkey was not accepted."
+		};
+		rememberHostChannelKey(finished.hostPublicKey);
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describe(error)
+		};
+	}
+}
+/**
+* Runs one gesture for one action and returns the header value that proves it.
+*
+* The assertion is base64url JSON because a WebAuthn response carries binary,
+* and it travels in a header rather than a body so the retry can replay the
+* original request untouched.
+*/
+async function assertionFor(action) {
+	if (!passkeysAvailable()) return void 0;
+	try {
+		const begun = await postJson(`${REMOTE_API_ROUTE}/challenge`, { action });
+		if (typeof begun?.ceremonyId !== "string" || begun.options === void 0) return void 0;
+		const response = await startAuthentication({ optionsJSON: begun.options });
+		return btoa(JSON.stringify({
+			ceremonyId: begun.ceremonyId,
+			response
+		})).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+	} catch {
+		return;
+	}
+}
+/** The header name a caller attaches an assertion under. */
+const STEP_UP_HEADER_NAME = STEP_UP_HEADER;
+//#endregion
+export { STEP_UP_HEADER_NAME, assertionFor, passkeysAvailable, registerPasskey, signInWithPasskey };
+
+//# sourceMappingURL=webauthnClient.mjs.map

package/dist/web/lib/webauthnClient.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnClient.mjs","names":[],"sources":["../../../src/web/lib/webauthnClient.ts"],"sourcesContent":["import { browserSupportsWebAuthn, startAuthentication, startRegistration } from '@simplewebauthn/browser';\n\nimport { REMOTE_API_ROUTE, STEP_UP_HEADER } from '../../types/remoteAccess';\nimport { rememberHostChannelKey, sealedHttpSession } from './sealedSession';\n\n/**\n * The browser half of the passkey ceremonies.\n *\n * A session cookie is a bearer token: whoever holds the bytes is you. A passkey\n * is a key in this device's secure enclave that never leaves it, so the two\n * actions that escalate out of \"drive the agent\" into \"own the machine\" can ask\n * for a gesture instead of trusting the cookie alone.\n */\n\nexport type PasskeyOutcome = { ok: true } | { ok: false; error: string };\n\nfunction describe(error: unknown): string {\n  if (error instanceof Error) {\n    // The user dismissing Face ID is not an error worth a stack trace.\n    return error.name === 'NotAllowedError' ? 'That was cancelled.' : error.message;\n  }\n  return String(error);\n}\n\nexport function passkeysAvailable(): boolean {\n  return browserSupportsWebAuthn();\n}\n\nasync function postJson(route: string, body: unknown): Promise<Record<string, unknown> | undefined> {\n  const response = await sealedHttpSession.fetch(route, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    credentials: 'same-origin',\n    body: JSON.stringify(body ?? {}),\n  });\n  if (!response.ok) return undefined;\n  const parsed: unknown = await response.json();\n  return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : undefined;\n}\n\n/** Enrols this device's passkey. Local-only on the server, so this runs at the machine. */\nexport async function registerPasskey(): Promise<PasskeyOutcome> {\n  if (!passkeysAvailable()) return { ok: false, error: 'This browser has no passkey support.' };\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/register/begin`, {});\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) {\n      return { ok: false, error: 'Passkeys are unavailable on this tunnel.' };\n    }\n    const response = await startRegistration({ optionsJSON: begun.options as never });\n    const finished = await postJson(`${REMOTE_API_ROUTE}/passkeys/register/finish`, {\n      ceremonyId: begun.ceremonyId,\n      response,\n    });\n    return finished === undefined ? { ok: false, error: 'That passkey was not accepted.' } : { ok: true };\n  } catch (error) {\n    return { ok: false, error: describe(error) };\n  }\n}\n\n/** Trades a registered passkey for a session, so a return visit needs no QR. */\nexport async function signInWithPasskey(): Promise<PasskeyOutcome> {\n  if (!passkeysAvailable()) return { ok: false, error: 'This browser has no passkey support.' };\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/begin`, {});\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) {\n      return { ok: false, error: 'Passkeys are unavailable on this tunnel.' };\n    }\n    const response = await startAuthentication({ optionsJSON: begun.options as never });\n    const finished = await postJson(`${REMOTE_API_ROUTE}/passkeys/authenticate/finish`, {\n      ceremonyId: begun.ceremonyId,\n      response,\n    });\n    if (typeof finished?.hostPublicKey !== 'string' || finished.hostPublicKey === '') {\n      return { ok: false, error: 'That passkey was not accepted.' };\n    }\n    rememberHostChannelKey(finished.hostPublicKey);\n    return { ok: true };\n  } catch (error) {\n    return { ok: false, error: describe(error) };\n  }\n}\n\n/**\n * Runs one gesture for one action and returns the header value that proves it.\n *\n * The assertion is base64url JSON because a WebAuthn response carries binary,\n * and it travels in a header rather than a body so the retry can replay the\n * original request untouched.\n */\nexport async function assertionFor(action: string): Promise<string | undefined> {\n  if (!passkeysAvailable()) return undefined;\n  try {\n    const begun = await postJson(`${REMOTE_API_ROUTE}/challenge`, { action });\n    if (typeof begun?.ceremonyId !== 'string' || begun.options === undefined) return undefined;\n    const response = await startAuthentication({ optionsJSON: begun.options as never });\n    return btoa(JSON.stringify({ ceremonyId: begun.ceremonyId, response }))\n      .replaceAll('+', '-')\n      .replaceAll('/', '_')\n      .replaceAll('=', '');\n  } catch {\n    // A dismissed or failed gesture means the action does not proceed, which\n    // the caller reports; there is nothing to log here.\n    return undefined;\n  }\n}\n\n/** The header name a caller attaches an assertion under. */\nexport const STEP_UP_HEADER_NAME = STEP_UP_HEADER;\n"],"mappings":";;;;AAgBA,SAAS,SAAS,OAAwB;CACxC,IAAI,iBAAiB,OAEnB,OAAO,MAAM,SAAS,oBAAoB,wBAAwB,MAAM;CAE1E,OAAO,OAAO,KAAK;AACrB;AAEA,SAAgB,oBAA6B;CAC3C,OAAO,wBAAwB;AACjC;AAEA,eAAe,SAAS,OAAe,MAA6D;CAClG,MAAM,WAAW,MAAM,kBAAkB,MAAM,OAAO;EACpD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,aAAa;EACb,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC;CACjC,CAAC;CACD,IAAI,CAAC,SAAS,IAAI,OAAO,KAAA;CACzB,MAAM,SAAkB,MAAM,SAAS,KAAK;CAC5C,OAAO,OAAO,WAAW,YAAY,WAAW,OAAQ,SAAqC,KAAA;AAC/F;;AAGA,eAAsB,kBAA2C;CAC/D,IAAI,CAAC,kBAAkB,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO;CAAuC;CAC5F,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAG,iBAAiB,2BAA2B,CAAC,CAAC;EAC9E,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAC7D,OAAO;GAAE,IAAI;GAAO,OAAO;EAA2C;EAExE,MAAM,WAAW,MAAM,kBAAkB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAKhF,OAAO,MAJgB,SAAS,wCAAgD;GAC9E,YAAY,MAAM;GAClB;EACF,CAAC,MACmB,KAAA,IAAY;GAAE,IAAI;GAAO,OAAO;EAAiC,IAAI,EAAE,IAAI,KAAK;CACtG,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,SAAS,KAAK;EAAE;CAC7C;AACF;;AAGA,eAAsB,oBAA6C;CACjE,IAAI,CAAC,kBAAkB,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO;CAAuC;CAC5F,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAG,iBAAiB,+BAA+B,CAAC,CAAC;EAClF,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAC7D,OAAO;GAAE,IAAI;GAAO,OAAO;EAA2C;EAExE,MAAM,WAAW,MAAM,oBAAoB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAClF,MAAM,WAAW,MAAM,SAAS,GAAG,iBAAiB,gCAAgC;GAClF,YAAY,MAAM;GAClB;EACF,CAAC;EACD,IAAI,OAAO,UAAU,kBAAkB,YAAY,SAAS,kBAAkB,IAC5E,OAAO;GAAE,IAAI;GAAO,OAAO;EAAiC;EAE9D,uBAAuB,SAAS,aAAa;EAC7C,OAAO,EAAE,IAAI,KAAK;CACpB,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,SAAS,KAAK;EAAE;CAC7C;AACF;;;;;;;;AASA,eAAsB,aAAa,QAA6C;CAC9E,IAAI,CAAC,kBAAkB,GAAG,OAAO,KAAA;CACjC,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,GAAG,iBAAiB,aAAa,EAAE,OAAO,CAAC;EACxE,IAAI,OAAO,OAAO,eAAe,YAAY,MAAM,YAAY,KAAA,GAAW,OAAO,KAAA;EACjF,MAAM,WAAW,MAAM,oBAAoB,EAAE,aAAa,MAAM,QAAiB,CAAC;EAClF,OAAO,KAAK,KAAK,UAAU;GAAE,YAAY,MAAM;GAAY;EAAS,CAAC,CAAC,CAAC,CACpE,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,EAAE;CACvB,QAAQ;EAGN;CACF;AACF;;AAGA,MAAa,sBAAsB"}