@blue-soda/dsh-remote 0.4.28

package/dist/safe-error.d.ts

@@ -0,0 +1,8 @@
+export declare class RpcError extends Error {
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    readonly retryable: boolean;
+    constructor(code: string, message: string, details?: unknown | undefined, retryable?: boolean);
+}
+export declare function safeErrorCode(error: unknown): string;
+//# sourceMappingURL=safe-error.d.ts.map

package/dist/safe-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-error.d.ts","sourceRoot":"","sources":["../src/safe-error.ts"],"names":[],"mappings":"AAEA,qBAAa,QAAS,SAAQ,KAAK;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO;IAAE,QAAQ,CAAC,SAAS;gBAA7E,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,OAAO,CAAC,EAAE,OAAO,YAAA,EAAW,SAAS,UAAQ;CAC3G;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIpD"}

package/dist/safe-error.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+export class RpcError extends Error {
+    code;
+    details;
+    retryable;
+    constructor(code, message, details, retryable = false) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.retryable = retryable;
+    }
+}
+export function safeErrorCode(error) {
+    if (error instanceof RpcError)
+        return error.code;
+    if (error instanceof z.ZodError)
+        return 'INVALID_MESSAGE';
+    return 'INTERNAL_ERROR';
+}
+//# sourceMappingURL=safe-error.js.map

package/dist/safe-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-error.js","sourceRoot":"","sources":["../src/safe-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,OAAO,QAAS,SAAQ,KAAK;IACZ;IAAwC;IAA4B;IAAzF,YAAqB,IAAY,EAAE,OAAe,EAAW,OAAiB,EAAW,YAAY,KAAK;QAAI,KAAK,CAAC,OAAO,CAAC,CAAA;QAAvG,SAAI,GAAJ,IAAI,CAAQ;QAA4B,YAAO,GAAP,OAAO,CAAU;QAAW,cAAS,GAAT,SAAS,CAAQ;IAAmB,CAAC;CAC/H;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAChD,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ;QAAE,OAAO,iBAAiB,CAAA;IACzD,OAAO,gBAAgB,CAAA;AACzB,CAAC"}

package/dist/server-api.d.ts

@@ -0,0 +1,109 @@
+import type { RtcIceServer } from '@dsh-remote/webrtc';
+import type { HostIdentity } from './identity-store.js';
+import { type ServerCredentialStore, type ServerCredentials } from './server-credentials.js';
+export interface OAuthQrSession {
+    qrId: string;
+    scanUrl: string;
+    expiresIn: number;
+}
+export type OAuthProvider = 'wechat' | 'zhihu' | 'github';
+/**
+ * QR-login providers this build offers. The self-hosted server implements
+ * WeChat; Zhihu and GitHub remain implemented for the hosted server but are not
+ * offered here. This is the one place to enable or retire a provider.
+ */
+export declare const ENABLED_QR_PROVIDERS: readonly OAuthProvider[];
+/**
+ * Whether a caller-supplied string names an offered provider. Narrows the value
+ * so downstream calls receive a validated `OAuthProvider` rather than `string`.
+ */
+export declare function isEnabledQrProvider(value: string): value is OAuthProvider;
+/** Human-readable provider name for diagnostics and prompts. */
+export declare function oauthProviderName(provider: OAuthProvider): string;
+export type OAuthQrPollResult = {
+    status: 'pending' | 'expired';
+} | {
+    status: 'complete';
+    authorization: DeviceAuthorization;
+};
+export interface DeviceAuthorization {
+    method: 'account' | 'host_registration_code' | 'owned_device';
+    account?: string;
+    expiresAt?: number;
+    isAdmin?: boolean;
+}
+export type FetchImplementation = typeof fetch;
+export interface ServerHostDevice {
+    deviceId: string;
+    name: string;
+    platform: string;
+    membershipId: string;
+    online?: boolean;
+    lastSeenAt?: number;
+    clientVersion?: string;
+    harnessVersion?: string;
+}
+export interface AuthorizedPeerDevice extends ServerHostDevice {
+    role: 'host' | 'client';
+    identityKey: string;
+}
+export declare class HostServerApi {
+    private readonly store;
+    private readonly fetchImplementation;
+    private readonly role;
+    readonly baseUrl: string;
+    private identity?;
+    private credentials?;
+    private credentialsPromise?;
+    private harnessVersion?;
+    constructor(serverUrl: string, store: ServerCredentialStore, fetchImplementation?: FetchImplementation, role?: 'host' | 'client');
+    bindIdentity(identity: HostIdentity): void;
+    setHarnessVersion(version: string | undefined): void;
+    currentAuthorization(): DeviceAuthorization | undefined;
+    /** Check the persisted device credential without issuing or refreshing one. */
+    hasStoredAuthorization(): Promise<boolean>;
+    clearAuthorization(): Promise<void>;
+    revokeCurrentDevice(): Promise<void>;
+    authorizeWithAccount(identity: HostIdentity, email: string, password: string): Promise<DeviceAuthorization>;
+    /**
+     * Authorize this device with the DSH DeepSeek account grant.
+     *
+     * The grant is forwarded once so the Server can ask the account platform who
+     * it belongs to; the Server then discards it and issues its own account
+     * session, exactly like a password sign-in.
+     */
+    authorizeWithDeepSeek(identity: HostIdentity, token: string): Promise<DeviceAuthorization>;
+    startOAuthQrLogin(provider?: OAuthProvider): Promise<OAuthQrSession>;
+    pollOAuthQrLogin(identity: HostIdentity, qrId: string, recoverIdentity?: () => Promise<HostIdentity>): Promise<OAuthQrPollResult>;
+    authorizeHostWithCode(identity: HostIdentity, code: string): Promise<DeviceAuthorization>;
+    authorizeOwnedRole(identity: HostIdentity, authorizingAccessToken: string, account?: string): Promise<DeviceAuthorization>;
+    authenticate(identity?: HostIdentity): Promise<ServerCredentials>;
+    refreshCredentials(rejectedAccessToken?: string | undefined): Promise<ServerCredentials>;
+    private withRefreshLock;
+    private rotateCredentials;
+    listDevices(): Promise<ServerHostDevice[]>;
+    deviceFor(peerDeviceId: string): Promise<AuthorizedPeerDevice>;
+    turnCredentials(connectionId: string): Promise<RtcIceServer[]>;
+    presenceFor(deviceId: string): Promise<{
+        online: boolean;
+        lastSeenAt?: number;
+    }>;
+    private loadOrIssue;
+    private register;
+    private deviceDescriptor;
+    private saveTokens;
+    private request;
+    private publicRequest;
+    private requireIdentity;
+}
+export declare class ClientServerApi extends HostServerApi {
+    constructor(serverUrl: string, store: ServerCredentialStore, fetchImplementation?: FetchImplementation);
+}
+export declare class ServerApiError extends Error {
+    readonly code: string;
+    readonly retryable: boolean;
+    readonly status?: number | undefined;
+    readonly phase?: "credential_refresh" | undefined;
+    constructor(code: string, message: string, retryable: boolean, status?: number | undefined, phase?: "credential_refresh" | undefined);
+}
+//# sourceMappingURL=server-api.d.ts.map

package/dist/server-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-api.d.ts","sourceRoot":"","sources":["../src/server-api.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAA8B,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAiBxH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,aAAa,EAAe,CAAA;AAExE;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,aAAa,CAEzE;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAEjE;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE9D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,wBAAwB,GAAG,cAAc,CAAA;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,KAAK,CAAA;AAI9C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,aAAa;IAStB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,QAAQ,CAAC,CAAc;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAmB;IACvC,OAAO,CAAC,kBAAkB,CAAC,CAA4B;IACvD,OAAO,CAAC,cAAc,CAAC,CAAQ;gBAG7B,SAAS,EAAE,MAAM,EACA,KAAK,EAAE,qBAAqB,EAC5B,mBAAmB,GAAE,mBAA2B,EAChD,IAAI,GAAE,MAAM,GAAG,QAAiB;IAKnD,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAE1C,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAEpD,oBAAoB,IAAI,mBAAmB,GAAG,SAAS;IAQvD,+EAA+E;IACzE,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAapC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBjH;;;;;;OAMG;IACG,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsB1F,iBAAiB,CAAC,QAAQ,GAAE,aAAwB,GAAG,OAAO,CAAC,cAAc,CAAC;IAe9E,gBAAgB,CACpB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,GAC5C,OAAO,CAAC,iBAAiB,CAAC;IAqCvB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBzF,kBAAkB,CACtB,QAAQ,EAAE,YAAY,EACtB,sBAAsB,EAAE,MAAM,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC;IAgBzB,YAAY,CAAC,QAAQ,eAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAU3E,kBAAkB,CAAC,mBAAmB,qBAAgC,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAc3F,eAAe;YAWf,iBAAiB;IAsBzB,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAM1C,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAK9D,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQ9D,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YASxE,WAAW;YAWX,QAAQ;IAsBtB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,UAAU;YAcJ,OAAO;YAKP,aAAa;IAiC3B,OAAO,CAAC,eAAe;CAIxB;AAyBD,qBAAa,eAAgB,SAAQ,aAAa;gBACpC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,GAAE,mBAA2B;CAG9G;AAED,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,SAAS,EAAE,OAAO;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB;gBAJ5B,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,KAAK,CAAC,EAAE,oBAAoB,YAAA;CAExC"}

package/dist/server-api.js

@@ -0,0 +1,520 @@
+import { platform } from 'node:os';
+import { fromBase64Url, toBase64Url } from '@dsh-remote/crypto';
+import { deviceTokenPairSchema } from '@dsh-remote/protocol';
+import { ServerCredentialsBusyError } from './server-credentials.js';
+import { normalizeServerUrl } from './config.js';
+import { PLUGIN_VERSION } from './version.js';
+/**
+ * QR-login providers this build offers. The self-hosted server implements
+ * WeChat; Zhihu and GitHub remain implemented for the hosted server but are not
+ * offered here. This is the one place to enable or retire a provider.
+ */
+export const ENABLED_QR_PROVIDERS = ['github'];
+/**
+ * Whether a caller-supplied string names an offered provider. Narrows the value
+ * so downstream calls receive a validated `OAuthProvider` rather than `string`.
+ */
+export function isEnabledQrProvider(value) {
+    return ENABLED_QR_PROVIDERS.includes(value);
+}
+/** Human-readable provider name for diagnostics and prompts. */
+export function oauthProviderName(provider) {
+    return provider === 'github' ? 'GitHub' : provider === 'zhihu' ? 'Zhihu' : 'WeChat';
+}
+const TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
+export class HostServerApi {
+    store;
+    fetchImplementation;
+    role;
+    baseUrl;
+    identity;
+    credentials;
+    credentialsPromise;
+    harnessVersion;
+    constructor(serverUrl, store, fetchImplementation = fetch, role = 'host') {
+        this.store = store;
+        this.fetchImplementation = fetchImplementation;
+        this.role = role;
+        this.baseUrl = normalizeServerUrl(serverUrl);
+    }
+    bindIdentity(identity) { this.identity = identity; }
+    setHarnessVersion(version) { this.harnessVersion = version; }
+    currentAuthorization() {
+        if (this.credentials === undefined)
+            return undefined;
+        return {
+            method: this.credentials.authorizationMethod,
+            ...(this.credentials.account === undefined ? {} : { account: this.credentials.account }),
+        };
+    }
+    /** Check the persisted device credential without issuing or refreshing one. */
+    async hasStoredAuthorization() {
+        const identity = this.requireIdentity();
+        return await this.store.load(this.baseUrl, identity.deviceId) !== undefined;
+    }
+    async clearAuthorization() {
+        this.credentials = undefined;
+        this.credentialsPromise = undefined;
+        await this.store.clear();
+    }
+    async revokeCurrentDevice() {
+        const identity = this.requireIdentity();
+        if (await this.store.load(this.baseUrl, identity.deviceId) === undefined) {
+            await this.clearAuthorization();
+            return;
+        }
+        try {
+            await this.request('/api/v1/devices/self', { method: 'DELETE' });
+        }
+        finally {
+            await this.clearAuthorization();
+        }
+    }
+    async authorizeWithAccount(identity, email, password) {
+        this.bindIdentity(identity);
+        const account = email.trim();
+        if (account.length === 0 || password.length === 0) {
+            throw new ServerApiError('INVALID_MESSAGE', 'Email and password are required.', false);
+        }
+        const login = validateWebLogin(await this.publicRequest('/api/v1/auth/login', {
+            method: 'POST',
+            body: JSON.stringify({ email: account, password }),
+        }));
+        await this.register(identity, {
+            accountToken: login.token,
+            account: login.account,
+            authorizationMethod: 'account',
+        });
+        return {
+            method: 'account',
+            account: login.account,
+            expiresAt: login.expiresAt,
+            isAdmin: login.isAdmin,
+        };
+    }
+    /**
+     * Authorize this device with the DSH DeepSeek account grant.
+     *
+     * The grant is forwarded once so the Server can ask the account platform who
+     * it belongs to; the Server then discards it and issues its own account
+     * session, exactly like a password sign-in.
+     */
+    async authorizeWithDeepSeek(identity, token) {
+        this.bindIdentity(identity);
+        if (token.trim().length === 0) {
+            throw new ServerApiError('INVALID_MESSAGE', 'A DeepSeek account grant is required.', false);
+        }
+        const login = validateWebLogin(await this.publicRequest('/api/v1/auth/deepseek', {
+            method: 'POST',
+            body: JSON.stringify({ token }),
+        }));
+        await this.register(identity, {
+            accountToken: login.token,
+            account: login.account,
+            authorizationMethod: 'account',
+        });
+        return {
+            method: 'account',
+            account: login.account,
+            expiresAt: login.expiresAt,
+            isAdmin: login.isAdmin,
+        };
+    }
+    async startOAuthQrLogin(provider = 'wechat') {
+        const value = requireRecord(await this.publicRequest(`/api/v1/auth/oauth/qr/start?provider=${provider}`, {
+            method: 'POST',
+            body: '{}',
+        }), 'QR login');
+        const scanUrl = normalizeOAuthScanUrl(value.scanUrl, this.baseUrl);
+        if (typeof value.qrId !== 'string' || value.qrId.length < 20
+            || scanUrl === undefined
+            || !Number.isSafeInteger(value.expiresIn)
+            || (value.provider !== undefined && value.provider !== provider)) {
+            throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid QR login session.', false);
+        }
+        return { qrId: value.qrId, scanUrl, expiresIn: value.expiresIn };
+    }
+    async pollOAuthQrLogin(identity, qrId, recoverIdentity) {
+        this.bindIdentity(identity);
+        const value = requireRecord(await this.publicRequest(`/api/v1/auth/oauth/qr/${encodeURIComponent(qrId)}`, { method: 'GET' }), 'QR login status');
+        if (value.status === 'pending' || value.status === 'expired')
+            return { status: value.status };
+        if (value.status !== 'complete' || typeof value.token !== 'string' || value.token.length < 16) {
+            throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid QR login status.', false);
+        }
+        const account = requireRecord(await this.publicRequest('/api/v1/auth/me', { method: 'GET' }, value.token), 'account profile');
+        if (typeof account.account !== 'string' || account.account.length === 0 || typeof account.isAdmin !== 'boolean') {
+            throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid account profile.', false);
+        }
+        const authorization = {
+            accountToken: value.token,
+            account: account.account,
+            authorizationMethod: 'account',
+        };
+        try {
+            await this.register(identity, authorization);
+        }
+        catch (error) {
+            if (!(error instanceof ServerApiError) || error.code !== 'DEVICE_REVOKED' || recoverIdentity === undefined)
+                throw error;
+            const nextIdentity = await recoverIdentity();
+            this.bindIdentity(nextIdentity);
+            await this.register(nextIdentity, authorization);
+        }
+        return {
+            status: 'complete',
+            authorization: { method: 'account', account: account.account, isAdmin: account.isAdmin },
+        };
+    }
+    async authorizeHostWithCode(identity, code) {
+        if (this.role !== 'host') {
+            throw new ServerApiError('METHOD_NOT_ALLOWED', 'Host registration codes can only authorize a Host device.', false);
+        }
+        const registrationCode = code.trim().toUpperCase();
+        if (registrationCode.length === 0) {
+            throw new ServerApiError('INVALID_MESSAGE', 'A Host registration code is required.', false);
+        }
+        this.bindIdentity(identity);
+        const tokens = await this.publicRequest('/api/v1/devices/register-with-code', {
+            method: 'POST',
+            body: JSON.stringify({ v: 1, code: registrationCode, device: this.deviceDescriptor(identity) }),
+        });
+        this.credentials = await this.saveTokens(identity, validateTokens(tokens), {
+            authorizationMethod: 'host_registration_code',
+        });
+        return { method: 'host_registration_code' };
+    }
+    async authorizeOwnedRole(identity, authorizingAccessToken, account) {
+        this.bindIdentity(identity);
+        const tokens = await this.publicRequest('/api/v1/devices/register-owned-role', {
+            method: 'POST',
+            body: JSON.stringify({ v: 1, device: this.deviceDescriptor(identity) }),
+        }, authorizingAccessToken);
+        this.credentials = await this.saveTokens(identity, validateTokens(tokens), {
+            authorizationMethod: 'owned_device',
+            ...(account === undefined ? {} : { account }),
+        });
+        return {
+            method: 'owned_device',
+            ...(account === undefined ? {} : { account }),
+        };
+    }
+    async authenticate(identity = this.requireIdentity()) {
+        this.bindIdentity(identity);
+        if (this.credentials !== undefined && this.credentials.accessTokenExpiresAt > Date.now() + 30_000) {
+            return this.credentials;
+        }
+        this.credentialsPromise ??= this.loadOrIssue(identity).finally(() => { this.credentialsPromise = undefined; });
+        this.credentials = await this.credentialsPromise;
+        return this.credentials;
+    }
+    async refreshCredentials(rejectedAccessToken = this.credentials?.accessToken) {
+        const identity = this.requireIdentity();
+        this.credentials = await this.withRefreshLock(async () => {
+            // Another process may have rotated the token while we waited for the lock.
+            const stored = await this.store.load(this.baseUrl, identity.deviceId);
+            if (stored === undefined || stored.refreshTokenExpiresAt <= Date.now())
+                return this.register(identity);
+            if (stored.accessToken !== rejectedAccessToken && stored.accessTokenExpiresAt > Date.now() + 30_000) {
+                return stored;
+            }
+            return this.rotateCredentials(identity, stored);
+        });
+        return this.credentials;
+    }
+    async withRefreshLock(operation) {
+        try {
+            return await this.store.withRefreshLock(operation);
+        }
+        catch (error) {
+            if (error instanceof ServerCredentialsBusyError) {
+                throw new ServerApiError(error.code, error.message, false);
+            }
+            throw error;
+        }
+    }
+    async rotateCredentials(identity, stored) {
+        let tokens;
+        try {
+            tokens = await this.publicRequest('/api/v1/auth/refresh', {
+                method: 'POST',
+                body: JSON.stringify({ deviceId: identity.deviceId, refreshToken: stored.refreshToken }),
+            });
+        }
+        catch (error) {
+            if (error instanceof ServerApiError) {
+                throw new ServerApiError(error.code, error.message, error.retryable, error.status, 'credential_refresh');
+            }
+            throw error;
+        }
+        return this.store.save({
+            serverUrl: this.baseUrl,
+            deviceId: identity.deviceId,
+            authorizationMethod: stored.authorizationMethod,
+            ...(stored.account === undefined ? {} : { account: stored.account }),
+            ...validateTokens(tokens),
+        });
+    }
+    async listDevices() {
+        const result = await this.request('/api/v1/devices');
+        if (!Array.isArray(result.items))
+            throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid device list.', false);
+        return result.items.map(parseHostDevice);
+    }
+    async deviceFor(peerDeviceId) {
+        const result = await this.request(`/api/v1/devices/${encodeURIComponent(peerDeviceId)}`);
+        return parseAuthorizedPeer(result);
+    }
+    async turnCredentials(connectionId) {
+        const result = await this.request(`/api/v1/turn/credentials?connection_id=${encodeURIComponent(connectionId)}`);
+        if (!Array.isArray(result.iceServers))
+            return [];
+        return result.iceServers.map(parseIceServer);
+    }
+    async presenceFor(deviceId) {
+        const result = await this.request(`/api/v1/devices/${encodeURIComponent(deviceId)}/presence`);
+        if (typeof result.online !== 'boolean'
+            || (result.lastSeenAt !== null && result.lastSeenAt !== undefined && !Number.isSafeInteger(result.lastSeenAt))) {
+            throw new ServerApiError('INVALID_MESSAGE', 'The Server returned invalid device presence.', false);
+        }
+        return { online: result.online, ...(typeof result.lastSeenAt === 'number' ? { lastSeenAt: result.lastSeenAt } : {}) };
+    }
+    async loadOrIssue(identity) {
+        return this.withRefreshLock(async () => {
+            const stored = await this.store.load(this.baseUrl, identity.deviceId);
+            if (stored === undefined || stored.refreshTokenExpiresAt <= Date.now() + 30_000) {
+                return this.register(identity);
+            }
+            if (stored.accessTokenExpiresAt > Date.now() + 30_000)
+                return stored;
+            return this.rotateCredentials(identity, stored);
+        });
+    }
+    async register(identity, authorization) {
+        const tokens = await this.publicRequest('/api/v1/devices/register', {
+            method: 'POST',
+            body: JSON.stringify({
+                v: 1,
+                device: this.deviceDescriptor(identity),
+            }),
+        }, authorization?.accountToken);
+        this.credentials = await this.saveTokens(identity, validateTokens(tokens), {
+            authorizationMethod: authorization?.authorizationMethod ?? 'account',
+            ...(authorization?.account === undefined ? {} : { account: authorization.account }),
+        });
+        return this.credentials;
+    }
+    deviceDescriptor(identity) {
+        return {
+            deviceId: identity.deviceId,
+            name: identity.name,
+            role: this.role,
+            platform: platform(),
+            identityKey: identity.publicKey,
+            clientVersion: PLUGIN_VERSION,
+            ...(this.role === 'host' && this.harnessVersion !== undefined ? { harnessVersion: this.harnessVersion } : {}),
+        };
+    }
+    saveTokens(identity, tokens, authorization) {
+        return this.store.save({
+            serverUrl: this.baseUrl,
+            deviceId: identity.deviceId,
+            authorizationMethod: authorization.authorizationMethod,
+            ...(authorization.account === undefined ? {} : { account: authorization.account }),
+            ...tokens,
+        });
+    }
+    async request(path, init = {}) {
+        const credentials = await this.authenticate();
+        return this.publicRequest(path, init, credentials.accessToken);
+    }
+    async publicRequest(path, init, accessToken) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 10_000);
+        let response;
+        try {
+            response = await this.fetchImplementation(`${this.baseUrl}${path}`, {
+                ...init,
+                signal: controller.signal,
+                headers: {
+                    Accept: 'application/json',
+                    'Content-Type': 'application/json',
+                    ...(accessToken === undefined ? {} : { Authorization: `Bearer ${accessToken}` }),
+                    ...init.headers,
+                },
+            });
+        }
+        catch (error) {
+            throw new ServerApiError('CONNECTION_FAILED', error instanceof Error ? error.message : 'Server request failed.', true);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const body = await parseBody(response);
+        if (!response.ok) {
+            const envelope = (body ?? {});
+            throw new ServerApiError(typeof envelope.error?.code === 'string' ? envelope.error.code : mapStatus(response.status), typeof envelope.error?.message === 'string' ? envelope.error.message : 'The Server rejected the request.', envelope.error?.retryable === true || response.status >= 500, response.status);
+        }
+        return body;
+    }
+    requireIdentity() {
+        if (this.identity === undefined)
+            throw new ServerApiError('IDENTITY_INVALID', 'The device identity is not loaded.', false);
+        return this.identity;
+    }
+}
+/**
+ * Accept the authorization URL a server hands back for a QR login.
+ *
+ * A real OAuth provider's page lives on another origin (`github.com`,
+ * `open.weixin.qq.com`), so requiring the server's own origin would reject every
+ * provider. The guard is the scheme instead: HTTPS, or HTTP when the server
+ * itself is loopback. That still keeps `javascript:`, `data:` and obfuscated
+ * payloads out of the QR link and the rendered anchor.
+ */
+function normalizeOAuthScanUrl(value, baseUrl) {
+    if (typeof value !== 'string' || TERMINAL_CONTROL_CHARACTERS.test(value))
+        return undefined;
+    try {
+        const normalized = new URL(value);
+        if (normalized.protocol === 'https:')
+            return normalized.href;
+        if (normalized.protocol !== 'http:')
+            return undefined;
+        const server = new URL(baseUrl);
+        const loopback = server.hostname === 'localhost' || server.hostname === '127.0.0.1' || server.hostname === '::1';
+        return loopback ? normalized.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export class ClientServerApi extends HostServerApi {
+    constructor(serverUrl, store, fetchImplementation = fetch) {
+        super(serverUrl, store, fetchImplementation, 'client');
+    }
+}
+export class ServerApiError extends Error {
+    code;
+    retryable;
+    status;
+    phase;
+    constructor(code, message, retryable, status, phase) {
+        super(message);
+        this.code = code;
+        this.retryable = retryable;
+        this.status = status;
+        this.phase = phase;
+    }
+}
+function validateTokens(value) {
+    const parsed = deviceTokenPairSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned invalid device credentials.', false);
+    }
+    return parsed.data;
+}
+function validateWebLogin(value) {
+    const item = requireRecord(value, 'account login');
+    if (typeof item.token !== 'string' || item.token.length < 16
+        || !Number.isSafeInteger(item.expiresAt)
+        || typeof item.account !== 'string' || item.account.length === 0 || item.account.length > 254
+        || typeof item.isAdmin !== 'boolean') {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid account session.', false);
+    }
+    return {
+        token: item.token,
+        expiresAt: item.expiresAt,
+        account: item.account,
+        profile: item.profile,
+        isAdmin: item.isAdmin,
+    };
+}
+async function parseBody(response) {
+    const text = await response.text();
+    if (text.length === 0)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned invalid JSON.', false, response.status);
+    }
+}
+function mapStatus(status) {
+    if (status === 401)
+        return 'AUTH_INVALID';
+    if (status === 403)
+        return 'AUTH_REQUIRED';
+    if (status === 404)
+        return 'DEVICE_NOT_FOUND';
+    if (status === 429)
+        return 'RATE_LIMITED';
+    return status >= 500 ? 'CONNECTION_FAILED' : 'INVALID_MESSAGE';
+}
+function parseHostDevice(value) {
+    const item = requireRecord(value, 'host device');
+    if (item.role !== 'host' || typeof item.deviceId !== 'string' || typeof item.name !== 'string'
+        || typeof item.platform !== 'string' || typeof item.membershipId !== 'string' || item.membershipId.length === 0) {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned invalid host device data.', false);
+    }
+    return {
+        deviceId: item.deviceId,
+        name: item.name,
+        platform: item.platform,
+        membershipId: item.membershipId,
+        ...(typeof item.online === 'boolean' ? { online: item.online } : {}),
+        ...(typeof item.lastSeenAt === 'number' && Number.isSafeInteger(item.lastSeenAt) ? { lastSeenAt: item.lastSeenAt } : {}),
+        ...(typeof item.clientVersion === 'string' ? { clientVersion: item.clientVersion } : {}),
+        ...(typeof item.harnessVersion === 'string' ? { harnessVersion: item.harnessVersion } : {}),
+    };
+}
+function parseAuthorizedPeer(value) {
+    const item = requireRecord(value, 'authorized peer');
+    if ((item.role !== 'host' && item.role !== 'client')
+        || typeof item.deviceId !== 'string' || item.deviceId.length === 0
+        || typeof item.name !== 'string' || item.name.length === 0
+        || typeof item.platform !== 'string' || item.platform.length === 0
+        || typeof item.identityKey !== 'string' || !isIdentityKey(item.identityKey)
+        || typeof item.membershipId !== 'string' || item.membershipId.length === 0) {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned invalid authorized peer data.', false);
+    }
+    return {
+        deviceId: item.deviceId,
+        name: item.name,
+        role: item.role,
+        platform: item.platform,
+        identityKey: item.identityKey,
+        membershipId: item.membershipId,
+        ...(typeof item.online === 'boolean' ? { online: item.online } : {}),
+        ...(typeof item.lastSeenAt === 'number' && Number.isSafeInteger(item.lastSeenAt) ? { lastSeenAt: item.lastSeenAt } : {}),
+    };
+}
+function parseIceServer(value) {
+    const item = requireRecord(value, 'ICE server');
+    const urls = item.urls;
+    if (typeof urls !== 'string' && !(Array.isArray(urls) && urls.every(url => typeof url === 'string'))) {
+        throw new ServerApiError('INVALID_MESSAGE', 'The Server returned an invalid ICE server.', false);
+    }
+    return {
+        urls,
+        ...(typeof item.username === 'string' ? { username: item.username } : {}),
+        ...(typeof item.credential === 'string' ? { credential: item.credential } : {}),
+    };
+}
+function isIdentityKey(value) {
+    try {
+        const decoded = fromBase64Url(value);
+        return decoded.length === 32 && toBase64Url(decoded) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function requireRecord(value, name) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new ServerApiError('INVALID_MESSAGE', `The Server returned invalid ${name} data.`, false);
+    }
+    return value;
+}
+//# sourceMappingURL=server-api.js.map