@camstack/server 1.2.572 → 1.2.573

package/dist/agent/main.js

@@ -46,6 +46,8 @@ const addon_scan_js_1 = require("./addon-scan.js");
 const agent_addon_updates_js_1 = require("./agent-addon-updates.js");
 const agent_hub_registration_js_1 = require("./agent-hub-registration.js");
 const agent_mesh_join_js_1 = require("./agent-mesh-join.js");
+const agent_pairing_local_js_1 = require("./agent-pairing-local.js");
+const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
 const agent_config_js_1 = require("./agent-config.js");
 const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_group_runner_js_1 = require("./agent-group-runner.js");
@@ -186,6 +188,13 @@ async function startAgent(configPath) {
     const meshJoin = (0, agent_mesh_join_js_1.createAgentMeshJoin)({
         nodeId: config.nodeId,
         secret: () => currentSecret,
+        // D857 (transition release): the hub is also accepted by its certificate, verified by this
+        // agent's own TLS listener, so a hub that stops answering the join still reaches this agent.
+        isPaired: () => (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
+        isVerifiedPeer: (nodeId) => {
+            const tx = (0, system_1.currentBrokerTransporter)(broker).tx;
+            return tx instanceof system_1.TlsTcpTransporter && tx.verifiedPeer(nodeId) !== undefined;
+        },
         call: (action, params, opts) => broker.call(action, params, opts),
         log: (msg) => console.log(`[Agent] ${msg}`),
         onState: (state) => {
@@ -512,6 +521,11 @@ async function startAgent(configPath) {
         dataDir: config.dataDir,
         configPath: config.configPath,
         reconnect,
+        // The hub unpairs this agent (D857): answered first, then erase and reconnect unpaired.
+        forgetHub: () => {
+            const timer = setTimeout(() => void forgetHubNow('the hub unpaired this agent'), 300);
+            timer.unref?.();
+        },
         getHttpsListener: () => agentHttpListener,
         hostFacts: (0, system_2.systemHostFacts)(),
         log: {
@@ -897,6 +911,54 @@ async function startAgent(configPath) {
             }),
         },
     };
+    // -- Pairing (D857) -------------------------------------------------------------
+    // A hub pairs this agent from outside; the agent installs the certificate only after
+    // its own operator confirmed the code. Its pairing state is advertised over mDNS.
+    const agentVersion = process.env['CAMSTACK_AGENT_APP_VERSION'] ?? agentUpdateService.getRunningRootPackage().version;
+    const agentMdns = new system_1.AgentMdnsAdvertiser({
+        publisher: (0, system_1.createCiaoPublisher)(),
+        logger: consoleLogger,
+    });
+    const advertise = () => {
+        void agentMdns.sync({
+            nodeId: config.nodeId,
+            version: agentVersion,
+            port: config.statusPort ?? 4444,
+            state: pairing.state(),
+            leafFingerprint: (0, agent_pairing_store_js_1.pairedLeafFingerprint)(config.configPath),
+        });
+    };
+    const localPairing = (0, agent_pairing_local_js_1.createLocalPairingAnnouncer)(config.dataDir, consoleLogger);
+    const pairing = new system_1.AgentPairing({
+        nodeId: config.nodeId,
+        version: agentVersion,
+        isPaired: () => (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
+        install: async (installed) => {
+            (0, agent_pairing_store_js_1.persistPairing)(config.configPath, installed);
+            hubConnectionStateOverride = null;
+            consoleLogger.info('Paired with the hub - reconnecting with the new certificate', {
+                meta: { hubUrl: installed.hubUrl, hubAddress: installed.hubAddress },
+            });
+            // The completion is answered first; the wire is replaced right after.
+            const timer = setTimeout(() => void reconnect().then(advertise, advertise), 400);
+            timer.unref?.();
+        },
+        log: (message, meta) => consoleLogger.info(`pairing: ${message}`, meta ? { meta } : undefined),
+        onStateChange: advertise,
+        // The PIN and the agent's own code are shown on THIS machine only (console, 0600 file).
+        onLocalSecret: localPairing.onSecret,
+        onLocalSecretCleared: localPairing.onCleared,
+        onResetCode: localPairing.onResetCode,
+    });
+    const forgetHubNow = async (why) => {
+        consoleLogger.warn(`Leaving the hub: ${why}. This agent is unpaired and advertises again`);
+        (0, agent_pairing_store_js_1.forgetPairing)(config.configPath, config.dataDir);
+        pairing.noteUnpaired();
+        hubConnectionStateOverride = null;
+        await reconnect().catch((err) => consoleLogger.error(`reconnect after unpairing failed: ${(0, types_1.errMsg)(err)}`));
+        advertise();
+    };
+    advertise();
     void (0, agent_http_js_1.startAgentHttpServer)(getBrokerFn, {
         log: {
             info: (message, extras) => consoleLogger.info(message, extras),
@@ -908,6 +970,8 @@ async function startAgent(configPath) {
         dataDir: config.dataDir,
         configPath: config.configPath,
         onReconnect: reconnect,
+        pairing,
+        onForgetHub: () => forgetHubNow('requested on this agent'),
         getHubConnectionState,
         getMeshTransport: () => (currentMeshTls !== null ? 'tls' : 'clear'),
         updateControls,
@@ -990,6 +1054,7 @@ async function startAgent(configPath) {
             }
         }
         // Stop accepting new HTTP/HTTPS connections before the broker goes away.
+        await agentMdns.stop().catch(() => undefined);
         await agentHttpListener?.close().catch(() => undefined);
         await broker.stop();
         process.exit(0);

package/dist/api/core/agent-pairing.router.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentPairingRouter = createAgentPairingRouter;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Agent pairing — fixed core API for System -> Cluster -> Agents (D857).
+ *
+ * Hand-written (not a `*.cap.ts`) like `certificates.router.ts`: it joins the
+ * mesh CA, the certificate registry, mDNS discovery and the agent's own HTTP
+ * pairing surface, none of which is a capability.
+ *
+ *   listDiscoveredAgents  agents found on the LAN + addresses typed so far
+ *   addAgentByAddress     probe a typed address (GET .../pairing/hello)
+ *   beginPairing          offer the mesh CA to an agent; both screens now show a code
+ *   getPairing/listPairings  progress (also advances the pairing)
+ *   confirmPairing        the operator typed the code the AGENT shows
+ *   rejectPairing         cancel on both sides
+ *   unpairAgent           tell the agent to forget the hub, revoke its certificates
+ *
+ * The operator MUST type the code read on the agent's screen into `confirmPairing`:
+ * the hub checks it against the code it computed itself. A page that sends back
+ * `code` from `getPairing` defeats the check and is a bug.
+ */
+const hub_discovery_1 = require("@camstack/develop/hub-discovery");
+const system_1 = require("@camstack/system");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const agent_pairing_http_js_1 = require("../../core/agent/agent-pairing-http.js");
+const hub_agent_pairing_js_1 = require("../../core/agent/hub-agent-pairing.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const HUB_NODE_ID = 'hub';
+const BROWSE_TIMEOUT_MS = 3_000;
+const EndpointSchema = zod_1.z.object({
+    host: zod_1.z.string().min(1).max(253),
+    port: zod_1.z.number().int().min(1).max(65535).default(4444),
+});
+const PairingViewSchema = zod_1.z.object({
+    pairingId: zod_1.z.string(),
+    nodeId: zod_1.z.string(),
+    endpoint: zod_1.z.object({ host: zod_1.z.string(), port: zod_1.z.number() }),
+    /**
+     * The six digits the hub computed. For DISPLAY next to the agent's own: the operator
+     * confirms by typing the code the AGENT shows, never by echoing this one.
+     */
+    code: zod_1.z.string(),
+    state: zod_1.z.enum(['awaiting-confirmation', 'completing', 'paired', 'rejected', 'expired', 'failed']),
+    hubConfirmed: zod_1.z.boolean(),
+    agentConfirmed: zod_1.z.boolean(),
+    expiresAt: zod_1.z.number(),
+    failure: zod_1.z.string().nullable(),
+});
+const DiscoveredAgentSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    host: zod_1.z.string(),
+    port: zod_1.z.number(),
+    version: zod_1.z.string().nullable(),
+    state: zod_1.z.enum(['unpaired', 'pending', 'paired']),
+    fingerprint: zod_1.z.string().nullable(),
+    source: zod_1.z.enum(['mdns', 'address']),
+    connected: zod_1.z.boolean(),
+    pairing: PairingViewSchema.nullable(),
+});
+const UnpairResultSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    /** The agent acknowledged and is erasing its certificate; `false` when it could not be reached. */
+    agentNotified: zod_1.z.boolean(),
+    revokedSerials: zod_1.z.array(zod_1.z.string()),
+    disconnected: zod_1.z.number().int(),
+    next: zod_1.z.string(),
+});
+function createAgentPairingRouter(deps) {
+    const transport = deps.transport ?? (0, agent_pairing_http_js_1.createHttpAgentPairingTransport)();
+    const meshCa = deps.meshCa ??
+        (() => {
+            const state = (0, system_1.getProcessMeshCaState)();
+            return state.state === 'ready' ? state.ca : null;
+        });
+    const meshRegistry = deps.meshRegistry ?? system_1.getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? system_1.processMeshCrl;
+    const peers = deps.peers ?? {
+        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
+        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
+    };
+    const isNodeConnected = deps.isNodeConnected ?? system_1.isProcessVerifiedMeshPeer;
+    const localNetwork = () => {
+        const provider = deps.registry?.getSingleton('local-network');
+        if (!provider) {
+            throw new Error('The local-network capability is not available yet');
+        }
+        return provider;
+    };
+    /** The address an agent dials (its `internal` role) and the URL the hub serves its API on. */
+    const hubAddresses = deps.hubAddresses ??
+        (async () => {
+            const book = await localNetwork().getAddresses({ scheme: 'https' });
+            const internal = book.roles.internal.resolved;
+            const hubUrl = book.roles.publicEndpoint.resolved ?? internal;
+            if (internal === null || hubUrl === null) {
+                throw new Error('The hub has no LAN address to give an agent yet - set one on System -> Network');
+            }
+            return {
+                hubUrl,
+                hubMeshAddress: `${new URL(internal).hostname}:${system_1.DEFAULT_HUB_TLS_TCP_PORT}`,
+            };
+        });
+    const pairing = new system_1.HubPairing({
+        transport,
+        ca: meshCa,
+        hubNodeId: HUB_NODE_ID,
+        hubUrl: async () => (await hubAddresses()).hubUrl,
+        hubMeshAddress: async () => (await hubAddresses()).hubMeshAddress,
+        isNodeConnected,
+        recordIssued: async (nodeId, certPem) => {
+            const registry = meshRegistry();
+            if (registry === null) {
+                throw new Error('the certificate registry is not loaded - the pairing was not completed');
+            }
+            await registry.recordIssued(nodeId, certPem, 'pairing');
+        },
+        revokeNode: async (nodeId, reason, keepCertPem) => {
+            const registry = meshRegistry();
+            if (registry === null)
+                return;
+            const keep = keepCertPem === undefined ? undefined : new node_crypto_1.X509Certificate(keepCertPem).fingerprint256;
+            await registry.revokeAllForNode(nodeId, reason, crl(), keep);
+        },
+        isLeafPresented: (nodeId, certPem) => {
+            const seen = peers.peerLeaf?.(nodeId)?.fingerprint;
+            const norm = (f) => f.replaceAll(':', '').toLowerCase();
+            return seen !== undefined && norm(seen) === norm(new node_crypto_1.X509Certificate(certPem).fingerprint256);
+        },
+        revokeLeaf: async (_nodeId, certPem, reason) => {
+            const registry = meshRegistry();
+            if (registry === null)
+                return;
+            await registry.revoke(new node_crypto_1.X509Certificate(certPem).fingerprint256, reason, crl());
+        },
+        // Ids the registry has ever issued for: a node id differing only in case from one of them is refused.
+        knownNodeIds: () => meshRegistry()
+            ?.list()
+            .map((r) => r.nodeId) ?? [],
+        log: (message, meta) => {
+            const nodeId = typeof meta?.['nodeId'] === 'string' ? meta['nodeId'] : undefined;
+            deps.log.info(`pairing: ${message}`, {
+                ...(nodeId !== undefined ? { tags: { nodeId } } : {}),
+                ...(meta ? { meta } : {}),
+            });
+        },
+    });
+    const service = new hub_agent_pairing_js_1.HubAgentPairing({
+        pairing,
+        transport,
+        browse: deps.browse ??
+            (() => (0, hub_discovery_1.browseAgentsMdns)({
+                timeoutMs: BROWSE_TIMEOUT_MS,
+                onProblem: (message) => deps.log.warn(`agent browse problem: ${message}`),
+            })),
+        isNodeConnected,
+        log: deps.log,
+    });
+    /** A refusal the operator can act on is a PRECONDITION_FAILED with the reason, not a 500. */
+    const guard = async (run) => {
+        try {
+            return await run();
+        }
+        catch (err) {
+            if (err instanceof server_1.TRPCError)
+                throw err;
+            throw new server_1.TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    };
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        /** Agents found over mDNS and addresses typed so far, with any pairing in progress. */
+        listDiscoveredAgents: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ refresh: zod_1.z.boolean().optional() }).optional())
+            .output(zod_1.z.object({
+            agents: zod_1.z.array(DiscoveredAgentSchema),
+            scannedAt: zod_1.z.number().nullable(),
+        }))
+            .query(({ input }) => guard(() => service.listDiscovered({ refresh: input?.refresh === true }))),
+        /** Probe an address the operator typed. The agent must be on a private / local address. */
+        addAgentByAddress: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({
+            host: zod_1.z.string().min(1).max(253),
+            port: zod_1.z.number().int().min(1).max(65535).optional(),
+        }))
+            .output(DiscoveredAgentSchema)
+            .mutation(({ input }) => guard(() => service.addByAddress(input.host.trim(), input.port))),
+        /** Offer the mesh CA to an agent and derive the code both screens show. */
+        beginPairing: trpc_middleware_js_1.adminProcedure
+            .input(EndpointSchema)
+            .output(PairingViewSchema)
+            .mutation(({ input }) => guard(() => service.begin({ host: input.host.trim(), port: input.port }))),
+        getPairing: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1) }))
+            .output(PairingViewSchema)
+            .query(({ input }) => guard(() => service.get(input.pairingId))),
+        listPairings: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(PairingViewSchema))
+            .query(() => service.list().map((p) => p)),
+        /** The operator typed the code shown on the AGENT. Wrong three times cancels the pairing. */
+        confirmPairing: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1), code: zod_1.z.string().min(1).max(16) }))
+            .output(PairingViewSchema)
+            .mutation(({ input }) => guard(() => service.confirm(input.pairingId, input.code))),
+        rejectPairing: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1) }))
+            .output(PairingViewSchema)
+            .mutation(({ input }) => guard(() => service.reject(input.pairingId))),
+        /**
+         * Unpair an agent: it is told to erase its certificate and advertise itself again, and every
+         * certificate the hub issued to it goes on the CRL. Revoke last - the agent is told first,
+         * because revoking drops its connection. An unreachable agent is still revoked (it can no longer
+         * connect); it is then unpaired by hand on its own page.
+         */
+        unpairAgent: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
+            .output(UnpairResultSchema)
+            .mutation(({ input }) => guard(async () => {
+            if (input.nodeId === HUB_NODE_ID) {
+                throw new Error('The hub is not an agent and cannot be unpaired');
+            }
+            const registry = meshRegistry();
+            if (registry === null) {
+                throw new Error('The certificate registry is not loaded - nothing can be revoked yet');
+            }
+            const tags = { nodeId: input.nodeId };
+            let agentNotified = false;
+            const client = deps.nodeClient(input.nodeId);
+            if (client !== null) {
+                try {
+                    await client.forgetHub();
+                    agentNotified = true;
+                }
+                catch (err) {
+                    deps.log.warn('The agent could not be told to forget the hub - revoking anyway', {
+                        tags,
+                        meta: { error: err instanceof Error ? err.message : String(err) },
+                    });
+                }
+            }
+            const revoked = await (0, system_1.revokeMeshCertificate)({
+                nodeId: input.nodeId,
+                registry,
+                crl: crl(),
+                peers,
+                log: deps.log,
+            });
+            return {
+                nodeId: input.nodeId,
+                agentNotified,
+                revokedSerials: [...revoked.revokedSerials],
+                disconnected: revoked.disconnected,
+                next: agentNotified
+                    ? 'The agent erased its certificate and advertises itself as unpaired. Pair it again from this page, or forget the node.'
+                    : 'The agent could not be reached: its certificate is revoked, but it still holds it until it is unpaired on its own page. Pair it again afterwards.',
+            };
+        })),
+    });
+}

package/dist/api/core/certificates.router.js

@@ -55,8 +55,8 @@ const MeshLeafRowSchema = zod_1.z.object({
     notBefore: zod_1.z.number(),
     notAfter: zod_1.z.number(),
     issuedAt: zod_1.z.number(),
-    /** `enroll` | `renewal` | `boot` were issued by the hub; `observed` was read off a live connection. */
-    issuedVia: zod_1.z.enum(['enroll', 'renewal', 'boot', 'observed']),
+    /** `enroll` | `pairing` | `renewal` | `boot` were issued by the hub; `observed` was read off a live connection. */
+    issuedVia: zod_1.z.enum(['enroll', 'pairing', 'renewal', 'boot', 'observed']),
     status: zod_1.z.enum(['valid', 'expiring', 'expired', 'revoked']),
     revokedAt: zod_1.z.number().nullable(),
     revokedReason: zod_1.z.string().nullable(),

package/dist/api/trpc/generated-cap-routers.js

@@ -6204,6 +6204,15 @@ function createCapRouter_nodeCertificates(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.prepareHttpsCertificate(methodInput);
         }),
+        forgetHub: trpc_middleware_js_1.adminProcedure
+            .input(types_88.nodeCertificatesCapability.methods.forgetHub.input.loose())
+            .output(types_88.nodeCertificatesCapability.methods.forgetHub.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('node-certificates', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.forgetHub(methodInput);
+        }),
         installHttpsCertificate: trpc_middleware_js_1.adminProcedure
             .input(types_88.nodeCertificatesCapability.methods.installHttpsCertificate.input.loose())
             .output(types_88.nodeCertificatesCapability.methods.installHttpsCertificate.output)

package/dist/api/trpc/trpc.router.js

@@ -41,6 +41,7 @@ exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
 const path = __importStar(require("node:path"));
 const addon_settings_router_js_1 = require("../core/addon-settings.router.js");
+const agent_pairing_router_js_1 = require("../core/agent-pairing.router.js");
 const certificates_router_js_1 = require("../core/certificates.router.js");
 const node_certificates_client_js_1 = require("../../core/agent/node-certificates-client.js");
 const auth_router_js_1 = require("../core/auth.router.js");
@@ -314,6 +315,12 @@ function buildCapabilityRouters(services) {
             hubDataDir: path.resolve(services.configService.get('server.dataPath') ?? 'camstack-data'),
             log: services.loggingService.createLogger('certificates'),
         }),
+        // agentPairing - hub-initiated pairing of agents, unpairing (D857).
+        agentPairing: (0, agent_pairing_router_js_1.createAgentPairingRouter)({
+            registry: services.capabilityRegistry,
+            nodeClient: (nodeId) => (0, node_certificates_client_js_1.createNodeCertificatesClient)(services.moleculer, nodeId),
+            log: services.loggingService.createLogger('agent-pairing'),
+        }),
         auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
             ...(services.authNetworkPolicy !== undefined
                 ? { network: services.authNetworkPolicy }

package/dist/core/agent/agent-pairing-http.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertPairableHost = assertPairableHost;
+exports.createHttpAgentPairingTransport = createHttpAgentPairingTransport;
+/**
+ * The hub's HTTP client for an agent's pairing endpoints (D857).
+ *
+ * An unpaired agent speaks plain HTTP on its API port (it has no certificate to
+ * speak TLS with); a paired one answers `hello` the same way. Everything the agent
+ * says is untrusted data: every answer is read through a size cap and a Zod
+ * schema, a redirect is an error, and a refusal keeps the agent's own code so the
+ * hub can tell "awaiting local confirmation" from a failure.
+ *
+ * The target is checked before anything is sent: a pairing talks to a machine on
+ * the operator's own network, never to a public address (the hub must not be a
+ * way to make requests to arbitrary hosts).
+ */
+const node_net_1 = require("node:net");
+const system_1 = require("@camstack/system");
+const zod_1 = require("zod");
+const REQUEST_TIMEOUT_MS = 8_000;
+const MAX_RESPONSE_BYTES = 128 * 1024;
+const HelloSchema = zod_1.z.object({
+    protocol: zod_1.z.number(),
+    nodeId: zod_1.z.string().min(1).max(128),
+    version: zod_1.z.string().nullable(),
+    state: zod_1.z.enum(['unpaired', 'pending', 'paired']),
+    pendingExpiresAt: zod_1.z.number().nullable(),
+});
+const OfferAnswerSchema = zod_1.z.object({
+    ok: zod_1.z.literal(true),
+    answer: zod_1.z.object({
+        pairingId: zod_1.z.string().min(1).max(128),
+        csrPem: zod_1.z.string().min(1).max(16_384),
+        agentNonce: zod_1.z.string().min(1).max(256),
+        expiresAt: zod_1.z.number(),
+    }),
+});
+const PollSchema = zod_1.z.object({
+    ok: zod_1.z.literal(true),
+    poll: zod_1.z.object({
+        state: zod_1.z.enum(['pending', 'idle']),
+        localConfirmed: zod_1.z.boolean(),
+        last: zod_1.z
+            .object({
+            pairingId: zod_1.z.string(),
+            outcome: zod_1.z.enum(['completed', 'rejected', 'expired', 'code-mismatch', 'failed']),
+        })
+            .nullable(),
+    }),
+});
+const FailureSchema = zod_1.z.object({
+    error: zod_1.z.string().optional(),
+    message: zod_1.z.string().optional(),
+});
+/** A pairing target must be on the operator's own network. Throws with the reason. */
+function assertPairableHost(host) {
+    const bare = host.replace(/^\[|\]$/g, '');
+    const isLoopback = bare === 'localhost' || bare === '::1' || bare.startsWith('127.');
+    if (isLoopback)
+        return;
+    if ((0, node_net_1.isIP)(bare) !== 0) {
+        if ((0, system_1.isPrivateAddress)(bare))
+            return;
+        throw new Error(`"${host}" is not a private network address - an agent is paired from the LAN`);
+    }
+    if ((0, system_1.isLocalOnlyHostname)(bare.toLowerCase()))
+        return;
+    throw new Error(`"${host}" is not a local name - use the agent's LAN address or a .local / .lan host name`);
+}
+function baseUrl(endpoint) {
+    const host = (0, node_net_1.isIP)(endpoint.host) === 6 ? `[${endpoint.host}]` : endpoint.host;
+    return `http://${host}:${endpoint.port}`;
+}
+async function readCapped(response) {
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        return '';
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > MAX_RESPONSE_BYTES) {
+            await reader.cancel();
+            throw new Error('the agent answered with more than 128 KiB');
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function createHttpAgentPairingTransport(options = {}) {
+    const fetchFn = options.fetchFn ?? fetch;
+    const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
+    async function call(endpoint, method, path, schema, body) {
+        assertPairableHost(endpoint.host);
+        let response;
+        try {
+            response = await fetchFn(`${baseUrl(endpoint)}${path}`, {
+                method,
+                redirect: 'error',
+                signal: AbortSignal.timeout(timeoutMs),
+                ...(body === undefined
+                    ? {}
+                    : { headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }),
+            });
+        }
+        catch (err) {
+            throw new Error(`could not reach the agent at ${endpoint.host}:${endpoint.port}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        const text = await readCapped(response);
+        let json;
+        try {
+            json = text.length === 0 ? null : JSON.parse(text);
+        }
+        catch {
+            json = null;
+        }
+        if (!response.ok) {
+            const failure = FailureSchema.safeParse(json);
+            const code = failure.success ? (failure.data.error ?? 'refused') : 'refused';
+            const message = failure.success
+                ? (failure.data.message ?? failure.data.error ?? `HTTP ${response.status}`)
+                : `HTTP ${response.status}`;
+            throw new system_1.PairingHttpError(response.status, code, message);
+        }
+        const parsed = schema.safeParse(json);
+        if (!parsed.success) {
+            throw new Error(`the agent at ${endpoint.host}:${endpoint.port} answered with an unexpected shape`);
+        }
+        return parsed.data;
+    }
+    const Ok = zod_1.z.object({ ok: zod_1.z.literal(true) });
+    return {
+        hello: (endpoint) => call(endpoint, 'GET', system_1.PAIRING_PATHS.hello, HelloSchema),
+        offer: async (endpoint, body) => (await call(endpoint, 'POST', system_1.PAIRING_PATHS.offer, OfferAnswerSchema, body)).answer,
+        reveal: async (endpoint, body) => {
+            await call(endpoint, 'POST', system_1.PAIRING_PATHS.reveal, Ok, body);
+        },
+        poll: async (endpoint, pairingId) => (await call(endpoint, 'POST', system_1.PAIRING_PATHS.poll, PollSchema, { pairingId })).poll,
+        complete: async (endpoint, body) => {
+            await call(endpoint, 'POST', system_1.PAIRING_PATHS.complete, Ok, body);
+        },
+        reject: async (endpoint, pairingId) => {
+            await call(endpoint, 'POST', system_1.PAIRING_PATHS.cancel, Ok, { pairingId });
+        },
+    };
+}