@classytic/labs 0.1.0 → 0.3.0

package/dist/domains/networking/vlan-designer/runtime.mjs

@@ -0,0 +1,276 @@
+'use client';
+
+import { CheckButton, Chip } from "../../../kit/controls.mjs";
+import { LiveRegion } from "../../../kit/frame.mjs";
+import { AuthoredActivityRuntime } from "../../../kit/authored-activity-runtime.mjs";
+import { broadcastFrom, domainCount, isLive, makeVlanSwitch, sendBetween, setPortVlan, setRouting } from "../../../networking/vlan.mjs";
+import { VlanScene } from "../../../networking/VlanScene.mjs";
+import { useCallback, useMemo, useState } from "react";
+import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
+
+//#region src/domains/networking/vlan-designer/runtime.tsx
+/**
+* VlanDesignerLab — two networks in one box, and the door between them.
+*
+* The textbook line is "a VLAN is a virtual LAN", which teaches nothing because it defines a term
+* with the same term. The definition that survives contact with a real network is: a VLAN is a
+* BROADCAST DOMAIN. So the lab is built entirely around one observable event, a broadcast, and the
+* learner watches where it stops.
+*
+* The move that lands it is reassigning a port. No cable is touched, nothing is unplugged, and the
+* set of machines that hear the broadcast changes. That is the whole reason VLANs exist, and it is
+* a single click here.
+*
+* The last phase is the half usually skipped. If the isolation is real, nothing can cross, and that
+* is a problem: Sales does need the file server. Turning on a layer-3 interface makes crossing
+* possible while the broadcast isolation stays exactly as it was, because routing happens a layer
+* up. Every crossing now passes one point, which is precisely where a firewall rule would sit.
+*/
+const VLAN_ACTIVITY = {
+	pattern: "diagnosis",
+	title: "Split one switch into two networks",
+	objectives: [
+		"State what a VLAN is in terms of what a broadcast reaches",
+		"Change which machines hear a broadcast without touching a cable",
+		"Explain why nothing crosses between VLANs at layer 2",
+		"Describe what a layer-3 interface adds, and what it deliberately does not"
+	],
+	success: [
+		{
+			id: "predict-broadcast",
+			source: "answer",
+			key: "who-hears",
+			pendingLabel: "Predict which machines hear the broadcast."
+		},
+		{
+			id: "moved-a-port",
+			source: "metric",
+			key: "reassigned",
+			pendingLabel: "Move a port into the other VLAN and broadcast again."
+		},
+		{
+			id: "tried-crossing",
+			source: "metric",
+			key: "crossing",
+			pendingLabel: "Try to send from one VLAN to the other."
+		},
+		{
+			id: "why-isolated",
+			source: "answer",
+			key: "what-routing-does",
+			pendingLabel: "Say what turning on routing changes, and what it leaves alone."
+		}
+	],
+	questions: [{
+		id: "who-hears",
+		prompt: "Eight machines share one switch. Ports 1 to 4 are in VLAN 10 and ports 5 to 8 are in VLAN 20. Sales, on port 1, sends a broadcast. Who receives it?",
+		choices: [
+			{
+				value: "all",
+				label: "Every machine on the switch, since they share one box",
+				feedback: "One chassis, but the switch will not carry a frame out of its VLAN."
+			},
+			{
+				value: "own-vlan",
+				label: "Only the live machines in VLAN 10"
+			},
+			{
+				value: "neighbours",
+				label: "Only the ports either side of port 1",
+				feedback: "Physical position on the panel means nothing here."
+			}
+		],
+		answer: "own-vlan",
+		explain: "A broadcast floods its own broadcast domain and stops. The VLAN tag on each access port is what defines that domain, so ports 2, 3 and 4 receive it and ports 5 and 6 never see it at all."
+	}, {
+		id: "what-routing-does",
+		prompt: "A layer-3 interface is added between VLAN 10 and VLAN 20. What changes?",
+		choices: [
+			{
+				value: "merged",
+				label: "The two VLANs are now one network again",
+				feedback: "If that were true there would be no reason to have split them."
+			},
+			{
+				value: "crossing-only",
+				label: "Directed traffic can cross, but broadcasts still stop at the VLAN edge"
+			},
+			{
+				value: "broadcast-too",
+				label: "Broadcasts now reach both VLANs as well",
+				feedback: "Broadcasts are a layer-2 event. A layer-3 interface is not in that conversation."
+			}
+		],
+		answer: "crossing-only",
+		explain: "Routing works a layer above the broadcast domain, so it can carry addressed traffic between the two networks while leaving the flooding boundary untouched. That is the point: you keep the isolation and you get one controlled door, which is exactly where a policy belongs."
+	}],
+	steps: [
+		{
+			id: "predict",
+			phase: "predict",
+			title: "Who hears it?",
+			lead: "One switch, eight ports, two VLANs. Sales is about to shout.",
+			success: "predict-broadcast"
+		},
+		{
+			id: "act",
+			phase: "act",
+			title: "Move a port, move a machine",
+			lead: "Click any port to reassign it to the other VLAN, then broadcast again. No cable moves.",
+			controls: true,
+			success: "moved-a-port"
+		},
+		{
+			id: "observe",
+			phase: "observe",
+			title: "Two networks, one box",
+			lead: "The tinted regions are not decoration. Each one is a separate broadcast domain that happens to share a power supply.",
+			controls: true
+		},
+		{
+			id: "explain",
+			phase: "explain",
+			title: "Now try to cross",
+			lead: "Send from a machine in one VLAN to a machine in the other. With no layer-3 interface there is no path at all.",
+			controls: true,
+			success: "tried-crossing"
+		},
+		{
+			id: "transfer",
+			phase: "transfer",
+			title: "One door, on purpose",
+			lead: "Turn the layer-3 interface on and watch what changes. Then check what did not.",
+			controls: true,
+			success: "why-isolated"
+		}
+	]
+};
+function VlanDesignerLab({ connectedPorts = 6, routing = false, title, prompt } = {}) {
+	const [state, setState] = useState(() => ({
+		...makeVlanSwitch(connectedPorts),
+		routing
+	}));
+	const [source, setSource] = useState(1);
+	const [target, setTarget] = useState(5);
+	const [result, setResult] = useState(null);
+	const livePorts = useMemo(() => state.ports.filter(isLive), [state.ports]);
+	const domains = domainCount(state);
+	const cyclePort = useCallback((portId, context) => {
+		setState((current) => {
+			const port = current.ports.find((item) => item.id === portId);
+			if (!port) return current;
+			const order = current.vlans.map((vlan) => vlan.id);
+			const next = order[(order.indexOf(port.vlan) + 1) % order.length];
+			return setPortVlan(current, portId, next);
+		});
+		setResult(null);
+		context.complete("moved-a-port", "reassigned");
+	}, []);
+	const doBroadcast = useCallback(() => {
+		setResult({
+			kind: "broadcast",
+			source,
+			...broadcastFrom(state, source)
+		});
+	}, [state, source]);
+	const doSend = useCallback((context) => {
+		setResult({
+			kind: "send",
+			source,
+			target,
+			...sendBetween(state, source, target)
+		});
+		const from = state.ports.find((port) => port.id === source);
+		const to = state.ports.find((port) => port.id === target);
+		if (from && to && from.vlan !== to.vlan) context.complete("tried-crossing", "crossing");
+	}, [
+		state,
+		source,
+		target
+	]);
+	const headline = result ? result.message : `Two VLANs on one switch, carrying ${domains} separate broadcast domain${domains === 1 ? "" : "s"}. Pick a machine and send something.`;
+	return /* @__PURE__ */ jsx(AuthoredActivityRuntime, {
+		activity: VLAN_ACTIVITY,
+		activityId: "vlan-designer",
+		eyebrow: "Segmentation",
+		title: title ?? "Two networks in one switch",
+		description: prompt ?? "A VLAN is not a virtual anything. It is a broadcast domain, and you can watch where one stops.",
+		status: /* @__PURE__ */ jsxs(Fragment$1, { children: [
+			/* @__PURE__ */ jsxs("span", { children: [
+				/* @__PURE__ */ jsx("strong", { children: domains }),
+				" broadcast domain",
+				domains === 1 ? "" : "s"
+			] }),
+			/* @__PURE__ */ jsx("span", { children: state.routing ? "layer 3 on" : "no routing" }),
+			result?.kind === "send" ? /* @__PURE__ */ jsx("span", {
+				"data-delivered": result.delivered || void 0,
+				children: result.delivered ? result.viaRouter ? "via router" : "direct" : "no path"
+			}) : null
+		] }),
+		inspector: (context) => /* @__PURE__ */ jsxs(Fragment$1, { children: [
+			/* @__PURE__ */ jsxs("div", {
+				className: "network-inspector-heading",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("span", { children: "Sending from" }), /* @__PURE__ */ jsx("strong", { children: state.ports.find((port) => port.id === source)?.device?.name ?? `port ${source}` })] }), /* @__PURE__ */ jsxs("span", { children: ["VLAN ", state.ports.find((port) => port.id === source)?.vlan] })]
+			}),
+			/* @__PURE__ */ jsx("div", {
+				className: "lab-activity-fields",
+				children: livePorts.map((port) => /* @__PURE__ */ jsx(Chip, {
+					selected: source === port.id,
+					onClick: () => setSource(port.id),
+					children: port.device.name
+				}, port.id))
+			}),
+			/* @__PURE__ */ jsx("div", {
+				className: "lab-activity-fields",
+				children: /* @__PURE__ */ jsx(CheckButton, {
+					onClick: doBroadcast,
+					children: "Broadcast to everyone"
+				})
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "network-inspector-heading",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("span", { children: "Or send directly to" }), /* @__PURE__ */ jsx("strong", { children: state.ports.find((port) => port.id === target)?.device?.name ?? `port ${target}` })] }), /* @__PURE__ */ jsxs("span", { children: ["VLAN ", state.ports.find((port) => port.id === target)?.vlan] })]
+			}),
+			/* @__PURE__ */ jsx("div", {
+				className: "lab-activity-fields",
+				children: livePorts.filter((port) => port.id !== source).map((port) => /* @__PURE__ */ jsx(Chip, {
+					selected: target === port.id,
+					onClick: () => setTarget(port.id),
+					children: port.device.name
+				}, port.id))
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "lab-activity-fields",
+				children: [/* @__PURE__ */ jsx(CheckButton, {
+					onClick: () => doSend(context),
+					children: "Send"
+				}), /* @__PURE__ */ jsxs(Chip, {
+					selected: state.routing,
+					onClick: () => {
+						setState((current) => setRouting(current, !current.routing));
+						setResult(null);
+					},
+					children: ["Layer-3 interface ", state.routing ? "on" : "off"]
+				})]
+			}),
+			/* @__PURE__ */ jsx("p", {
+				className: "lab-note",
+				children: "Click a port on the switch to move that machine into the other VLAN. Nothing is unplugged."
+			}),
+			/* @__PURE__ */ jsx(LiveRegion, { children: headline })
+		] }),
+		observation: headline,
+		children: (context) => /* @__PURE__ */ jsx(VlanScene, {
+			state,
+			source: result ? result.source : source,
+			reached: result?.kind === "broadcast" ? result.reached : result?.kind === "send" && result.delivered ? [result.target] : [],
+			blocked: result?.kind === "broadcast" ? result.blocked : [],
+			viaRouter: result?.kind === "send" && result.viaRouter,
+			onPortClick: (portId) => cyclePort(portId, context),
+			label: headline
+		})
+	});
+}
+
+//#endregion
+export { VlanDesignerLab, VlanDesignerLab as default };

package/dist/domains/networking/vpn-tunnel/manifest.mjs

@@ -0,0 +1,68 @@
+import { defineLab } from "../../../lab-def/define-lab.mjs";
+import { z } from "zod";
+
+//#region src/domains/networking/vpn-tunnel/manifest.ts
+var manifest_default = defineLab({
+	id: "vpn-tunnel",
+	domain: "networking",
+	group: "Networking",
+	title: "Who can see what (VPNs and HTTPS)",
+	description: "The same traffic read from four vantage points: the café Wi-Fi, the internet provider, the VPN gateway and the website itself. Each watcher shows the three things anyone watching traffic wants, who is sending, where it is going and what it says, with the ones they cannot get shuttered behind a padlock. The tunnel is drawn as a sleeve enclosing the café and the provider, which is why they carry the traffic without being able to see into it. Trying all four combinations of tunnel and HTTPS produces the actual rule: a VPN moves the watching to the VPN company, and HTTPS decides whether a watcher gets the addresses or the contents too.",
+	schema: z.object({
+		vpn: z.boolean().default(false),
+		https: z.boolean().default(true),
+		title: z.string().optional(),
+		prompt: z.string().optional()
+	}),
+	taxonomy: {
+		grades: [
+			"10",
+			"11",
+			"12",
+			"undergraduate"
+		],
+		outcomes: [
+			"networking",
+			"security",
+			"privacy",
+			"encryption",
+			"vpn"
+		],
+		durationMinutes: 16,
+		interaction: "explorer",
+		authorability: "simple",
+		representation: "table",
+		prerequisites: ["layer-encapsulation"],
+		related: [
+			"layer-encapsulation",
+			"packet-journey",
+			"network-media"
+		],
+		starter: true
+	},
+	experience: {
+		objectives: [
+			"Say what a tunnel hides, and from which watcher",
+			"Explain why a VPN moves trust rather than removing it",
+			"Separate what HTTPS protects from what a VPN protects",
+			"Judge an offer of a free VPN on what the provider can see"
+		],
+		phases: [
+			"predict",
+			"act",
+			"observe",
+			"explain",
+			"transfer"
+		],
+		responses: ["choice"],
+		accessibility: {
+			keyboard: true,
+			textAlternative: true,
+			reducedMotion: true
+		}
+	},
+	loadRuntime: () => import("./runtime.mjs")
+});
+
+//#endregion
+export { manifest_default as default };

package/dist/domains/networking/vpn-tunnel/runtime.mjs

@@ -0,0 +1,256 @@
+'use client';
+
+import { Chip } from "../../../kit/controls.mjs";
+import { LiveRegion } from "../../../kit/frame.mjs";
+import { AuthoredActivityRuntime } from "../../../kit/authored-activity-runtime.mjs";
+import { VpnScene } from "../../../networking/VpnScene.mjs";
+import { OBSERVERS, canReadContents, canSeeDestination, observe, observersFor } from "../../../networking/vpn.mjs";
+import { useCallback, useMemo, useState } from "react";
+import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
+
+//#region src/domains/networking/vpn-tunnel/runtime.tsx
+/**
+* VpnTunnelLab — who can see what, and what a VPN actually changes about that.
+*
+* This subject is taught by advertising, so students arrive with two wrong beliefs at once: that a
+* VPN makes them anonymous, and that the provider can read their banking password. Correcting each
+* one separately produces a shrug. Putting all four setups in front of them and letting them read
+* the same three fields off each watcher produces the actual rule, which is sharper than either
+* belief: a VPN moves the watching from your network operator to the VPN company, and HTTPS is what
+* decides whether the watcher can read the contents or only the addresses.
+*
+* The transfer question is the one that matters outside an exam. A free VPN's product is the view
+* it just acquired, and the lab has already shown that this view exists rather than asserting it.
+*/
+const VPN_ACTIVITY = {
+	pattern: "diagnosis",
+	title: "Work out who can see what",
+	objectives: [
+		"Say what a tunnel hides, and from which watcher",
+		"Explain why a VPN moves trust rather than removing it",
+		"Separate what HTTPS protects from what a VPN protects",
+		"Judge an offer of a free VPN on what the provider can see"
+	],
+	success: [
+		{
+			id: "predict-isp",
+			source: "answer",
+			key: "what-isp-sees",
+			pendingLabel: "Predict what your provider can still see."
+		},
+		{
+			id: "checked-watchers",
+			source: "metric",
+			key: "watchers",
+			pendingLabel: "Read the same three fields from every watcher."
+		},
+		{
+			id: "tried-setups",
+			source: "metric",
+			key: "setups",
+			pendingLabel: "Try all four combinations of tunnel and HTTPS."
+		},
+		{
+			id: "free-vpn",
+			source: "answer",
+			key: "free-vpn",
+			pendingLabel: "Decide what a free provider is being paid in."
+		}
+	],
+	questions: [{
+		id: "what-isp-sees",
+		prompt: "You visit an HTTPS site with no VPN. Your internet provider is carrying every packet. What can they tell about it?",
+		choices: [
+			{
+				value: "nothing",
+				label: "Nothing: HTTPS encrypts the traffic",
+				feedback: "HTTPS encrypts the contents. The address on the outside has to stay readable or nothing could deliver it."
+			},
+			{
+				value: "site-only",
+				label: "Which site you visited and when, but not what you asked for"
+			},
+			{
+				value: "everything",
+				label: "Everything, including what you typed",
+				feedback: "That was true before HTTPS was everywhere. The contents really are covered now."
+			}
+		],
+		answer: "site-only",
+		explain: "Encryption protects what is inside the packet, never the address on the outside, because every device along the way needs that address to move it along. So a provider builds a list of which sites you visited and when without ever reading a word of the traffic."
+	}, {
+		id: "free-vpn",
+		prompt: "A VPN app is free, with no adverts and no subscription. What are they most likely being paid in?",
+		choices: [
+			{
+				value: "goodwill",
+				label: "Nothing: it is a loss leader for the paid tier",
+				feedback: "Sometimes true, and it is worth asking which one you are looking at rather than assuming."
+			},
+			{
+				value: "the-view",
+				label: "The one thing they just acquired: a list of every site each user visits"
+			},
+			{
+				value: "bandwidth",
+				label: "Spare bandwidth they had anyway",
+				feedback: "Carrying other people’s traffic is the expensive part, not the spare part."
+			}
+		],
+		answer: "the-view",
+		explain: "You have just watched the tunnel take the view away from the café and the provider and hand it to the gateway. That view is worth money, and a company with no other income has an obvious reason to sell it. The question to ask about any VPN is not whether it is secure, it is who you would rather was watching."
+	}],
+	steps: [
+		{
+			id: "predict",
+			phase: "predict",
+			title: "What does your provider know?",
+			lead: "No VPN yet. Just an ordinary HTTPS site and the company carrying your packets.",
+			success: "predict-isp"
+		},
+		{
+			id: "act",
+			phase: "act",
+			title: "Look from each position",
+			lead: "Same traffic, four different vantage points. Read the three fields from each one.",
+			controls: true,
+			success: "checked-watchers"
+		},
+		{
+			id: "observe",
+			phase: "observe",
+			title: "Switch the tunnel on",
+			lead: "Watch what the café and the provider lose, and notice who gains it.",
+			controls: true
+		},
+		{
+			id: "explain",
+			phase: "explain",
+			title: "Two protections, two jobs",
+			lead: "Try all four combinations. HTTPS decides what is readable, the tunnel decides who is watching.",
+			controls: true,
+			success: "tried-setups"
+		},
+		{
+			id: "transfer",
+			phase: "transfer",
+			title: "So who would you rather was watching?",
+			lead: "You have seen exactly what a provider gains. Now judge an offer.",
+			controls: true,
+			success: "free-vpn"
+		}
+	]
+};
+const key = (setup) => `${setup.vpn ? "v" : "-"}${setup.https ? "h" : "-"}`;
+function VpnTunnelLab({ vpn = false, https = true, title, prompt } = {}) {
+	const [setup, setSetup] = useState({
+		vpn,
+		https
+	});
+	const [watcher, setWatcher] = useState("isp");
+	const [seenWatchers, setSeenWatchers] = useState(["isp"]);
+	const [seenSetups, setSeenSetups] = useState([key({
+		vpn,
+		https
+	})]);
+	const watchers = useMemo(() => observersFor(setup), [setup]);
+	const active = watchers.some((item) => item.id === watcher) ? watcher : "isp";
+	const sighting = observe(active, setup);
+	const namesSite = canSeeDestination(setup).filter((id) => id !== "website");
+	const readsAll = canReadContents(setup).filter((id) => id !== "website");
+	const chain = useMemo(() => [{
+		id: "you",
+		name: "You"
+	}, ...watchers.map((item) => ({
+		id: item.id,
+		name: item.short,
+		watcher: item
+	}))], [watchers]);
+	const tunnelEndsAt = setup.vpn ? chain.findIndex((node) => node.id === "gateway") : void 0;
+	const look = useCallback((id, context) => {
+		setWatcher(id);
+		setSeenWatchers((current) => {
+			const next = current.includes(id) ? current : [...current, id];
+			if (next.length >= OBSERVERS.length) context.complete("checked-watchers", "watchers");
+			return next;
+		});
+	}, []);
+	const change = useCallback((next, context) => {
+		setSetup(next);
+		setSeenSetups((current) => {
+			const seen = current.includes(key(next)) ? current : [...current, key(next)];
+			if (seen.length >= 4) context.complete("tried-setups", "setups");
+			return seen;
+		});
+	}, []);
+	const headline = sighting.verdict;
+	return /* @__PURE__ */ jsx(AuthoredActivityRuntime, {
+		activity: VPN_ACTIVITY,
+		activityId: "vpn-tunnel",
+		eyebrow: "Privacy",
+		title: title ?? "Who can see what",
+		description: prompt ?? "A VPN wraps your packet inside one addressed to the gateway. Follow what that does to each watcher on the path, including the new one it adds.",
+		status: /* @__PURE__ */ jsxs(Fragment$1, { children: [
+			/* @__PURE__ */ jsx("span", { children: setup.vpn ? "tunnel on" : "no tunnel" }),
+			/* @__PURE__ */ jsx("span", { children: setup.https ? "HTTPS" : "plain HTTP" }),
+			/* @__PURE__ */ jsxs("span", { children: [/* @__PURE__ */ jsx("strong", { children: namesSite.length }), " can name the site"] })
+		] }),
+		inspector: (context) => /* @__PURE__ */ jsxs(Fragment$1, { children: [
+			/* @__PURE__ */ jsxs("div", {
+				className: "network-inspector-heading",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("span", { children: "Looking from" }), /* @__PURE__ */ jsx("strong", { children: sighting.observer.name })] }), /* @__PURE__ */ jsx("span", { children: setup.vpn ? "tunnel on" : "no tunnel" })]
+			}),
+			/* @__PURE__ */ jsx("div", {
+				className: "lab-activity-fields",
+				children: watchers.map((item) => /* @__PURE__ */ jsx(Chip, {
+					selected: active === item.id,
+					onClick: () => look(item.id, context),
+					children: item.name
+				}, item.id))
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "lab-activity-fields",
+				children: [/* @__PURE__ */ jsxs(Chip, {
+					selected: setup.vpn,
+					onClick: () => change({
+						...setup,
+						vpn: !setup.vpn
+					}, context),
+					children: ["VPN tunnel ", setup.vpn ? "on" : "off"]
+				}), /* @__PURE__ */ jsxs(Chip, {
+					selected: setup.https,
+					onClick: () => change({
+						...setup,
+						https: !setup.https
+					}, context),
+					children: ["HTTPS ", setup.https ? "on" : "off"]
+				})]
+			}),
+			/* @__PURE__ */ jsxs("ul", {
+				className: "lab-metric-list",
+				children: [
+					/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("span", { children: "Can name the site" }), /* @__PURE__ */ jsx("strong", { children: namesSite.length ? namesSite.length : "nobody in between" })] }),
+					/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("span", { children: "Can read the contents" }), /* @__PURE__ */ jsx("strong", { children: readsAll.length ? readsAll.length : "nobody in between" })] }),
+					/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("span", { children: "Room lost to the tunnel" }), /* @__PURE__ */ jsx("strong", { children: setup.vpn ? `${60} bytes per packet` : "none" })] })
+				]
+			}),
+			/* @__PURE__ */ jsxs("p", {
+				className: "lab-note",
+				children: [sighting.observer.where, "."]
+			}),
+			/* @__PURE__ */ jsx(LiveRegion, { children: headline })
+		] }),
+		observation: headline,
+		children: (context) => /* @__PURE__ */ jsx(VpnScene, {
+			sighting,
+			chain,
+			tunnelEndsAt: tunnelEndsAt != null && tunnelEndsAt >= 0 ? tunnelEndsAt : void 0,
+			selected: active,
+			onSelect: (id) => look(id, context),
+			label: `${sighting.observer.name}: sender ${sighting.from.value}, destination ${sighting.to.hidden ? "hidden" : sighting.to.value}, contents ${sighting.contents.hidden ? "unreadable" : "readable"}.`
+		})
+	});
+}
+
+//#endregion
+export { VpnTunnelLab, VpnTunnelLab as default };

package/dist/domains/physics/alternating-current/manifest.mjs

@@ -0,0 +1,67 @@
+import { defineLab } from "../../../lab-def/define-lab.mjs";
+import { commonLabProps } from "../../../blocks/lab-block.mjs";
+import { authoredActivitySchema } from "../../../schemas/activity-authoring.mjs";
+import { z } from "zod";
+
+//#region src/domains/physics/alternating-current/manifest.ts
+var manifest_default = defineLab({
+	id: "alternating-current",
+	domain: "physics",
+	group: "Physics",
+	title: "Alternating current: peak, r.m.s. and rectifying",
+	tag: "AlternatingCurrentLab",
+	description: "Alternating currents (A Level 9702 chapter 21). A sinusoidal supply drives a resistor, with three views on one circuit. The waveform view marks the period T = 1/f and the peaks of v and i. The r.m.s. view is the heart of it: the wave is squared so it is never negative, the mean of that square is added up from the graph (it lands on V0 squared over 2), and the root of that mean is drawn back on the voltage graph as V_rms. The readout states the point in watts: a steady d.c. of V_rms delivers the same mean power, V0 squared over 2R. The rectifying view adds one diode or a bridge, then a smoothing capacitor whose ripple shrinks as the capacitance rises.",
+	schema: z.object({
+		peakVoltageV: z.number().finite().min(5).max(400).optional().describe("peak voltage V0 of the supply, V"),
+		frequencyHz: z.number().finite().min(5).max(200).optional().describe("supply frequency f, Hz"),
+		resistanceOhm: z.number().finite().min(10).max(500).optional().describe("load resistance R, ohms"),
+		capacitanceUf: z.number().finite().min(0).max(5e3).optional().describe("smoothing capacitance across the load, microfarads; 0 means no capacitor"),
+		rectifier: z.enum(["half", "full"]).optional().describe("half = one diode, full = a bridge of four diodes"),
+		view: z.enum([
+			"waveform",
+			"rms",
+			"rectification"
+		]).optional().describe("which view opens first"),
+		...commonLabProps,
+		activity: z.union([z.string().trim().min(1), authoredActivitySchema]).optional()
+	}),
+	taxonomy: {
+		grades: ["11", "12"],
+		outcomes: [
+			"alternating-currents",
+			"root-mean-square",
+			"mean-power",
+			"rectification"
+		],
+		durationMinutes: 14,
+		interaction: "explorer",
+		authorability: "moderate",
+		representation: "graph",
+		related: ["power", "work-energy"]
+	},
+	experience: {
+		objectives: [
+			"Read the period T and the peak value V0 from a sinusoidal supply",
+			"Explain V_rms as the steady d.c. voltage that delivers the same mean power",
+			"Calculate mean power as V_rms squared over R, which is V0 squared over 2R",
+			"Describe how a diode and a smoothing capacitor turn a.c. into a nearly steady d.c."
+		],
+		phases: [
+			"predict",
+			"act",
+			"observe",
+			"explain",
+			"transfer"
+		],
+		responses: ["choice"],
+		accessibility: {
+			keyboard: true,
+			textAlternative: true,
+			reducedMotion: true
+		}
+	},
+	loadRuntime: () => import("./runtime.mjs")
+});
+
+//#endregion
+export { manifest_default as default };

package/dist/domains/physics/alternating-current/runtime.mjs

@@ -0,0 +1,5 @@
+'use client';
+
+import { AlternatingCurrentLab } from "../../../physics/alternating-current/preset.mjs";
+
+export { AlternatingCurrentLab as default };