@decibelsystems/tools 3.0.0 → 3.1.0

package/dist/pty/pairing.d.ts

@@ -0,0 +1,86 @@
+import type { IncomingMessage } from 'http';
+export declare const PENDING_TTL_MS: number;
+/** Approved pairings idle this long expire (Ben, 2026-09-25). */
+export declare const IDLE_EXPIRY_MS: number;
+export declare const NONCE_TTL_MS = 60000;
+/** Signed requests must be this fresh, in either direction. */
+export declare const IAT_SKEW_MS = 60000;
+export interface PublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+export interface Pairing {
+    id: string;
+    origin: string;
+    label: string;
+    public_key_jwk: PublicJwk;
+    status: 'pending' | 'approved';
+    /** pending only: what HQ shows and the human types. */
+    code?: string;
+    requested_at: string;
+    approved_at?: string;
+    last_used?: string;
+}
+export declare function pairingsPath(): string;
+export declare function listPairings(): Pairing[];
+export declare function isPairingActive(id: string): boolean;
+/**
+ * A P-256 PUBLIC key and nothing else. A JWK carrying `d` is a private key: the
+ * page is supposed to hold a non-extractable key, so receiving one means
+ * something is badly wrong, and it is refused rather than stored.
+ */
+export declare function validatePublicJwk(v: unknown): PublicJwk;
+/** RFC 7638 thumbprint. */
+export declare function thumbprint(jwk: PublicJwk): string;
+/**
+ * The code both sides show. Derived from the key AND a daemon nonce: from the
+ * key alone, an attacker could grind keys offline until one lands on a chosen
+ * code (cheap at 10^6); with the daemon's nonce mixed in, there is nothing to
+ * grind against before asking.
+ */
+export declare function pairingCode(jwk: PublicJwk, daemonNonce: string): string;
+export declare function requestPairing(origin: string, jwkIn: unknown, labelIn: unknown): Promise<{
+    pairing_id: string;
+    code: string;
+    expires_at: string;
+}>;
+export declare function pairingStatus(id: string, origin: string): {
+    status: 'pending' | 'approved' | 'unknown';
+};
+/** CLI only. Never reachable over HTTP. */
+export declare function approveByCode(code: string): Promise<Pairing>;
+/**
+ * The native macOS dialog's Allow (pairDialog.ts). Never reachable over HTTP:
+ * it is called only from the daemon after a local click. It approves the exact
+ * request the dialog showed, by id AND code, so a request that was replaced
+ * while the dialog was open is not approved by it.
+ */
+export declare function approvePendingLocally(id: string, code: string): Promise<Pairing>;
+/** CLI, or a signed request from the pairing itself. */
+export declare function revokePairing(id: string): Promise<boolean>;
+/** Test seam. */
+export declare function _setPairingClock(fn: (() => number) | null): void;
+export declare function issueNonces(pairingId: unknown, origin: string, countIn: unknown): {
+    nonces: string[];
+    expires_at: string;
+};
+/**
+ * Exactly what the browser signs. The body is not included: replay is stopped
+ * by the single-use nonce, and anything able to rewrite a loopback request in
+ * flight is already past every boundary this could add.
+ */
+export declare function signingPayload(method: string, pathAndQuery: string, origin: string, pairingId: string, nonce: string, iat: number): string;
+/** The pairing id a request was verified under, if it was. */
+export declare function pairingOf(req: IncomingMessage): string | undefined;
+export declare function hasPairingHeaders(req: IncomingMessage): boolean;
+/**
+ * Verify a signed request. Order is the ADR's: loopback, origin allowlist,
+ * pairing approved and bound to this origin, freshness, nonce (burned before
+ * the signature check, so a bad signature still spends it), signature.
+ */
+export declare function verifyPairedRequest(req: IncomingMessage, pathAndQuery: string, allowedOrigins: string[]): string;
+/** Test seam. */
+export declare function _resetPairing(): void;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/pty/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pty/pairing.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAO5C,eAAO,MAAM,cAAc,QAAc,CAAC;AAC1C,iEAAiE;AACjE,eAAO,MAAM,cAAc,QAAwB,CAAC;AACpD,eAAO,MAAM,YAAY,QAAS,CAAC;AACnC,+DAA+D;AAC/D,eAAO,MAAM,WAAW,QAAS,CAAC;AAOlC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,SAAS,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAUD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA4DD,wBAAgB,YAAY,IAAI,OAAO,EAAE,CAExC;AAMD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAQD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAevD;AAED,2BAA2B;AAC3B,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAIjD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGvE;AAMD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BxJ;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAKxG;AAED,2CAA2C;AAC3C,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlE;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAStF;AAED,wDAAwD;AACxD,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMhE;AAQD,iBAAiB;AACjB,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAEhE;AAOD,wBAAgB,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAc1H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1I;AAID,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAElE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,CAwChH;AAcD,iBAAiB;AACjB,wBAAgB,aAAa,IAAI,IAAI,CAKpC"}

package/dist/pty/pairing.js

@@ -0,0 +1,351 @@
+// ============================================================================
+// Browser pairing (ADR-0012 in this repo; decibel-hq ADR-0012 / EPIC-0015 ph 2)
+// ============================================================================
+// Deployed HQ is an https page with no server of its own on this machine, so
+// nothing can inject the daemon's bearer for it, and POL-0002 forbids putting
+// one in the page. Instead the page holds a NON-EXTRACTABLE ECDSA P-256 key
+// and signs each request; the daemon holds only public keys.
+//
+//   1. POST /pair/request {public_key_jwk, label}  → pending, with a 6-digit
+//      code = H(thumbprint(pubkey) || daemon_nonce). HQ shows the code.
+//   2. The human approves on this machine: on macOS a native dialog showing
+//      the same code (pairDialog.ts, ISS-0228), elsewhere
+//      `decibel-tools pair approve <code>`. NO HTTP ROUTE APPROVES — that is
+//      the whole gate. A compromised HQ can ask to pair; it cannot say yes.
+//   3. POST /pair/challenge → single-use daemon nonces. Each request is then
+//      signed over (method, path, origin, pairing id, nonce, iat) and carried
+//      in X-Pairing-* headers.
+//
+// Store: ~/.decibel/pairings.yaml, mode 0600, public keys only. The CLI and the
+// daemon are different processes and both write it, so every write is locked
+// and atomic, and the daemon re-reads it when its mtime changes — which is how
+// a CLI revoke reaches the daemon without any HTTP route.
+// ============================================================================
+import { createHash, createPublicKey, randomBytes, verify as cryptoVerify } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import YAML from 'yaml';
+import { writeFileAtomic } from '../lib/atomicWrite.js';
+import { withFileLock } from '../lib/fileLock.js';
+import { SessionError } from './errors.js';
+import { isAllowedOrigin, isLoopbackPeer } from './boundary.js';
+export const PENDING_TTL_MS = 10 * 60_000;
+/** Approved pairings idle this long expire (Ben, 2026-09-25). */
+export const IDLE_EXPIRY_MS = 30 * 24 * 60 * 60_000;
+export const NONCE_TTL_MS = 60_000;
+/** Signed requests must be this fresh, in either direction. */
+export const IAT_SKEW_MS = 60_000;
+const MAX_PENDING_PER_ORIGIN = 3;
+const MAX_PENDING_TOTAL = 10;
+const MAX_NONCES_PER_CHALLENGE = 20;
+/** last_used is written at most this often per pairing. */
+const LAST_USED_WRITE_MS = 10 * 60_000;
+// ----------------------------------------------------------------------------
+// Paths (per call, so tests can move HOME)
+// ----------------------------------------------------------------------------
+export function pairingsPath() {
+    return join(homedir(), '.decibel', 'pairings.yaml');
+}
+function lockPath() {
+    return pairingsPath() + '.lock';
+}
+// ----------------------------------------------------------------------------
+// Store I/O
+// ----------------------------------------------------------------------------
+/**
+ * Cache key: inode + size + mtime, never mtime alone. $HOME here is HFS+, whose
+ * mtime has ONE-SECOND resolution, so a CLI approve landing in the same second
+ * as the daemon's last read left the daemon holding a stale "pending" — found
+ * live, not in tests. Every writer replaces the file by atomic rename, which
+ * always yields a new inode, so the inode alone would do; size and mtime also
+ * catch an in-place edit.
+ */
+let cache = null;
+function readStore() {
+    const p = pairingsPath();
+    if (!existsSync(p)) {
+        cache = null;
+        return { pairings: [] };
+    }
+    const st = statSync(p);
+    const key = `${st.ino}:${st.size}:${st.mtimeMs}`;
+    if (cache && cache.key === key)
+        return cache.store;
+    // An unparseable store must fail loudly, not read as "no pairings": the
+    // latter would silently un-pair every browser and hide the damage.
+    const parsed = YAML.parse(readFileSync(p, 'utf-8'));
+    const store = { pairings: Array.isArray(parsed?.pairings) ? parsed.pairings : [] };
+    cache = { key, store };
+    return store;
+}
+async function mutate(fn) {
+    const p = pairingsPath();
+    mkdirSync(join(homedir(), '.decibel'), { recursive: true });
+    return withFileLock(lockPath(), async () => {
+        cache = null;
+        const store = prune(readStore());
+        const result = fn(store);
+        if (!existsSync(p))
+            writeFileSync(p, '', { mode: 0o600 });
+        await writeFileAtomic(p, YAML.stringify(store));
+        cache = null;
+        return result;
+    });
+}
+/** Drop expired pending requests and idle approved pairings. */
+function prune(store, now = Date.now()) {
+    store.pairings = store.pairings.filter((p) => {
+        if (p.status === 'pending')
+            return now - Date.parse(p.requested_at) < PENDING_TTL_MS;
+        const last = Date.parse(p.last_used ?? p.approved_at ?? p.requested_at);
+        return now - last < IDLE_EXPIRY_MS;
+    });
+    return store;
+}
+export function listPairings() {
+    return prune({ pairings: [...readStore().pairings] }).pairings;
+}
+function activePairing(id) {
+    return listPairings().find((p) => p.id === id && p.status === 'approved');
+}
+export function isPairingActive(id) {
+    return !!activePairing(id);
+}
+// ----------------------------------------------------------------------------
+// Keys and codes
+// ----------------------------------------------------------------------------
+const B64URL = /^[A-Za-z0-9_-]{43}$/;
+/**
+ * A P-256 PUBLIC key and nothing else. A JWK carrying `d` is a private key: the
+ * page is supposed to hold a non-extractable key, so receiving one means
+ * something is badly wrong, and it is refused rather than stored.
+ */
+export function validatePublicJwk(v) {
+    const j = v;
+    if (!j || typeof j !== 'object')
+        throw new SessionError(400, 'BAD_KEY', 'public_key_jwk is required.');
+    if ('d' in j)
+        throw new SessionError(400, 'BAD_KEY', 'That is a PRIVATE key. Send only the public half; the private key must never leave the browser.');
+    if (j.kty !== 'EC' || j.crv !== 'P-256')
+        throw new SessionError(400, 'BAD_KEY', 'Only ECDSA P-256 keys are accepted.');
+    if (typeof j.x !== 'string' || typeof j.y !== 'string' || !B64URL.test(j.x) || !B64URL.test(j.y)) {
+        throw new SessionError(400, 'BAD_KEY', 'Malformed EC coordinates.');
+    }
+    const jwk = { kty: 'EC', crv: 'P-256', x: j.x, y: j.y };
+    try {
+        createPublicKey({ key: jwk, format: 'jwk' });
+    }
+    catch {
+        throw new SessionError(400, 'BAD_KEY', 'Not a valid P-256 point.');
+    }
+    return jwk;
+}
+/** RFC 7638 thumbprint. */
+export function thumbprint(jwk) {
+    return createHash('sha256')
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))
+        .digest('base64url');
+}
+/**
+ * The code both sides show. Derived from the key AND a daemon nonce: from the
+ * key alone, an attacker could grind keys offline until one lands on a chosen
+ * code (cheap at 10^6); with the daemon's nonce mixed in, there is nothing to
+ * grind against before asking.
+ */
+export function pairingCode(jwk, daemonNonce) {
+    const h = createHash('sha256').update(thumbprint(jwk)).update(daemonNonce).digest();
+    return String(h.readUInt32BE(0) % 1_000_000).padStart(6, '0');
+}
+// ----------------------------------------------------------------------------
+// Request / status / approve / revoke
+// ----------------------------------------------------------------------------
+export async function requestPairing(origin, jwkIn, labelIn) {
+    const jwk = validatePublicJwk(jwkIn);
+    const label = typeof labelIn === 'string' ? labelIn.replace(/[\r\n\t]/g, ' ').trim().slice(0, 80) : '';
+    return mutate((store) => {
+        const pending = store.pairings.filter((p) => p.status === 'pending');
+        if (pending.length >= MAX_PENDING_TOTAL || pending.filter((p) => p.origin === origin).length >= MAX_PENDING_PER_ORIGIN) {
+            throw new SessionError(429, 'TOO_MANY_PENDING', 'Too many pairing requests are waiting. Approve or let them expire (10 min) first.');
+        }
+        // Re-requesting with the same key replaces the old pending request.
+        const tp = thumbprint(jwk);
+        store.pairings = store.pairings.filter((p) => !(p.status === 'pending' && thumbprint(p.public_key_jwk) === tp));
+        const taken = new Set(store.pairings.filter((p) => p.status === 'pending').map((p) => p.code));
+        let code = '';
+        for (let i = 0; i < 20 && (!code || taken.has(code)); i++)
+            code = pairingCode(jwk, randomBytes(16).toString('hex'));
+        if (taken.has(code))
+            throw new SessionError(503, 'CODE_COLLISION', 'Could not allocate a pairing code; try again.');
+        const now = new Date();
+        const p = {
+            id: `pr_${randomBytes(9).toString('hex')}`,
+            origin,
+            label: label || 'HQ',
+            public_key_jwk: jwk,
+            status: 'pending',
+            code,
+            requested_at: now.toISOString(),
+        };
+        store.pairings.push(p);
+        return { pairing_id: p.id, code, expires_at: new Date(now.getTime() + PENDING_TTL_MS).toISOString() };
+    });
+}
+export function pairingStatus(id, origin) {
+    const p = listPairings().find((x) => x.id === id);
+    // A pairing is only reported to the origin it belongs to.
+    if (!p || p.origin !== origin)
+        return { status: 'unknown' };
+    return { status: p.status };
+}
+/** CLI only. Never reachable over HTTP. */
+export async function approveByCode(code) {
+    if (!/^\d{6}$/.test(code))
+        throw new Error('A pairing code is 6 digits.');
+    return mutate((store) => {
+        const p = store.pairings.find((x) => x.status === 'pending' && x.code === code);
+        if (!p)
+            throw new Error(`No pending pairing request with code ${code} (requests expire after 10 minutes).`);
+        p.status = 'approved';
+        p.approved_at = new Date().toISOString();
+        delete p.code;
+        return { ...p };
+    });
+}
+/**
+ * The native macOS dialog's Allow (pairDialog.ts). Never reachable over HTTP:
+ * it is called only from the daemon after a local click. It approves the exact
+ * request the dialog showed, by id AND code, so a request that was replaced
+ * while the dialog was open is not approved by it.
+ */
+export async function approvePendingLocally(id, code) {
+    return mutate((store) => {
+        const p = store.pairings.find((x) => x.id === id && x.status === 'pending' && x.code === code);
+        if (!p)
+            throw new Error('That pairing request is no longer pending (expired, replaced or already answered).');
+        p.status = 'approved';
+        p.approved_at = new Date().toISOString();
+        delete p.code;
+        return { ...p };
+    });
+}
+/** CLI, or a signed request from the pairing itself. */
+export async function revokePairing(id) {
+    return mutate((store) => {
+        const before = store.pairings.length;
+        store.pairings = store.pairings.filter((p) => p.id !== id);
+        return store.pairings.length < before;
+    });
+}
+// ----------------------------------------------------------------------------
+// Nonces and signed requests
+// ----------------------------------------------------------------------------
+const nonces = new Map();
+let clock = Date.now;
+/** Test seam. */
+export function _setPairingClock(fn) {
+    clock = fn ?? Date.now;
+}
+function sweepNonces() {
+    const t = clock();
+    for (const [n, rec] of nonces)
+        if (rec.expiresAt <= t)
+            nonces.delete(n);
+}
+export function issueNonces(pairingId, origin, countIn) {
+    if (typeof pairingId !== 'string')
+        throw new SessionError(400, 'BAD_REQUEST', 'pairing_id is required.');
+    const p = activePairing(pairingId);
+    if (!p || p.origin !== origin)
+        throw new SessionError(403, 'NOT_PAIRED', 'No approved pairing with that id for this origin.');
+    const count = Math.min(Math.max(1, Math.floor(Number(countIn) || 1)), MAX_NONCES_PER_CHALLENGE);
+    sweepNonces();
+    const expiresAt = clock() + NONCE_TTL_MS;
+    const out = [];
+    for (let i = 0; i < count; i++) {
+        const n = randomBytes(24).toString('base64url');
+        nonces.set(n, { pairingId, expiresAt });
+        out.push(n);
+    }
+    return { nonces: out, expires_at: new Date(expiresAt).toISOString() };
+}
+/**
+ * Exactly what the browser signs. The body is not included: replay is stopped
+ * by the single-use nonce, and anything able to rewrite a loopback request in
+ * flight is already past every boundary this could add.
+ */
+export function signingPayload(method, pathAndQuery, origin, pairingId, nonce, iat) {
+    return ['decibel-pair-v1', method.toUpperCase(), pathAndQuery, origin, pairingId, nonce, String(iat)].join('\n');
+}
+const pairedRequests = new WeakMap();
+/** The pairing id a request was verified under, if it was. */
+export function pairingOf(req) {
+    return pairedRequests.get(req);
+}
+export function hasPairingHeaders(req) {
+    return typeof req.headers['x-pairing-id'] === 'string';
+}
+/**
+ * Verify a signed request. Order is the ADR's: loopback, origin allowlist,
+ * pairing approved and bound to this origin, freshness, nonce (burned before
+ * the signature check, so a bad signature still spends it), signature.
+ */
+export function verifyPairedRequest(req, pathAndQuery, allowedOrigins) {
+    const h = (k) => (typeof req.headers[k] === 'string' ? req.headers[k] : '');
+    const origin = h('origin');
+    if (!isLoopbackPeer(req))
+        throw new SessionError(403, 'FORBIDDEN', 'not a loopback peer');
+    if (!isAllowedOrigin(origin, allowedOrigins))
+        throw new SessionError(403, 'FORBIDDEN', 'origin not allowed');
+    const pairingId = h('x-pairing-id');
+    const nonce = h('x-pairing-nonce');
+    const iat = Number(h('x-pairing-iat'));
+    const sig = h('x-pairing-sig');
+    if (!pairingId || !nonce || !Number.isFinite(iat) || !sig) {
+        throw new SessionError(401, 'BAD_SIGNATURE', 'X-Pairing-Id, -Nonce, -Iat and -Sig are all required.');
+    }
+    const p = activePairing(pairingId);
+    if (!p || p.origin !== origin)
+        throw new SessionError(401, 'NOT_PAIRED', 'No approved pairing with that id for this origin.');
+    if (Math.abs(clock() - iat) > IAT_SKEW_MS)
+        throw new SessionError(401, 'STALE_REQUEST', 'X-Pairing-Iat is outside the allowed window.');
+    sweepNonces();
+    const rec = nonces.get(nonce);
+    nonces.delete(nonce);
+    if (!rec || rec.pairingId !== pairingId)
+        throw new SessionError(401, 'BAD_NONCE', 'Unknown, reused or expired nonce.');
+    const payload = signingPayload(req.method || 'GET', pathAndQuery, origin, pairingId, nonce, iat);
+    let ok = false;
+    try {
+        ok = cryptoVerify('sha256', Buffer.from(payload, 'utf-8'), { key: createPublicKey({ key: p.public_key_jwk, format: 'jwk' }), dsaEncoding: 'ieee-p1363' }, Buffer.from(sig, 'base64url'));
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok)
+        throw new SessionError(401, 'BAD_SIGNATURE', 'Signature does not verify.');
+    pairedRequests.set(req, pairingId);
+    touch(p);
+    return pairingId;
+}
+const lastTouched = new Map();
+function touch(p) {
+    const now = clock();
+    const last = lastTouched.get(p.id) ?? Date.parse(p.last_used ?? '') ?? 0;
+    if (now - (Number.isFinite(last) ? last : 0) < LAST_USED_WRITE_MS)
+        return;
+    lastTouched.set(p.id, now);
+    mutate((store) => {
+        const q = store.pairings.find((x) => x.id === p.id);
+        if (q)
+            q.last_used = new Date(now).toISOString();
+    }).catch(() => undefined);
+}
+/** Test seam. */
+export function _resetPairing() {
+    nonces.clear();
+    lastTouched.clear();
+    cache = null;
+    clock = Date.now;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/pty/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/pty/pairing.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6DAA6D;AAC7D,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,0DAA0D;AAC1D,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,0DAA0D;AAC1D,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,IAAI,YAAY,EAAmB,MAAM,QAAQ,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AA0BvC,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AACD,SAAS,QAAQ;IACf,OAAO,YAAY,EAAE,GAAG,OAAO,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;;;;GAOG;AACH,IAAI,KAAK,GAAyC,IAAI,CAAC;AAEvD,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACnD,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAA0B,CAAC;IAC7E,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3F,KAAK,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAI,EAAuB;IAC9C,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;QACzC,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,KAAK,CAAC,KAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3C,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;QACxE,OAAO,GAAG,GAAG,IAAI,GAAG,cAAc,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,MAAM,CAAC,GAAG,CAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAC;IACvG,IAAI,GAAG,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,iGAAiG,CAAC,CAAC;IACxJ,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,qCAAqC,CAAC,CAAC;IACvH,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAc,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,UAAU,CAAC,GAAc;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;SAC1E,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAc,EAAE,WAAmB;IAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IACpF,OAAO,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,KAAc,EAAE,OAAgB;IACnF,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;YACvH,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,mFAAmF,CAAC,CAAC;QACvI,CAAC;QACD,oEAAoE;QACpE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEhH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/F,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACpH,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QAEpH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAY;YACjB,EAAE,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAC1C,MAAM;YACN,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,cAAc,EAAE,GAAG;YACnB,MAAM,EAAE,SAAS;YACjB,IAAI;YACJ,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;SAChC,CAAC;QACF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,MAAc;IACtD,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,0DAA0D;IAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,sCAAsC,CAAC,CAAC;QAC5G,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAU,EAAE,IAAY;IAClE,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAC9G,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoD,CAAC;AAC3E,IAAI,KAAK,GAAiB,IAAI,CAAC,GAAG,CAAC;AACnC,iBAAiB;AACjB,MAAM,UAAU,gBAAgB,CAAC,EAAyB;IACxD,KAAK,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM;QAAE,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAkB,EAAE,MAAc,EAAE,OAAgB;IAC9E,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAChG,WAAW,EAAE,CAAC;IACd,MAAM,SAAS,GAAG,KAAK,EAAE,GAAG,YAAY,CAAC;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,YAAoB,EAAE,MAAc,EAAE,SAAiB,EAAE,KAAa,EAAE,GAAW;IAChI,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,OAAO,EAA2B,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,GAAoB;IAC5C,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,YAAoB,EAAE,cAAwB;IACtG,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1F,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAE7G,MAAM,SAAS,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;IAC/B,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC9H,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,GAAG,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAExI,WAAW,EAAE,CAAC;IACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,mCAAmC,CAAC,CAAC;IAEvH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjG,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CACf,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAC7B,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,cAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,EAC3G,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAEpF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnC,KAAK,CAAC,CAAC,CAAC,CAAC;IACT,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC9C,SAAS,KAAK,CAAC,CAAU;IACvB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB;QAAE,OAAO;IAC1E,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC;YAAE,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,KAAK,GAAG,IAAI,CAAC;IACb,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC;AACnB,CAAC"}

package/dist/pty/routes.d.ts

@@ -0,0 +1,49 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { Duplex } from 'stream';
+/** How long a minted attach token stays usable. Deliberately short. */
+export declare const ATTACH_TOKEN_TTL_MS = 30000;
+/** HQ dev server, through the Vite proxy (decibel-hq EPIC-0015 phase 1). */
+export declare const DEFAULT_SESSION_ORIGINS: string[];
+export interface SessionAuthConfig {
+    token?: string;
+    allowedOrigins: string[];
+}
+export declare function sessionAuthConfig(): SessionAuthConfig;
+/** Test seam. */
+export declare function _setSessionAuthConfig(c: SessionAuthConfig | null): void;
+/** Test seam. */
+export declare function _setClock(fn: (() => number) | null): void;
+export declare function outstandingTokens(): number;
+/** The routes this module gates itself. GET /sessions and /sessions/last-fleet are NOT among them. */
+export declare function isSessionWritePath(path: string): boolean;
+export declare function isSessionAttachPath(path: string): boolean;
+/**
+ * Handle a session write route or its preflight. Called by httpServer.ts for
+ * any path where isSessionWritePath() is true, before the daemon's own auth
+ * gate (which knows nothing of the sessions bearer).
+ */
+export declare function handleSessionWrite(req: IncomingMessage, res: ServerResponse, path: string): Promise<void>;
+/**
+ * POST /chat (decibel-hq EPIC-0016): send as the HQ chat peer. Same gate as
+ * the session writes: it puts text into other sessions.
+ */
+export declare function handleChatWrite(req: IncomingMessage, res: ServerResponse): Promise<void>;
+/**
+ * Signed requests from a paired browser (ADR-0012 in this repo). httpServer.ts
+ * calls this once per request, before rate limiting and auth. A verified
+ * request is marked (pairingOf) and stands in for a bearer everywhere after.
+ * A request that CLAIMS a pairing and fails verification is refused outright
+ * rather than falling through as anonymous. Returns false when it refused.
+ */
+export declare function applyPairingAuth(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
+export declare function isPairPath(path: string): boolean;
+export declare function handlePair(req: IncomingMessage, res: ServerResponse, path: string): Promise<void>;
+export declare function closeRevokedSockets(): number;
+/**
+ * Handle an upgrade on /sessions/<key>/attach. The caller (httpServer.ts)
+ * routes here only for that path; anything else it refuses itself.
+ */
+export declare function handleSessionUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, url: URL): Promise<void>;
+/** Close every live attach socket (daemon shutdown). */
+export declare function closeAllAttachSockets(): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/pty/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/pty/routes.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AA0CrC,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,UAAqD,CAAC;AAoB1F,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAWD,wBAAgB,iBAAiB,IAAI,iBAAiB,CAWrD;AACD,iBAAiB;AACjB,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAGvE;AAcD,iBAAiB;AACjB,wBAAgB,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAEzD;AACD,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAcD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AA8ED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+D/G;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAkB7F;AAUD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDvG;AAiCD,wBAAgB,mBAAmB,IAAI,MAAM,CAkB5C;AAuBD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAkItH;AAED,wDAAwD;AACxD,wBAAgB,qBAAqB,IAAI,IAAI,CAS5C"}