@gryt/core 0.13.0 → 0.15.0

package/dist/pairing/approver.js

@@ -0,0 +1,198 @@
+import { base64Url, base64UrlDecode, createPairingKey, decodePairingSessionId, encodePairingEnvelope, encodePairingSessionId, parsePairingCode, parsePairingQr, startApproverSession, } from "@gryt/crypto";
+import { mailbox, openJson, PairingEnded, reasonFor, systemClock } from "./channel.js";
+import { PAIRING_APPROVAL_MS } from "./newDevice.js";
+const NOT_LISTED_RETRIES = 5;
+/** auth#46's codes that get a named reason. Anything else it can answer still falls
+    through to the generic `approve:<code>`. */
+const APPROVE_ERROR_REASONS = {
+    code_used: "code_used",
+    unknown_code: "code_expired",
+    expired_code: "code_expired",
+    code_not_pending: "code_expired",
+    required_actions: "required_actions",
+    stale_token: "stale_token",
+    rate_limited: "rate_limited",
+};
+/** A: claims the session, shows N and the emoji, and on Approve seals the envelope, signs N in and adds it. */
+export function createApproverPairing(options) {
+    const { relay, fetch, devices } = options;
+    const clock = options.clock ?? systemClock;
+    const approvalMs = options.approvalMs ?? PAIRING_APPROVAL_MS;
+    const listeners = new Set();
+    const abort = new AbortController();
+    let state = { phase: "idle" };
+    let current = null;
+    let device = null;
+    let confirming = null;
+    const set = (next) => {
+        if (state.phase === "ended" || state.phase === "done")
+            return;
+        state = next;
+        for (const l of listeners)
+            l(state);
+    };
+    const closeQuietly = () => (current ? relay.close(current.id, current.token).catch(() => undefined) : undefined);
+    const end = async (reason) => {
+        if (state.phase === "ended" || state.phase === "done")
+            return;
+        set({ phase: "ended", reason });
+        abort.abort();
+        current?.session?.close();
+        await closeQuietly();
+    };
+    const fail = (e) => (abort.signal.aborted ? undefined : end(reasonFor(e)));
+    async function claim(input) {
+        let by;
+        let scanned;
+        if ("qr" in input) {
+            const qr = parsePairingQr(input.qr);
+            if (!qr.ok)
+                throw new PairingEnded(qr.reason === "newer-version" ? "newer_version" : "not_pairing");
+            if (qr.relayOrigin !== undefined && qr.relayOrigin !== options.relayOrigin.toLowerCase().replace(/\/+$/, "")) {
+                throw new PairingEnded("wrong_relay");
+            }
+            by = { id: encodePairingSessionId(qr.sessionId) };
+            scanned = qr.publicKey;
+        }
+        else {
+            const code = parsePairingCode(input.code);
+            if (!code)
+                throw new PairingEnded("unknown_code");
+            by = { code };
+        }
+        set({ phase: "claiming" });
+        const key = createPairingKey();
+        const claimed = await relay.claim(by, base64Url(key.publicKey));
+        const box = mailbox(relay, claimed.id, claimed.token, clock);
+        current = { id: claimed.id, token: claimed.token, box };
+        const sessionId = decodePairingSessionId(claimed.id);
+        set({ phase: "waiting" });
+        const reveal = await box.next(abort.signal, clock.now() + approvalMs);
+        if (!reveal)
+            throw new PairingEnded("timed_out");
+        if (reveal.type !== "reveal" || !reveal.pkN || !sessionId)
+            throw new PairingEnded("tampered");
+        try {
+            current.session = startApproverSession(key, {
+                sessionId,
+                commitment: base64UrlDecode(claimed.commit),
+                newDevicePublicKey: base64UrlDecode(reveal.pkN),
+                scannedPublicKey: scanned,
+            });
+        }
+        catch {
+            throw new PairingEnded("tampered");
+        }
+        const hello = openJson(current.session, await box.next(abort.signal, clock.now() + approvalMs), "hello");
+        const text = (v) => (typeof v === "string" ? v.slice(0, 100) : "");
+        device = { name: text(hello.name), app: text(hello.app), platform: text(hello.platform) };
+        const deadline = clock.now() + approvalMs;
+        set({ phase: "confirming", device, location: claimed.location, yourLocation: claimed.yourLocation, emoji: current.session.emoji, deadline });
+        // N sends nothing more until A approves, so a message or a close here means something's off.
+        confirming = new AbortController();
+        abort.signal.addEventListener("abort", () => confirming?.abort(), { once: true });
+        try {
+            if (await box.next(confirming.signal, deadline))
+                throw new PairingEnded("tampered");
+        }
+        catch (e) {
+            if (confirming.signal.aborted)
+                return;
+            // N's clock started a moment before ours, so its timeout close can land just before ours fires.
+            if (reasonFor(e) !== "cancelled_by_other" || clock.now() < deadline - 5000)
+                throw e;
+        }
+        throw new PairingEnded("timed_out");
+    }
+    async function approveExtension(issuer, userCode, accessToken) {
+        const token = await accessToken();
+        const res = await fetch(`${issuer.replace(/\/+$/, "")}/gryt-pairing/approve`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+            body: JSON.stringify({ user_code: userCode, binding: current.session.keycloakNonce }),
+        }).catch(() => {
+            throw new PairingEnded("approve:network");
+        });
+        if (res.status === 204)
+            return true;
+        if (res.status === 404)
+            return false;
+        const body = (await res.json().catch(() => null));
+        const code = typeof body?.error === "string" ? body.error : String(res.status);
+        throw new PairingEnded(APPROVE_ERROR_REASONS[code] ?? `approve:${code}`);
+    }
+    async function addEverywhere(ready) {
+        const added = {};
+        for (const { host, deviceId } of ready) {
+            const driver = devices(host);
+            if (!driver)
+                continue;
+            for (let tries = 0;; tries++) {
+                try {
+                    added[host] = await driver.addOwnDevice(deviceId, {
+                        onProgress: ({ done, total }) => set({ phase: "adding", device: device, host, done, total }),
+                    });
+                    break;
+                }
+                catch (e) {
+                    // The server lists N's device once its KeyPackages are in, which can trail N's "ready".
+                    if (e.code !== "not_own_device" || tries >= NOT_LISTED_RETRIES)
+                        throw e;
+                    await clock.sleep(2000, abort.signal);
+                }
+            }
+        }
+        return added;
+    }
+    async function approve(envelope, accessToken) {
+        const { id, token, box, session } = current;
+        set({ phase: envelope.account ? "signing_in" : "waiting_ready", device: device });
+        await relay.post(id, token, { type: "sealed", body: base64Url(session.seal(encodePairingEnvelope(envelope))) });
+        if (envelope.account && accessToken) {
+            const message = await box.next(abort.signal, clock.now() + approvalMs);
+            if (!message)
+                throw new PairingEnded("timed_out");
+            const userCode = String(openJson(session, message, "user_code").userCode ?? "");
+            if (!(await approveExtension(envelope.account.issuer, userCode, accessToken))) {
+                const url = `${envelope.account.issuer.replace(/\/+$/, "")}/device?user_code=${encodeURIComponent(userCode)}`;
+                set({ phase: "browser", device: device, url });
+            }
+        }
+        if (state.phase === "signing_in")
+            set({ phase: "waiting_ready", device: device });
+        const ready = openJson(session, await box.next(abort.signal), "ready");
+        const list = Array.isArray(ready.devices) ? ready.devices : [];
+        const named = list.filter((d) => typeof d?.host === "string" && typeof d?.deviceId === "string");
+        const added = await addEverywhere(named);
+        set({ phase: "done", device: device, added });
+        session.close();
+        await closeQuietly();
+    }
+    return {
+        get state() {
+            return state;
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => void listeners.delete(listener);
+        },
+        claim(input) {
+            if (state.phase !== "idle")
+                throw new Error("This pairing has claimed a session already.");
+            claim(input).catch(fail);
+        },
+        approve(envelope, accessToken) {
+            if (state.phase !== "confirming")
+                throw new Error("Nothing to approve.");
+            if (envelope.account && !accessToken)
+                throw new Error("An account needs an access token to approve with.");
+            if (clock.now() > state.deadline)
+                return void end("timed_out");
+            confirming?.abort();
+            approve(envelope, accessToken).catch(fail);
+        },
+        deny: () => end("cancelled"),
+        mismatch: () => end("mismatch"),
+        cancel: () => end("cancelled"),
+    };
+}

package/dist/pairing/channel.d.ts

@@ -0,0 +1,17 @@
+import { type PairingSession } from "@gryt/crypto";
+import type { PairingClock, PairingEndReason } from "./interfaces.js";
+import type { PairingRelay, RelayMessage } from "./relayClient.js";
+/** Thrown inside a pairing to stop it with a reason the screen can show. */
+export declare class PairingEnded extends Error {
+    readonly reason: PairingEndReason;
+    constructor(reason: PairingEndReason);
+}
+export declare const systemClock: PairingClock;
+export declare function reasonFor(error: unknown): PairingEndReason;
+export declare function sealJson(session: PairingSession, value: Record<string, unknown>): string;
+/** The next sealed message as JSON with a `t`, or a throw that ends the pairing as tampered. */
+export declare function openJson(session: PairingSession, message: RelayMessage | null, t: string): Record<string, unknown>;
+/** The other side's messages in order, long-polling the relay. `next` gives null once `deadline` passes. */
+export declare function mailbox(relay: PairingRelay, id: string, token: string, clock: PairingClock): {
+    next(signal: AbortSignal, deadline?: number): Promise<RelayMessage | null>;
+};

package/dist/pairing/channel.js

@@ -0,0 +1,81 @@
+import { base64Url, base64UrlDecode } from "@gryt/crypto";
+import { PairingRelayError } from "./relayClient.js";
+/** Thrown inside a pairing to stop it with a reason the screen can show. */
+export class PairingEnded extends Error {
+    reason;
+    constructor(reason) {
+        super(`Pairing ended: ${reason}`);
+        this.reason = reason;
+    }
+}
+export const systemClock = {
+    now: () => Date.now(),
+    sleep: (ms, signal) => new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(signal.reason);
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => (clearTimeout(timer), reject(signal.reason)), { once: true });
+    }),
+};
+export function reasonFor(error) {
+    if (error instanceof PairingEnded)
+        return error.reason;
+    if (!(error instanceof PairingRelayError))
+        return "relay_error";
+    if (error.status === 410)
+        return error.code === "closed" ? "cancelled_by_other" : "expired";
+    if (error.code === "already_claimed")
+        return "already_claimed";
+    if (error.status === 404)
+        return "unknown_code";
+    if (error.status === 429)
+        return "rate_limited";
+    return "relay_error";
+}
+export function sealJson(session, value) {
+    return base64Url(session.seal(new TextEncoder().encode(JSON.stringify(value))));
+}
+/** The next sealed message as JSON with a `t`, or a throw that ends the pairing as tampered. */
+export function openJson(session, message, t) {
+    try {
+        if (message?.type !== "sealed" || !message.body)
+            throw new Error();
+        const value = JSON.parse(new TextDecoder().decode(session.open(base64UrlDecode(message.body))));
+        if (value && typeof value === "object" && value.t === t)
+            return value;
+    }
+    catch {
+        // Falls through: whatever went wrong, the other side can't be trusted with the rest.
+    }
+    throw new PairingEnded("tampered");
+}
+const MAX_NETWORK_RETRIES = 5;
+/** The other side's messages in order, long-polling the relay. `next` gives null once `deadline` passes. */
+export function mailbox(relay, id, token, clock) {
+    let after = 0;
+    const queue = [];
+    return {
+        async next(signal, deadline) {
+            for (let failures = 0;;) {
+                const queued = queue.shift();
+                if (queued)
+                    return queued;
+                const left = deadline === undefined ? 25_000 : deadline - clock.now();
+                if (left <= 0)
+                    return null;
+                try {
+                    for (const m of await relay.poll(id, token, after, Math.min(25, Math.ceil(left / 1000)), signal)) {
+                        if (m.seq > after)
+                            (queue.push(m), (after = m.seq));
+                    }
+                    failures = 0;
+                }
+                catch (e) {
+                    if (!(e instanceof PairingRelayError && e.code === "network") || ++failures > MAX_NETWORK_RETRIES)
+                        throw e;
+                    await clock.sleep(2000, signal);
+                }
+            }
+        },
+    };
+}

package/dist/pairing/interfaces.d.ts

@@ -0,0 +1,87 @@
+import type { PairingEnvelope } from "@gryt/crypto";
+import type { MlsAddOwnDeviceOptions, MlsOwnDeviceAdd } from "../mls/interfaces.js";
+/** `fetch`, cut down to what pairing uses. The browser's, Node's and React Native's all fit. */
+export type PairingFetch = (url: string, init: {
+    method: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export interface PairingClock {
+    now(): number;
+    /** Resolves after `ms`, or rejects once `signal` aborts. */
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+}
+/** What N tells A about itself, shown on the approval screen. N chooses it, so A treats it as a claim. */
+export interface PairingDeviceInfo {
+    name: string;
+    app: string;
+    platform: string;
+}
+/** Tokens from the device grant. The ID token has already been checked against the envelope. */
+export interface PairingTokens {
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export interface DeviceAuthorization {
+    deviceCode: string;
+    userCode: string;
+    expiresIn: number;
+    interval?: number;
+}
+export type DeviceTokenPoll = {
+    status: "pending" | "slow_down" | "denied" | "expired";
+} | {
+    status: "ok";
+    tokens: PairingTokens;
+};
+/** The two RFC 8628 calls, against `{issuer}/protocol/openid-connect/...`. Core makes the PKCE and nonce. */
+export interface PairingOidc {
+    deviceAuthorization(req: {
+        issuer: string;
+        clientId: string;
+        scope: string;
+        codeChallenge: string;
+        codeChallengeMethod: "S256";
+        nonce: string;
+    }): Promise<DeviceAuthorization>;
+    deviceToken(req: {
+        issuer: string;
+        clientId: string;
+        deviceCode: string;
+        codeVerifier: string;
+    }): Promise<DeviceTokenPoll>;
+}
+/** N's secure storage. Called once, only after every check has passed, with everything to keep. */
+export interface PairingStorage {
+    commit(envelope: PairingEnvelope, tokens: PairingTokens | null): Promise<void>;
+}
+/** N's MLS device on one server, sent to A in "ready" once its KeyPackages are published. */
+export interface PairedServerDevice {
+    host: string;
+    deviceId: string;
+}
+/** A's DM driver on one server, or undefined when A isn't on it. */
+export type OwnDeviceAdder = (host: string) => {
+    addOwnDevice(deviceId: string, options?: MlsAddOwnDeviceOptions): Promise<MlsOwnDeviceAdd[]>;
+} | undefined;
+/** Why a pairing stopped. `approve:<error>` carries the extension's own error code for anything
+    below that isn't broken out on its own (GRYT-1578; auth#46 has the full list). */
+export type PairingEndReason = "cancelled" | "cancelled_by_other" | "mismatch" | "timed_out" | "expired" | "already_claimed" | "unknown_code" | "wrong_relay" | "newer_version" | "not_pairing" | "rate_limited" | "tampered" | "wrong_account" | "sign_in_failed" | "relay_error"
+/** The approve endpoint says this user_code already got its one answer. */
+ | "code_used"
+/** The approve endpoint says the user_code isn't valid any more: unknown, expired, or not pending. */
+ | "code_expired"
+/** The approve endpoint refuses because the account has something pending, like verifying an email. */
+ | "required_actions"
+/** The approve endpoint refuses A's access token as too old; refresh it and try again. */
+ | "stale_token"
+/** The device grant itself said no: A denied it, or the approve endpoint's refusal denied the code. */
+ | "access_denied"
+/** The device grant's user_code ran out before anyone answered it. */
+ | "expired_token" | `approve:${string}`;

package/dist/pairing/interfaces.js

@@ -0,0 +1 @@
+export {};

package/dist/pairing/newDevice.d.ts

@@ -0,0 +1,62 @@
+import { type PairingEmoji, type PairingServer } from "@gryt/crypto";
+import type { PairedServerDevice, PairingClock, PairingDeviceInfo, PairingEndReason, PairingOidc, PairingStorage } from "./interfaces.js";
+import type { PairingRelay } from "./relayClient.js";
+export type NewDeviceState = {
+    phase: "idle";
+} | {
+    phase: "opening";
+}
+/** `renewed` says why this is a fresh QR: the last one ran out, or A never approved. */
+ | {
+    phase: "showing";
+    qr: string;
+    code: string;
+    expiresAt: number;
+    renewed?: "expired" | "timed_out";
+} | {
+    phase: "comparing";
+    emoji: readonly PairingEmoji[];
+    deadline: number;
+} | {
+    phase: "signing_in";
+    username: string;
+    from: string;
+}
+/** Everything is written. The app joins `servers`, publishes KeyPackages, then calls `ready`. */
+ | {
+    phase: "joining";
+    servers: PairingServer[];
+    from: string;
+} | {
+    phase: "linked";
+    from: string;
+} | {
+    phase: "done";
+    from: string;
+} | {
+    phase: "ended";
+    reason: PairingEndReason;
+};
+export interface NewDeviceOptions {
+    relay: PairingRelay;
+    device: PairingDeviceInfo;
+    storage: PairingStorage;
+    oidc: PairingOidc;
+    clock?: PairingClock;
+    /** Only for a server with its own auth server: goes in the QR for A to check against its own. */
+    relayOrigin?: string;
+    approvalMs?: number;
+}
+export interface NewDevicePairing {
+    readonly state: NewDeviceState;
+    subscribe(listener: (state: NewDeviceState) => void): () => void;
+    start(): void;
+    /** In `joining`: N's device on each server, once its KeyPackages are up. */
+    ready(devices: PairedServerDevice[]): Promise<void>;
+    cancel(): Promise<void>;
+    /** "They don't match": the same as cancel, with a reason that says the link may be tampered with. */
+    mismatch(): Promise<void>;
+}
+export declare const PAIRING_APPROVAL_MS = 60000;
+/** N: shows the QR and code, checks the emoji, opens the envelope, signs in, then says ready. */
+export declare function createNewDevicePairing(options: NewDeviceOptions): NewDevicePairing;

package/dist/pairing/newDevice.js

@@ -0,0 +1,209 @@
+import { base64Url, base64UrlDecode, createPairingKey, decodePairingEnvelope, decodePairingSessionId, formatPairingCode, formatPairingQr, pairingCommitment, startNewDeviceSession, } from "@gryt/crypto";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+import { mailbox, PairingEnded, reasonFor, sealJson, systemClock } from "./channel.js";
+export const PAIRING_APPROVAL_MS = 60_000;
+const PAIRING_OIDC_SCOPE = "openid profile email offline_access";
+/** N: shows the QR and code, checks the emoji, opens the envelope, signs in, then says ready. */
+export function createNewDevicePairing(options) {
+    const { relay, device, storage, oidc } = options;
+    const clock = options.clock ?? systemClock;
+    const approvalMs = options.approvalMs ?? PAIRING_APPROVAL_MS;
+    const listeners = new Set();
+    const abort = new AbortController();
+    let state = { phase: "idle" };
+    let current = null;
+    const set = (next) => {
+        if (state.phase === "ended" || state.phase === "done")
+            return;
+        state = next;
+        for (const l of listeners)
+            l(state);
+    };
+    const closeQuietly = () => (current ? relay.close(current.id, current.token).catch(() => undefined) : undefined);
+    const end = async (reason) => {
+        if (state.phase === "ended" || state.phase === "done")
+            return;
+        set({ phase: "ended", reason });
+        abort.abort();
+        current?.session?.close();
+        await closeQuietly();
+    };
+    async function attempt(renewed) {
+        set({ phase: "opening" });
+        const key = createPairingKey();
+        const created = await relay.create(base64Url(pairingCommitment(key.publicKey)));
+        const sessionId = decodePairingSessionId(created.id);
+        if (!sessionId)
+            throw new PairingEnded("relay_error");
+        const box = mailbox(relay, created.id, created.token, clock);
+        current = { id: created.id, token: created.token, box };
+        if (abort.signal.aborted) {
+            await closeQuietly();
+            throw new PairingEnded("cancelled");
+        }
+        const expiresAt = Date.parse(created.expiresAt);
+        const qr = formatPairingQr({ sessionId, publicKey: key.publicKey, relayOrigin: options.relayOrigin });
+        set({ phase: "showing", qr, code: formatPairingCode(created.code), expiresAt, ...(renewed ? { renewed } : {}) });
+        // No local deadline: the relay's clock decides, and its 410 is what renews the QR.
+        const claim = await box.next(abort.signal).catch((e) => {
+            if (reasonFor(e) === "expired")
+                return null;
+            throw e;
+        });
+        if (!claim)
+            return "expired";
+        if (claim.type !== "claim" || !claim.pkA)
+            throw new PairingEnded("tampered");
+        let session;
+        try {
+            session = current.session = startNewDeviceSession(key, { sessionId, approverPublicKey: base64UrlDecode(claim.pkA) });
+        }
+        catch {
+            throw new PairingEnded("tampered");
+        }
+        await relay.post(created.id, created.token, { type: "reveal", pkN: base64Url(key.publicKey) });
+        const deadline = clock.now() + approvalMs;
+        await relay.post(created.id, created.token, { type: "sealed", body: sealJson(session, { t: "hello", ...device, deadline }) });
+        set({ phase: "comparing", emoji: session.emoji, deadline });
+        const sealed = await box.next(abort.signal, deadline);
+        if (!sealed || clock.now() > deadline) {
+            session.close();
+            await closeQuietly();
+            return "timed_out";
+        }
+        try {
+            if (sealed.type !== "sealed" || !sealed.body)
+                throw new Error();
+            return decodePairingEnvelope(session.open(base64UrlDecode(sealed.body)));
+        }
+        catch (e) {
+            throw new PairingEnded(e instanceof Error && /newer version/.test(e.message) ? "newer_version" : "tampered");
+        }
+    }
+    async function signIn(account, from) {
+        const { id, token, box, session } = current;
+        set({ phase: "signing_in", username: account.username, from });
+        const verifier = base64Url(randomBytes(32));
+        const auth = await oidc.deviceAuthorization({
+            issuer: account.issuer,
+            clientId: account.clientId,
+            scope: PAIRING_OIDC_SCOPE,
+            codeChallenge: base64Url(sha256(new TextEncoder().encode(verifier))),
+            codeChallengeMethod: "S256",
+            nonce: session.keycloakNonce,
+        });
+        await relay.post(id, token, { type: "sealed", body: sealJson(session, { t: "user_code", userCode: auth.userCode }) });
+        // A sends nothing more here, so anything from the relay (a close, most likely) stops the polling.
+        const stop = new AbortController();
+        const onAbort = () => stop.abort();
+        abort.signal.addEventListener("abort", onAbort, { once: true });
+        let failure = null;
+        box.next(stop.signal).then(() => ((failure = new PairingEnded("tampered")), stop.abort()), (e) => (stop.signal.aborted ? undefined : ((failure = e), stop.abort())));
+        try {
+            let interval = (auth.interval ?? 5) * 1000;
+            for (const until = clock.now() + auth.expiresIn * 1000; clock.now() < until;) {
+                await clock.sleep(interval, stop.signal).catch(() => {
+                    throw failure ?? new PairingEnded("cancelled");
+                });
+                const polled = await oidc.deviceToken({
+                    issuer: account.issuer,
+                    clientId: account.clientId,
+                    deviceCode: auth.deviceCode,
+                    codeVerifier: verifier,
+                });
+                if (failure)
+                    throw failure;
+                if (polled.status === "ok")
+                    return checkIdToken(polled.tokens, account, session.keycloakNonce);
+                // RFC 8628's own two terminal errors, plus what auth#46 leaves behind when A's approve
+                // endpoint refuses the code: either way N's device grant sees it as denied.
+                if (polled.status === "denied")
+                    throw new PairingEnded("access_denied");
+                if (polled.status === "expired")
+                    throw new PairingEnded("expired_token");
+                if (polled.status === "slow_down")
+                    interval += 5000;
+                // Anything else is "pending": keep polling.
+            }
+            throw new PairingEnded("sign_in_failed");
+        }
+        finally {
+            stop.abort();
+            abort.signal.removeEventListener("abort", onAbort);
+        }
+    }
+    async function run() {
+        try {
+            let outcome = await attempt();
+            while (typeof outcome === "string")
+                outcome = await attempt(outcome);
+            const envelope = outcome;
+            const tokens = envelope.account ? await signIn(envelope.account, envelope.from) : null;
+            await storage.commit(envelope, tokens);
+            set({ phase: "joining", servers: envelope.servers, from: envelope.from });
+        }
+        catch (e) {
+            if (!abort.signal.aborted)
+                await end(reasonFor(e));
+        }
+    }
+    async function linked(from) {
+        try {
+            // History from A lands here in a later version. Until then, A closing is the finish.
+            while (await current.box.next(abort.signal))
+                ;
+        }
+        catch (e) {
+            if (abort.signal.aborted)
+                return;
+            const reason = reasonFor(e);
+            if (reason !== "cancelled_by_other" && reason !== "expired")
+                return end(reason);
+            set({ phase: "done", from });
+            current?.session?.close();
+        }
+    }
+    return {
+        get state() {
+            return state;
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => void listeners.delete(listener);
+        },
+        start() {
+            if (state.phase !== "idle")
+                throw new Error("This pairing has started already.");
+            void run();
+        },
+        async ready(devices) {
+            if (state.phase !== "joining" || !current?.session)
+                throw new Error("Not waiting to join.");
+            const { from } = state;
+            const body = sealJson(current.session, { t: "ready", devices: devices.map(({ host, deviceId }) => ({ host, deviceId })) });
+            await relay.post(current.id, current.token, { type: "sealed", body });
+            set({ phase: "linked", from });
+            void linked(from);
+        },
+        cancel: () => end("cancelled"),
+        mismatch: () => end("mismatch"),
+    };
+}
+/** Straight from the token endpoint over TLS, so the claims are read, not the signature (OIDC Core 3.1.3.7). */
+function checkIdToken(tokens, account, nonce) {
+    let claims;
+    try {
+        claims = JSON.parse(new TextDecoder().decode(base64UrlDecode(tokens.idToken.split(".")[1] ?? "")));
+    }
+    catch {
+        throw new PairingEnded("sign_in_failed");
+    }
+    const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (claims.nonce !== nonce || claims.iss !== account.issuer || !aud.includes(account.clientId)) {
+        throw new PairingEnded("tampered");
+    }
+    if (claims.sub !== account.sub)
+        throw new PairingEnded("wrong_account");
+    return tokens;
+}