@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/audit.js

@@ -0,0 +1,274 @@
+import { Buffer } from "node:buffer";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+export const DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES = 2;
+export const DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES = 64 * 1024;
+export const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS = 60_000;
+export const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST = 4;
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const MINIMUM_AUDIT_FILE_BYTES = 1024;
+const RATE_LIMITED_SECURITY_EVENT_TYPES = new Set([
+    "client_rejected",
+    "handshake_rejected",
+    "iroh_security_connection_limit",
+    "iroh_security_unauthenticated_connection_limit",
+    "iroh_security_stream_limit",
+    "iroh_security_handshake_limit",
+    "iroh_security_handshake_timeout",
+    "iroh_security_transport_rejected",
+]);
+function getErrorCode(error) {
+    if (typeof error !== "object" || error === null || !("code" in error))
+        return undefined;
+    return typeof error.code === "string" ? error.code : undefined;
+}
+function assertIntegerAtLeast(value, minimum, name) {
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new Error(`${name} must be an integer of at least ${minimum}`);
+    }
+}
+/**
+ * Serialized, owner-only JSONL audit persistence with bounded files. Rejected
+ * unauthenticated traffic is burst-sampled and then represented by aggregate
+ * records so hostile handshakes cannot turn the audit trail into a disk DoS.
+ */
+export class IrohRemoteAuditLogger {
+    path;
+    sink;
+    now;
+    maxFileBytes;
+    maxBackupFiles;
+    maxEntryBytes;
+    securityRateLimit;
+    securityBuckets = new Map();
+    writeQueue = Promise.resolve();
+    constructor(options = {}) {
+        this.path = options.path;
+        this.sink = options.sink;
+        this.now = options.now ?? Date.now;
+        this.maxFileBytes = options.maxFileBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES;
+        this.maxBackupFiles = options.maxBackupFiles ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES;
+        this.maxEntryBytes = options.maxEntryBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES;
+        assertIntegerAtLeast(this.maxFileBytes, MINIMUM_AUDIT_FILE_BYTES, "maxFileBytes");
+        assertIntegerAtLeast(this.maxBackupFiles, 0, "maxBackupFiles");
+        assertIntegerAtLeast(this.maxEntryBytes, MINIMUM_AUDIT_FILE_BYTES, "maxEntryBytes");
+        if (this.maxEntryBytes > this.maxFileBytes) {
+            throw new Error("maxEntryBytes must not exceed maxFileBytes");
+        }
+        const rateLimit = options.securityEventRateLimit;
+        if (rateLimit !== false && (rateLimit !== undefined || this.path !== undefined)) {
+            const maxEventsPerWindow = rateLimit?.maxEventsPerWindow ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST;
+            const windowMs = rateLimit?.windowMs ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS;
+            assertIntegerAtLeast(maxEventsPerWindow, 1, "securityEventRateLimit.maxEventsPerWindow");
+            assertIntegerAtLeast(windowMs, 1, "securityEventRateLimit.windowMs");
+            this.securityRateLimit = { maxEventsPerWindow, windowMs };
+        }
+    }
+    async log(event) {
+        const auditEvent = {
+            ...event,
+            timestamp: event.timestamp ?? this.now(),
+        };
+        const events = this.applySecurityRateLimit(auditEvent);
+        for (const eventToWrite of events) {
+            await this.enqueue(eventToWrite);
+        }
+    }
+    /** Flush rate-limit summaries and all queued file writes. */
+    async flush() {
+        const observedAt = this.now();
+        const summaries = [];
+        for (const [eventType, bucket] of this.securityBuckets) {
+            if (bucket.timer !== undefined)
+                clearTimeout(bucket.timer);
+            const summary = this.createSuppressionSummary(eventType, bucket, observedAt);
+            if (summary !== undefined)
+                summaries.push(summary);
+        }
+        this.securityBuckets.clear();
+        const summaryWrites = summaries.map((summary) => this.enqueue(summary));
+        await Promise.all(summaryWrites);
+        await this.writeQueue;
+    }
+    applySecurityRateLimit(event) {
+        const rateLimit = this.securityRateLimit;
+        if (rateLimit === undefined || !RATE_LIMITED_SECURITY_EVENT_TYPES.has(event.type))
+            return [event];
+        const observedAt = this.now();
+        let bucket = this.securityBuckets.get(event.type);
+        const events = [];
+        if (bucket === undefined || observedAt - bucket.windowStartedAt >= rateLimit.windowMs) {
+            if (bucket !== undefined) {
+                if (bucket.timer !== undefined)
+                    clearTimeout(bucket.timer);
+                const summary = this.createSuppressionSummary(event.type, bucket, observedAt);
+                if (summary !== undefined)
+                    events.push(summary);
+            }
+            bucket = { windowStartedAt: observedAt, emitted: 0, suppressed: 0 };
+            this.securityBuckets.set(event.type, bucket);
+        }
+        if (bucket.emitted < rateLimit.maxEventsPerWindow) {
+            bucket.emitted++;
+            events.push(event);
+            return events;
+        }
+        bucket.suppressed++;
+        bucket.firstSuppressedAt ??= observedAt;
+        bucket.lastSuppressedAt = observedAt;
+        this.scheduleSecurityBucketFlush(event.type, bucket);
+        return events;
+    }
+    scheduleSecurityBucketFlush(eventType, bucket) {
+        const rateLimit = this.securityRateLimit;
+        if (rateLimit === undefined || bucket.timer !== undefined)
+            return;
+        const delayMs = Math.max(1, bucket.windowStartedAt + rateLimit.windowMs - this.now());
+        bucket.timer = setTimeout(() => {
+            void this.flushExpiredSecurityBucket(eventType).catch(() => { });
+        }, delayMs);
+        bucket.timer.unref?.();
+    }
+    async flushExpiredSecurityBucket(eventType) {
+        const rateLimit = this.securityRateLimit;
+        const bucket = this.securityBuckets.get(eventType);
+        if (rateLimit === undefined || bucket === undefined)
+            return;
+        bucket.timer = undefined;
+        const observedAt = this.now();
+        if (observedAt - bucket.windowStartedAt < rateLimit.windowMs) {
+            this.scheduleSecurityBucketFlush(eventType, bucket);
+            return;
+        }
+        const summary = this.createSuppressionSummary(eventType, bucket, observedAt);
+        this.securityBuckets.set(eventType, { windowStartedAt: observedAt, emitted: 0, suppressed: 0 });
+        if (summary !== undefined)
+            await this.enqueue(summary);
+    }
+    createSuppressionSummary(eventType, bucket, observedAt) {
+        if (bucket.suppressed === 0)
+            return undefined;
+        return {
+            type: "security_events_rate_limited",
+            timestamp: observedAt,
+            success: false,
+            details: {
+                eventType,
+                sampledCount: bucket.emitted,
+                suppressedCount: bucket.suppressed,
+                windowStartedAt: bucket.windowStartedAt,
+                firstSuppressedAt: bucket.firstSuppressedAt,
+                lastSuppressedAt: bucket.lastSuppressedAt,
+            },
+        };
+    }
+    enqueue(event) {
+        const operation = this.writeQueue.then(() => this.write(event));
+        this.writeQueue = operation.catch(() => { });
+        return operation;
+    }
+    async write(auditEvent) {
+        if (this.sink)
+            await this.sink.write(auditEvent);
+        if (!this.path)
+            return;
+        const line = this.serialize(auditEvent);
+        await this.ensurePrivateParent();
+        const existingSize = await this.inspectCurrentFile();
+        if (existingSize > 0 && existingSize + Buffer.byteLength(line, "utf8") > this.maxFileBytes) {
+            await this.rotate();
+        }
+        await this.appendPrivate(line);
+    }
+    serialize(auditEvent) {
+        const serialized = `${JSON.stringify(auditEvent)}\n`;
+        const originalBytes = Buffer.byteLength(serialized, "utf8");
+        if (originalBytes <= this.maxEntryBytes)
+            return serialized;
+        return `${JSON.stringify({
+            type: "audit_event_truncated",
+            timestamp: auditEvent.timestamp,
+            success: false,
+            error: "audit event exceeded maximum serialized size",
+            details: { originalBytes, originalType: auditEvent.type.slice(0, 128) },
+        })}\n`;
+    }
+    async ensurePrivateParent() {
+        if (this.path === undefined)
+            return;
+        const parentPath = dirname(this.path);
+        await mkdir(parentPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+        const parentStat = await lstat(parentPath);
+        if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+            throw new Error(`Refusing to use non-directory audit path: ${parentPath}`);
+        }
+        await chmod(parentPath, PRIVATE_DIRECTORY_MODE);
+    }
+    async inspectCurrentFile() {
+        if (this.path === undefined)
+            return 0;
+        try {
+            const fileStat = await lstat(this.path);
+            if (fileStat.isSymbolicLink() || !fileStat.isFile() || fileStat.nlink !== 1) {
+                throw new Error(`Refusing to use non-regular audit file: ${this.path}`);
+            }
+            await chmod(this.path, PRIVATE_FILE_MODE);
+            return fileStat.size;
+        }
+        catch (error) {
+            if (getErrorCode(error) === "ENOENT")
+                return 0;
+            throw error;
+        }
+    }
+    async rotate() {
+        if (this.path === undefined)
+            return;
+        if (this.maxBackupFiles === 0) {
+            await rm(this.path, { force: true });
+            return;
+        }
+        await rm(`${this.path}.${this.maxBackupFiles}`, { force: true });
+        for (let index = this.maxBackupFiles - 1; index >= 1; index--) {
+            await this.renameIfRegular(`${this.path}.${index}`, `${this.path}.${index + 1}`);
+        }
+        await rename(this.path, `${this.path}.1`);
+    }
+    async renameIfRegular(source, destination) {
+        try {
+            const sourceStat = await lstat(source);
+            if (sourceStat.isSymbolicLink() || !sourceStat.isFile() || sourceStat.nlink !== 1) {
+                await rm(source, { force: true });
+                return;
+            }
+            await chmod(source, PRIVATE_FILE_MODE);
+            await rm(destination, { force: true });
+            await rename(source, destination);
+        }
+        catch (error) {
+            if (getErrorCode(error) !== "ENOENT")
+                throw error;
+        }
+    }
+    async appendPrivate(line) {
+        if (this.path === undefined)
+            return;
+        const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+        const handle = await open(this.path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | noFollow, PRIVATE_FILE_MODE);
+        try {
+            const fileStat = await handle.stat();
+            if (!fileStat.isFile() || fileStat.nlink !== 1) {
+                throw new Error(`Refusing to use non-regular audit file: ${this.path}`);
+            }
+            await handle.chmod(PRIVATE_FILE_MODE);
+            await handle.writeFile(line, "utf8");
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/core/remote/iroh/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACxE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,4CAA4C,GAAG,MAAM,CAAC;AACnE,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC;AAE1D,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IACjD,iBAAiB;IACjB,oBAAoB;IACpB,gCAAgC;IAChC,gDAAgD;IAChD,4BAA4B;IAC5B,+BAA+B;IAC/B,iCAAiC;IACjC,kCAAkC;CAClC,CAAC,CAAC;AAgDH,SAAS,YAAY,CAAC,KAAc,EAAsB;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC/D;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY,EAAQ;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AAAA,CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAChB,IAAI,CAAqB;IACzB,IAAI,CAAkC;IACtC,GAAG,CAAe;IAClB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,aAAa,CAAS;IACtB,iBAAiB,CAA6C;IAC9D,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClE,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YAAY,OAAO,GAAiC,EAAE,EAAE;QACvD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,wCAAwC,CAAC;QACrF,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,0CAA0C,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yCAAyC,CAAC;QACxF,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,EAAE,cAAc,CAAC,CAAC;QAClF,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC/D,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC;QACjD,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YACjF,MAAM,kBAAkB,GAAG,SAAS,EAAE,kBAAkB,IAAI,wCAAwC,CAAC;YACrG,MAAM,QAAQ,GAAG,SAAS,EAAE,QAAQ,IAAI,4CAA4C,CAAC;YACrF,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;YACzF,oBAAoB,CAAC,QAAQ,EAAE,CAAC,EAAE,iCAAiC,CAAC,CAAC;YACrE,IAAI,CAAC,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC3D,CAAC;IAAA,CACD;IAED,KAAK,CAAC,GAAG,CAAC,KAAgC,EAAiB;QAC1D,MAAM,UAAU,GAAyB;YACxC,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;SACxC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACvD,KAAK,MAAM,YAAY,IAAI,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;IAAA,CACD;IAED,6DAA6D;IAC7D,KAAK,CAAC,KAAK,GAAkB;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7E,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC;IAAA,CACtB;IAEO,sBAAsB,CAAC,KAA2B,EAA0B;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAElG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC9E,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QACf,CAAC;QAED,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,iBAAiB,KAAK,UAAU,CAAC;QACxC,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC;QACrC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAAA,CACd;IAEO,2BAA2B,CAAC,SAAiB,EAAE,MAA2B,EAAQ;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAAA,CAChE,EAAE,OAAO,CAAC,CAAC;QACZ,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAAA,CACvB;IAEO,KAAK,CAAC,0BAA0B,CAAC,SAAiB,EAAiB;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QAC5D,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,GAAG,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC9D,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAChG,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAAA,CACvD;IAEO,wBAAwB,CAC/B,SAAiB,EACjB,MAA2B,EAC3B,UAAkB,EACiB;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO;YACN,IAAI,EAAE,8BAA8B;YACpC,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACR,SAAS;gBACT,YAAY,EAAE,MAAM,CAAC,OAAO;gBAC5B,eAAe,EAAE,MAAM,CAAC,UAAU;gBAClC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aACzC;SACD,CAAC;IAAA,CACF;IAEO,OAAO,CAAC,KAA2B,EAAiB;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,SAAS,CAAC;IAAA,CACjB;IAEO,KAAK,CAAC,KAAK,CAAC,UAAgC,EAAiB;QACpE,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACrD,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5F,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAAA,CAC/B;IAEO,SAAS,CAAC,UAAgC,EAAU;QAC3D,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,aAAa,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,UAAU,CAAC;QAC3D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8CAA8C;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACxC,CAAC,IAAI,CAAC;IAAA,CACtC;IAEO,KAAK,CAAC,mBAAmB,GAAkB;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAAA,CAChD;IAEO,KAAK,CAAC,kBAAkB,GAAoB;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,MAAM,GAAkB;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO;QACR,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAAA,CAC1C;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,WAAmB,EAAiB;QACjF,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClC,OAAO;YACR,CAAC;YACD,MAAM,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YACvC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACnD,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAiB;QACxD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACpC,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CACxB,IAAI,CAAC,IAAI,EACT,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,QAAQ,EACtE,iBAAiB,CACjB,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IAAA,CACD;CACD","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { constants } from \"node:fs\";\nimport { chmod, lstat, mkdir, open, rename, rm } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES = 8 * 1024 * 1024;\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES = 2;\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES = 64 * 1024;\nexport const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS = 60_000;\nexport const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST = 4;\n\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\nconst MINIMUM_AUDIT_FILE_BYTES = 1024;\nconst RATE_LIMITED_SECURITY_EVENT_TYPES = new Set([\n\t\"client_rejected\",\n\t\"handshake_rejected\",\n\t\"iroh_security_connection_limit\",\n\t\"iroh_security_unauthenticated_connection_limit\",\n\t\"iroh_security_stream_limit\",\n\t\"iroh_security_handshake_limit\",\n\t\"iroh_security_handshake_timeout\",\n\t\"iroh_security_transport_rejected\",\n]);\n\nexport interface IrohRemoteAuditEvent {\n\ttype: string;\n\ttimestamp: number;\n\tclientNodeId?: string;\n\tworkspace?: string;\n\tsuccess?: boolean;\n\terror?: string;\n\tdetails?: Record<string, unknown>;\n}\n\nexport type IrohRemoteAuditEventInput = Omit<IrohRemoteAuditEvent, \"timestamp\"> & { timestamp?: number };\n\nexport interface IrohRemoteAuditSink {\n\twrite(event: IrohRemoteAuditEvent): void | Promise<void>;\n}\n\nexport interface IrohRemoteSecurityAuditRateLimitOptions {\n\tmaxEventsPerWindow?: number;\n\twindowMs?: number;\n}\n\nexport interface IrohRemoteAuditLoggerOptions {\n\tpath?: string;\n\tsink?: IrohRemoteAuditSink;\n\tnow?: () => number;\n\tmaxFileBytes?: number;\n\tmaxBackupFiles?: number;\n\tmaxEntryBytes?: number;\n\t/** Path-backed daemon logs enable the default limiter unless explicitly disabled. */\n\tsecurityEventRateLimit?: false | IrohRemoteSecurityAuditRateLimitOptions;\n}\n\ninterface SecurityAuditBucket {\n\twindowStartedAt: number;\n\temitted: number;\n\tsuppressed: number;\n\tfirstSuppressedAt?: number;\n\tlastSuppressedAt?: number;\n\ttimer?: NodeJS.Timeout;\n}\n\ninterface ResolvedSecurityAuditRateLimit {\n\tmaxEventsPerWindow: number;\n\twindowMs: number;\n}\n\nfunction getErrorCode(error: unknown): string | undefined {\n\tif (typeof error !== \"object\" || error === null || !(\"code\" in error)) return undefined;\n\treturn typeof error.code === \"string\" ? error.code : undefined;\n}\n\nfunction assertIntegerAtLeast(value: number, minimum: number, name: string): void {\n\tif (!Number.isSafeInteger(value) || value < minimum) {\n\t\tthrow new Error(`${name} must be an integer of at least ${minimum}`);\n\t}\n}\n\n/**\n * Serialized, owner-only JSONL audit persistence with bounded files. Rejected\n * unauthenticated traffic is burst-sampled and then represented by aggregate\n * records so hostile handshakes cannot turn the audit trail into a disk DoS.\n */\nexport class IrohRemoteAuditLogger {\n\tprivate readonly path: string | undefined;\n\tprivate readonly sink: IrohRemoteAuditSink | undefined;\n\tprivate readonly now: () => number;\n\tprivate readonly maxFileBytes: number;\n\tprivate readonly maxBackupFiles: number;\n\tprivate readonly maxEntryBytes: number;\n\tprivate readonly securityRateLimit: ResolvedSecurityAuditRateLimit | undefined;\n\tprivate readonly securityBuckets = new Map<string, SecurityAuditBucket>();\n\tprivate writeQueue: Promise<void> = Promise.resolve();\n\n\tconstructor(options: IrohRemoteAuditLoggerOptions = {}) {\n\t\tthis.path = options.path;\n\t\tthis.sink = options.sink;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.maxFileBytes = options.maxFileBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES;\n\t\tthis.maxBackupFiles = options.maxBackupFiles ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES;\n\t\tthis.maxEntryBytes = options.maxEntryBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES;\n\t\tassertIntegerAtLeast(this.maxFileBytes, MINIMUM_AUDIT_FILE_BYTES, \"maxFileBytes\");\n\t\tassertIntegerAtLeast(this.maxBackupFiles, 0, \"maxBackupFiles\");\n\t\tassertIntegerAtLeast(this.maxEntryBytes, MINIMUM_AUDIT_FILE_BYTES, \"maxEntryBytes\");\n\t\tif (this.maxEntryBytes > this.maxFileBytes) {\n\t\t\tthrow new Error(\"maxEntryBytes must not exceed maxFileBytes\");\n\t\t}\n\n\t\tconst rateLimit = options.securityEventRateLimit;\n\t\tif (rateLimit !== false && (rateLimit !== undefined || this.path !== undefined)) {\n\t\t\tconst maxEventsPerWindow = rateLimit?.maxEventsPerWindow ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST;\n\t\t\tconst windowMs = rateLimit?.windowMs ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS;\n\t\t\tassertIntegerAtLeast(maxEventsPerWindow, 1, \"securityEventRateLimit.maxEventsPerWindow\");\n\t\t\tassertIntegerAtLeast(windowMs, 1, \"securityEventRateLimit.windowMs\");\n\t\t\tthis.securityRateLimit = { maxEventsPerWindow, windowMs };\n\t\t}\n\t}\n\n\tasync log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\tconst auditEvent: IrohRemoteAuditEvent = {\n\t\t\t...event,\n\t\t\ttimestamp: event.timestamp ?? this.now(),\n\t\t};\n\t\tconst events = this.applySecurityRateLimit(auditEvent);\n\t\tfor (const eventToWrite of events) {\n\t\t\tawait this.enqueue(eventToWrite);\n\t\t}\n\t}\n\n\t/** Flush rate-limit summaries and all queued file writes. */\n\tasync flush(): Promise<void> {\n\t\tconst observedAt = this.now();\n\t\tconst summaries: IrohRemoteAuditEvent[] = [];\n\t\tfor (const [eventType, bucket] of this.securityBuckets) {\n\t\t\tif (bucket.timer !== undefined) clearTimeout(bucket.timer);\n\t\t\tconst summary = this.createSuppressionSummary(eventType, bucket, observedAt);\n\t\t\tif (summary !== undefined) summaries.push(summary);\n\t\t}\n\t\tthis.securityBuckets.clear();\n\t\tconst summaryWrites = summaries.map((summary) => this.enqueue(summary));\n\t\tawait Promise.all(summaryWrites);\n\t\tawait this.writeQueue;\n\t}\n\n\tprivate applySecurityRateLimit(event: IrohRemoteAuditEvent): IrohRemoteAuditEvent[] {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tif (rateLimit === undefined || !RATE_LIMITED_SECURITY_EVENT_TYPES.has(event.type)) return [event];\n\n\t\tconst observedAt = this.now();\n\t\tlet bucket = this.securityBuckets.get(event.type);\n\t\tconst events: IrohRemoteAuditEvent[] = [];\n\t\tif (bucket === undefined || observedAt - bucket.windowStartedAt >= rateLimit.windowMs) {\n\t\t\tif (bucket !== undefined) {\n\t\t\t\tif (bucket.timer !== undefined) clearTimeout(bucket.timer);\n\t\t\t\tconst summary = this.createSuppressionSummary(event.type, bucket, observedAt);\n\t\t\t\tif (summary !== undefined) events.push(summary);\n\t\t\t}\n\t\t\tbucket = { windowStartedAt: observedAt, emitted: 0, suppressed: 0 };\n\t\t\tthis.securityBuckets.set(event.type, bucket);\n\t\t}\n\n\t\tif (bucket.emitted < rateLimit.maxEventsPerWindow) {\n\t\t\tbucket.emitted++;\n\t\t\tevents.push(event);\n\t\t\treturn events;\n\t\t}\n\n\t\tbucket.suppressed++;\n\t\tbucket.firstSuppressedAt ??= observedAt;\n\t\tbucket.lastSuppressedAt = observedAt;\n\t\tthis.scheduleSecurityBucketFlush(event.type, bucket);\n\t\treturn events;\n\t}\n\n\tprivate scheduleSecurityBucketFlush(eventType: string, bucket: SecurityAuditBucket): void {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tif (rateLimit === undefined || bucket.timer !== undefined) return;\n\t\tconst delayMs = Math.max(1, bucket.windowStartedAt + rateLimit.windowMs - this.now());\n\t\tbucket.timer = setTimeout(() => {\n\t\t\tvoid this.flushExpiredSecurityBucket(eventType).catch(() => {});\n\t\t}, delayMs);\n\t\tbucket.timer.unref?.();\n\t}\n\n\tprivate async flushExpiredSecurityBucket(eventType: string): Promise<void> {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tconst bucket = this.securityBuckets.get(eventType);\n\t\tif (rateLimit === undefined || bucket === undefined) return;\n\t\tbucket.timer = undefined;\n\t\tconst observedAt = this.now();\n\t\tif (observedAt - bucket.windowStartedAt < rateLimit.windowMs) {\n\t\t\tthis.scheduleSecurityBucketFlush(eventType, bucket);\n\t\t\treturn;\n\t\t}\n\t\tconst summary = this.createSuppressionSummary(eventType, bucket, observedAt);\n\t\tthis.securityBuckets.set(eventType, { windowStartedAt: observedAt, emitted: 0, suppressed: 0 });\n\t\tif (summary !== undefined) await this.enqueue(summary);\n\t}\n\n\tprivate createSuppressionSummary(\n\t\teventType: string,\n\t\tbucket: SecurityAuditBucket,\n\t\tobservedAt: number,\n\t): IrohRemoteAuditEvent | undefined {\n\t\tif (bucket.suppressed === 0) return undefined;\n\t\treturn {\n\t\t\ttype: \"security_events_rate_limited\",\n\t\t\ttimestamp: observedAt,\n\t\t\tsuccess: false,\n\t\t\tdetails: {\n\t\t\t\teventType,\n\t\t\t\tsampledCount: bucket.emitted,\n\t\t\t\tsuppressedCount: bucket.suppressed,\n\t\t\t\twindowStartedAt: bucket.windowStartedAt,\n\t\t\t\tfirstSuppressedAt: bucket.firstSuppressedAt,\n\t\t\t\tlastSuppressedAt: bucket.lastSuppressedAt,\n\t\t\t},\n\t\t};\n\t}\n\n\tprivate enqueue(event: IrohRemoteAuditEvent): Promise<void> {\n\t\tconst operation = this.writeQueue.then(() => this.write(event));\n\t\tthis.writeQueue = operation.catch(() => {});\n\t\treturn operation;\n\t}\n\n\tprivate async write(auditEvent: IrohRemoteAuditEvent): Promise<void> {\n\t\tif (this.sink) await this.sink.write(auditEvent);\n\t\tif (!this.path) return;\n\n\t\tconst line = this.serialize(auditEvent);\n\t\tawait this.ensurePrivateParent();\n\t\tconst existingSize = await this.inspectCurrentFile();\n\t\tif (existingSize > 0 && existingSize + Buffer.byteLength(line, \"utf8\") > this.maxFileBytes) {\n\t\t\tawait this.rotate();\n\t\t}\n\t\tawait this.appendPrivate(line);\n\t}\n\n\tprivate serialize(auditEvent: IrohRemoteAuditEvent): string {\n\t\tconst serialized = `${JSON.stringify(auditEvent)}\\n`;\n\t\tconst originalBytes = Buffer.byteLength(serialized, \"utf8\");\n\t\tif (originalBytes <= this.maxEntryBytes) return serialized;\n\t\treturn `${JSON.stringify({\n\t\t\ttype: \"audit_event_truncated\",\n\t\t\ttimestamp: auditEvent.timestamp,\n\t\t\tsuccess: false,\n\t\t\terror: \"audit event exceeded maximum serialized size\",\n\t\t\tdetails: { originalBytes, originalType: auditEvent.type.slice(0, 128) },\n\t\t} satisfies IrohRemoteAuditEvent)}\\n`;\n\t}\n\n\tprivate async ensurePrivateParent(): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tconst parentPath = dirname(this.path);\n\t\tawait mkdir(parentPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n\t\tconst parentStat = await lstat(parentPath);\n\t\tif (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {\n\t\t\tthrow new Error(`Refusing to use non-directory audit path: ${parentPath}`);\n\t\t}\n\t\tawait chmod(parentPath, PRIVATE_DIRECTORY_MODE);\n\t}\n\n\tprivate async inspectCurrentFile(): Promise<number> {\n\t\tif (this.path === undefined) return 0;\n\t\ttry {\n\t\t\tconst fileStat = await lstat(this.path);\n\t\t\tif (fileStat.isSymbolicLink() || !fileStat.isFile() || fileStat.nlink !== 1) {\n\t\t\t\tthrow new Error(`Refusing to use non-regular audit file: ${this.path}`);\n\t\t\t}\n\t\t\tawait chmod(this.path, PRIVATE_FILE_MODE);\n\t\t\treturn fileStat.size;\n\t\t} catch (error) {\n\t\t\tif (getErrorCode(error) === \"ENOENT\") return 0;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async rotate(): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tif (this.maxBackupFiles === 0) {\n\t\t\tawait rm(this.path, { force: true });\n\t\t\treturn;\n\t\t}\n\t\tawait rm(`${this.path}.${this.maxBackupFiles}`, { force: true });\n\t\tfor (let index = this.maxBackupFiles - 1; index >= 1; index--) {\n\t\t\tawait this.renameIfRegular(`${this.path}.${index}`, `${this.path}.${index + 1}`);\n\t\t}\n\t\tawait rename(this.path, `${this.path}.1`);\n\t}\n\n\tprivate async renameIfRegular(source: string, destination: string): Promise<void> {\n\t\ttry {\n\t\t\tconst sourceStat = await lstat(source);\n\t\t\tif (sourceStat.isSymbolicLink() || !sourceStat.isFile() || sourceStat.nlink !== 1) {\n\t\t\t\tawait rm(source, { force: true });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait chmod(source, PRIVATE_FILE_MODE);\n\t\t\tawait rm(destination, { force: true });\n\t\t\tawait rename(source, destination);\n\t\t} catch (error) {\n\t\t\tif (getErrorCode(error) !== \"ENOENT\") throw error;\n\t\t}\n\t}\n\n\tprivate async appendPrivate(line: string): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tconst noFollow = typeof constants.O_NOFOLLOW === \"number\" ? constants.O_NOFOLLOW : 0;\n\t\tconst handle = await open(\n\t\t\tthis.path,\n\t\t\tconstants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | noFollow,\n\t\t\tPRIVATE_FILE_MODE,\n\t\t);\n\t\ttry {\n\t\t\tconst fileStat = await handle.stat();\n\t\t\tif (!fileStat.isFile() || fileStat.nlink !== 1) {\n\t\t\t\tthrow new Error(`Refusing to use non-regular audit file: ${this.path}`);\n\t\t\t}\n\t\t\tawait handle.chmod(PRIVATE_FILE_MODE);\n\t\t\tawait handle.writeFile(line, \"utf8\");\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n}\n"]}

package/dist/core/remote/iroh/authorization.d.ts

@@ -0,0 +1,46 @@
+import { type IrohRemoteRpcGrant } from "./access-grant.ts";
+import type { IrohRemoteHello } from "./handshake.ts";
+import { type IrohRemoteHostHandshakeFailureOutcome } from "./protocol.ts";
+import type { IrohRemoteClient, IrohRemoteGrantedClient, IrohRemoteHostState, IrohRemotePendingPairingTicket, IrohRemoteRevokedClient, IrohRemoteWorkspace } from "./state.ts";
+import type { IrohRemoteWorkspaceAvailabilityClassifier, IrohRemoteWorkspaceStatus } from "./workspace.ts";
+export declare const DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS: number;
+export declare const DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS: number;
+export interface AuthorizeIrohRemoteClientOptions {
+    allowTools: string;
+    rpcGrant?: IrohRemoteRpcGrant;
+    classifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;
+    pairingExpiresAt?: number;
+    pairingSecret?: string;
+    validateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;
+    workspace?: IrohRemoteWorkspace;
+    workspaceStatuses?: readonly IrohRemoteWorkspaceStatus[];
+    now?: number;
+}
+export interface IrohRemoteClientAuthorizationSuccess {
+    ok: true;
+    allowTools: string;
+    client: IrohRemoteGrantedClient;
+    consumedPairingTicket?: IrohRemotePendingPairingTicket;
+    expiredPairingTickets?: IrohRemotePendingPairingTicket[];
+    paired: boolean;
+    pairingSecretConsumed: boolean;
+    workspace: IrohRemoteWorkspace;
+    workspaceNames: string[];
+    workspaces: IrohRemoteWorkspaceStatus[];
+}
+export interface IrohRemoteClientAuthorizationFailure {
+    ok: false;
+    client?: IrohRemoteClient;
+    error: string;
+    expiredPairingTickets?: IrohRemotePendingPairingTicket[];
+    outcome: IrohRemoteHostHandshakeFailureOutcome;
+    pairingSecretExpired: boolean;
+    workspace?: IrohRemoteWorkspace;
+}
+export type IrohRemoteClientAuthorizationResult = IrohRemoteClientAuthorizationSuccess | IrohRemoteClientAuthorizationFailure;
+export declare function authorizeIrohRemoteClient(state: IrohRemoteHostState, hello: IrohRemoteHello, remoteNodeId: string, options: AuthorizeIrohRemoteClientOptions): IrohRemoteClientAuthorizationResult;
+export declare function findIrohRemoteClient(state: IrohRemoteHostState, nodeId: string): IrohRemoteClient | undefined;
+export declare function findIrohRemoteRevokedClient(state: IrohRemoteHostState, nodeId: string): IrohRemoteRevokedClient | undefined;
+export declare function isIrohRemoteClientAllowedForWorkspace(client: IrohRemoteClient, workspaceName: string): boolean;
+export declare function hashIrohRemotePairingSecret(secret: string): string;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/core/remote/iroh/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,KAAK,kBAAkB,EAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAEN,KAAK,qCAAqC,EAE1C,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACX,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EAEnB,8BAA8B,EAC9B,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,yCAAyC,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3G,eAAO,MAAM,yDAAyD,QAA2B,CAAC;AAQlG,eAAO,MAAM,2CAA2C,QAAiB,CAAC;AAE1E,MAAM,WAAW,gCAAgC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6BAA6B,CAAC,EAAE,yCAAyC,CAAC;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,mBAAmB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,iBAAiB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oCAAoC;IACpD,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,uBAAuB,CAAC;IAChC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;IACvD,qBAAqB,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACzD,MAAM,EAAE,OAAO,CAAC;IAChB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,oCAAoC;IACpD,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACzD,OAAO,EAAE,qCAAqC,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,MAAM,MAAM,mCAAmC,GAC5C,oCAAoC,GACpC,oCAAoC,CAAC;AAExC,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gCAAgC,GACvC,mCAAmC,CA4QrC;AAYD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAE7G;AAED,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,MAAM,GACZ,uBAAuB,GAAG,SAAS,CAErC;AAED,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAE9G;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE","sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n\tcloneIrohRemoteRpcGrant,\n\tcreateIrohRemotePresetAccess,\n\ttype IrohRemoteRpcGrant,\n\tparseIrohRemoteRpcGrant,\n} from \"./access-grant.ts\";\nimport type { IrohRemoteHello } from \"./handshake.ts\";\nimport {\n\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\ttype IrohRemoteHostHandshakeFailureOutcome,\n\tnormalizeIrohRemoteAllowTools,\n} from \"./protocol.ts\";\nimport type {\n\tIrohRemoteClient,\n\tIrohRemoteGrantedClient,\n\tIrohRemoteHostState,\n\tIrohRemotePairingSecretTombstone,\n\tIrohRemotePendingPairingTicket,\n\tIrohRemoteRevokedClient,\n\tIrohRemoteWorkspace,\n} from \"./state.ts\";\nimport type { IrohRemoteWorkspaceAvailabilityClassifier, IrohRemoteWorkspaceStatus } from \"./workspace.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;\n\n// A re-pair approval for a revoked client is a standing grant to consume a\n// pairing secret again. Bound it so a stale, unused approval cannot silently\n// hijack an unrelated pairing ticket minted much later for a different device;\n// the approval is otherwise cleared only when the revoked client actually\n// re-pairs. The window comfortably covers a deliberate approve -> mint ticket\n// -> scan operator flow.\nexport const DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS = 30 * 60 * 1000;\n\nexport interface AuthorizeIrohRemoteClientOptions {\n\tallowTools: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tclassifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;\n\tpairingExpiresAt?: number;\n\tpairingSecret?: string;\n\tvalidateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;\n\tworkspace?: IrohRemoteWorkspace;\n\tworkspaceStatuses?: readonly IrohRemoteWorkspaceStatus[];\n\tnow?: number;\n}\n\nexport interface IrohRemoteClientAuthorizationSuccess {\n\tok: true;\n\tallowTools: string;\n\tclient: IrohRemoteGrantedClient;\n\tconsumedPairingTicket?: IrohRemotePendingPairingTicket;\n\texpiredPairingTickets?: IrohRemotePendingPairingTicket[];\n\tpaired: boolean;\n\tpairingSecretConsumed: boolean;\n\tworkspace: IrohRemoteWorkspace;\n\tworkspaceNames: string[];\n\tworkspaces: IrohRemoteWorkspaceStatus[];\n}\n\nexport interface IrohRemoteClientAuthorizationFailure {\n\tok: false;\n\tclient?: IrohRemoteClient;\n\terror: string;\n\texpiredPairingTickets?: IrohRemotePendingPairingTicket[];\n\toutcome: IrohRemoteHostHandshakeFailureOutcome;\n\tpairingSecretExpired: boolean;\n\tworkspace?: IrohRemoteWorkspace;\n}\n\nexport type IrohRemoteClientAuthorizationResult =\n\t| IrohRemoteClientAuthorizationSuccess\n\t| IrohRemoteClientAuthorizationFailure;\n\nexport function authorizeIrohRemoteClient(\n\tstate: IrohRemoteHostState,\n\thello: IrohRemoteHello,\n\tremoteNodeId: string,\n\toptions: AuthorizeIrohRemoteClientOptions,\n): IrohRemoteClientAuthorizationResult {\n\tconst workspace = options.workspace?.name === hello.workspace ? options.workspace : undefined;\n\tconst registeredWorkspace =\n\t\tstate.workspaces.find((entry) => entry.name === hello.workspace) ??\n\t\t(options.workspace?.name === hello.workspace ? options.workspace : undefined);\n\tconst workspaceName = registeredWorkspace?.name ?? options.workspace?.name ?? hello.workspace;\n\tconst workspaces = getIrohRemoteWorkspaceStatuses(state, options.workspaceStatuses);\n\tconst workspaceNames = workspaces.filter((entry) => entry.status === \"available\").map((entry) => entry.name);\n\tconst now = options.now ?? Date.now();\n\tconst revokedClient = findIrohRemoteRevokedClient(state, remoteNodeId);\n\tconst existingClient = revokedClient ? undefined : findIrohRemoteClient(state, remoteNodeId);\n\tconst pairingSecretHash = hello.secret ? hashIrohRemotePairingSecret(hello.secret) : undefined;\n\tconst expiredPairingTickets = pruneExpiredPendingPairingTickets(state, now);\n\tconst matchingExpiredPairingTicket = pairingSecretHash\n\t\t? expiredPairingTickets.find((ticket) => ticket.secretHash === pairingSecretHash)\n\t\t: undefined;\n\tconst matchingPendingPairingTicket = pairingSecretHash\n\t\t? getPendingPairingTickets(state).find((ticket) => ticket.secretHash === pairingSecretHash)\n\t\t: undefined;\n\tconst matchingRuntimePairingSecret =\n\t\toptions.pairingSecret !== undefined && hello.secret === options.pairingSecret ? options.pairingSecret : undefined;\n\tconst hasPairingSecret = matchingRuntimePairingSecret !== undefined || matchingPendingPairingTicket !== undefined;\n\tconst pairingSecretTombstones = prunePairingSecretTombstones(state, now);\n\tconst matchingConsumedPairingSecret = pairingSecretHash\n\t\t? pairingSecretTombstones.find(\n\t\t\t\t(tombstone) =>\n\t\t\t\t\ttombstone.secretHash === pairingSecretHash && tombstone.outcome === \"pairing_secret_consumed\",\n\t\t\t)\n\t\t: undefined;\n\tconst matchingExpiredPairingSecret = pairingSecretHash\n\t\t? pairingSecretTombstones.find(\n\t\t\t\t(tombstone) => tombstone.secretHash === pairingSecretHash && tombstone.outcome === \"pairing_secret_expired\",\n\t\t\t)\n\t\t: undefined;\n\tconst runtimePairingSecretExpired =\n\t\tmatchingRuntimePairingSecret !== undefined &&\n\t\toptions.pairingExpiresAt !== undefined &&\n\t\tnow > options.pairingExpiresAt;\n\tconst pairingSecretExpired =\n\t\truntimePairingSecretExpired ||\n\t\tmatchingExpiredPairingTicket !== undefined ||\n\t\tmatchingExpiredPairingSecret !== undefined;\n\tconst expiredResultTickets = expiredPairingTickets.length > 0 ? expiredPairingTickets : undefined;\n\tconst rePairApprovalActive =\n\t\trevokedClient?.rePairApprovedAt !== undefined &&\n\t\t// Fail closed on a future timestamp (host clock moved back, or state carried\n\t\t// across a clock change): without the lower bound a negative delta always\n\t\t// satisfies the TTL and keeps a revoked client's re-pair approval alive\n\t\t// indefinitely.\n\t\tnow >= revokedClient.rePairApprovedAt &&\n\t\tnow - revokedClient.rePairApprovedAt <= DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS;\n\ttry {\n\t\tif (revokedClient) parseIrohRemoteRpcGrant(revokedClient.rpcGrant, \"revoked client rpcGrant\");\n\t\tif (existingClient) assertGrantedClient(existingClient);\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client RPC grant is missing or malformed\",\n\t\t\toutcome: revokedClient ? \"client_revoked\" : \"client_unknown\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\tconst hasActivePairingSecretForRevokedClient =\n\t\trePairApprovalActive &&\n\t\thasPairingSecret &&\n\t\t!pairingSecretExpired &&\n\t\tmatchingConsumedPairingSecret === undefined &&\n\t\tmatchingExpiredPairingSecret === undefined;\n\n\tif (revokedClient && !hasActivePairingSecretForRevokedClient) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client is revoked\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"client_revoked\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient && pairingSecretExpired) {\n\t\tif (runtimePairingSecretExpired && pairingSecretHash) {\n\t\t\tupsertPairingSecretTombstone(state, {\n\t\t\t\tsecretHash: pairingSecretHash,\n\t\t\t\tworkspace: workspaceName,\n\t\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\t\texpiresAt: options.pairingExpiresAt,\n\t\t\t\texpiredAt: now,\n\t\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, options.pairingExpiresAt),\n\t\t\t});\n\t\t}\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"pairing ticket has expired\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\tpairingSecretExpired: true,\n\t\t};\n\t}\n\n\tif (!registeredWorkspace) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `workspace is not registered: ${hello.workspace}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_unregistered\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!workspace) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `workspace path is unavailable: ${hello.workspace}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_unavailable\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (existingClient && !isIrohRemoteClientAllowedForWorkspace(existingClient, workspace.name)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tclient: existingClient,\n\t\t\terror: `workspace authorization has been removed: ${workspace.name}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_authorization_removed\",\n\t\t\tpairingSecretExpired: false,\n\t\t\tworkspace,\n\t\t};\n\t}\n\n\tif (!existingClient && matchingConsumedPairingSecret) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"pairing ticket has already been used\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"pairing_secret_consumed\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient && !hasPairingSecret) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client is not paired\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"client_unknown\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient) {\n\t\tif (!pairingSecretHash) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: \"client is not paired\",\n\t\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\t\toutcome: \"client_unknown\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tif (matchingPendingPairingTicket && matchingPendingPairingTicket.workspace !== workspace.name) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: `pairing ticket is not valid for workspace: ${workspace.name}`,\n\t\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\t\toutcome: \"workspace_authorization_removed\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tconst allowedTools = normalizeIrohRemoteAllowTools(\n\t\t\tmatchingPendingPairingTicket?.allowedTools ?? options.allowTools,\n\t\t);\n\t\tlet rpcGrant: IrohRemoteRpcGrant;\n\t\ttry {\n\t\t\tconst selectedGrant = parseIrohRemoteRpcGrant(\n\t\t\t\tmatchingPendingPairingTicket?.rpcGrant ??\n\t\t\t\t\toptions.rpcGrant ??\n\t\t\t\t\tcreateIrohRemotePresetAccess(\"coding\").rpcGrant,\n\t\t\t);\n\t\t\tconst revokedRevision =\n\t\t\t\trevokedClient === undefined\n\t\t\t\t\t? 0\n\t\t\t\t\t: parseIrohRemoteRpcGrant(revokedClient.rpcGrant, \"revoked client rpcGrant\").revision;\n\t\t\tif (revokedRevision === Number.MAX_SAFE_INTEGER) {\n\t\t\t\tthrow new Error(\"revoked client RPC grant revision is exhausted\");\n\t\t\t}\n\t\t\trpcGrant = {\n\t\t\t\t...cloneIrohRemoteRpcGrant(selectedGrant),\n\t\t\t\trevision: Math.max(selectedGrant.revision, revokedRevision + 1),\n\t\t\t};\n\t\t} catch {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: \"pairing ticket RPC grant is missing or malformed\",\n\t\t\t\toutcome: \"client_unknown\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tconst allowedWorkspace = matchingPendingPairingTicket?.workspace ?? workspace.name;\n\t\tconst ticketExpiresAt = matchingPendingPairingTicket?.expiresAt ?? options.pairingExpiresAt;\n\t\tconst client: IrohRemoteGrantedClient = {\n\t\t\tnodeId: remoteNodeId,\n\t\t\tlabel: hello.clientLabel || matchingPendingPairingTicket?.labelHint || remoteNodeId.slice(0, 12),\n\t\t\tallowedWorkspaces: [],\n\t\t\tallowedTools,\n\t\t\trpcGrant,\n\t\t\tpairedAt: now,\n\t\t\tlastSeenAt: now,\n\t\t};\n\t\tupsertPairingSecretTombstone(state, {\n\t\t\tsecretHash: pairingSecretHash,\n\t\t\tworkspace: allowedWorkspace,\n\t\t\toutcome: \"pairing_secret_consumed\",\n\t\t\tconsumedAt: now,\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\t...(matchingPendingPairingTicket?.createdAt === undefined\n\t\t\t\t? {}\n\t\t\t\t: { createdAt: matchingPendingPairingTicket.createdAt }),\n\t\t\t...(ticketExpiresAt === undefined ? {} : { expiresAt: ticketExpiresAt }),\n\t\t\t...(matchingPendingPairingTicket?.labelHint === undefined\n\t\t\t\t? {}\n\t\t\t\t: { labelHint: matchingPendingPairingTicket.labelHint }),\n\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, ticketExpiresAt),\n\t\t});\n\t\tif (matchingPendingPairingTicket) {\n\t\t\tstate.pendingPairingTickets = getPendingPairingTickets(state).filter(\n\t\t\t\t(ticket) => ticket.secretHash !== matchingPendingPairingTicket.secretHash,\n\t\t\t);\n\t\t}\n\t\tif (revokedClient) {\n\t\t\tstate.revokedClients = getRevokedClients(state).filter((client) => client.nodeId !== remoteNodeId);\n\t\t\tstate.clients = state.clients.filter((entry) => entry.nodeId !== remoteNodeId);\n\t\t}\n\t\tstate.clients.push(client);\n\t\treturn {\n\t\t\tok: true,\n\t\t\tallowTools: allowedTools,\n\t\t\tclient,\n\t\t\t...(matchingPendingPairingTicket ? { consumedPairingTicket: matchingPendingPairingTicket } : {}),\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\tpaired: true,\n\t\t\tpairingSecretConsumed: true,\n\t\t\tworkspace,\n\t\t\tworkspaceNames,\n\t\t\tworkspaces,\n\t\t};\n\t}\n\n\tconst persistedAllowedTools = normalizeIrohRemoteAllowTools(\n\t\texistingClient.allowedTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t);\n\texistingClient.lastSeenAt = now;\n\texistingClient.allowedTools = persistedAllowedTools;\n\tif (hello.clientLabel) {\n\t\texistingClient.label = hello.clientLabel;\n\t}\n\treturn {\n\t\tok: true,\n\t\tallowTools: persistedAllowedTools,\n\t\tclient: existingClient,\n\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\tpaired: false,\n\t\tpairingSecretConsumed: false,\n\t\tworkspace,\n\t\tworkspaceNames,\n\t\tworkspaces,\n\t};\n}\n\nfunction getIrohRemoteWorkspaceStatuses(\n\tstate: IrohRemoteHostState,\n\tworkspaceStatuses: readonly IrohRemoteWorkspaceStatus[] | undefined,\n): IrohRemoteWorkspaceStatus[] {\n\treturn state.workspaces.map((workspace) => ({\n\t\tname: workspace.name,\n\t\tstatus: workspaceStatuses?.find((entry) => entry.name === workspace.name)?.status ?? \"available\",\n\t}));\n}\n\nexport function findIrohRemoteClient(state: IrohRemoteHostState, nodeId: string): IrohRemoteClient | undefined {\n\treturn state.clients.find((client) => client.nodeId === nodeId);\n}\n\nexport function findIrohRemoteRevokedClient(\n\tstate: IrohRemoteHostState,\n\tnodeId: string,\n): IrohRemoteRevokedClient | undefined {\n\treturn getRevokedClients(state).find((client) => client.nodeId === nodeId);\n}\n\nexport function isIrohRemoteClientAllowedForWorkspace(client: IrohRemoteClient, workspaceName: string): boolean {\n\treturn client.allowedWorkspaces.length === 0 || client.allowedWorkspaces.includes(workspaceName);\n}\n\nexport function hashIrohRemotePairingSecret(secret: string): string {\n\treturn `sha256:${createHash(\"sha256\").update(secret, \"utf8\").digest(\"base64url\")}`;\n}\n\nfunction assertGrantedClient(client: IrohRemoteClient): asserts client is IrohRemoteGrantedClient {\n\tclient.rpcGrant = parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\");\n}\n\nfunction getPendingPairingTickets(state: IrohRemoteHostState): IrohRemotePendingPairingTicket[] {\n\tstate.pendingPairingTickets ??= [];\n\treturn state.pendingPairingTickets;\n}\n\nfunction getPairingSecretTombstones(state: IrohRemoteHostState): IrohRemotePairingSecretTombstone[] {\n\tstate.pairingSecretTombstones ??= [];\n\treturn state.pairingSecretTombstones;\n}\n\nfunction getRevokedClients(state: IrohRemoteHostState): IrohRemoteRevokedClient[] {\n\tstate.revokedClients ??= [];\n\treturn state.revokedClients;\n}\n\nfunction getPairingSecretTombstoneRetainUntil(terminalAt: number, expiresAt: number | undefined): number {\n\treturn Math.max(terminalAt + DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS, expiresAt ?? terminalAt);\n}\n\nfunction prunePairingSecretTombstones(state: IrohRemoteHostState, now: number): IrohRemotePairingSecretTombstone[] {\n\tconst tombstones = getPairingSecretTombstones(state);\n\tconst retainedTombstones = tombstones.filter((tombstone) => now <= tombstone.retainUntil);\n\tif (retainedTombstones.length !== tombstones.length) {\n\t\tstate.pairingSecretTombstones = retainedTombstones;\n\t}\n\treturn retainedTombstones;\n}\n\nfunction upsertPairingSecretTombstone(state: IrohRemoteHostState, tombstone: IrohRemotePairingSecretTombstone): void {\n\tconst tombstones = getPairingSecretTombstones(state);\n\tstate.pairingSecretTombstones = [\n\t\t...tombstones.filter((entry) => entry.secretHash !== tombstone.secretHash),\n\t\ttombstone,\n\t];\n}\n\nfunction pruneExpiredPendingPairingTickets(state: IrohRemoteHostState, now: number): IrohRemotePendingPairingTicket[] {\n\tconst pendingPairingTickets = getPendingPairingTickets(state);\n\tconst expiredPairingTickets = pendingPairingTickets.filter((ticket) => now > ticket.expiresAt);\n\tif (expiredPairingTickets.length > 0) {\n\t\tstate.pendingPairingTickets = pendingPairingTickets.filter((ticket) => now <= ticket.expiresAt);\n\t\tfor (const ticket of expiredPairingTickets) {\n\t\t\tupsertPairingSecretTombstone(state, {\n\t\t\t\tsecretHash: ticket.secretHash,\n\t\t\t\tworkspace: ticket.workspace,\n\t\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\t\tcreatedAt: ticket.createdAt,\n\t\t\t\texpiresAt: ticket.expiresAt,\n\t\t\t\texpiredAt: now,\n\t\t\t\t...(ticket.labelHint === undefined ? {} : { labelHint: ticket.labelHint }),\n\t\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, ticket.expiresAt),\n\t\t\t});\n\t\t}\n\t}\n\treturn expiredPairingTickets;\n}\n"]}