@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/authorization.js

@@ -0,0 +1,327 @@
+import { createHash } from "node:crypto";
+import { cloneIrohRemoteRpcGrant, createIrohRemotePresetAccess, parseIrohRemoteRpcGrant, } from "./access-grant.js";
+import { DEFAULT_IROH_REMOTE_ALLOW_TOOLS, normalizeIrohRemoteAllowTools, } from "./protocol.js";
+export const DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+// A re-pair approval for a revoked client is a standing grant to consume a
+// pairing secret again. Bound it so a stale, unused approval cannot silently
+// hijack an unrelated pairing ticket minted much later for a different device;
+// the approval is otherwise cleared only when the revoked client actually
+// re-pairs. The window comfortably covers a deliberate approve -> mint ticket
+// -> scan operator flow.
+export const DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS = 30 * 60 * 1000;
+export function authorizeIrohRemoteClient(state, hello, remoteNodeId, options) {
+    const workspace = options.workspace?.name === hello.workspace ? options.workspace : undefined;
+    const registeredWorkspace = state.workspaces.find((entry) => entry.name === hello.workspace) ??
+        (options.workspace?.name === hello.workspace ? options.workspace : undefined);
+    const workspaceName = registeredWorkspace?.name ?? options.workspace?.name ?? hello.workspace;
+    const workspaces = getIrohRemoteWorkspaceStatuses(state, options.workspaceStatuses);
+    const workspaceNames = workspaces.filter((entry) => entry.status === "available").map((entry) => entry.name);
+    const now = options.now ?? Date.now();
+    const revokedClient = findIrohRemoteRevokedClient(state, remoteNodeId);
+    const existingClient = revokedClient ? undefined : findIrohRemoteClient(state, remoteNodeId);
+    const pairingSecretHash = hello.secret ? hashIrohRemotePairingSecret(hello.secret) : undefined;
+    const expiredPairingTickets = pruneExpiredPendingPairingTickets(state, now);
+    const matchingExpiredPairingTicket = pairingSecretHash
+        ? expiredPairingTickets.find((ticket) => ticket.secretHash === pairingSecretHash)
+        : undefined;
+    const matchingPendingPairingTicket = pairingSecretHash
+        ? getPendingPairingTickets(state).find((ticket) => ticket.secretHash === pairingSecretHash)
+        : undefined;
+    const matchingRuntimePairingSecret = options.pairingSecret !== undefined && hello.secret === options.pairingSecret ? options.pairingSecret : undefined;
+    const hasPairingSecret = matchingRuntimePairingSecret !== undefined || matchingPendingPairingTicket !== undefined;
+    const pairingSecretTombstones = prunePairingSecretTombstones(state, now);
+    const matchingConsumedPairingSecret = pairingSecretHash
+        ? pairingSecretTombstones.find((tombstone) => tombstone.secretHash === pairingSecretHash && tombstone.outcome === "pairing_secret_consumed")
+        : undefined;
+    const matchingExpiredPairingSecret = pairingSecretHash
+        ? pairingSecretTombstones.find((tombstone) => tombstone.secretHash === pairingSecretHash && tombstone.outcome === "pairing_secret_expired")
+        : undefined;
+    const runtimePairingSecretExpired = matchingRuntimePairingSecret !== undefined &&
+        options.pairingExpiresAt !== undefined &&
+        now > options.pairingExpiresAt;
+    const pairingSecretExpired = runtimePairingSecretExpired ||
+        matchingExpiredPairingTicket !== undefined ||
+        matchingExpiredPairingSecret !== undefined;
+    const expiredResultTickets = expiredPairingTickets.length > 0 ? expiredPairingTickets : undefined;
+    const rePairApprovalActive = revokedClient?.rePairApprovedAt !== undefined &&
+        // Fail closed on a future timestamp (host clock moved back, or state carried
+        // across a clock change): without the lower bound a negative delta always
+        // satisfies the TTL and keeps a revoked client's re-pair approval alive
+        // indefinitely.
+        now >= revokedClient.rePairApprovedAt &&
+        now - revokedClient.rePairApprovedAt <= DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS;
+    try {
+        if (revokedClient)
+            parseIrohRemoteRpcGrant(revokedClient.rpcGrant, "revoked client rpcGrant");
+        if (existingClient)
+            assertGrantedClient(existingClient);
+    }
+    catch {
+        return {
+            ok: false,
+            error: "client RPC grant is missing or malformed",
+            outcome: revokedClient ? "client_revoked" : "client_unknown",
+            pairingSecretExpired: false,
+        };
+    }
+    const hasActivePairingSecretForRevokedClient = rePairApprovalActive &&
+        hasPairingSecret &&
+        !pairingSecretExpired &&
+        matchingConsumedPairingSecret === undefined &&
+        matchingExpiredPairingSecret === undefined;
+    if (revokedClient && !hasActivePairingSecretForRevokedClient) {
+        return {
+            ok: false,
+            error: "client is revoked",
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "client_revoked",
+            pairingSecretExpired: false,
+        };
+    }
+    if (!existingClient && pairingSecretExpired) {
+        if (runtimePairingSecretExpired && pairingSecretHash) {
+            upsertPairingSecretTombstone(state, {
+                secretHash: pairingSecretHash,
+                workspace: workspaceName,
+                outcome: "pairing_secret_expired",
+                expiresAt: options.pairingExpiresAt,
+                expiredAt: now,
+                retainUntil: getPairingSecretTombstoneRetainUntil(now, options.pairingExpiresAt),
+            });
+        }
+        return {
+            ok: false,
+            error: "pairing ticket has expired",
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "pairing_secret_expired",
+            pairingSecretExpired: true,
+        };
+    }
+    if (!registeredWorkspace) {
+        return {
+            ok: false,
+            error: `workspace is not registered: ${hello.workspace}`,
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "workspace_unregistered",
+            pairingSecretExpired: false,
+        };
+    }
+    if (!workspace) {
+        return {
+            ok: false,
+            error: `workspace path is unavailable: ${hello.workspace}`,
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "workspace_unavailable",
+            pairingSecretExpired: false,
+        };
+    }
+    if (existingClient && !isIrohRemoteClientAllowedForWorkspace(existingClient, workspace.name)) {
+        return {
+            ok: false,
+            client: existingClient,
+            error: `workspace authorization has been removed: ${workspace.name}`,
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "workspace_authorization_removed",
+            pairingSecretExpired: false,
+            workspace,
+        };
+    }
+    if (!existingClient && matchingConsumedPairingSecret) {
+        return {
+            ok: false,
+            error: "pairing ticket has already been used",
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "pairing_secret_consumed",
+            pairingSecretExpired: false,
+        };
+    }
+    if (!existingClient && !hasPairingSecret) {
+        return {
+            ok: false,
+            error: "client is not paired",
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            outcome: "client_unknown",
+            pairingSecretExpired: false,
+        };
+    }
+    if (!existingClient) {
+        if (!pairingSecretHash) {
+            return {
+                ok: false,
+                error: "client is not paired",
+                ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+                outcome: "client_unknown",
+                pairingSecretExpired: false,
+            };
+        }
+        if (matchingPendingPairingTicket && matchingPendingPairingTicket.workspace !== workspace.name) {
+            return {
+                ok: false,
+                error: `pairing ticket is not valid for workspace: ${workspace.name}`,
+                ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+                outcome: "workspace_authorization_removed",
+                pairingSecretExpired: false,
+            };
+        }
+        const allowedTools = normalizeIrohRemoteAllowTools(matchingPendingPairingTicket?.allowedTools ?? options.allowTools);
+        let rpcGrant;
+        try {
+            const selectedGrant = parseIrohRemoteRpcGrant(matchingPendingPairingTicket?.rpcGrant ??
+                options.rpcGrant ??
+                createIrohRemotePresetAccess("coding").rpcGrant);
+            const revokedRevision = revokedClient === undefined
+                ? 0
+                : parseIrohRemoteRpcGrant(revokedClient.rpcGrant, "revoked client rpcGrant").revision;
+            if (revokedRevision === Number.MAX_SAFE_INTEGER) {
+                throw new Error("revoked client RPC grant revision is exhausted");
+            }
+            rpcGrant = {
+                ...cloneIrohRemoteRpcGrant(selectedGrant),
+                revision: Math.max(selectedGrant.revision, revokedRevision + 1),
+            };
+        }
+        catch {
+            return {
+                ok: false,
+                error: "pairing ticket RPC grant is missing or malformed",
+                outcome: "client_unknown",
+                pairingSecretExpired: false,
+            };
+        }
+        const allowedWorkspace = matchingPendingPairingTicket?.workspace ?? workspace.name;
+        const ticketExpiresAt = matchingPendingPairingTicket?.expiresAt ?? options.pairingExpiresAt;
+        const client = {
+            nodeId: remoteNodeId,
+            label: hello.clientLabel || matchingPendingPairingTicket?.labelHint || remoteNodeId.slice(0, 12),
+            allowedWorkspaces: [],
+            allowedTools,
+            rpcGrant,
+            pairedAt: now,
+            lastSeenAt: now,
+        };
+        upsertPairingSecretTombstone(state, {
+            secretHash: pairingSecretHash,
+            workspace: allowedWorkspace,
+            outcome: "pairing_secret_consumed",
+            consumedAt: now,
+            clientNodeId: remoteNodeId,
+            ...(matchingPendingPairingTicket?.createdAt === undefined
+                ? {}
+                : { createdAt: matchingPendingPairingTicket.createdAt }),
+            ...(ticketExpiresAt === undefined ? {} : { expiresAt: ticketExpiresAt }),
+            ...(matchingPendingPairingTicket?.labelHint === undefined
+                ? {}
+                : { labelHint: matchingPendingPairingTicket.labelHint }),
+            retainUntil: getPairingSecretTombstoneRetainUntil(now, ticketExpiresAt),
+        });
+        if (matchingPendingPairingTicket) {
+            state.pendingPairingTickets = getPendingPairingTickets(state).filter((ticket) => ticket.secretHash !== matchingPendingPairingTicket.secretHash);
+        }
+        if (revokedClient) {
+            state.revokedClients = getRevokedClients(state).filter((client) => client.nodeId !== remoteNodeId);
+            state.clients = state.clients.filter((entry) => entry.nodeId !== remoteNodeId);
+        }
+        state.clients.push(client);
+        return {
+            ok: true,
+            allowTools: allowedTools,
+            client,
+            ...(matchingPendingPairingTicket ? { consumedPairingTicket: matchingPendingPairingTicket } : {}),
+            ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+            paired: true,
+            pairingSecretConsumed: true,
+            workspace,
+            workspaceNames,
+            workspaces,
+        };
+    }
+    const persistedAllowedTools = normalizeIrohRemoteAllowTools(existingClient.allowedTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS);
+    existingClient.lastSeenAt = now;
+    existingClient.allowedTools = persistedAllowedTools;
+    if (hello.clientLabel) {
+        existingClient.label = hello.clientLabel;
+    }
+    return {
+        ok: true,
+        allowTools: persistedAllowedTools,
+        client: existingClient,
+        ...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),
+        paired: false,
+        pairingSecretConsumed: false,
+        workspace,
+        workspaceNames,
+        workspaces,
+    };
+}
+function getIrohRemoteWorkspaceStatuses(state, workspaceStatuses) {
+    return state.workspaces.map((workspace) => ({
+        name: workspace.name,
+        status: workspaceStatuses?.find((entry) => entry.name === workspace.name)?.status ?? "available",
+    }));
+}
+export function findIrohRemoteClient(state, nodeId) {
+    return state.clients.find((client) => client.nodeId === nodeId);
+}
+export function findIrohRemoteRevokedClient(state, nodeId) {
+    return getRevokedClients(state).find((client) => client.nodeId === nodeId);
+}
+export function isIrohRemoteClientAllowedForWorkspace(client, workspaceName) {
+    return client.allowedWorkspaces.length === 0 || client.allowedWorkspaces.includes(workspaceName);
+}
+export function hashIrohRemotePairingSecret(secret) {
+    return `sha256:${createHash("sha256").update(secret, "utf8").digest("base64url")}`;
+}
+function assertGrantedClient(client) {
+    client.rpcGrant = parseIrohRemoteRpcGrant(client.rpcGrant, "client rpcGrant");
+}
+function getPendingPairingTickets(state) {
+    state.pendingPairingTickets ??= [];
+    return state.pendingPairingTickets;
+}
+function getPairingSecretTombstones(state) {
+    state.pairingSecretTombstones ??= [];
+    return state.pairingSecretTombstones;
+}
+function getRevokedClients(state) {
+    state.revokedClients ??= [];
+    return state.revokedClients;
+}
+function getPairingSecretTombstoneRetainUntil(terminalAt, expiresAt) {
+    return Math.max(terminalAt + DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS, expiresAt ?? terminalAt);
+}
+function prunePairingSecretTombstones(state, now) {
+    const tombstones = getPairingSecretTombstones(state);
+    const retainedTombstones = tombstones.filter((tombstone) => now <= tombstone.retainUntil);
+    if (retainedTombstones.length !== tombstones.length) {
+        state.pairingSecretTombstones = retainedTombstones;
+    }
+    return retainedTombstones;
+}
+function upsertPairingSecretTombstone(state, tombstone) {
+    const tombstones = getPairingSecretTombstones(state);
+    state.pairingSecretTombstones = [
+        ...tombstones.filter((entry) => entry.secretHash !== tombstone.secretHash),
+        tombstone,
+    ];
+}
+function pruneExpiredPendingPairingTickets(state, now) {
+    const pendingPairingTickets = getPendingPairingTickets(state);
+    const expiredPairingTickets = pendingPairingTickets.filter((ticket) => now > ticket.expiresAt);
+    if (expiredPairingTickets.length > 0) {
+        state.pendingPairingTickets = pendingPairingTickets.filter((ticket) => now <= ticket.expiresAt);
+        for (const ticket of expiredPairingTickets) {
+            upsertPairingSecretTombstone(state, {
+                secretHash: ticket.secretHash,
+                workspace: ticket.workspace,
+                outcome: "pairing_secret_expired",
+                createdAt: ticket.createdAt,
+                expiresAt: ticket.expiresAt,
+                expiredAt: now,
+                ...(ticket.labelHint === undefined ? {} : { labelHint: ticket.labelHint }),
+                retainUntil: getPairingSecretTombstoneRetainUntil(now, ticket.expiresAt),
+            });
+        }
+    }
+    return expiredPairingTickets;
+}
+//# sourceMappingURL=authorization.js.map

package/dist/core/remote/iroh/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAE5B,uBAAuB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,+BAA+B,EAE/B,6BAA6B,GAC7B,MAAM,eAAe,CAAC;AAYvB,MAAM,CAAC,MAAM,yDAAyD,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElG,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,8EAA8E;AAC9E,yBAAyB;AACzB,MAAM,CAAC,MAAM,2CAA2C,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAyC1E,MAAM,UAAU,yBAAyB,CACxC,KAA0B,EAC1B,KAAsB,EACtB,YAAoB,EACpB,OAAyC,EACH;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,mBAAmB,GACxB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC;QAChE,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,mBAAmB,EAAE,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC;IAC9F,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,qBAAqB,GAAG,iCAAiC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5E,MAAM,4BAA4B,GAAG,iBAAiB;QACrD,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;QACjF,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,4BAA4B,GAAG,iBAAiB;QACrD,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;QAC3F,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,4BAA4B,GACjC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,MAAM,gBAAgB,GAAG,4BAA4B,KAAK,SAAS,IAAI,4BAA4B,KAAK,SAAS,CAAC;IAClH,MAAM,uBAAuB,GAAG,4BAA4B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,6BAA6B,GAAG,iBAAiB;QACtD,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAC5B,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,UAAU,KAAK,iBAAiB,IAAI,SAAS,CAAC,OAAO,KAAK,yBAAyB,CAC9F;QACF,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,4BAA4B,GAAG,iBAAiB;QACrD,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,iBAAiB,IAAI,SAAS,CAAC,OAAO,KAAK,wBAAwB,CAC3G;QACF,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,2BAA2B,GAChC,4BAA4B,KAAK,SAAS;QAC1C,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAChC,MAAM,oBAAoB,GACzB,2BAA2B;QAC3B,4BAA4B,KAAK,SAAS;QAC1C,4BAA4B,KAAK,SAAS,CAAC;IAC5C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,oBAAoB,GACzB,aAAa,EAAE,gBAAgB,KAAK,SAAS;QAC7C,6EAA6E;QAC7E,0EAA0E;QAC1E,wEAAwE;QACxE,gBAAgB;QAChB,GAAG,IAAI,aAAa,CAAC,gBAAgB;QACrC,GAAG,GAAG,aAAa,CAAC,gBAAgB,IAAI,2CAA2C,CAAC;IACrF,IAAI,CAAC;QACJ,IAAI,aAAa;YAAE,uBAAuB,CAAC,aAAa,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QAC9F,IAAI,cAAc;YAAE,mBAAmB,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0CAA0C;YACjD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC5D,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IACD,MAAM,sCAAsC,GAC3C,oBAAoB;QACpB,gBAAgB;QAChB,CAAC,oBAAoB;QACrB,6BAA6B,KAAK,SAAS;QAC3C,4BAA4B,KAAK,SAAS,CAAC;IAE5C,IAAI,aAAa,IAAI,CAAC,sCAAsC,EAAE,CAAC;QAC9D,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB;YAC1B,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,gBAAgB;YACzB,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,oBAAoB,EAAE,CAAC;QAC7C,IAAI,2BAA2B,IAAI,iBAAiB,EAAE,CAAC;YACtD,4BAA4B,CAAC,KAAK,EAAE;gBACnC,UAAU,EAAE,iBAAiB;gBAC7B,SAAS,EAAE,aAAa;gBACxB,OAAO,EAAE,wBAAwB;gBACjC,SAAS,EAAE,OAAO,CAAC,gBAAgB;gBACnC,SAAS,EAAE,GAAG;gBACd,WAAW,EAAE,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC;aAChF,CAAC,CAAC;QACJ,CAAC;QACD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,4BAA4B;YACnC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,wBAAwB;YACjC,oBAAoB,EAAE,IAAI;SAC1B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC1B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,gCAAgC,KAAK,CAAC,SAAS,EAAE;YACxD,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,wBAAwB;YACjC,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kCAAkC,KAAK,CAAC,SAAS,EAAE;YAC1D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,uBAAuB;YAChC,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IAED,IAAI,cAAc,IAAI,CAAC,qCAAqC,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,6CAA6C,SAAS,CAAC,IAAI,EAAE;YACpE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,iCAAiC;YAC1C,oBAAoB,EAAE,KAAK;YAC3B,SAAS;SACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,6BAA6B,EAAE,CAAC;QACtD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sCAAsC;YAC7C,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,yBAAyB;YAClC,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sBAAsB;YAC7B,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,gBAAgB;YACzB,oBAAoB,EAAE,KAAK;SAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB;gBAC7B,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,gBAAgB;gBACzB,oBAAoB,EAAE,KAAK;aAC3B,CAAC;QACH,CAAC;QACD,IAAI,4BAA4B,IAAI,4BAA4B,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/F,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,8CAA8C,SAAS,CAAC,IAAI,EAAE;gBACrE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,iCAAiC;gBAC1C,oBAAoB,EAAE,KAAK;aAC3B,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,6BAA6B,CACjD,4BAA4B,EAAE,YAAY,IAAI,OAAO,CAAC,UAAU,CAChE,CAAC;QACF,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,uBAAuB,CAC5C,4BAA4B,EAAE,QAAQ;gBACrC,OAAO,CAAC,QAAQ;gBAChB,4BAA4B,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAChD,CAAC;YACF,MAAM,eAAe,GACpB,aAAa,KAAK,SAAS;gBAC1B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC;YACxF,IAAI,eAAe,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACnE,CAAC;YACD,QAAQ,GAAG;gBACV,GAAG,uBAAuB,CAAC,aAAa,CAAC;gBACzC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,CAAC,CAAC;aAC/D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,kDAAkD;gBACzD,OAAO,EAAE,gBAAgB;gBACzB,oBAAoB,EAAE,KAAK;aAC3B,CAAC;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,4BAA4B,EAAE,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC;QACnF,MAAM,eAAe,GAAG,4BAA4B,EAAE,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC;QAC5F,MAAM,MAAM,GAA4B;YACvC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,4BAA4B,EAAE,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChG,iBAAiB,EAAE,EAAE;YACrB,YAAY;YACZ,QAAQ;YACR,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,GAAG;SACf,CAAC;QACF,4BAA4B,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE,iBAAiB;YAC7B,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,yBAAyB;YAClC,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,YAAY;YAC1B,GAAG,CAAC,4BAA4B,EAAE,SAAS,KAAK,SAAS;gBACxD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,4BAA4B,CAAC,SAAS,EAAE,CAAC;YACzD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;YACxE,GAAG,CAAC,4BAA4B,EAAE,SAAS,KAAK,SAAS;gBACxD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,4BAA4B,CAAC,SAAS,EAAE,CAAC;YACzD,WAAW,EAAE,oCAAoC,CAAC,GAAG,EAAE,eAAe,CAAC;SACvE,CAAC,CAAC;QACH,IAAI,4BAA4B,EAAE,CAAC;YAClC,KAAK,CAAC,qBAAqB,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,MAAM,CACnE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,4BAA4B,CAAC,UAAU,CACzE,CAAC;QACH,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YACnB,KAAK,CAAC,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;YACnG,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,YAAY;YACxB,MAAM;YACN,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,EAAE,IAAI;YACZ,qBAAqB,EAAE,IAAI;YAC3B,SAAS;YACT,cAAc;YACd,UAAU;SACV,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,GAAG,6BAA6B,CAC1D,cAAc,CAAC,YAAY,IAAI,+BAA+B,CAC9D,CAAC;IACF,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,cAAc,CAAC,YAAY,GAAG,qBAAqB,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1C,CAAC;IACD,OAAO;QACN,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,qBAAqB;QACjC,MAAM,EAAE,cAAc;QACtB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,KAAK;QACb,qBAAqB,EAAE,KAAK;QAC5B,SAAS;QACT,cAAc;QACd,UAAU;KACV,CAAC;AAAA,CACF;AAED,SAAS,8BAA8B,CACtC,KAA0B,EAC1B,iBAAmE,EACrC;IAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,WAAW;KAChG,CAAC,CAAC,CAAC;AAAA,CACJ;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA0B,EAAE,MAAc,EAAgC;IAC9G,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAAA,CAChE;AAED,MAAM,UAAU,2BAA2B,CAC1C,KAA0B,EAC1B,MAAc,EACwB;IACtC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAAA,CAC3E;AAED,MAAM,UAAU,qCAAqC,CAAC,MAAwB,EAAE,aAAqB,EAAW;IAC/G,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAAA,CACjG;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAU;IACnE,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAAA,CACnF;AAED,SAAS,mBAAmB,CAAC,MAAwB,EAA6C;IACjG,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAAA,CAC9E;AAED,SAAS,wBAAwB,CAAC,KAA0B,EAAoC;IAC/F,KAAK,CAAC,qBAAqB,KAAK,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,qBAAqB,CAAC;AAAA,CACnC;AAED,SAAS,0BAA0B,CAAC,KAA0B,EAAsC;IACnG,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,uBAAuB,CAAC;AAAA,CACrC;AAED,SAAS,iBAAiB,CAAC,KAA0B,EAA6B;IACjF,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC;IAC5B,OAAO,KAAK,CAAC,cAAc,CAAC;AAAA,CAC5B;AAED,SAAS,oCAAoC,CAAC,UAAkB,EAAE,SAA6B,EAAU;IACxG,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,yDAAyD,EAAE,SAAS,IAAI,UAAU,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,4BAA4B,CAAC,KAA0B,EAAE,GAAW,EAAsC;IAClH,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1F,IAAI,kBAAkB,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACrD,KAAK,CAAC,uBAAuB,GAAG,kBAAkB,CAAC;IACpD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAAA,CAC1B;AAED,SAAS,4BAA4B,CAAC,KAA0B,EAAE,SAA2C,EAAQ;IACpH,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,uBAAuB,GAAG;QAC/B,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CAAC;QAC1E,SAAS;KACT,CAAC;AAAA,CACF;AAED,SAAS,iCAAiC,CAAC,KAA0B,EAAE,GAAW,EAAoC;IACrH,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/F,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAChG,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC5C,4BAA4B,CAAC,KAAK,EAAE;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,wBAAwB;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,GAAG;gBACd,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1E,WAAW,EAAE,oCAAoC,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;aACxE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,qBAAqB,CAAC;AAAA,CAC7B","sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n\tcloneIrohRemoteRpcGrant,\n\tcreateIrohRemotePresetAccess,\n\ttype IrohRemoteRpcGrant,\n\tparseIrohRemoteRpcGrant,\n} from \"./access-grant.ts\";\nimport type { IrohRemoteHello } from \"./handshake.ts\";\nimport {\n\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\ttype IrohRemoteHostHandshakeFailureOutcome,\n\tnormalizeIrohRemoteAllowTools,\n} from \"./protocol.ts\";\nimport type {\n\tIrohRemoteClient,\n\tIrohRemoteGrantedClient,\n\tIrohRemoteHostState,\n\tIrohRemotePairingSecretTombstone,\n\tIrohRemotePendingPairingTicket,\n\tIrohRemoteRevokedClient,\n\tIrohRemoteWorkspace,\n} from \"./state.ts\";\nimport type { IrohRemoteWorkspaceAvailabilityClassifier, IrohRemoteWorkspaceStatus } from \"./workspace.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;\n\n// A re-pair approval for a revoked client is a standing grant to consume a\n// pairing secret again. Bound it so a stale, unused approval cannot silently\n// hijack an unrelated pairing ticket minted much later for a different device;\n// the approval is otherwise cleared only when the revoked client actually\n// re-pairs. The window comfortably covers a deliberate approve -> mint ticket\n// -> scan operator flow.\nexport const DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS = 30 * 60 * 1000;\n\nexport interface AuthorizeIrohRemoteClientOptions {\n\tallowTools: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tclassifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;\n\tpairingExpiresAt?: number;\n\tpairingSecret?: string;\n\tvalidateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;\n\tworkspace?: IrohRemoteWorkspace;\n\tworkspaceStatuses?: readonly IrohRemoteWorkspaceStatus[];\n\tnow?: number;\n}\n\nexport interface IrohRemoteClientAuthorizationSuccess {\n\tok: true;\n\tallowTools: string;\n\tclient: IrohRemoteGrantedClient;\n\tconsumedPairingTicket?: IrohRemotePendingPairingTicket;\n\texpiredPairingTickets?: IrohRemotePendingPairingTicket[];\n\tpaired: boolean;\n\tpairingSecretConsumed: boolean;\n\tworkspace: IrohRemoteWorkspace;\n\tworkspaceNames: string[];\n\tworkspaces: IrohRemoteWorkspaceStatus[];\n}\n\nexport interface IrohRemoteClientAuthorizationFailure {\n\tok: false;\n\tclient?: IrohRemoteClient;\n\terror: string;\n\texpiredPairingTickets?: IrohRemotePendingPairingTicket[];\n\toutcome: IrohRemoteHostHandshakeFailureOutcome;\n\tpairingSecretExpired: boolean;\n\tworkspace?: IrohRemoteWorkspace;\n}\n\nexport type IrohRemoteClientAuthorizationResult =\n\t| IrohRemoteClientAuthorizationSuccess\n\t| IrohRemoteClientAuthorizationFailure;\n\nexport function authorizeIrohRemoteClient(\n\tstate: IrohRemoteHostState,\n\thello: IrohRemoteHello,\n\tremoteNodeId: string,\n\toptions: AuthorizeIrohRemoteClientOptions,\n): IrohRemoteClientAuthorizationResult {\n\tconst workspace = options.workspace?.name === hello.workspace ? options.workspace : undefined;\n\tconst registeredWorkspace =\n\t\tstate.workspaces.find((entry) => entry.name === hello.workspace) ??\n\t\t(options.workspace?.name === hello.workspace ? options.workspace : undefined);\n\tconst workspaceName = registeredWorkspace?.name ?? options.workspace?.name ?? hello.workspace;\n\tconst workspaces = getIrohRemoteWorkspaceStatuses(state, options.workspaceStatuses);\n\tconst workspaceNames = workspaces.filter((entry) => entry.status === \"available\").map((entry) => entry.name);\n\tconst now = options.now ?? Date.now();\n\tconst revokedClient = findIrohRemoteRevokedClient(state, remoteNodeId);\n\tconst existingClient = revokedClient ? undefined : findIrohRemoteClient(state, remoteNodeId);\n\tconst pairingSecretHash = hello.secret ? hashIrohRemotePairingSecret(hello.secret) : undefined;\n\tconst expiredPairingTickets = pruneExpiredPendingPairingTickets(state, now);\n\tconst matchingExpiredPairingTicket = pairingSecretHash\n\t\t? expiredPairingTickets.find((ticket) => ticket.secretHash === pairingSecretHash)\n\t\t: undefined;\n\tconst matchingPendingPairingTicket = pairingSecretHash\n\t\t? getPendingPairingTickets(state).find((ticket) => ticket.secretHash === pairingSecretHash)\n\t\t: undefined;\n\tconst matchingRuntimePairingSecret =\n\t\toptions.pairingSecret !== undefined && hello.secret === options.pairingSecret ? options.pairingSecret : undefined;\n\tconst hasPairingSecret = matchingRuntimePairingSecret !== undefined || matchingPendingPairingTicket !== undefined;\n\tconst pairingSecretTombstones = prunePairingSecretTombstones(state, now);\n\tconst matchingConsumedPairingSecret = pairingSecretHash\n\t\t? pairingSecretTombstones.find(\n\t\t\t\t(tombstone) =>\n\t\t\t\t\ttombstone.secretHash === pairingSecretHash && tombstone.outcome === \"pairing_secret_consumed\",\n\t\t\t)\n\t\t: undefined;\n\tconst matchingExpiredPairingSecret = pairingSecretHash\n\t\t? pairingSecretTombstones.find(\n\t\t\t\t(tombstone) => tombstone.secretHash === pairingSecretHash && tombstone.outcome === \"pairing_secret_expired\",\n\t\t\t)\n\t\t: undefined;\n\tconst runtimePairingSecretExpired =\n\t\tmatchingRuntimePairingSecret !== undefined &&\n\t\toptions.pairingExpiresAt !== undefined &&\n\t\tnow > options.pairingExpiresAt;\n\tconst pairingSecretExpired =\n\t\truntimePairingSecretExpired ||\n\t\tmatchingExpiredPairingTicket !== undefined ||\n\t\tmatchingExpiredPairingSecret !== undefined;\n\tconst expiredResultTickets = expiredPairingTickets.length > 0 ? expiredPairingTickets : undefined;\n\tconst rePairApprovalActive =\n\t\trevokedClient?.rePairApprovedAt !== undefined &&\n\t\t// Fail closed on a future timestamp (host clock moved back, or state carried\n\t\t// across a clock change): without the lower bound a negative delta always\n\t\t// satisfies the TTL and keeps a revoked client's re-pair approval alive\n\t\t// indefinitely.\n\t\tnow >= revokedClient.rePairApprovedAt &&\n\t\tnow - revokedClient.rePairApprovedAt <= DEFAULT_IROH_REMOTE_RE_PAIR_APPROVAL_TTL_MS;\n\ttry {\n\t\tif (revokedClient) parseIrohRemoteRpcGrant(revokedClient.rpcGrant, \"revoked client rpcGrant\");\n\t\tif (existingClient) assertGrantedClient(existingClient);\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client RPC grant is missing or malformed\",\n\t\t\toutcome: revokedClient ? \"client_revoked\" : \"client_unknown\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\tconst hasActivePairingSecretForRevokedClient =\n\t\trePairApprovalActive &&\n\t\thasPairingSecret &&\n\t\t!pairingSecretExpired &&\n\t\tmatchingConsumedPairingSecret === undefined &&\n\t\tmatchingExpiredPairingSecret === undefined;\n\n\tif (revokedClient && !hasActivePairingSecretForRevokedClient) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client is revoked\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"client_revoked\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient && pairingSecretExpired) {\n\t\tif (runtimePairingSecretExpired && pairingSecretHash) {\n\t\t\tupsertPairingSecretTombstone(state, {\n\t\t\t\tsecretHash: pairingSecretHash,\n\t\t\t\tworkspace: workspaceName,\n\t\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\t\texpiresAt: options.pairingExpiresAt,\n\t\t\t\texpiredAt: now,\n\t\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, options.pairingExpiresAt),\n\t\t\t});\n\t\t}\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"pairing ticket has expired\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\tpairingSecretExpired: true,\n\t\t};\n\t}\n\n\tif (!registeredWorkspace) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `workspace is not registered: ${hello.workspace}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_unregistered\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!workspace) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: `workspace path is unavailable: ${hello.workspace}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_unavailable\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (existingClient && !isIrohRemoteClientAllowedForWorkspace(existingClient, workspace.name)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tclient: existingClient,\n\t\t\terror: `workspace authorization has been removed: ${workspace.name}`,\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"workspace_authorization_removed\",\n\t\t\tpairingSecretExpired: false,\n\t\t\tworkspace,\n\t\t};\n\t}\n\n\tif (!existingClient && matchingConsumedPairingSecret) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"pairing ticket has already been used\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"pairing_secret_consumed\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient && !hasPairingSecret) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror: \"client is not paired\",\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\toutcome: \"client_unknown\",\n\t\t\tpairingSecretExpired: false,\n\t\t};\n\t}\n\n\tif (!existingClient) {\n\t\tif (!pairingSecretHash) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: \"client is not paired\",\n\t\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\t\toutcome: \"client_unknown\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tif (matchingPendingPairingTicket && matchingPendingPairingTicket.workspace !== workspace.name) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: `pairing ticket is not valid for workspace: ${workspace.name}`,\n\t\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\t\toutcome: \"workspace_authorization_removed\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tconst allowedTools = normalizeIrohRemoteAllowTools(\n\t\t\tmatchingPendingPairingTicket?.allowedTools ?? options.allowTools,\n\t\t);\n\t\tlet rpcGrant: IrohRemoteRpcGrant;\n\t\ttry {\n\t\t\tconst selectedGrant = parseIrohRemoteRpcGrant(\n\t\t\t\tmatchingPendingPairingTicket?.rpcGrant ??\n\t\t\t\t\toptions.rpcGrant ??\n\t\t\t\t\tcreateIrohRemotePresetAccess(\"coding\").rpcGrant,\n\t\t\t);\n\t\t\tconst revokedRevision =\n\t\t\t\trevokedClient === undefined\n\t\t\t\t\t? 0\n\t\t\t\t\t: parseIrohRemoteRpcGrant(revokedClient.rpcGrant, \"revoked client rpcGrant\").revision;\n\t\t\tif (revokedRevision === Number.MAX_SAFE_INTEGER) {\n\t\t\t\tthrow new Error(\"revoked client RPC grant revision is exhausted\");\n\t\t\t}\n\t\t\trpcGrant = {\n\t\t\t\t...cloneIrohRemoteRpcGrant(selectedGrant),\n\t\t\t\trevision: Math.max(selectedGrant.revision, revokedRevision + 1),\n\t\t\t};\n\t\t} catch {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: \"pairing ticket RPC grant is missing or malformed\",\n\t\t\t\toutcome: \"client_unknown\",\n\t\t\t\tpairingSecretExpired: false,\n\t\t\t};\n\t\t}\n\t\tconst allowedWorkspace = matchingPendingPairingTicket?.workspace ?? workspace.name;\n\t\tconst ticketExpiresAt = matchingPendingPairingTicket?.expiresAt ?? options.pairingExpiresAt;\n\t\tconst client: IrohRemoteGrantedClient = {\n\t\t\tnodeId: remoteNodeId,\n\t\t\tlabel: hello.clientLabel || matchingPendingPairingTicket?.labelHint || remoteNodeId.slice(0, 12),\n\t\t\tallowedWorkspaces: [],\n\t\t\tallowedTools,\n\t\t\trpcGrant,\n\t\t\tpairedAt: now,\n\t\t\tlastSeenAt: now,\n\t\t};\n\t\tupsertPairingSecretTombstone(state, {\n\t\t\tsecretHash: pairingSecretHash,\n\t\t\tworkspace: allowedWorkspace,\n\t\t\toutcome: \"pairing_secret_consumed\",\n\t\t\tconsumedAt: now,\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\t...(matchingPendingPairingTicket?.createdAt === undefined\n\t\t\t\t? {}\n\t\t\t\t: { createdAt: matchingPendingPairingTicket.createdAt }),\n\t\t\t...(ticketExpiresAt === undefined ? {} : { expiresAt: ticketExpiresAt }),\n\t\t\t...(matchingPendingPairingTicket?.labelHint === undefined\n\t\t\t\t? {}\n\t\t\t\t: { labelHint: matchingPendingPairingTicket.labelHint }),\n\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, ticketExpiresAt),\n\t\t});\n\t\tif (matchingPendingPairingTicket) {\n\t\t\tstate.pendingPairingTickets = getPendingPairingTickets(state).filter(\n\t\t\t\t(ticket) => ticket.secretHash !== matchingPendingPairingTicket.secretHash,\n\t\t\t);\n\t\t}\n\t\tif (revokedClient) {\n\t\t\tstate.revokedClients = getRevokedClients(state).filter((client) => client.nodeId !== remoteNodeId);\n\t\t\tstate.clients = state.clients.filter((entry) => entry.nodeId !== remoteNodeId);\n\t\t}\n\t\tstate.clients.push(client);\n\t\treturn {\n\t\t\tok: true,\n\t\t\tallowTools: allowedTools,\n\t\t\tclient,\n\t\t\t...(matchingPendingPairingTicket ? { consumedPairingTicket: matchingPendingPairingTicket } : {}),\n\t\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\t\tpaired: true,\n\t\t\tpairingSecretConsumed: true,\n\t\t\tworkspace,\n\t\t\tworkspaceNames,\n\t\t\tworkspaces,\n\t\t};\n\t}\n\n\tconst persistedAllowedTools = normalizeIrohRemoteAllowTools(\n\t\texistingClient.allowedTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t);\n\texistingClient.lastSeenAt = now;\n\texistingClient.allowedTools = persistedAllowedTools;\n\tif (hello.clientLabel) {\n\t\texistingClient.label = hello.clientLabel;\n\t}\n\treturn {\n\t\tok: true,\n\t\tallowTools: persistedAllowedTools,\n\t\tclient: existingClient,\n\t\t...(expiredResultTickets ? { expiredPairingTickets: expiredResultTickets } : {}),\n\t\tpaired: false,\n\t\tpairingSecretConsumed: false,\n\t\tworkspace,\n\t\tworkspaceNames,\n\t\tworkspaces,\n\t};\n}\n\nfunction getIrohRemoteWorkspaceStatuses(\n\tstate: IrohRemoteHostState,\n\tworkspaceStatuses: readonly IrohRemoteWorkspaceStatus[] | undefined,\n): IrohRemoteWorkspaceStatus[] {\n\treturn state.workspaces.map((workspace) => ({\n\t\tname: workspace.name,\n\t\tstatus: workspaceStatuses?.find((entry) => entry.name === workspace.name)?.status ?? \"available\",\n\t}));\n}\n\nexport function findIrohRemoteClient(state: IrohRemoteHostState, nodeId: string): IrohRemoteClient | undefined {\n\treturn state.clients.find((client) => client.nodeId === nodeId);\n}\n\nexport function findIrohRemoteRevokedClient(\n\tstate: IrohRemoteHostState,\n\tnodeId: string,\n): IrohRemoteRevokedClient | undefined {\n\treturn getRevokedClients(state).find((client) => client.nodeId === nodeId);\n}\n\nexport function isIrohRemoteClientAllowedForWorkspace(client: IrohRemoteClient, workspaceName: string): boolean {\n\treturn client.allowedWorkspaces.length === 0 || client.allowedWorkspaces.includes(workspaceName);\n}\n\nexport function hashIrohRemotePairingSecret(secret: string): string {\n\treturn `sha256:${createHash(\"sha256\").update(secret, \"utf8\").digest(\"base64url\")}`;\n}\n\nfunction assertGrantedClient(client: IrohRemoteClient): asserts client is IrohRemoteGrantedClient {\n\tclient.rpcGrant = parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\");\n}\n\nfunction getPendingPairingTickets(state: IrohRemoteHostState): IrohRemotePendingPairingTicket[] {\n\tstate.pendingPairingTickets ??= [];\n\treturn state.pendingPairingTickets;\n}\n\nfunction getPairingSecretTombstones(state: IrohRemoteHostState): IrohRemotePairingSecretTombstone[] {\n\tstate.pairingSecretTombstones ??= [];\n\treturn state.pairingSecretTombstones;\n}\n\nfunction getRevokedClients(state: IrohRemoteHostState): IrohRemoteRevokedClient[] {\n\tstate.revokedClients ??= [];\n\treturn state.revokedClients;\n}\n\nfunction getPairingSecretTombstoneRetainUntil(terminalAt: number, expiresAt: number | undefined): number {\n\treturn Math.max(terminalAt + DEFAULT_IROH_REMOTE_PAIRING_SECRET_TOMBSTONE_RETENTION_MS, expiresAt ?? terminalAt);\n}\n\nfunction prunePairingSecretTombstones(state: IrohRemoteHostState, now: number): IrohRemotePairingSecretTombstone[] {\n\tconst tombstones = getPairingSecretTombstones(state);\n\tconst retainedTombstones = tombstones.filter((tombstone) => now <= tombstone.retainUntil);\n\tif (retainedTombstones.length !== tombstones.length) {\n\t\tstate.pairingSecretTombstones = retainedTombstones;\n\t}\n\treturn retainedTombstones;\n}\n\nfunction upsertPairingSecretTombstone(state: IrohRemoteHostState, tombstone: IrohRemotePairingSecretTombstone): void {\n\tconst tombstones = getPairingSecretTombstones(state);\n\tstate.pairingSecretTombstones = [\n\t\t...tombstones.filter((entry) => entry.secretHash !== tombstone.secretHash),\n\t\ttombstone,\n\t];\n}\n\nfunction pruneExpiredPendingPairingTickets(state: IrohRemoteHostState, now: number): IrohRemotePendingPairingTicket[] {\n\tconst pendingPairingTickets = getPendingPairingTickets(state);\n\tconst expiredPairingTickets = pendingPairingTickets.filter((ticket) => now > ticket.expiresAt);\n\tif (expiredPairingTickets.length > 0) {\n\t\tstate.pendingPairingTickets = pendingPairingTickets.filter((ticket) => now <= ticket.expiresAt);\n\t\tfor (const ticket of expiredPairingTickets) {\n\t\t\tupsertPairingSecretTombstone(state, {\n\t\t\t\tsecretHash: ticket.secretHash,\n\t\t\t\tworkspace: ticket.workspace,\n\t\t\t\toutcome: \"pairing_secret_expired\",\n\t\t\t\tcreatedAt: ticket.createdAt,\n\t\t\t\texpiresAt: ticket.expiresAt,\n\t\t\t\texpiredAt: now,\n\t\t\t\t...(ticket.labelHint === undefined ? {} : { labelHint: ticket.labelHint }),\n\t\t\t\tretainUntil: getPairingSecretTombstoneRetainUntil(now, ticket.expiresAt),\n\t\t\t});\n\t\t}\n\t}\n\treturn expiredPairingTickets;\n}\n"]}

package/dist/core/remote/iroh/control.d.ts

@@ -0,0 +1,64 @@
+import { type Server } from "node:net";
+import { type IrohRemoteRelayMode } from "./protocol.ts";
+export declare const IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE = "volt_iroh_pair_request";
+export declare const IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE = "volt_iroh_pair_response";
+export declare const IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE = "volt_iroh_revoke_request";
+export declare const IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE = "volt_iroh_revoke_response";
+export declare const DEFAULT_IROH_REMOTE_CONTROL_TIMEOUT_MS = 5000;
+export type IrohRemoteUnsafeApproval = "tty_confirmation" | "yes_flag";
+export interface IrohRemotePairControlRequest {
+    type: typeof IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE;
+    allowTools?: string;
+    labelHint?: string;
+    relayMode?: IrohRemoteRelayMode;
+    ttlMs?: number;
+    unsafeApproval?: IrohRemoteUnsafeApproval;
+    workspace: string;
+}
+export interface IrohRemoteRevokeControlRequest {
+    type: typeof IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE;
+    nodeId: string;
+}
+export type IrohRemoteControlRequest = IrohRemotePairControlRequest | IrohRemoteRevokeControlRequest;
+export type IrohRemotePairControlResponse = {
+    type: typeof IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE;
+    success: true;
+    expiresAt: number;
+    ticket: string;
+} | {
+    type: typeof IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE;
+    success: false;
+    error: string;
+};
+export type IrohRemoteRevokeControlResponse = {
+    type: typeof IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE;
+    success: true;
+    closed: boolean;
+    closedCount: number;
+} | {
+    type: typeof IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE;
+    success: false;
+    error: string;
+};
+export interface IrohRemoteControlClientOptions<Request extends IrohRemoteControlRequest> {
+    request: Request;
+    statePath: string;
+    timeoutMs?: number;
+}
+export interface IrohRemoteControlServerListenOptions {
+    activeRetryAttempts?: number;
+    activeRetryDelayMs?: number;
+}
+export type IrohRemotePairControlClientOptions = IrohRemoteControlClientOptions<IrohRemotePairControlRequest>;
+export type IrohRemoteRevokeControlClientOptions = IrohRemoteControlClientOptions<IrohRemoteRevokeControlRequest>;
+export declare function getIrohRemoteControlPath(statePath: string): string;
+export declare function ensureIrohRemoteControlDirectory(controlPath: string): Promise<void>;
+export declare function listenIrohRemoteControlServer(server: Server, controlPath: string, options?: IrohRemoteControlServerListenOptions): Promise<void>;
+export declare function parseIrohRemoteControlRequest(value: unknown): IrohRemoteControlRequest;
+export declare function parseIrohRemotePairControlRequest(value: unknown): IrohRemotePairControlRequest;
+export declare function parseIrohRemoteRevokeControlRequest(value: unknown): IrohRemoteRevokeControlRequest;
+export declare function parseIrohRemotePairControlResponse(value: unknown): IrohRemotePairControlResponse;
+export declare function parseIrohRemoteRevokeControlResponse(value: unknown): IrohRemoteRevokeControlResponse;
+export declare function requestIrohRemotePairingTicket(options: IrohRemotePairControlClientOptions): Promise<IrohRemotePairControlResponse>;
+export declare function requestIrohRemoteActiveRevocation(options: IrohRemoteRevokeControlClientOptions): Promise<IrohRemoteRevokeControlResponse>;
+//# sourceMappingURL=control.d.ts.map

package/dist/core/remote/iroh/control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/control.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAGhD,OAAO,EAAE,KAAK,mBAAmB,EAAyB,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,qCAAqC,2BAA2B,CAAC;AAC9E,eAAO,MAAM,sCAAsC,4BAA4B,CAAC;AAChF,eAAO,MAAM,uCAAuC,6BAA6B,CAAC;AAClF,eAAO,MAAM,wCAAwC,8BAA8B,CAAC;AACpF,eAAO,MAAM,sCAAsC,OAAQ,CAAC;AAO5D,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,4BAA4B;IAC5C,IAAI,EAAE,OAAO,qCAAqC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,OAAO,uCAAuC,CAAC;IACrD,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG,8BAA8B,CAAC;AAErG,MAAM,MAAM,6BAA6B,GACtC;IACA,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,OAAO,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CACd,GACD;IACA,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACb,CAAC;AAEL,MAAM,MAAM,+BAA+B,GACxC;IACA,IAAI,EAAE,OAAO,wCAAwC,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACnB,GACD;IACA,IAAI,EAAE,OAAO,wCAAwC,CAAC;IACtD,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACb,CAAC;AAEL,MAAM,WAAW,8BAA8B,CAAC,OAAO,SAAS,wBAAwB;IACvF,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oCAAoC;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;AAC9G,MAAM,MAAM,oCAAoC,GAAG,8BAA8B,CAAC,8BAA8B,CAAC,CAAC;AAElH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wBAAsB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;AAED,wBAAsB,6BAA6B,CAClD,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oCAAyC,GAChD,OAAO,CAAC,IAAI,CAAC,CAsBf;AAqED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAUtF;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,CAE9F;AAuBD,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAElG;AAaD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAqBhG;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,+BAA+B,CAoBpG;AAED,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,kCAAkC,GACzC,OAAO,CAAC,6BAA6B,CAAC,CAExC;AAED,wBAAsB,iCAAiC,CACtD,OAAO,EAAE,oCAAoC,GAC3C,OAAO,CAAC,+BAA+B,CAAC,CAE1C","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { chmod, lstat, mkdir, rm } from \"node:fs/promises\";\nimport { connect, type Server } from \"node:net\";\nimport { tmpdir } from \"node:os\";\nimport { basename, dirname, join } from \"node:path\";\nimport { type IrohRemoteRelayMode, isIrohRemoteRelayMode } from \"./protocol.ts\";\n\nexport const IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE = \"volt_iroh_pair_request\";\nexport const IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE = \"volt_iroh_pair_response\";\nexport const IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE = \"volt_iroh_revoke_request\";\nexport const IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE = \"volt_iroh_revoke_response\";\nexport const DEFAULT_IROH_REMOTE_CONTROL_TIMEOUT_MS = 5_000;\n\nconst DEFAULT_IROH_REMOTE_CONTROL_ACTIVE_RETRY_ATTEMPTS = 10;\nconst DEFAULT_IROH_REMOTE_CONTROL_ACTIVE_RETRY_DELAY_MS = 250;\nconst IROH_REMOTE_CONTROL_ROOT_DIR = \"volt-iroh-remote\";\nconst IROH_REMOTE_UNIX_CONTROL_PATH_MAX_BYTES = 100;\n\nexport type IrohRemoteUnsafeApproval = \"tty_confirmation\" | \"yes_flag\";\n\nexport interface IrohRemotePairControlRequest {\n\ttype: typeof IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE;\n\tallowTools?: string;\n\tlabelHint?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\tttlMs?: number;\n\tunsafeApproval?: IrohRemoteUnsafeApproval;\n\tworkspace: string;\n}\n\nexport interface IrohRemoteRevokeControlRequest {\n\ttype: typeof IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE;\n\tnodeId: string;\n}\n\nexport type IrohRemoteControlRequest = IrohRemotePairControlRequest | IrohRemoteRevokeControlRequest;\n\nexport type IrohRemotePairControlResponse =\n\t| {\n\t\t\ttype: typeof IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE;\n\t\t\tsuccess: true;\n\t\t\texpiresAt: number;\n\t\t\tticket: string;\n\t  }\n\t| {\n\t\t\ttype: typeof IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE;\n\t\t\tsuccess: false;\n\t\t\terror: string;\n\t  };\n\nexport type IrohRemoteRevokeControlResponse =\n\t| {\n\t\t\ttype: typeof IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE;\n\t\t\tsuccess: true;\n\t\t\tclosed: boolean;\n\t\t\tclosedCount: number;\n\t  }\n\t| {\n\t\t\ttype: typeof IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE;\n\t\t\tsuccess: false;\n\t\t\terror: string;\n\t  };\n\nexport interface IrohRemoteControlClientOptions<Request extends IrohRemoteControlRequest> {\n\trequest: Request;\n\tstatePath: string;\n\ttimeoutMs?: number;\n}\n\nexport interface IrohRemoteControlServerListenOptions {\n\tactiveRetryAttempts?: number;\n\tactiveRetryDelayMs?: number;\n}\n\nexport type IrohRemotePairControlClientOptions = IrohRemoteControlClientOptions<IrohRemotePairControlRequest>;\nexport type IrohRemoteRevokeControlClientOptions = IrohRemoteControlClientOptions<IrohRemoteRevokeControlRequest>;\n\nexport function getIrohRemoteControlPath(statePath: string): string {\n\tconst hash = createHash(\"sha256\").update(statePath).digest(\"hex\").slice(0, 32);\n\tif (process.platform === \"win32\") {\n\t\treturn `\\\\\\\\.\\\\pipe\\\\volt-iroh-remote-${hash}`;\n\t}\n\tconst defaultPath = join(tmpdir(), IROH_REMOTE_CONTROL_ROOT_DIR, hash, \"control.sock\");\n\tif (Buffer.byteLength(defaultPath, \"utf8\") <= IROH_REMOTE_UNIX_CONTROL_PATH_MAX_BYTES) {\n\t\treturn defaultPath;\n\t}\n\treturn join(\"/tmp\", IROH_REMOTE_CONTROL_ROOT_DIR, hash, \"control.sock\");\n}\n\nexport async function ensureIrohRemoteControlDirectory(controlPath: string): Promise<void> {\n\tif (process.platform === \"win32\") {\n\t\treturn;\n\t}\n\tconst controlDir = dirname(controlPath);\n\tconst controlRootDir = dirname(controlDir);\n\tif (basename(controlRootDir) === IROH_REMOTE_CONTROL_ROOT_DIR) {\n\t\tawait ensureOwnerOnlyIrohRemoteControlDirectory(controlRootDir);\n\t}\n\tawait ensureOwnerOnlyIrohRemoteControlDirectory(controlDir);\n}\n\nexport async function listenIrohRemoteControlServer(\n\tserver: Server,\n\tcontrolPath: string,\n\toptions: IrohRemoteControlServerListenOptions = {},\n): Promise<void> {\n\tawait ensureIrohRemoteControlDirectory(controlPath);\n\tconst activeRetryAttempts = options.activeRetryAttempts ?? DEFAULT_IROH_REMOTE_CONTROL_ACTIVE_RETRY_ATTEMPTS;\n\tconst activeRetryDelayMs = options.activeRetryDelayMs ?? DEFAULT_IROH_REMOTE_CONTROL_ACTIVE_RETRY_DELAY_MS;\n\tfor (let attempt = 0; ; attempt += 1) {\n\t\ttry {\n\t\t\tawait listenServer(server, controlPath);\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tif (process.platform === \"win32\" || !(error instanceof Error) || !isNodeErrorCode(error, \"EADDRINUSE\")) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (await canConnectToControlPath(controlPath)) {\n\t\t\t\tif (attempt < activeRetryAttempts) {\n\t\t\t\t\tawait delay(activeRetryDelayMs);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Iroh remote host control channel is already active for this state path: ${controlPath}`);\n\t\t\t}\n\t\t\tawait rm(controlPath, { force: true });\n\t\t}\n\t}\n}\n\nfunction listenServer(server: Server, controlPath: string): Promise<void> {\n\treturn new Promise((resolveListen, rejectListen) => {\n\t\tconst cleanup = () => {\n\t\t\tserver.off(\"error\", handleError);\n\t\t\tserver.off(\"listening\", handleListening);\n\t\t};\n\t\tconst handleError = (error: Error) => {\n\t\t\tcleanup();\n\t\t\trejectListen(error);\n\t\t};\n\t\tconst handleListening = () => {\n\t\t\tcleanup();\n\t\t\tresolveListen();\n\t\t};\n\t\tserver.once(\"error\", handleError);\n\t\tserver.once(\"listening\", handleListening);\n\t\ttry {\n\t\t\tserver.listen(controlPath);\n\t\t} catch (error) {\n\t\t\tcleanup();\n\t\t\trejectListen(error instanceof Error ? error : new Error(String(error)));\n\t\t}\n\t});\n}\n\nfunction canConnectToControlPath(controlPath: string): Promise<boolean> {\n\treturn new Promise((resolveConnect) => {\n\t\tconst socket = connect(controlPath);\n\t\tlet settled = false;\n\t\tconst finish = (canConnect: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tsocket.destroy();\n\t\t\tresolveConnect(canConnect);\n\t\t};\n\t\tconst timeout = setTimeout(() => finish(false), 250);\n\t\tsocket.once(\"connect\", () => finish(true));\n\t\tsocket.once(\"error\", () => finish(false));\n\t});\n}\n\nfunction delay(ms: number): Promise<void> {\n\treturn new Promise((resolveDelay) => {\n\t\tsetTimeout(resolveDelay, ms);\n\t});\n}\n\nfunction isNodeErrorCode(error: Error, code: string): boolean {\n\treturn \"code\" in error && error.code === code;\n}\n\nasync function ensureOwnerOnlyIrohRemoteControlDirectory(path: string): Promise<void> {\n\tawait mkdir(path, { recursive: true, mode: 0o700 });\n\tconst pathStat = await lstat(path);\n\tif (!pathStat.isDirectory() || pathStat.isSymbolicLink()) {\n\t\tthrow new Error(`Iroh remote host control directory is not a directory: ${path}`);\n\t}\n\tconst currentUid = process.getuid?.();\n\tif (currentUid !== undefined && pathStat.uid !== currentUid) {\n\t\tthrow new Error(`Iroh remote host control directory is owned by another user: ${path}`);\n\t}\n\tif ((pathStat.mode & 0o777) !== 0o700) {\n\t\tawait chmod(path, 0o700);\n\t}\n}\n\nexport function parseIrohRemoteControlRequest(value: unknown): IrohRemoteControlRequest {\n\tconst request = expectRecord(value, \"Iroh remote control request\");\n\tconst type = expectString(request.type, \"control request type\");\n\tif (type === IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE) {\n\t\treturn parseIrohRemotePairControlRequestRecord(request);\n\t}\n\tif (type === IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE) {\n\t\treturn parseIrohRemoteRevokeControlRequestRecord(request);\n\t}\n\tthrow new Error(`Unsupported Iroh remote control request type: ${type}`);\n}\n\nexport function parseIrohRemotePairControlRequest(value: unknown): IrohRemotePairControlRequest {\n\treturn parseIrohRemotePairControlRequestRecord(expectRecord(value, \"Iroh remote pair control request\"));\n}\n\nfunction parseIrohRemotePairControlRequestRecord(request: Record<string, unknown>): IrohRemotePairControlRequest {\n\tconst type = expectString(request.type, \"pair control request type\");\n\tif (type !== IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE) {\n\t\tthrow new Error(`Unsupported Iroh remote pair control request type: ${type}`);\n\t}\n\tconst relayMode = expectOptionalRelayMode(request.relayMode, \"pair control request relayMode\");\n\tconst unsafeApproval = expectOptionalUnsafeApproval(request.unsafeApproval, \"pair control request unsafeApproval\");\n\tconst allowTools = expectOptionalString(request.allowTools, \"pair control request allowTools\");\n\tconst labelHint = expectOptionalString(request.labelHint, \"pair control request labelHint\");\n\tconst ttlMs = expectOptionalPositiveNumber(request.ttlMs, \"pair control request ttlMs\");\n\treturn {\n\t\ttype: IROH_REMOTE_PAIR_CONTROL_REQUEST_TYPE,\n\t\tworkspace: expectString(request.workspace, \"pair control request workspace\"),\n\t\t...(allowTools === undefined ? {} : { allowTools }),\n\t\t...(labelHint === undefined ? {} : { labelHint }),\n\t\t...(relayMode === undefined ? {} : { relayMode }),\n\t\t...(ttlMs === undefined ? {} : { ttlMs }),\n\t\t...(unsafeApproval === undefined ? {} : { unsafeApproval }),\n\t};\n}\n\nexport function parseIrohRemoteRevokeControlRequest(value: unknown): IrohRemoteRevokeControlRequest {\n\treturn parseIrohRemoteRevokeControlRequestRecord(expectRecord(value, \"Iroh remote revoke control request\"));\n}\n\nfunction parseIrohRemoteRevokeControlRequestRecord(request: Record<string, unknown>): IrohRemoteRevokeControlRequest {\n\tconst type = expectString(request.type, \"revoke control request type\");\n\tif (type !== IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE) {\n\t\tthrow new Error(`Unsupported Iroh remote revoke control request type: ${type}`);\n\t}\n\treturn {\n\t\ttype: IROH_REMOTE_REVOKE_CONTROL_REQUEST_TYPE,\n\t\tnodeId: expectString(request.nodeId, \"revoke control request nodeId\"),\n\t};\n}\n\nexport function parseIrohRemotePairControlResponse(value: unknown): IrohRemotePairControlResponse {\n\tconst response = expectRecord(value, \"Iroh remote pair control response\");\n\tconst type = expectString(response.type, \"pair control response type\");\n\tif (type !== IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE) {\n\t\tthrow new Error(`Unsupported Iroh remote control response type: ${type}`);\n\t}\n\tconst success = expectBoolean(response.success, \"pair control response success\");\n\tif (!success) {\n\t\treturn {\n\t\t\ttype: IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE,\n\t\t\tsuccess: false,\n\t\t\terror: expectString(response.error, \"pair control response error\"),\n\t\t};\n\t}\n\tconst expiresAt = expectPositiveNumber(response.expiresAt, \"pair control response expiresAt\");\n\treturn {\n\t\ttype: IROH_REMOTE_PAIR_CONTROL_RESPONSE_TYPE,\n\t\tsuccess: true,\n\t\texpiresAt,\n\t\tticket: expectString(response.ticket, \"pair control response ticket\"),\n\t};\n}\n\nexport function parseIrohRemoteRevokeControlResponse(value: unknown): IrohRemoteRevokeControlResponse {\n\tconst response = expectRecord(value, \"Iroh remote revoke control response\");\n\tconst type = expectString(response.type, \"revoke control response type\");\n\tif (type !== IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE) {\n\t\tthrow new Error(`Unsupported Iroh remote revoke control response type: ${type}`);\n\t}\n\tconst success = expectBoolean(response.success, \"revoke control response success\");\n\tif (!success) {\n\t\treturn {\n\t\t\ttype: IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE,\n\t\t\tsuccess: false,\n\t\t\terror: expectString(response.error, \"revoke control response error\"),\n\t\t};\n\t}\n\treturn {\n\t\ttype: IROH_REMOTE_REVOKE_CONTROL_RESPONSE_TYPE,\n\t\tsuccess: true,\n\t\tclosed: expectBoolean(response.closed, \"revoke control response closed\"),\n\t\tclosedCount: expectNonNegativeNumber(response.closedCount, \"revoke control response closedCount\"),\n\t};\n}\n\nexport async function requestIrohRemotePairingTicket(\n\toptions: IrohRemotePairControlClientOptions,\n): Promise<IrohRemotePairControlResponse> {\n\treturn await requestIrohRemoteControl(options, parseIrohRemotePairControlResponse);\n}\n\nexport async function requestIrohRemoteActiveRevocation(\n\toptions: IrohRemoteRevokeControlClientOptions,\n): Promise<IrohRemoteRevokeControlResponse> {\n\treturn await requestIrohRemoteControl(options, parseIrohRemoteRevokeControlResponse);\n}\n\nasync function requestIrohRemoteControl<Response>(\n\toptions: IrohRemoteControlClientOptions<IrohRemoteControlRequest>,\n\tparseResponse: (value: unknown) => Response,\n): Promise<Response> {\n\tconst controlPath = getIrohRemoteControlPath(options.statePath);\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_IROH_REMOTE_CONTROL_TIMEOUT_MS;\n\tconst socket = connect(controlPath);\n\tsocket.setEncoding(\"utf8\");\n\n\treturn await new Promise<Response>((resolve, reject) => {\n\t\tlet buffer = \"\";\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tfinish(undefined, new Error(\"Timed out waiting for a running Iroh remote host control response\"));\n\t\t}, timeoutMs);\n\n\t\tconst finish = (response?: Response, error?: Error) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tsocket.destroy();\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!response) {\n\t\t\t\treject(new Error(\"Iroh remote host control channel closed without a response\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tresolve(response);\n\t\t};\n\n\t\tsocket.once(\"connect\", () => {\n\t\t\tsocket.write(`${JSON.stringify(options.request)}\\n`);\n\t\t});\n\t\tsocket.on(\"data\", (chunk: string) => {\n\t\t\tbuffer += chunk;\n\t\t\tconst newlineIndex = buffer.indexOf(\"\\n\");\n\t\t\tif (newlineIndex === -1) return;\n\t\t\ttry {\n\t\t\t\tfinish(parseResponse(JSON.parse(buffer.slice(0, newlineIndex))));\n\t\t\t} catch (error) {\n\t\t\t\tfinish(undefined, error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\t\tsocket.once(\"error\", (error) => {\n\t\t\tfinish(undefined, new Error(`No running Iroh remote host control channel is available (${error.message})`));\n\t\t});\n\t\tsocket.once(\"end\", () => finish());\n\t});\n}\n\nfunction expectRecord(value: unknown, description: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${description} must be an object`);\n\t}\n\treturn value as Record<string, unknown>;\n}\n\nfunction expectString(value: unknown, description: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`${description} must be a non-empty string`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalString(value: unknown, description: string): string | undefined {\n\tif (value === undefined) return undefined;\n\treturn expectString(value, description);\n}\n\nfunction expectBoolean(value: unknown, description: string): boolean {\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`${description} must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction expectPositiveNumber(value: unknown, description: string): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n\t\tthrow new Error(`${description} must be a positive number`);\n\t}\n\treturn value;\n}\n\nfunction expectNonNegativeNumber(value: unknown, description: string): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n\t\tthrow new Error(`${description} must be a non-negative number`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalPositiveNumber(value: unknown, description: string): number | undefined {\n\tif (value === undefined) return undefined;\n\treturn expectPositiveNumber(value, description);\n}\n\nfunction expectOptionalRelayMode(value: unknown, description: string): IrohRemoteRelayMode | undefined {\n\tif (value === undefined) return undefined;\n\tif (!isIrohRemoteRelayMode(value)) {\n\t\tthrow new Error(`${description} must be disabled, development, or production`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalUnsafeApproval(value: unknown, description: string): IrohRemoteUnsafeApproval | undefined {\n\tif (value === undefined) return undefined;\n\tif (value !== \"tty_confirmation\" && value !== \"yes_flag\") {\n\t\tthrow new Error(`${description} must be tty_confirmation or yes_flag`);\n\t}\n\treturn value;\n}\n"]}