@opensesame-labs/web-pwa 0.0.0-alpha.0

package/dist/assets/cap-ai.password-reset-rh9CIhu-.js

@@ -0,0 +1 @@
+import{a as e,k as t,b as n,c as s,e as a,f as r,l as o}from"./model-provider-B6oAnQX9.js";import{i,j as c,k as d,l,m as u,n as f,o as p,p as m,q as h,s as w,t as y,e as b,v,w as g,x as j,y as x,z as k,A as I,B as _,D as S,E as $,F as C,c as T,P as A}from"./main-BrkS-iow.js";import{l as O}from"./connections-CNmhCNAV.js";import{c as P}from"./certs-CDCfMuEi.js";import{r as E,s as q,c as N}from"./connector-settings-CBJ6GX5X.js";import{g as R}from"./local-vault-sessions-CGv9AsFj.js";import{o as z,c as H,i as M,b as J,e as V}from"./vault-ui-seam-BQGS7RR6.js";import{r as B,j as D}from"./react-dom-BwC4eQlG.js";import{a as U}from"./react-router-XsJY84ug.js";import{c as F,h as L,a as G,b as Q}from"./identity-BVf8yWa4.js";import{a as W,r as Y}from"./rotation-relay-DCS7Aa59.js";import{o as K,j as X,a as Z,s as ee,n as te,_ as ne}from"./native-worker-zod-5c0ed887-B342B6ko.js";import{v as se,i as ae,c as re,a as oe,b as ie,d as ce,l as de,e as le,s as ue}from"./drop-open-BjgdLxWM.js";import{S as fe}from"./InvokeScreen-C-kFFYVF.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./signals-DdOHdr--.js";import"./seams-DJ_lslby.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-catalog-status-INsDvLpU.js";import"./github-app-local-B-4pPsY4.js";import"./connect-plan-ClXbb_FT.js";import"./bucket-saved-vQCiVvN_.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";async function pe(t,n,s){return function(e){return!0===e?.includes("ai.password-reset")}(t)?await async function(e){let t={};if(e)try{t=await E(e)}catch{return!1}const n=e=>!q(t,e).enabled,s=e=>!q(t,N(e.connectionId)).enabled,a=(await O().catch(()=>[])).filter(e=>"revoked"!==e.status&&"cua_runtime"===P(e.providerId)?.category);return!!a.some(e=>!n(e.providerId)&&!s(e))||R().some(e=>"cua_runtime"===e.category&&e.configured&&e.autoConfigurable&&!n(e.id)&&!a.some(t=>t.providerId===e.id&&s(t)))}(s)?function(t){return e(t)}(n)?{ok:!0}:{ok:!1,reason:"model"}:{ok:!1,reason:"runtime"}:{ok:!1,reason:"feature-off"}}const me="password-reset.vault-runs.v1",he=new Set;function we(e){return he.add(e),()=>{he.delete(e)}}function ye(){const e=t(me);if(!e)return[];try{const t=z(JSON.parse(e));return Array.isArray(t)?t.flatMap(e=>function(e){if(!H(e))return null;if(!M(e.scope)||!M(e.itemId))return null;if(!M(e.phase)||!M(e.updatedAt))return null;const t=e.phase;if("queued"!==t&&"in-progress"!==t&&"needs-you"!==t&&"done"!==t&&"failed"!==t)return null;const n=null==e.detail?null:M(e.detail)?e.detail:null;return{scope:e.scope,itemId:e.itemId,phase:t,updatedAt:e.updatedAt,detail:n,runId:M(e.runId)?e.runId:null}}(e)??[]):[]}catch{return[]}}function be(e){n(me,JSON.stringify(e)),function(){for(const e of he)e()}()}function ve(e,t){return ye().find(n=>n.scope===e&&n.itemId===t)??null}function ge(e,t,n,s,a=new Date,r){const o=ve(e,t),i={scope:e,itemId:t,phase:n,updatedAt:a.toISOString(),detail:s,runId:void 0===r?o?.runId??null:r},c=ye().filter(n=>n.scope!==e||n.itemId!==t);return"done"===n?(be(c),i):(be([...c,i]),i)}const je=ee().nullable().optional(),xe=K({id:ee(),job_id:je,origin:ee().optional(),control_state:ee(),driver:ee().optional(),blocked_reason:je,lease_expires_at:je,closed_at:je,observation:ee().optional()}),ke=K({runs:Z(X())}),Ie=K({id:ee()}),_e=K({id:ee(),status:ee().optional()}),Se=K({status:ne(["accepted","queued"]),hint:ee()}),$e=K({run_id:ee(),seq:te(),request:K({step:ee().optional(),selector:ee().optional(),url:ee().optional()}).catchall(X()),claim_expires_at:je}),Ce=K({sequence:te(),interception_point:ee(),decision:ee(),reason:je,recorded_at:ee()}),Te=K({run_id:ee(),records:Z(X()),next_after:X().optional(),has_more:X().optional()}),Ae=new Set(["awaiting_human","suspended"]),Oe=new Set(["done","failed"]);function Pe(e){switch(e){case"awaiting_human":return"Parked — waiting for you";case"handoff_requested":return"Handoff requested — the agent is parking";case"suspended":return"Suspended — take over to re-attach";case"human_driving":return"You are driving";case"resume_requested":return"Handed back — the agent is re-checking the page";case"agent_driving":return"The agent is driving";default:return e}}function Ee(e){return D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Verify to control",title:"Verify to control",disabled:e.busy,onClick:()=>{e.verify()},children:D.jsx(c,{size:18})})}function qe(e){const t=(n=e.run).closed_at?[]:Ae.has(n.control_state)?["take"]:"human_driving"===n.control_state?["release","claim"]:["handoff_requested","resume_requested"].includes(n.control_state)?[]:["handoff"];var n;const{act:s,client:a,runId:r}=e;return D.jsxs("div",{className:"keyed-row",children:[t.length>0&&!e.authenticated?D.jsx(Ee,{busy:e.busy,verify:e.verify}):null,e.authenticated&&t.includes("handoff")?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Request handoff",title:"Request handoff",disabled:e.busy,onClick:()=>{s(async()=>{await a.requestHandoff(r)})},children:D.jsx(d,{size:18})}):null,e.authenticated&&t.includes("take")?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Take over",title:"Take over",disabled:e.busy,onClick:()=>{s(()=>a.takeControl(r))},children:D.jsx(c,{size:18})}):null,e.authenticated&&t.includes("release")?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Hand back & resume",title:"Hand back & resume",disabled:e.busy,onClick:()=>{s(()=>a.release(r))},children:D.jsx(l,{size:18})}):null]})}function Ne(e){const t=function(e){switch(e){case"navigate":case"wait_for":case"submit":return"done";case"fill_credential":return"filled";case"assert_present":return"presence";case"read_dom_redacted":return"dom";case"screenshot_redacted":return"frame";case"verify_login":return"verified";case"capture_credential":case"capture_download":return"captured";default:return null}}(e.step.request.step),n=function(e,t=Date.now()){if(!e.claim_expires_at)return!1;const n=Date.parse(e.claim_expires_at);return Number.isFinite(n)&&n<=t}(e.step);return D.jsxs("div",{children:[D.jsxs("p",{children:["Step ",e.step.seq,": ",e.step.request.step??"step",e.step.request.selector?` · ${e.step.request.selector}`:"",e.step.request.url?` · ${e.step.request.url}`:""]}),D.jsxs("div",{className:"keyed-row",children:["done"===t?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"I did this",title:"I did this",disabled:e.busy,onClick:()=>e.settle({outcome:"done"}),children:D.jsx(f,{size:18})}):null,D.jsx("button",{type:"button",className:"icon-btn","aria-label":"I can't do this",title:"I can't do this",disabled:e.busy,onClick:()=>e.settle({outcome:"failed",error:"challenge"}),children:D.jsx(p,{size:18})}),n?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Reacquire step",title:"Reacquire step",disabled:e.busy,onClick:()=>e.reacquire(),children:D.jsx(u,{size:18})}):null]}),n?D.jsx("p",{children:"This claim has expired. Reacquire the step to finish it."}):null,null!==t&&"done"!==t?D.jsxs("p",{children:["This step expects a ",t," result from the page driver; this panel never invents one."]}):null]})}function Re(e){const[t,n]=B.useState(null),{act:s,client:a,runId:r}=e;return D.jsxs(D.Fragment,{children:[D.jsx("p",{children:"The browser session is yours — the agent cannot drive while you hold it. Complete the challenge in the live session, then hand back. Anything you do is recorded as your segment of the ceremony; passwords are never shown or stored here."}),null===t?D.jsx("button",{type:"button",className:"icon-btn","aria-label":"Check for a step",title:"Check for a step",disabled:e.busy,onClick:()=>{s(async()=>n(await a.claimStep(r)))},children:D.jsx(u,{size:18})}):D.jsx(Ne,{step:t,busy:e.busy,reacquire:()=>{s(async()=>n(await a.claimStep(r)))},settle:e=>{s(async()=>{await a.settleStep(r,t.seq,e),n(null)})}})]})}function ze({records:e}){return 0===e.length?null:D.jsxs(D.Fragment,{children:[D.jsx("h2",{children:"Run record"}),D.jsx("ul",{children:e.map(e=>D.jsxs("li",{children:[e.interception_point," · ",e.decision,e.reason?` · ${e.reason}`:""]},e.sequence))})]})}function He({client:e}){const{runId:t=""}=U(),n=B.useRef(null);n.current??=e??function(){const e=e=>async(t,n)=>{const s={method:e};void 0!==n&&(s.headers={"content-type":"application/json"},s.body=JSON.stringify(n));const a=await G(t,s);return{status:a.status,json:async()=>X().parse(await a.json())}};return function(e){const t=e=>`/api/v1/agent/runs/${encodeURIComponent(e)}`;async function n(e,t){if(e.status<200||e.status>=300)throw new Error("The run could not be reached on the Host.");const n=xe.parse(await e.json());if(n.id!==t)throw new Error("The Host returned a different run.");return n}async function s(s,a,r){const o=await e.authorize(a,s);if(!o)throw new Error("Verification did not grant control.");return n(await e.post(`${t(s)}/${r}`,{elevation:o}),s)}return{authenticate:()=>e.authenticate(),getRun:async s=>n(await e.get(t(s)),s),requestHandoff:async n=>{const s=await e.authorize("handoff",n);if(!s)throw new Error("Verification did not grant control.");const a=await e.post(`${t(n)}/handoff`,{elevation:s});if(202!==a.status)throw new Error("The handoff could not be requested on the Host.");return Se.parse(await a.json())},takeControl:e=>s(e,"take","control"),release:e=>s(e,"release","release"),claimStep:async n=>{const s=await e.post(`${t(n)}/steps/claim`);if(204===s.status)return null;if(s.status<200||s.status>=300)throw new Error("No step could be claimed.");const a=$e.parse(await s.json());if(a.run_id!==n)throw new Error("The Host returned a step from a different run.");return a},settleStep:async(n,s,a)=>{if(!Oe.has(a.outcome))throw new Error("This panel cannot report that outcome; it never invents page payloads.");const r=await e.post(`${t(n)}/steps/${s}/outcome`,{outcome:a});if(r.status<200||r.status>=300)throw new Error("The Host refused that outcome.")},listHookRecords:async n=>{const s=[];let a=null;for(let r=0;r<100;r+=1){const r=null===a?"":`&after=${a}`,o=await e.get(`${t(n)}/hook-records?limit=20${r}`);if(o.status<200||o.status>=300)return s;const i=Te.safeParse(await o.json());if(!i.success||i.data.run_id!==n)return s;const c=i.data;for(const e of c.records){const t=Ce.safeParse(e);t.success&&s.push(t.data)}const d=te().safeParse(c.next_after);if(!0!==c.has_more||!d.success)return s;a=d.data}throw new Error("The run record exceeded the pagination bound.")}}}({get:e("GET"),post:e("POST"),authenticate:async()=>{const e=F(L());if(!e)throw new Error("This browser has no approved Host grant.");await W({operation:"browser.authenticate",target_id:e.clientId,transition:null},(new AbortController).signal)},authorize:(e,t)=>W({operation:"agent.browser.control",target_id:t,transition:e},(new AbortController).signal)})}();const s=n.current,{run:a,records:r,busy:o,authenticated:c,act:d,verify:l}=function(e,t){const[n,s]=B.useState(null),[a,r]=B.useState([]),[o,c]=B.useState(null),[d,l]=B.useState(null),[u,f]=B.useState(!1),[p,m]=B.useState(!1);i(`takeover-${t}`,"Browser takeover",d??o);const h=B.useCallback(async()=>{try{const[n,a]=await Promise.all([e.getRun(t),e.listHookRecords(t)]);if(n.id!==t)return;s(n),r(a),c(null)}catch{c("The run could not be reached on the Host.")}},[e,t]);B.useEffect(()=>{s(null),r([]),c(null),l(null),f(!1),h();const e=setInterval(()=>{h()},3e3);return()=>clearInterval(e)},[h]);const w=async e=>{m(!0),l(null);try{await e(),await h()}catch(t){l(t instanceof Error?t.message:"That did not go through.")}finally{m(!1)}};return{run:n,records:a,busy:p,authenticated:u,act:w,verify:()=>w(async()=>{await e.authenticate(),f(!0)})}}(s,t);return D.jsxs("section",a?{"aria-label":"Browser takeover",children:[D.jsx("h1",{children:"Browser takeover"}),D.jsxs("p",{children:[a.origin??"Provider site"," · ",Pe(a.control_state),a.blocked_reason?` · ${a.blocked_reason}`:""]}),D.jsx(qe,{run:a,busy:o,authenticated:c,act:d,verify:l,client:s,runId:t}),"human_driving"===a.control_state&&c?D.jsx(Re,{busy:o,act:d,client:s,runId:t},t):null,D.jsx(ze,{records:r})]}:{"aria-label":"Browser takeover",children:[D.jsx("h1",{children:"Browser takeover"}),D.jsx("p",{children:"Loading the run…"}),c?null:D.jsx(Ee,{busy:o,verify:l})]})}const Me=[{id:"email-account",version:"1.0.0",text:'{\n  "apiVersion": "opensesame.dev/v1alpha1",\n  "kind": "VaultItemType",\n  "metadata": {\n    "id": "email-account",\n    "version": "1.0.0",\n    "publisher": "https://opensesame.dev"\n  },\n  "spec": {\n    "title": "Email account",\n    "plural": "Email accounts",\n    "extension": ".mail",\n    "summary": "A mailbox and the incoming and outgoing servers a mail client needs to reach it.",\n    "categories": ["access"],\n    "sections": [\n      {\n        "id": "account",\n        "title": "Account",\n        "fields": [\n          {\n            "id": "address",\n            "type": "email",\n            "label": "Address",\n            "required": true\n          },\n          { "id": "username", "type": "string", "label": "Username" },\n          { "id": "password", "type": "password", "label": "Password" }\n        ]\n      },\n      {\n        "id": "servers",\n        "title": "Servers",\n        "fields": [\n          { "id": "incoming", "type": "host-port", "label": "Incoming server" },\n          {\n            "id": "incomingProtocol",\n            "type": "select",\n            "label": "Incoming protocol",\n            "options": ["imap", "pop3", "jmap", "exchange"]\n          },\n          { "id": "outgoing", "type": "host-port", "label": "Outgoing server" },\n          {\n            "id": "security",\n            "type": "select",\n            "label": "Security",\n            "options": ["tls", "starttls", "none"]\n          }\n        ]\n      }\n    ],\n    "native": {\n      "secret": "password",\n      "trailer": [\n        { "key": "email", "field": "address" },\n        { "key": "username", "field": "username" },\n        { "key": "incoming", "field": "incoming" },\n        { "key": "incoming_protocol", "field": "incomingProtocol" },\n        { "key": "outgoing", "field": "outgoing" },\n        { "key": "security", "field": "security" }\n      ]\n    },\n    "cxf": { "credential": "custom-fields" },\n    "subtitle": ["address"],\n    "search": ["address", "username"]\n  }\n}\n'}],Je=new WeakMap;function Ve(e=se){const t=Je.get(e);if(t)return t;const n=async function(e){for(const{id:t,version:n,text:s}of Me){const a=ae().get(t);if(a&&re(a.metadata.version,n)>=0)continue;const r=await e.installItemTypeDefinition(s);if(!r.ok)throw new Error(`The ${t} item type could not be installed: ${r.message}`)}}(e).finally(()=>Je.delete(e));return Je.set(e,n),n}const Be=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/i;function De(e){const t=e.trim().replace(/^https:\/\//i,"").replace(/\/+$/,"").toLowerCase();return""!==t&&Be.test(t)&&t.includes(".")?t:null}function Ue(e){const t=m(e);if(!t?.readable||!h(e))return null;const n=e.values.incoming;if(void 0===n||M(n)||Array.isArray(n))return null;const s=De(n.host??""),a=function(e){const t=e.trim();if(""===t||"443"===t)return"";if(!/^\d{1,5}$/.test(t))return null;const n=Number(t);return n>=1&&n<=65535?String(n):null}(n.port??""),r=e.values.password;if(null===s||null===a||!M(r))return null;const o=e.values.username;return{origin:""===a?`https://${s}`:`https://${s}:${a}`,username:M(o)?o.trim():"",password:r,address:t.address}}const Fe=["imap","pop3","jmap","exchange"],Le=["tls","starttls","none"],Ge={address:"",name:"",server:{host:"",port:"",protocol:"jmap",security:"tls",username:"",password:""}};function Qe(e){return M(e)?e:""}function We(e,t){return void 0===e||M(e)||Array.isArray(e)?"":e[t]??""}function Ye(e,t,n){return e.find(e=>e===t)??n}function Ke(e,t,n){const{server:s}=e,a=s.host.trim(),r=Qe(n?.values.password);return""===a?{address:t}:{address:t,username:s.username.trim(),password:""!==s.password?s.password:r,incoming:{host:a,port:s.port.trim()},incomingProtocol:s.protocol,security:s.security}}function Xe(e,t,n){const s=w(e.address);return null===s?{ok:!1,refusal:"address"}:(a=e.server).protocol===y&&"none"!==a.security&&""!==a.host.trim()&&null===De(a.host)?{ok:!1,refusal:"host"}:function(e){if(""===e)return!0;if(!/^\d{1,5}$/.test(e))return!1;const t=Number(e);return t>=1&&t<=65535}(e.server.port.trim())?function(e,t,n){return ie([...e]).some(e=>e.id!==n&&m(e)?.address===t)}(t,s,n)?{ok:!1,refusal:"duplicate"}:{ok:!0,address:s}:{ok:!1,refusal:"port"};var a}function Ze({id:e,label:t,value:n,onChange:s,type:a,invalid:r,placeholder:o,plain:i=!1}){return D.jsxs("div",{className:"field",children:[D.jsx("label",{htmlFor:e,children:t}),D.jsx("input",{id:e,type:a,autoComplete:"password"===a?"new-password":"off",autoCapitalize:i?"none":void 0,spellCheck:!i&&void 0,"aria-invalid":r,placeholder:o,value:n,onChange:e=>s(e.target.value)})]})}function et({id:e,label:t,value:n,choices:s,onChange:a}){return D.jsxs("div",{className:"field",children:[D.jsx("label",{htmlFor:e,children:t}),D.jsx("select",{id:e,value:n,onChange:e=>{const t=s.find(t=>t===e.target.value);t&&a(t)},children:s.map(e=>D.jsx("option",{value:e,children:e.toUpperCase()},e))})]})}function tt({id:e,server:t,invalidHost:n,invalidPort:s,savedPassword:a,onChange:r}){return D.jsxs(D.Fragment,{children:[D.jsx(Ze,{id:`${e}-host`,label:"Mail server",plain:!0,invalid:n,value:t.host,onChange:e=>r({host:e})}),D.jsx(Ze,{id:`${e}-port`,label:"Port",invalid:s,value:t.port,onChange:e=>r({port:e})}),D.jsx(et,{id:`${e}-protocol`,label:"Protocol",value:t.protocol,choices:Fe,onChange:e=>r({protocol:e})}),D.jsx(et,{id:`${e}-security`,label:"Security",value:t.security,choices:Le,onChange:e=>r({security:e})}),D.jsx(Ze,{id:`${e}-username`,label:"Username",plain:!0,value:t.username,onChange:e=>r({username:e})}),D.jsx(Ze,{id:`${e}-password`,label:"Password",type:"password",placeholder:a?"••••••••":void 0,value:t.password,onChange:e=>r({password:e})})]})}function nt({draft:e,advanced:t,invalid:n,savedPassword:s,onChange:a}){const r=B.useId();return D.jsxs("div",{className:"editor__grid",children:[D.jsx(Ze,{id:`${r}-address`,label:"Reset email",type:"email",invalid:"address"===n,value:e.address,onChange:t=>a({...e,address:t})}),t?D.jsxs(D.Fragment,{children:[D.jsx(Ze,{id:`${r}-name`,label:"Name",value:e.name,onChange:t=>a({...e,name:t})}),D.jsx(tt,{id:r,server:e.server,invalidHost:"host"===n,invalidPort:"port"===n,savedPassword:s,onChange:t=>a({...e,server:{...e.server,...t}})})]}):null]})}function st({initial:e=Ge,savedPassword:t=!1,startAdvanced:n=!1,adding:s,onSave:a,onClose:r}){const[o,i]=B.useState(e),[c,d]=B.useState(n),[l,u]=B.useState(null),[m,h]=B.useState(!1);return D.jsxs("form",{className:"editor__grid",noValidate:!0,onSubmit:e=>{e.preventDefault(),(async()=>{if(!m){h(!0);try{const e=await a(o);e.ok?(u(null),s&&(i(Ge),d(!1))):u(e.field)}finally{h(!1)}}})()},children:[D.jsx(nt,{draft:o,advanced:c,invalid:l,savedPassword:t,onChange:e=>{i(e),u(null)}}),D.jsxs("div",{className:"field-inline",children:[D.jsx(b,{type:"submit",label:s?"Add reset email":"Save reset email",disabled:m,children:D.jsx(s?v:f,{size:16})}),D.jsx(b,{small:!0,label:c?"Hide mail server":"Show mail server","aria-expanded":c,onClick:()=>d(!c),children:D.jsx(c?g:j,{size:16})}),r?D.jsx(b,{small:!0,label:"Close editor",onClick:r,children:D.jsx(p,{size:16})}):null]})]})}function at({mailbox:e,configured:t}){return e.readable?D.jsx(fe,{tone:"ok",label:"Its mail can be read"}):t?D.jsx(fe,{tone:"warn",label:"Its mail is not read: it needs a JMAP server over TLS and a password"}):null}function rt({mailbox:e,draft:t,bound:n,onSave:s,onRemove:a}){const[r,o]=B.useState(!1);return r?D.jsx(st,{adding:!1,initial:t,savedPassword:e.readable,startAdvanced:e.readable||""!==t.server.host,onSave:async e=>{const t=await s(e);return t.ok&&o(!1),t},onClose:()=>o(!1)}):D.jsxs("div",{className:"field-inline","data-mailbox":e.id,children:[D.jsx(at,{mailbox:e,configured:""!==t.server.host}),D.jsx("span",{children:e.name===e.address?e.address:`${e.name} (${e.address})`}),D.jsx(b,{small:!0,label:`Edit ${e.address}`,onClick:()=>o(!0),children:D.jsx(x,{size:16})}),0===n?D.jsx(b,{small:!0,label:`Remove ${e.address}`,onClick:a,children:D.jsx(k,{size:16})}):null]})}function ot(e){switch(e){case"address":return"That is not an email address.";case"duplicate":return"That address is already a mailbox.";case"host":return"The mail server is a host name, such as mail.example.com.";case"port":return"The port is a number from 1 to 65535.";case"missing":return"That mailbox is no longer in the vault."}}function it(e){switch(e){case"address":case"duplicate":return"address";case"host":return"host";case"port":return"port";case"missing":return null}}const ct=()=>se.getSnapshot();function dt(){const e=B.useSyncExternalStore(se.subscribe,ct,ct),[t,n]=B.useState(null);i("password-reset-mailbox","Reset email not saved",t?.message??null,"err",{occurrence:t});const s=B.useMemo(()=>I(e.items).flatMap(t=>{const n=e.items.find(e=>e.id===t.id),s=n?function(e){return h(e)?{address:Qe(e.values.address),name:e.name,server:{host:We(e.values.incoming,"host"),port:We(e.values.incoming,"port"),protocol:Ye(Fe,Qe(e.values.incomingProtocol),"jmap"),security:Ye(Le,Qe(e.values.security),"tls"),username:Qe(e.values.username),password:""}}:null}(n):null;return s?[{mailbox:t,draft:s}]:[]}),[e.items]);if("unlocked"!==e.status)return null;const a=async e=>{try{return(t=await e()).ok?(n(null),{ok:!0}):(n({message:ot(t.refusal)}),{ok:!1,field:it(t.refusal)})}catch{return n({message:"The reset email could not be saved."}),{ok:!1,field:null}}var t};return D.jsxs("div",{className:"editor__grid",children:[s.map(({mailbox:t,draft:n})=>D.jsx(rt,{mailbox:t,draft:n,bound:_(e.items,t.id).length,onSave:e=>a(()=>async function(e,t,n){const s=e.getSnapshot().items.find(e=>e.id===t&&h(e));if(!s)return{ok:!1,refusal:"missing"};const a=Xe(n,e.getSnapshot().items,t);if(!a.ok)return a;const{address:r}=a,o={...s,name:n.name.trim()||r,values:Ke(n,r,s)};await e.saveItem(o);const i=m(o);if(!i)throw new Error("a saved mailbox did not read back");return{ok:!0,mailbox:i}}(se,t.id,e)),onRemove:()=>{!async function(e,t){const n=e.getSnapshot().items.find(e=>e.id===t);n&&h(n)&&await e.trashItem(t)}(se,t.id)}},t.id)),D.jsx(st,{adding:!0,onSave:e=>a(()=>async function(e,t){const n=Xe(t,e.getSnapshot().items);if(!n.ok)return n;const{address:s}=n;await Ve(e);const a=ae().get("email-account");if(!a)throw new Error("email-account is not installed");const r=oe(a,Ke(t,s,void 0),t.name.trim()||s);await e.saveItem(r);const o=m(r);if(!o)throw new Error("a saved mailbox did not read back");return{ok:!0,mailbox:o}}(se,e))})]})}const lt={handOff:null},ut=new Set(["awaiting_human","handoff_requested","suspended"]);function ft(e){return`agent-run:${e}`}async function pt(e,t,n,s){const a=n.find(e=>e.job_id===t.runId)??null;if(!s?.aborted){if(!a||a.closed_at||!ut.has(a.control_state))return a&&!a.closed_at?(ce(ft(t.runId??a.id)),void("needs-you"===t.phase&&ge(t.scope,t.itemId,"in-progress",null))):void(await async function(e,t,n,s){const a=t.runId;if(!a)return;const r=await e.getRotationJob(a).catch(()=>null);if(!s?.aborted&&ve(t.scope,t.itemId)?.runId===a&&("succeeded"===r?.status||"failed"===r?.status))if(ce(ft(a)),"succeeded"===r.status)ge(t.scope,t.itemId,"done",null);else{ge(t.scope,t.itemId,"failed","The password reset did not complete.");const e=`password-reset:${a}:failed`;de().some(t=>t.id===e)||le({id:e,tone:"err",title:"Password reset failed",body:"The password reset did not complete. Review the vault item and try again."})}}(e,t,0,s));!function(e,t){const n=ft(e.runId??t.id);var s;de().some(e=>e.id===n)||le({id:n,tone:"warn",title:"Password reset needs you",body:t.blocked_reason??"The agent is paused on the provider site. Take over the browser session to continue.",open:{to:(s=t.id,`/runs/${encodeURIComponent(s)}`),label:"Take over"}}),"needs-you"!==e.phase&&ge(e.scope,e.itemId,"needs-you",t.blocked_reason??"The reset needs you.")}(t,a)}}async function mt(e){try{const t=await G("/api/v1/rotations",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({web_login_origin:e,execute_now:!0})});if(!t.ok)return{accepted:!1,jobId:null};const n=Ie.safeParse(await t.json().catch(()=>null));return{accepted:!0,jobId:n.success?n.data.id:null}}catch{return{accepted:!1,jobId:null}}}const ht="password-reset-handled.v1",wt=72e5;function yt(e){const t=new Map;if(void 0===e||!H(e))return t;for(const[n,s]of Object.entries(e))J(s)&&t.set(n,s);return t}function bt(){const e=t(ht),n={announced:new Map,handedOff:new Map};if(!e)return n;try{const t=z(JSON.parse(e));return H(t)?{announced:yt(t.announced),handedOff:yt(t.handedOff)}:n}catch{return n}}function vt(e){n(ht,JSON.stringify({announced:Object.fromEntries(e.announced),handedOff:Object.fromEntries(e.handedOff)}))}async function gt(e,t,n){const s=(new TextEncoder).encode(`${e}\n${t}\n${n}`),a=await crypto.subtle.digest("SHA-256",s);return[...new Uint8Array(a)].slice(0,16).map(e=>e.toString(16).padStart(2,"0")).join("")}function jt(e,t){return bt()[e].has(t)}function xt(e,t){return new Map([...e].filter(([,e])=>t-e<=wt))}function kt(e,t,n){const s=bt(),a={announced:xt(s.announced,n),handedOff:xt(s.handedOff,n)};a[e].set(t,n),vt(a)}function It(e,t){const n=bt();n[e].delete(t)&&vt(n)}const _t=new Map;function St(e){return`${e.itemId}\n${e.origin}\n${e.messageId}`}function $t(e,t=Date.now()){const n=[...crypto.getRandomValues(new Uint8Array(16))].map(e=>e.toString(16).padStart(2,"0")).join("");return _t.set(St(e),{...e,nonce:n,expiresAt:t+3e5}),n}function Ct(e,t=Date.now()){const n=St(e),s=_t.get(n);return s?(_t.delete(n),s.expiresAt>t?s.nonce:null):null}class Tt extends Error{code;constructor(e){super(`the mail server could not be read (${e})`),this.name="JmapError",this.code=e}}const At="urn:ietf:params:jmap:mail",Ot=["/jmap/session","/.well-known/jmap"];function Pt(e){if(""===e.username)return`Bearer ${e.password}`;const t=(new TextEncoder).encode(`${e.username}:${e.password}`);let n="";for(const s of t)n+=String.fromCharCode(s);return`Basic ${btoa(n)}`}async function Et(e,t,n,s){try{return await e(t,{...n,signal:s})}catch{throw new Tt("unreachable")}}async function qt(e,t){try{const t=z(await e.json());if(H(t))return t}catch{if(t.aborted)throw new Tt("unreachable")}throw new Tt("malformed")}function Nt(e){const t=e.primaryAccounts;if(H(t)&&M(t[At]))return t[At];const n=e.accounts;return H(n)?Object.keys(n)[0]??null:null}function Rt(e,t){try{return new URL(e,t)}catch{return null}}function zt(e,t){return[["Email/query",{accountId:e,filter:{after:t.since.toISOString()},sort:[{property:"receivedAt",isAscending:!1}],limit:t.limit??25},"q"],["Email/get",{accountId:e,"#ids":{resultOf:"q",name:"Email/query",path:"/ids"},properties:["id","subject","receivedAt","textBody","bodyValues"],fetchTextBodyValues:!0,maxBodyValueBytes:16384},"g"]]}function Ht(e){const t=e.bodyValues,n=e.textBody;if(!H(t)||!Array.isArray(n))return"";const s=[];for(const a of n){if(!H(a)||!M(a.partId))continue;const e=t[a.partId];H(e)&&M(e.value)&&s.push(e.value)}return s.join("\n")}async function Mt(e,t,n){const s=new AbortController,a=setTimeout(()=>s.abort(),3e4),{signal:r}=s;try{const s=await async function(e,t,n){const s={authorization:Pt(e),accept:"application/json"};let a="unsupported";for(const r of Ot){const o=await Et(t,`${e.origin}${r}`,{method:"GET",headers:s,credentials:"omit",redirect:"manual"},n);if(401===o.status||403===o.status)throw new Tt("unauthorized");if(!o.ok)continue;const i=await qt(o,n),c=Nt(i);if(!M(i.apiUrl)||null===c){a="malformed";continue}const d=Rt(i.apiUrl,e.origin);if(null===d||d.origin!==e.origin)throw new Tt("malformed");return{apiUrl:d.toString(),accountId:c}}throw new Tt(a)}(e,t,r),a=await Et(t,s.apiUrl,{method:"POST",headers:{authorization:Pt(e),"content-type":"application/json",accept:"application/json"},credentials:"omit",redirect:"manual",body:JSON.stringify({using:["urn:ietf:params:jmap:core",At],methodCalls:zt(s.accountId,n)})},r);if(401===a.status||403===a.status)throw new Tt("unauthorized");if(!a.ok)throw new Tt("unsupported");return function(e,t){const n=e.methodResponses;if(!Array.isArray(n))throw new Tt("malformed");for(const s of n){if(!Array.isArray(s)||"Email/get"!==s[0])continue;const e=s[1];if(!H(e)||!Array.isArray(e.list))throw new Tt("malformed");return e.list.flatMap(e=>H(e)&&M(e.id)?[{id:e.id,mailbox:t.address,subject:M(e.subject)?e.subject:"",text:Ht(e)}]:[])}throw new Tt("unsupported")}(await qt(a,r),e)}finally{clearTimeout(a)}}const Jt="password-reset-mail.v1";function Vt(){const e=t(Jt);if(!e)return{};try{const t=z(JSON.parse(e));return H(t)&&H(t.byVault)?function(e){const t=[];for(const[n,s]of Object.entries(e)){if(!Array.isArray(s))continue;const e=s.flatMap(Bt);e.length>0&&t.push([n,e])}return Object.fromEntries(t)}(t.byVault):{}}catch{return{}}}function Bt(e){if(!H(e)||!M(e.id)||!M(e.address))return[];const t=w(e.address);return t?[{id:e.id,address:t}]:[]}function Dt(e){switch(e){case"unauthorized":return"The mail server refused the login.";case"unreachable":return"The mail server could not be reached.";case"unsupported":return"The mail server does not answer JMAP.";case"malformed":return"The mail server answered in a way that could not be read."}}async function Ut(e){try{return(await G("/api/v1/rotations",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({web_login_origin:e,execute_now:!0})})).ok}catch{return!1}}const Ft="ai.password-reset",Lt="features.feature-password-reset",Gt={capability:Ft,async activate(e){const t=T(e,Ft);if(await e.hydrate([me]),t.disposed())return t.handle();t.register("settings-panel",{id:"password-reset-mail",label:"Password reset",category:Lt,Panel:dt,order:10});const i=function(e){const t=e.now??Date.now,a=e.items??(()=>se.getSnapshot().items),r=e.unlocked??(()=>"unlocked"===se.getSnapshot().status),o=e.handOff??Ut;let i=!1;async function c(){if(!i&&r()){i=!0;try{await async function(e,t=Q()){const a=function(e=Q()){return Vt()[e]??[]}(t);if(0===a.length)return 0;await Ve(e);const r=ae().get("email-account");if(!r)throw new Error("email-account is not installed");let o=0;for(const n of a){if(e.getSnapshot().items.some(e=>e.id===n.id||m(e)?.address===n.address))continue;const t=oe(r,{address:n.address},n.address);await e.saveItem({...t,id:n.id}),o+=1}return function(e){const t=Vt();delete t[e],0===Object.keys(t).length?s(Jt):n(Jt,JSON.stringify({byVault:t}))}(t),o}(se).catch(()=>0);const r=a();await async function(e,n){const s=I(e),a=await $();for(const r of C(s,function(e){return e.flatMap(e=>"account"===e.kind?[{id:e.id,resetEmailId:e.resetEmailId,uris:e.uris.map(e=>e.uri)}]:[])}(e),n)){const n=await gt(r.itemId,r.origin,r.messageId??""),s=e.find(e=>e.id===r.itemId),i={itemId:r.itemId,origin:r.origin,messageId:r.messageId??""},c=async()=>!(jt("handedOff",n)||!Ct(i,t())||(kt("handedOff",n,t()),!(await o(r.origin))&&(It("handedOff",n),1))),d=a&&!jt("handedOff",n);jt("announced",n)&&!d||(jt("announced",n)||kt("announced",n,t()),ue({id:`password-reset-mail:${n}`,tone:"info",title:"Password reset email",body:`A reset message for ${s?.name||r.origin} arrived.`,...d?{act:{label:"Reset this password",run:()=>{$t(i,t()),c()}}}:void 0})),a&&!jt("handedOff",n)&&await c()}}(r,await async function(n){const s=new Date(t()-wt),a=[];for(const t of I(n)){if(!t.readable)continue;if(0===_(n,t.id).length)continue;const o=n.find(e=>e.id===t.id),i=o?Ue(o):null,c=`password-reset-read:${t.id}`;if(i)try{a.push(...await Mt(i,e.fetch,{since:s})),ce(c)}catch(r){ue({id:c,tone:"warn",title:"Reset email not read",body:`${t.name}: ${Dt(r instanceof Tt?r.code:"unreachable")}`})}else ue({id:c,tone:"warn",title:"Reset email not read",body:`${t.name}: The mail server address could not be used.`})}return a}(r))}finally{i=!1}}}return{scan:c,start:function(e){const t=setInterval(()=>{c()},6e4),n=()=>clearInterval(t);e.aborted?n():(e.addEventListener("abort",n,{once:!0}),c())}}}({fetch:(t,n)=>e.egress.fetch(t,n,{capability:Ft,purpose:A})});var c;return t.register("background-job",{id:"password-reset-mail",start:i.start}),t.register("background-job",{id:"password-reset-run-notices",start:{start(e){const t=function(e,t=5e3){let n=!1,s=!1;const a=new AbortController,r=async()=>{if(!n&&!s){s=!0;try{await async function(e,t){const n=ye().filter(e=>e.runId);if(0===n.length||t?.aborted)return;let s;try{s=await e.listAgentRuns()}catch{return}for(const a of n){if(t?.aborted)return;a.runId&&"failed"!==a.phase&&await pt(e,a,s,t)}}(e,a.signal)}finally{s=!1}}};r();const o=setInterval(()=>{r()},t);return()=>{n=!0,a.abort(),clearInterval(o)}}({listAgentRuns:async()=>{const e=await G("/api/v1/agent/runs");if(!e.ok)throw new Error("agent runs unavailable");const t=ke.safeParse(await e.json());return t.success?t.data.runs.flatMap(e=>{const t=xe.safeParse(e);return t.success?[t.data]:[]}):[]},getRotationJob:async e=>{const t=await G(`/api/v1/rotations/${encodeURIComponent(e)}`);if(!t.ok)return null;const n=_e.safeParse(await t.json().catch(()=>null));return n.success&&n.data.id===e?n.data:null}});e.aborted?t():e.addEventListener("abort",t,{once:!0})}}.start}),t.register("route",{id:"password-reset-takeover",path:"/runs/:runId",element:He,framed:!0,order:70}),t.onDispose((c=e.vault,V({subscribeRuns:we,runPhaseFor:(e,t)=>ve(e,t)?.phase??null,evaluateReadiness:async e=>{const t=await a(),n=r(o(),t),s=await pe(e,n,c.tomb);return s.ok?{ok:!0}:{ok:!1,reason:s.reason}}}))),t.onDispose(function(e){const t=Y.relay,n=lt.handOff;return lt.handOff=mt,Y.relay=async t=>{if(!(await e.readiness()).ok)return{ok:!1,detail:"Password reset is not configured."};const n=se.getSnapshot().items.find(e=>e.id===t.itemId)??null;return async function(e,t,n=new Date){if(s=ve(e.scope,e.itemId),"in-progress"===s?.phase||"needs-you"===s?.phase&&null!==s.runId)return{ok:!1,detail:"A password reset is already running."};var s;ge(e.scope,e.itemId,"queued",null,n,null);const a="account"===t?.kind?S(t):null;if(!a)return ge(e.scope,e.itemId,"failed","No https site is configured for this item.",n),{ok:!1,detail:"No https site is configured for this item."};const r=lt.handOff;if(!r)return ge(e.scope,e.itemId,"needs-you","Password reset is not wired on this device.",n),{ok:!1,detail:"Password reset is not wired on this device."};ge(e.scope,e.itemId,"in-progress",null,n,null);try{const t=await r(a);return!0===t||!1!==t&&t.accepted?(ge(e.scope,e.itemId,"in-progress",null,n,!0===t||!1===t?null:t.jobId??null),{ok:!0}):(ge(e.scope,e.itemId,"needs-you","The reset needs you on the provider site.",n),{ok:!1,detail:"The reset needs you on the provider site."})}catch{return ge(e.scope,e.itemId,"failed","The password reset could not be started.",n),{ok:!1,detail:"The password reset could not be started."}}}(t,n)},()=>{Y.relay=t,lt.handOff=n}}({readiness:async()=>{const t=await a();return pe(["ai.password-reset"],r(o(),t),e.vault.tomb)}})),t.handle()}};export{Ft as CAPABILITY,Lt as PASSWORD_RESET_PANEL_CATEGORY,Gt as capabilityRuntime};

package/dist/assets/cap-connectors.external-dKuiKE5J.js

@@ -0,0 +1 @@
+import{a as e}from"./github-app-local-B-4pPsY4.js";import{c as t,n as r,r as n}from"./native-catalog-status-INsDvLpU.js";import{s as o,D as s}from"./connector-directory-gjDOqgWh.js";import{t as i,e as a,g as c,C as u,n as l,S as p,r as d,p as f}from"./certs-CDCfMuEi.js";import{F as h}from"./shared-Ck7e2FJN.js";import{u as g,h as w}from"./connections-CNmhCNAV.js";import{b as m,a as v,c as b,d as y,r as C,e as k,f as j,g as I,h as S,i as A,l as E,j as D,v as x,n as z,k as O,m as T,o as P,p as L,q as R,t as M,s as U,u as _,w as q,x as V,y as N,z as B,A as G,B as J,C as W,D as $,E as H,F,G as K,H as Q,I as Y,J as Z,K as X,L as ee,M as te,N as re,O as ne,P as oe,Q as se,R as ie,S as ae,T as ce,U as ue,V as le,W as pe,X as de,Y as fe,Z as he,_ as ge,$ as we,a0 as me,a1 as ve,a2 as be,a3 as ye,a4 as Ce,a5 as ke,a6 as je,a7 as Ie,a8 as Se,a9 as Ae,aa as Ee,ab as De,ac as xe,ad as ze,ae as Oe,af as Te,ag as Pe,ah as Le,ai as Re,aj as Me,ak as Ue,al as _e,am as qe,an as Ve,ao as Ne,ap as Be,aq as Ge}from"./session-connections-WQ2L1zGG.js";import{f as Je,C as We}from"./identity-view-paths-Bi1yigZk.js";import{a as $e}from"./section-nav-goals-B_N-ZW2I.js";import{A as He,a as Fe}from"./types-Ctz6L20B.js";import{c as Ke,r as Qe}from"./BackupEnableSwitch-DwKTWzBG.js";import{c as Ye}from"./connector-marks-BsMcGRbV.js";import{N as Ze,L as Xe,c as et,h as tt,r as rt}from"./main-BrkS-iow.js";import{E as nt,i as ot,t as st}from"./vault-ui-seam-BQGS7RR6.js";import{n as it,b as at}from"./model-key-state-NiiWojtT.js";import{i as ct}from"./vault-credential-custody-DpnBb4qo.js";import{b as ut,r as lt,d as pt}from"./signals-DdOHdr--.js";import{s as dt}from"./tailscale-artifacts-FyY85j_Y.js";import{r as ft,e as ht,l as gt,f as wt,g as mt,s as vt,h as bt,i as yt,j as Ct,k as kt,p as jt,m as It}from"./binary-encoding-D9rJ9tvs.js";import{q as St,t as At,v as Et,u as Dt,w as xt}from"./drop-open-BjgdLxWM.js";import{a as zt}from"./connect-plan-ClXbb_FT.js";import{r as Ot,s as Tt}from"./bucket-saved-vQCiVvN_.js";import{d as Pt}from"./hosted-model-authority-CcNPE44H.js";import{r as Lt}from"./IdentityConnectionSignIn-Bg53RjtJ.js";import{c as Rt,N as Mt}from"./native-implicit-session-B9CuYTBA.js";import{N as Ut,r as _t}from"./native-oauth-http-BDqv664F.js";import{p as qt,n as Vt}from"./native-google-capability-BVj1mBPb.js";import{c as Nt,b as Bt}from"./secret-backends-_-CBukTJ.js";import{c as Gt}from"./native-oauth-resource-runtime-D9u6_l-d.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./model-provider-B6oAnQX9.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./react-dom-BwC4eQlG.js";import"./wake-lock-C_y0fQco.js";import"./identity-BVf8yWa4.js";import"./react-router-XsJY84ug.js";import"./InvokeScreen-C-kFFYVF.js";import"./PageTreeBranch-OgsaK684.js";import"./idp-presets-B1M-P0Ek.js";import"./seams-DJ_lslby.js";import"./listing-page-B-c8QQVp.js";import"./pane-trail-dW-2RSUm.js";import"./local-vault-sessions-CGv9AsFj.js";import"./EmptyTip-DnxQjLsP.js";import"./vault-menu-CqO_AStq.js";import"./MethodPicker-CqQTyAaT.js";import"./vault-list-path-Bh2_KZkq.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./s3-CXe7JlAr.js";import"./files-Bc2ZE3YH.js";import"./native-worker-hash-wasm-9cbb16de-Bp4uJJy_.js";import"./entra-instances-NyEKYI5c.js";import"./local-applications-rigvedS6.js";import"./runtime-2tzejM54.js";import"./local-share-grants-approvals-C89RIn08.js";import"./vaults-B043odav.js";import"./hosted-model-protocol-B8j_voAG.js";import"./federation-configured-restoration-DWAXgzcz.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./commonjs-runtime-R6OqCcd0.js";import"./native-auth-return-BTXjvSvx.js";import"./merge-C8VYouYu.js";import"./native-worker-bitwarden-native-contract-4175b124-DCuX5Y-I.js";import"./native-worker-bitwarden-native-network-protocol-2ec12c2c-DdlqONg5.js";import"./native-worker-bitwarden-native-worker-protocol-f491b626-C1Dz2Mxy.js";import"./native-worker-bitwarden-worker-protocol-c9bedea4-CgZDhS6p.js";function Jt(e,t){const r=dt();if(!r?.nativeHTTP)return e;const n=JSON.stringify(r),o=new Set(r.nativeHTTP.targets.map(e=>e.origin)),s=i(),a=function(e){try{return e?.captureNativeHTTP?.((new AbortController).signal)??null}catch{return null}}(s);let c=!1;const u=()=>{if(!a||i()!==s||JSON.stringify(dt())!==n)throw new Error("Reconnect this provider after connecting the configured browser node.");a.assertCurrent()},l=(r,n,s)=>{const i=new URL(r instanceof Request?r.url:r.toString());if(!o.has(i.origin))return null;e.assertCurrent(),u();const l=t.egress.decide(i,{capability:"connectors.external",purpose:Ze});if(!l.ok)throw new nt(l.code,"connectors.external",l.destination);if(u(),!a)throw new Error("The configured browser node is unavailable.");const p=new Request(r,n),d=[p.signal];return s?d.push(AbortSignal.timeout(15e3)):e.signal&&d.push(e.signal),c=!0,a.fetch(p,{signal:ut(d)})},p=e.settleCredentialMutation,d={...e,capture:void 0,supportsNativeOrigin:r=>{try{e.assertCurrent();const n=new URL(r);if(n.origin!==r||!o.has(r))return!1;u();const s=t.egress.decide(n,{capability:"connectors.external",purpose:Ze});return u(),e.assertCurrent(),s.ok&&(c=!0),s.ok}catch{return!1}},assertCurrent:()=>{e.assertCurrent(),c&&u()},fetch:async(t,r)=>(e.assertCurrent(),l(t,r,!1)??e.fetch(t,r))};return p&&(d.settleCredentialMutation=async(t,r)=>(e.assertCurrent(),l(t,r,!0)??p(t,r))),Object.freeze(d)}function Wt(e,t){return async(r,n)=>{e.assertCurrent(),t.throwIfAborted();const o=n?.signal,s=function(e){const t=new AbortController;let r=!1;const n=()=>{if(!r){r=!0;for(const t of e)t.removeEventListener("abort",o)}},o=()=>{r||(n(),t.abort())};for(const s of e){if(s.aborted){o();break}s.addEventListener("abort",o,{once:!0})}return{signal:t.signal,retire:n,withdraw:o}}(o?[t,o]:[t]);try{return await lt(s.signal,async()=>{o&&v.observe?.({phase:"signal",httpSignal:o,fetchSignal:s.signal});const t=await e.fetch(r,{...n,signal:s.signal});return s.signal.aborted&&(await(t.body?.cancel().catch(()=>{})),s.signal.throwIfAborted()),t.body?b(t,s.retire,s.signal):s.retire(),t})}catch(i){throw s.withdraw(),i}}}function $t(e,t,r){const n=function(e){try{return e instanceof URL?e:new URL(e)}catch{return null}}(t.url);if(!n||!j(n))return null;const o=e.egress.decide(t.url,{capability:"connectors.external",purpose:Ze});if(!o.ok)throw new nt(o.code,"connectors.external",o.destination);return lt(r,()=>I(t.url,{...t.init,signal:r}))}function Ht(e){const t=Object.entries(e);if(t.length>64)throw new Error("This secret contains more than 64 fields");return t.map(([e,t])=>{const r=ot(t)?t:JSON.stringify(t);if(!e||e.length>256||void 0===r||r.length>32768)throw new Error("This secret field exceeds the display limit");return{id:e,label:e,secretValue:r}})}function Ft(e){return"vault"===e||"openbao"===e}function Kt(e){const t=ft(e);if(!t)throw new Error("Saved provider connection not found");return t.providerId}function Qt(e){return"linear"!==e&&L(e)}function Yt(e){const t={vault:R("vault",e),openbao:R("openbao",e)},r=e=>{if("github"===e)return N;if("s3"===e)return B;const r=z(e);return r?r.cleanup:Ft(e)?t[e]:G};return{credentialSlots:(t,n)=>{if(e.assertCurrent(),Ft(t.providerId)||"github"===t.providerId)return["api_key"];const o=r(t.providerId).credentialSlots??[];return"call"in o?o(t,n):o},classification:t=>(e.assertCurrent(),r(t.providerId).classification(t)),cleanup:(t,n)=>(e.assertCurrent(),r(t.providerId).cleanup(t,n))}}function Zt(e,t,r){r?.(),t.throwIfAborted();const n=[t];e.signal&&n.push(e.signal);const o=ut(n),s=()=>{try{r?.(),e.assertCurrent(),o.throwIfAborted(),r?.()}catch{throw new pt("This provider operation ended.")}},i={...e,signal:o,assertCurrent:s};return s(),i}const Xt=["api-key","oauth","oidc","mcp","native-local"],er={...ae,senderConstraint:"dpop_optional"};function tr(e){const t=ft(e);return t?"ai-connection-v1"===t.configuration.parameters.ai_contract?ce(e)?{connectionId:e,providerId:t.providerId,verified:!0}:null:{connectionId:e,providerId:t.providerId,verified:"connected"===t.status&&"api-key"===t.configuration.method}:null}function rr(e){const t=ft(e),r=ue(e);if(!t)return null;const n={connectionId:e,providerId:t.providerId,status:t.status,method:t.configuration.method};return r&&(n.family=r.family,n.model=r.model,n.endpoint=r.baseUrl,n.name=r.name),n}function nr(e,t,r){const n=function(e,t){let r=null;const n=new AbortController,o=()=>{r?.controller.abort(),r?.popup.cancel(),r=null},s=e=>{e.cancel(),r?.popup===e&&(r.controller.abort(),r=null)},i=Et.onLock(o);return e.onDispose(()=>{i(),n.abort(),o()}),{prepare:()=>{if(t(),r)throw new Error("Finish the current provider sign-in first");const e=Lt();return r={popup:e,controller:new AbortController},()=>s(e)},release:s,close:e=>e.cancel(),captureGuard:()=>{if(!r)throw new Error("Reserve a fresh provider sign-in window first");const e=r.controller.signal;return()=>{t(),n.signal.throwIfAborted(),e.throwIfAborted()}},cancel:o,assertCurrent:t,signal:()=>{if(!r)throw new Error("Reserve a fresh provider sign-in window first");return AbortSignal.any([n.signal,r.controller.signal])},popup:()=>{if(t(),!r)throw new Error("Reserve a fresh provider sign-in window first");return r.popup}}}(e,r);return{prepareAuthorization:n.prepare,captureAuthorizationGuard:n.captureGuard,cancelAuthorization:n.cancel,deviceConsent:e=>function(e,t){const r=e.popup(),n=e.signal(),o=r.showDeviceConsent(t);return{signal:AbortSignal.any([n,o.signal]),close:()=>{o.close(),e.close(r)}}}(n,e),prepareImplicitAuthorization:e=>async function(e,t){const r=e.popup(),n=e.signal();try{return await async function(e,t,r,n,o){if("discord"!==e&&"reddit"!==e&&"google"!==e)throw new Error("This provider does not support browser token consent");const s=e,i=new URL(`/OpenSesame/auth/${"google"===s?"native-google":"native-implicit"}.html`,window.location.origin).href,a=[...crypto.getRandomValues(new Uint8Array(32))].map(e=>e.toString(16).padStart(2,"0")).join(""),c=await Rt({providerId:s,redirectUri:i,nonce:a}),u=()=>{c.close(),o()};try{return r.throwIfAborted(),n(),{state:c.state,redirectUri:i,close:u,authorize:async(e,o)=>{n();const i=t.showRedirectConsent({authorizationUrl:e,state:c.state,expiresAt:o.expiresAt}),a=AbortSignal.any([r,i.signal]);let l=null;try{if(await c.wait({expiresAt:o.expiresAt,signal:a,assertCurrent:n,retain:async e=>{const t=function(e,t){const r=qt({access_token:t.accessToken,token_type:t.tokenType,expires_in:t.expiresIn??void 0,scope:t.scopes?.join(" ")},_t(e));return{...r,protocolValid:r.protocolValid&&!1!==t.protocolValid}}(s,e);await o.retain(t),l=t}}),a.aborted)throw new Ut("denied");if(n(),!l)throw new Ut("provider");return l}catch(p){if(p instanceof Mt)throw new Ut("denied");throw p}finally{i.close(),u()}}}}catch(l){throw u(),l}}(t,r,n,e.assertCurrent,()=>e.close(r))}catch(o){throw e.close(r),o}}(n,e),authorize:(e,r)=>async function(e,t,r,n){const o=e.popup(),s=e.signal();try{const i={authorizationUrl:r,state:n.state,expiresAt:n.expiresAt,signal:n.signal?AbortSignal.any([s,n.signal]):s},a="web_message.opener"===n.responseMode?await o.waitWebMessage({...i,expectedOrigin:n.expectedOrigin??""}):await o.wait({...i,redirectUri:n.redirectUri??t});e.assertCurrent();const c=new URLSearchParams({native_state:a.state});return a.error?c.set("native_error","access_denied"):a.code&&c.set("native_code",a.code),c.toString()}finally{e.close(o)}}(n,t,e,r)}}function or(e,t){return{capture:e=>{const r=ft(e);if(!r)throw new Error("Saved MCP connection not found");const n=t(e,r.configuration.fingerprint),o=n.capture?.(e);if(!o)throw new Error("Original MCP cleanup route unavailable");return o},classification:e=>de(e)?ge():bt.classification(),credentialSlots:(e,t)=>{if(de(e))return[];const r=bt.credentialSlots??[];return"call"in r?r(e,t):r},prepare:(r,n)=>{e.assertCurrent();const o=ft(r);if(!o||"mcp"!==o.configuration.method)throw new Error("Saved MCP connection not found");return t(r,o.configuration.fingerprint,n).prepare?.(r,n)??Promise.resolve()},cleanup:(e,r)=>t(r.connectionId,r.configuration.fingerprint,r.transport).cleanup(e,r)}}function sr(){return new URL("/OpenSesame/auth/native-connector.html",window.location.origin).href}function ir(e){if("google"===e&&!Vt())throw new Error("Google popup authorization is unavailable under this deployment's browser isolation policy")}const ar=36e5;function cr(e){null!==e.timer&&clearTimeout(e.timer),e.timer=null,e.running?.abort()}function ur(e){if(e.stopped)return;if(null!==e.timer&&clearTimeout(e.timer),e.timer=null,!e.session.isUnlocked())return void cr(e);try{e.transport.assertCurrent()}catch{return e.stopped=!0,void cr(e)}if(e.running)return;const t=function(e){const t=ve(),r=new Set(t.map(e=>e.connectionId));for(const n of e.checked.keys())r.has(n)||e.checked.delete(n);return t}(e),r=t.filter(t=>{const r=e.checked.get(t.connectionId);return!r||r.revision!==t.revision||r.nextAt<=Date.now()});if(!r.length)return void function(e,t){if(!t.length)return;const r=Math.min(...t.map(t=>Math.min(t.expiresAt,e.checked.get(t.connectionId)?.nextAt??Date.now())));e.timer=setTimeout(()=>ur(e),Math.max(1,r-Date.now()))}(e,t);const n=new AbortController;e.running=n,async function(e,t,r){for(const n of t){if(r.signal.aborted||e.stopped||!e.session.isUnlocked())return;try{const t=await be(n.connectionId,e.transport,r.signal);if(r.signal.aborted||e.stopped)return;e.checked.set(n.connectionId,{revision:n.revision,nextAt:t?Math.min(Date.now()+ar,t.expiresAt):Date.now()+ar})}catch{if(r.signal.aborted||e.stopped)return;e.checked.set(n.connectionId,{revision:n.revision,nextAt:Date.now()+6e4})}}}(e,r,n).finally(()=>{e.running===n&&(e.running=null),ur(e)})}function lr(e){const t=()=>{"hidden"!==document.visibilityState&&e()};return document.addEventListener("visibilitychange",t),window.addEventListener("focus",t),()=>{document.removeEventListener("visibilitychange",t),window.removeEventListener("focus",t)}}function pr(e,t){return{classification:t=>{const r=t.providerId;if("vault"!==r&&"openbao"!==r)throw new Error("This cleanup belongs to another provider");return Ce(r,e.capture()).classification(t)},credentialSlots:[],prepare:async e=>{const r=t.transport(e);await(Ce(function(e){const t=ft(e)?.providerId;if("vault"!==t&&"openbao"!==t)throw new Error("Saved Vault connection not found");return t}(e),r).prepare?.(e)),r.assertCurrent()},cleanup:(e,r)=>{const n=t.transport(r.connectionId,r.configuration.fingerprint),o=r.configuration.providerId;if("vault"!==o&&"openbao"!==o)throw new Error("This cleanup belongs to another provider");return Ce(o,n).cleanup(e,r)}}}async function dr(e,t){const r=new Request(e,t),n={...t,method:r.method,headers:r.headers,cache:r.cache,credentials:r.credentials,integrity:r.integrity,keepalive:r.keepalive,mode:r.mode,redirect:r.redirect,referrer:r.referrer,referrerPolicy:r.referrerPolicy,signal:r.signal};return null!==r.body&&(n.body=await r.arrayBuffer()),{url:r.url,init:n}}const fr={configuration:"Configured on this device; provider authorization or verification required",authorizing:"Provider authorization is in progress",connected:null,reauthorize:"Provider authorization expired or changed; authorize again",cleanup:"Provider cleanup required before this connection can be used"};function hr(e){const t=e.grants.flatMap(e=>null===e.expiresAt?[]:[e.expiresAt]);return t.length?new Date(Math.min(...t)).toISOString():null}const gr={sealPendingConnectorDirectory:o,hydrateVercelConnectAuth:Te,disarmVercelConnectAuth:Oe},wr="connectors.external",mr=[s,h],vr={targets:Le,goals:[...We,...$e],routes:Pe},br=[Re,Me];function yr(){return[...Fe(["password_managers"],Ne),...Fe(["local_storage"],Be)].map(e=>Cr(e.providerId))}function Cr(e){return f(e)}function kr(){return yr()}const jr={capability:wr,async activate(o){const s=et(o,wr);if(s.disposed())return s.handle();if(e(o.runtimeConfig.endpoints.connectCallbackBase),s.onDispose(()=>e(void 0)),function(e,t){(function(e,t){let r;const n=()=>{r?.dispose(),r=void 0},o=()=>{if(t.disposed()||!Et.isGenuineSession())return void n();if(r)return;const o=et(e,"connectors.external:owner");r=o;try{!function(e,t){(function(e,t){S(e.runtimeConfig.linearClientId);const r=new AbortController,n=ut([e.lease.signal,r.signal]),o=E.fetch;E.fetch=(t,r)=>{const o=ut(r?.signal?[n,r.signal]:[n]);return lt(o,()=>e.egress.fetch(t instanceof Request?t.url:t,{...r,signal:o},{capability:"connectors.external",purpose:Xe}))},a.linear=A,t.onDispose(()=>{r.abort(),S(void 0),E.fetch=o,a.linear=void 0})})(e,t),function(e,t){t.onDispose(It(()=>window.location.origin));const r=new AbortController,n=ut([e.lease.signal,r.signal]),o=()=>{if(n.aborted||t.disposed()||!Et.isGenuineSession())throw new pt},s={assertCurrent:o,signal:n,openWebSocket:(t,r,s)=>function(e,t,r,n,o){const s=t.href,i=e.egress.decideWebSocket;if(!i)throw new Error("This capability has no WebSocket transport");const a={capability:"connectors.external",purpose:Ze};let c=!1;const u=()=>{if(o(),n.throwIfAborted(),c)throw new pt;const e=i(s,a);if(!e.ok)throw new nt(e.code,"connectors.external",e.destination)};u();const l=new WebSocket(s,[...r]),p=()=>{c||(c=!0,l.close(1e3,"Operation ended"))},d=tt.subscribe(()=>{try{u()}catch{p()}});return n.addEventListener("abort",p,{once:!0}),l.addEventListener("close",()=>{n.removeEventListener("abort",p),d()},{once:!0}),n.aborted&&p(),{socket:l,assertCurrent:u}}(e,t,r,s?ut([n,s]):n,o),settleCredentialMutation:async(t,r)=>{o();const s=t instanceof Request?await lt(n,()=>dr(t,r)):{url:t,init:r??{}};o();const i=AbortSignal.timeout(15e3),a=s.init.signal?ut([s.init.signal,i]):i;return a.throwIfAborted(),$t(e,s,a)||e.egress.fetch(s.url,{...s.init,signal:a},{capability:"connectors.external",purpose:Ze})},fetch:async(t,r)=>{o();const s=t instanceof Request?await lt(n,()=>dr(t,r)):{url:t,init:r??{}};o();const i=s.init.signal?ut([n,s.init.signal]):n;return $t(e,s,i)||lt(i,()=>e.egress.fetch(s.url,{...s.init,signal:i},{capability:"connectors.external",purpose:Ze}))},capture:()=>Jt(s,e)},i=xt(s);!function(e,t=globalThis.window){if(!t)return;const r=y(function(e=window){return{post:t=>e.postMessage(t,e.location.origin),listen(t){const r=e.removeEventListener.bind(e),n=r=>{r.source===e&&r.origin===e.location.origin&&t(r.data)};return e.addEventListener("message",n),()=>r("message",n)}}}(t)),n=k(r),o=()=>{e.disposed()||C()};t.addEventListener("focus",o),t.document.addEventListener("visibilitychange",o),e.onDispose(()=>{t.removeEventListener("focus",o),t.document.removeEventListener("visibilitychange",o),n(),r.drain()}),C()}(t);const a=l.authorization,c=function(e,t){return r=>{if(e.aborted||t.disposed())return null;const n=ft(r);if(!n)return null;const o=function(e,t){const r=xe(e);return"ordinary"===r?ze(t.providerId,t.configuration.method,t.configuration.parameters):{available:"verified"===r,reason:"Verify this AI connection in its owning vault."}}(r,n),s="connected"===n.status&&o.available;return{status:s?"active":"pending",statusDetail:"cleanup"===n.status||o.available?fr[n.status]:o.reason,grantedScopes:s?n.grants.flatMap(e=>e.grantedScopes):[],accountLabel:"account-verified"===n.identity?.assurance?n.identity.label:null,expiresAt:hr(n),refreshable:o.available&&"cleanup"!==n.status&&Object.values(gt(r)?.privateState.grants??{}).some(e=>!!e.refreshToken)}}}(n,t);l.authorization=c,t.onDispose(()=>{r.abort(),i(),l.authorization===c&&(l.authorization=a)})}(e,t),function(e){const t=St(),r=new Map;e.onDispose(()=>r.clear()),e.onDispose(D("api-key",{supports:Qt,configure:async e=>{const{owner:n,...o}=e,s=n?.signal,i=n?.assertCurrent,a=()=>{if(n?.signal!==s||n?.assertCurrent!==i)throw new pt;i?.call(n)};a(),s?.throwIfAborted();const c=t.capture();return(async e=>{const n=await function(e,t){if(t.assertCurrent(),"s3"===e.providerId)return U(e,t);const r=z(e.providerId);return r?r.configure(e,t):"github"===e.providerId?_(e,t):Ft(e.providerId)?(function(e){if("api-key"!==e.method||Object.keys(e.requestedScopes).length||Object.keys(e.targetIds).length)throw new Error("This provider instance does not accept selected scopes or targets");if(Object.keys(e.parameters).some(e=>!["endpoint","namespace"].includes(e))||Object.keys(e.credentials).some(e=>"api_key"!==e))throw new Error("This provider instance received an unsupported configuration field")}(e),V({providerId:e.providerId,connectionId:e.connectionId,revision:e.revision,displayName:e.displayName,icon:e.icon??"",endpoint:e.parameters.endpoint??"",namespace:e.parameters.namespace??"",apiKey:e.credentials.api_key??""},t)):q(e,t)}(o,e);t.assertCurrent();const s=JSON.stringify([n.connectionId,n.fingerprint]);return r.has(s)||r.set(s,c),n})(s?Zt(c,s,a):c)},test:async e=>function(e,t){if(t.assertCurrent(),"s3"===e.providerId||"github"===e.providerId||z(e.providerId))throw new Error("This provider verifies only when it is saved");if(Ft(e.providerId))throw new Error("This provider verifies only when it is saved");return M(e,t)}(e,t.capture()),verify:async e=>{const r=t.capture(),n=Kt(e);if("s3"===n)return x(e,r);const o=z(n);return o?o.verify(e,r):"github"===n?O(e,r):Ft(n)?T(e,r):P(e,r)},invoke:async(e,r,n,o)=>async function(t,o){o?.throwIfAborted();const s=t(),i=o?Zt(s,o):s;try{const t=await(t=>async function(e,t,r,n){n.assertCurrent();const o=Kt(e),s=J(o,e,t,r,n);if(s)return s;if("s3"===o)return W(e,t,r,n);const i=z(o);return i?i.invoke(e,t,r,n):"github"===o?$(e,t,r,n):Ft(o)?async function(e,t,r,n){if("provider.secret.read"===t&&!Object.keys(r).some(e=>!["mount","path"].includes(e))){const t=await F(e,{mount:r.mount??"secret",path:r.path??""},n);return{label:`Secret version ${t.metadata.version}`,items:Ht(t.data)}}if("provider.read"!==t||Object.keys(r).length)throw new Error("Select a supported provider operation");return{label:"Provider token access verified",items:(await K(e,n)).policies.map(e=>({id:e,label:e}))}}(e,t,r,n):H(e,t,r,n)}(e,r,n,t))(i);return i.assertCurrent(),t}catch(a){throw i.assertCurrent(),a}}(t.capture,o),cleanup:{classification:e=>Yt(t.capture()).classification(e),credentialSlots:(e,r)=>{const n=Yt(t.capture()).credentialSlots;return n&&"call"in n?n(e,r):n??[]},cleanup:(e,n)=>Yt(((e,n)=>{t.assertCurrent();const o=JSON.stringify([e,n]),s=r.get(o)??t.capture();return s.assertCurrent(),r.set(o,s),s})(n.connectionId,n.configuration.fingerprint)).cleanup(e,n)}}))}(t),function(e){const t=St();e.onDispose(Pt({fetch:(e,r)=>t.capture().fetch(e,r),assertCurrent:t.assertCurrent,read:e=>(t.assertCurrent(),rr(e)),connections:()=>(t.assertCurrent(),Ot().flatMap(e=>{const t=rr(e.connectionId);return t?[t]:[]})),execute:(e,r,n,o,s)=>{const i=((e,t)=>({signal:t.signal,assertCurrent(){t.signal.throwIfAborted(),t.assertCurrent(),e.assertCurrent()},fetch:(r,n)=>{t.signal.throwIfAborted(),t.assertCurrent();const o=n?.signal?ut([t.signal,n.signal]):t.signal;return lt(o,()=>e.fetch(r,{...n,signal:o}))}}))(t.capture(),s);return i.assertCurrent(),ue(e)?le(e,r,n,o,i):pe(e,r,n,o,i)}}))}(t),function(e){const t=new se(ie({connection:tr}),er);e.onDispose(at(t)),e.onDispose(oe),e.onDispose(At(()=>{t.reset(),oe(),it()}))}(t),function(e){e.onDispose(Je(De()))}(t),function(e){const t=St();e.onDispose(Ct({redirectUri:sr(),...nr(e,sr(),t.assertCurrent),navigate:e=>{t.assertCurrent(),window.location.assign(e)},scrubCallback:()=>{const e=new URL(window.location.href);for(const t of[...e.searchParams.keys()])t.startsWith("native_")&&e.searchParams.delete(t);window.history.replaceState(null,"",e.href)},googleToken:me}));const r=we(t),n={...r,configure:e=>(t.assertCurrent(),ir(e.providerId),r.configure(e)),authorize:(e,n)=>{if(t.assertCurrent(),ir(ft(e)?.providerId??""),!r.authorize)throw new Error("Browser OAuth authorization is unavailable");return r.authorize(e,n)}};e.onDispose(D("oauth",Q(Gt(n,t,sr()),t))),function(e){const t=St(),r=new Map;e.onDispose(()=>r.clear());const n=(e,t)=>JSON.stringify([e,t]),o=e=>function(e,t){const r=fe({capture:(e,r)=>async function(e,t){if(e.assertCurrent(),t?.throwIfAborted(),!e.signal)throw new mt("disposed");const r=AbortSignal.any([e.signal,...t?[t]:[]]),n=await Nt(r);try{const t=AbortSignal.any([r,n.signal]),o=()=>{if(t.throwIfAborted(),e.assertCurrent(),n.guest||!n.current())throw new mt("disposed")};return o(),{tomb:n.tomb,close:n.close,transport:{...e,signal:t,assertCurrent:o}}}catch(o){throw n.close(),o}}(r??t,e)}),n=t=>de(t)?r:e,o=e=>{const t=ft(e);if(!t||"mcp"!==t.configuration.method)throw new mt("target");return n(t.configuration)};return{supports:t=>e.supports(t)||r.supports(t),configure:t=>{const n=t.parameters.mcp_authentication;if(void 0===n)return e.configure(t);if("oauth"===n){const{mcp_authentication:r,...n}=t.parameters;return e.configure({...t,parameters:n})}return r.configure(t)},verify:e=>o(e).verify(e),authorize:(t,r)=>{const n=o(t);if(n!==e||!n.authorize)throw new mt("authorization");return n.authorize(t,r)},invoke:(e,t,r,n)=>o(e).invoke(e,t,r,n),cleanup:{capture:()=>(t.assertCurrent(),t),classification:e=>n(e).cleanup.classification(e),credentialSlots:(e,t)=>{const r=n(e).cleanup.credentialSlots??[];return"call"in r?r(e,t):r},prepare:(e,t)=>o(e).cleanup.prepare?.(e,t)??Promise.resolve(),cleanup:(e,t)=>n(t.configuration).cleanup.cleanup(e,t)}}}(yt(e),e),s=(e,s)=>{s?.throwIfAborted();const i=t.capture();if(e){const t=ft(e);if(!t||"mcp"!==t.configuration.method)throw new Error("Saved MCP connection not found");const o=n(e,t.configuration.fingerprint);r.has(o)||r.set(o,i)}const a=function(e,t){if(!t)return e;const r=AbortSignal.any([t,...e.signal?[e.signal]:[]]),n=()=>{e.assertCurrent(),r.throwIfAborted()};return Object.freeze({...e,signal:r,assertCurrent:n,fetch:(t,o)=>(n(),e.fetch(t,{...o,signal:AbortSignal.any([r,...t instanceof Request?[t.signal]:[],...o?.signal?[o.signal]:[]])}))})}(i,s);return Q(o(a),a)};e.onDispose(D("mcp",Q({supports:e=>vt(e)||he(e),configure:e=>{const t=s();return t.configure(e).then(e=>{const o=t.cleanup.capture?.(e.connectionId);return o&&r.set(n(e.connectionId,e.configuration.fingerprint),o),e})},verify:e=>s(e).verify(e),authorize:(e,t)=>{const r=s(e).authorize;if(!r)throw new Error("MCP authorization is unavailable");return r(e,t)},invoke:(e,t,r,n)=>s(e,n).invoke(e,t,r),cleanup:or(t,(e,s,i)=>{t.assertCurrent();const a=n(e,s),c=i??r.get(a)??t.capture();return c.assertCurrent(),r.set(a,c),Q(o(c),c).cleanup})},t)))}(e)}(t),function(e){e.onDispose(function(e,t){const r={transport:e,session:t,checked:new Map,timer:null,running:null,stopped:!1},n=()=>ur(r),o=[Tt(n),t.subscribeUnlock(n),t.subscribeVisible(n)];return ur(r),()=>{r.stopped=!0,cr(r);for(const e of o)e();r.checked.clear()}}(Dt(),{isUnlocked:()=>!e.disposed()&&Et.isUnlocked(),subscribeUnlock:Et.subscribe,subscribeVisible:lr}))}(t),function(e){const t=St(),r=function(e,t){const r=new Map;return t.onDispose(()=>r.clear()),{assertCurrent(t){e.assertCurrent(),r.get(t)?.transport.assertCurrent()},remember(e,t){t.assertCurrent();const n=r.get(e);n?.transport.assertCurrent();const o=ft(e)?.fingerprint;if(!o||n&&n.fingerprint!==o)throw new Error("Vault cleanup belongs to another configuration");n||r.set(e,{fingerprint:o,transport:t})},transport(t,n){e.assertCurrent();const o=r.get(t),s=o?.transport??e.capture();s.assertCurrent();const i=n??ft(t)?.fingerprint;if(!i||o&&o.fingerprint!==i)throw new Error("Vault cleanup belongs to another configuration");return o||r.set(t,{fingerprint:i,transport:s}),s}}}(t,e),n={supports:e=>"vault"===e||"openbao"===e,configure:e=>async function(e,t){if(function(e){if("oidc"!==e.method||Object.keys(e.credentials).length||Object.keys(e.requestedScopes).length||Object.keys(e.targetIds).length||Object.keys(e.parameters).some(e=>!["endpoint","namespace","auth_mount","role"].includes(e)))throw new Error("Select this instance's approved OIDC sign-in fields")}(e),"vault"!==e.providerId&&"openbao"!==e.providerId)throw new Error("Select a Vault or OpenBao instance");const r=await Ee({providerId:e.providerId,connectionId:e.connectionId,revision:e.revision,endpoint:e.parameters.endpoint??"",namespace:e.parameters.namespace??"",authMount:e.parameters.auth_mount??"oidc",role:e.parameters.role??"",displayName:e.displayName,icon:e.icon},t);t.assertCurrent();const n=ft(r);if(!n)throw new Error("The Vault sign-in request was not saved");return n}(e,t.capture()),authorize:e=>{const n=t.capture();return r.assertCurrent(e),async function(e,t,r){const n=kt();if(!n.authorize)throw new Error("This browser cannot receive provider sign-in");const o=await Ie(e,n.redirectUri,t);let s;r.remember(e,t);try{s=await n.authorize(o.authorizationUrl,o)}catch(a){throw await Se(e,o.state),a}const i=jt(s);if(i.error||!i.code)throw await Se(e,o.state),new Error("Provider sign-in was cancelled");await Ae(e,{state:i.state,code:i.code},t),t.assertCurrent()}(e,n,r)},verify:e=>ye(e,t.capture()),invoke:(e,r,n)=>async function(e,t,r,n){if("provider.read"===t&&!Object.keys(r).length)return{label:"Provider access verified",items:[{id:"user",label:(await ke(e,n)).tokenLabel}]};if("provider.secret.read"!==t||Object.keys(r).some(e=>!["mount","path"].includes(e)))throw new Error("Select a supported Vault operation");const o=await je(e,{mount:r.mount??"secret",path:r.path??""},n);return{label:`Secret version ${o.metadata.version}`,items:Ht(o.data)}}(e,r,n,t.capture()),cleanup:pr(t,r)};e.onDispose(D("oidc",Q(n,t)))}(t),function(e){const t=St(),r=Q({supports:e=>null!==te(e),configure:e=>{const{owner:r,...n}=e,o=t.capture();return ee(n,r?function(e,t){const r=t.signal,n=t.assertCurrent,o=()=>{if(t.signal!==r||t.assertCurrent!==n)throw new pt;n.call(t)};o(),r.throwIfAborted();const s=[r];e.signal&&s.push(e.signal);const i=ut(s),a=()=>{try{o(),e.assertCurrent(),i.throwIfAborted(),o()}catch{throw new pt("This provider operation ended.")}},c={...e,signal:i,assertCurrent:a};return a(),c}(o,r):o)},verify:e=>X(e,t.capture()),invoke:(e,r,n)=>{if("provider.read"!==r)throw new Error("Select local configuration review");return Z(e,n,t.capture())},cleanup:Y},t);e.onDispose(D("native-local",r))}(t),function(e,t=[]){const r=St(),n=new Set([...zt().map(e=>e.id),...c().map(e=>e.id),...Object.keys(u),...t]);for(const o of n){if("linear"===o)continue;const t=new Map;for(const e of Xt)re(e,o)&&t.set(e,ne(e,o));if(!t.size)continue;const n=e=>{r.assertCurrent();const n=t.get(e);if(!n)throw new Error("This provider cleanup method is unavailable");return n};e.onDispose(ht(o,{capture:e=>{r.assertCurrent();const t=gt(e);if(!t||t.configuration.providerId!==o)throw new Error("Provider cleanup belongs to another connection");return n(t.configuration.method).cleanup.capture?.(e)??r.capture()},prepare:async(e,t)=>{r.assertCurrent();const s=gt(e);if(!s||s.configuration.providerId!==o)throw new Error("Provider cleanup belongs to another connection");const i=n(s.configuration.method).cleanup.prepare;t?await(i?.(e,t)):await(i?.(e)),r.assertCurrent()},credentialSlots:(e,t)=>{const r=n(t?.kind??e.method).cleanup.credentialSlots??[];return"call"in r?r(e,t):r},classification:e=>n(e.method).cleanup.classification(e),cleanup:async(e,t)=>{const o=e.grant?.kind??t.configuration.method,s=await n(o).cleanup.cleanup(e,t);return r.assertCurrent(),s}}));const s=a[o],i=async e=>{r.assertCurrent();const t=gt(e);if(!t||t.configuration.providerId!==o)throw new Error("Provider cleanup belongs to another connection");await wt(e),r.assertCurrent()};a[o]=i,e.onDispose(()=>{a[o]===i&&(a[o]=s)})}}(t,["vault","openbao","github","s3"])}(e,o)}catch(s){throw n(),s}},s=Et.onLock(n),i=Et.subscribe(o);t.onDispose(()=>{s(),i(),n()}),o()})(e,t),function(e,t){const r=new AbortController,n=ut([e.lease.signal,r.signal]),o=()=>{if(n.aborted||t.disposed())throw new p("stale","External connectors were disabled. Reconnect this secret backend.")},s={signal:n,assertCurrent:o,fetch:async(t,r)=>{o();const s=t instanceof Request?await lt(n,()=>async function(e,t){const r=new Request(e,t),n={method:r.method,headers:r.headers,cache:r.cache,credentials:r.credentials,integrity:r.integrity,keepalive:r.keepalive,mode:r.mode,redirect:r.redirect,referrer:r.referrer,referrerPolicy:r.referrerPolicy,signal:r.signal};return null!==r.body&&(n.body=await r.arrayBuffer()),{url:r.url,init:n}}(t,r)):{url:t,init:r??{}};o();const i=s.init.signal?ut([n,s.init.signal]):n;try{return await lt(i,()=>e.egress.fetch(s.url,{...s.init,signal:i},{capability:"connectors.external",purpose:Ze}))}catch(a){if(o(),a instanceof nt)throw new p("unsupported","The current network or deployment policy does not allow this secret backend.");throw a}}},i=Bt({...s,capture:()=>{o();const t=Jt(s,e);return o(),{...t,capture:void 0,signal:n}}});t.onDispose(()=>{r.abort(),i()})}(e,t),function(e,t){const r=e.egress,n=r.fetch,o=r.decide,s=e.lease,i=s.signal,a=new AbortController,c=ut([i,a.signal]),u=()=>{if(c.aborted||t.disposed()||e.egress!==r||r.fetch!==n||r.decide!==o||e.lease!==s||s.signal!==i)throw new He("stale","External connectors changed. Reconnect this AI service.")},l=Object.freeze({assertCurrent:u,signal:c,fetch:(e,t)=>{if(u(),e instanceof Request)throw new He("configuration","Direct AI requests require a string or URL.");return n.call(r,e,t,{capability:"connectors.external",purpose:Ze})}}),p=(e,t)=>{u();const n=o.call(r,e,t);return u(),n},d={...e,egress:{...r,decide:p}},f=e=>{u();const t=p(e,{capability:"connectors.external",purpose:Ze});if(!t.ok)throw new nt(t.code,"connectors.external",t.destination);u()},h=m({assertCurrent:u,signal:c,assertEndpointAllowed:f,fetch:Wt(l,c),capture:()=>{u();const e=Jt(l,d);return u(),{signal:c,assertCurrent:()=>{u(),e.assertCurrent()},assertEndpointAllowed:t=>{e.assertCurrent(),f(t),e.assertCurrent()},fetch:Wt(e,c)}}});ct().then(()=>{c.aborted||t.disposed()||it()}).catch(()=>{}),t.onDispose(()=>{a.abort(),h()})}(e,t),function(e,t){const r=new AbortController;ut([e.lease.signal,r.signal]),t.onDispose(()=>{r.abort()})}(e,t)}(o,s),await o.hydrate(mr),s.disposed())return s.handle();const i=d("password_managers",kr),f=d("local_storage",kr);s.onDispose(i),s.onDispose(f),s.register("section",{id:"connections",to:"/connections",label:"Connections",segment:"connections",jump:"c",icon:"connection",order:20,Tree:Ue}),s.register("route",{id:"connections",path:"/connections/:providerId?/:connectionId?",element:_e,framed:!0,order:20}),s.register("route",{id:"settings-connections",path:"/settings/connections/:providerId/:connectionId?",element:_e,framed:!0,order:21}),s.register("setup-panel",{id:"connectors",tab:"connectors",rail:"Connectors",Panel:qe,order:10}),s.register("setup-panel",{id:"storage",tab:"storage",rail:"Storage",Panel:Ve,order:15}),s.register("command-path",{path:"/connections",label:"Connections"}),s.register("keymap-jump",{key:"c",path:"/connections"}),rt(s,vr);for(const e of br)s.register("webmcp-tool",st(e));for(const e of function(e){return[{id:"seal-connector-directory",run:({tomb:t,guest:r,signal:n})=>lt(ut([e,n]),async()=>{await gr.sealPendingConnectorDirectory(t,{ephemeral:r}).catch(()=>{})})},{id:"hydrate-vercel-connect",run:({tomb:t,guest:r,signal:n})=>{const o=ut([e,n]);return o.addEventListener("abort",()=>gr.disarmVercelConnectAuth(),{once:!0}),lt(o,async()=>{await gr.hydrateVercelConnectAuth(t,{ephemeral:r,signal:o}).catch(()=>{})})}}]}(o.lease.signal))s.register("unlock-effect",e);return t.usesConnect=g,t.hasConnectRoute=w,t.pagesOpen=()=>!0,Ke.find=Ye,r(),s.onDispose(()=>{Oe(),Ge(),n(),Qe(),r()}),s.handle()}};export{wr as CAPABILITY,mr as HYDRATE_KEYS,vr as TUTORIAL,br as WEBMCP_TOOLS,jr as capabilityRuntime,Cr as externalOperation,kr as runSavedExternalConnectors,yr as startExternalConnectors};

package/dist/assets/cap-enterprise.ca-administration-CirJdAWC.js

@@ -0,0 +1 @@
+import{r,p as t,h as e}from"./certs-CDCfMuEi.js";import{a as o}from"./types-Ctz6L20B.js";import{c as i}from"./main-BrkS-iow.js";import"./hosted-model-authority-CcNPE44H.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./drop-open-BjgdLxWM.js";import"./model-provider-B6oAnQX9.js";import"./signals-DdOHdr--.js";import"./identity-BVf8yWa4.js";import"./bucket-saved-vQCiVvN_.js";import"./react-dom-BwC4eQlG.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";const s="enterprise.ca-administration";function a(r){return e(r)}function n(){return o(["certificates"],a)}function m(){return n().map(r=>p(r.providerId))}function p(r){return t(r)}function c(){return m()}const j={capability:s,async activate(t){const e=i(t,s);return e.onDispose(r("certificates",c)),e.handle()}};export{s as CAPABILITY,n as applySavedCertificateConnectors,j as capabilityRuntime,p as certificateOperation,c as runSavedCertificateConnectors,a as savedCertificateOperation,m as startCertificateConnectors};

package/dist/assets/cap-enterprise.directory-provisioning-ixTSdLjk.js

@@ -0,0 +1 @@
+import{g as t,r as i,I as s}from"./identity-view-paths-Bi1yigZk.js";import{c as e,r,I as o}from"./main-BrkS-iow.js";import{c as a}from"./hosted-identity-rail-Dv05NPNo.js";import{D as p}from"./directory-panels-DNhzC0ld.js";import{p as n}from"./vault-ui-seam-BQGS7RR6.js";import"./drop-open-BjgdLxWM.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./hosted-model-authority-CcNPE44H.js";import"./model-provider-B6oAnQX9.js";import"./signals-DdOHdr--.js";import"./identity-BVf8yWa4.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./react-dom-BwC4eQlG.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";import"./wake-lock-C_y0fQco.js";import"./pane-trail-dW-2RSUm.js";import"./Crumbs-BQsauYj_.js";import"./vault-list-path-Bh2_KZkq.js";import"./idp-presets-B1M-P0Ek.js";import"./support-context-DrcseTKK.js";import"./PageTreeBranch-OgsaK684.js";import"./InvokeScreen-C-kFFYVF.js";import"./listing-page-B-c8QQVp.js";import"./section-nav-goals-B_N-ZW2I.js";import"./use-settings-category-Dy0gsCtF.js";import"./features-9FeW22VH.js";import"./use-integrations-drawn-DYzpglrK.js";import"./shared-Ck7e2FJN.js";import"./native-catalog-status-INsDvLpU.js";import"./certs-CDCfMuEi.js";import"./bucket-saved-vQCiVvN_.js";import"./local-vault-sessions-CGv9AsFj.js";import"./payload-CVz3G9cA.js";import"./compartment-guard-D3FuKM8N.js";import"./vaults-B043odav.js";import"./FeatureSections-BG-JsWID.js";import"./vault-menu-CqO_AStq.js";import"./MethodPicker-CqQTyAaT.js";import"./use-vault-search-C7u00nrc.js";import"./directory-signin-model-BfxENbC3.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";const m="enterprise.directory-provisioning",j=["people","agents","devices","organization"],d={targets:n(s,["identity.people","identity.agents","identity.organization","identity.org-signin"]),goals:n(o,["identity.organizations.review","identity.users.manage","identity.agents.manage","identity.device.approve"])},c={capability:m,async activate(s){const o=e(s,m);return o.disposed()||(o.onDispose(t(j)),o.onDispose(a(p)),i(o,j),r(o,d)),o.handle()}};export{m as CAPABILITY,j as IDENTITY_VIEWS_OWNED,d as TUTORIAL,c as capabilityRuntime};

package/dist/assets/cap-identity.ambient-sso-Bfz5okEX.js

@@ -0,0 +1 @@
+import{h as e,c as t,G as a,H as s,J as n}from"./main-BrkS-iow.js";import{r as o,a as i,d as r,b as m,A as p,c,e as l,f as u,g as d,i as h,h as b}from"./AmbientAuthPanel-CwFZygJY.js";import{n as j,f as A}from"./entra-instances-NyEKYI5c.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./signals-DdOHdr--.js";import"./model-provider-B6oAnQX9.js";import"./identity-BVf8yWa4.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./drop-open-BjgdLxWM.js";import"./react-dom-BwC4eQlG.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";const f="identity.ambient-sso",g={runAmbientAuthBoot:o,externalServicesDenied:()=>"allow"!==e.getSnapshot().plan?.network.externalServices};function v(){w.ran=!1}const w={ran:!1};function y(e){if(e.aborted||w.ran)return;if(w.ran=!0,g.externalServicesDenied())return;const{search:t,pathname:a}=window.location;g.runAmbientAuthBoot({hasAuthCallback:n(t),pathname:a})}const k={capability:f,async activate(e){const n=e,o=t(n,f);return o.disposed()||(a({autoAuthSuppressed:h,clearAutoAuthSuppression:d,fenceLocalSignOut:u,cancelAllTransactions:l,applyAmbientReturn:c,completeIfPresent:async e=>(await b(e))?.completed??null}),o.onDispose(s),void 0!==n.runtimeConfig.ambientAuth&&(i(n.runtimeConfig.ambientAuth),j(r().map(e=>e.clientId)),o.onDispose(m),o.onDispose(A)),o.register("background-job",{id:"ambient-auth-boot",start:y}),o.register("settings-panel",{id:"ambient-auth",label:"Automatic sign-in",category:"security",Panel:p,order:30})),o.handle()}};export{f as CAPABILITY,g as ambientRuntimeSeams,k as capabilityRuntime,v as resetAmbientBootForTest,y as startAmbientBoot};

package/dist/assets/cap-identity.claim-different-link-C0NXeZQE.js

@@ -0,0 +1 @@
+import{j as o}from"./react-dom-BwC4eQlG.js";function t({onChoose:t}){return o.jsx("button",{type:"button",className:"unlock__switch",onClick:t,children:"Use a different link"})}export{t as ClaimDifferentLink};

package/dist/assets/cap-identity.federation-Di6GjTkh.js

@@ -0,0 +1 @@
+import{r as t,p as i,h as r}from"./certs-CDCfMuEi.js";import{g as e,r as s,I as o}from"./identity-view-paths-Bi1yigZk.js";import{c as a,r as n,I as p}from"./main-BrkS-iow.js";import{i as m,I as d,M as j,a as c}from"./MfaStep-DvSV4q5P.js";import{a as l}from"./types-Ctz6L20B.js";import{p as u,t as f}from"./vault-ui-seam-BQGS7RR6.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./drop-open-BjgdLxWM.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./model-provider-B6oAnQX9.js";import"./signals-DdOHdr--.js";import"./identity-BVf8yWa4.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./bucket-saved-vQCiVvN_.js";import"./react-dom-BwC4eQlG.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";import"./idp-presets-B1M-P0Ek.js";import"./InvokeScreen-C-kFFYVF.js";import"./native-catalog-status-INsDvLpU.js";import"./connections-CNmhCNAV.js";import"./github-app-local-B-4pPsY4.js";import"./connect-plan-ClXbb_FT.js";import"./iam-zBfzStfy.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";const y="identity.federation";function v(t){return r(t)}function b(){return l(["identity"],v)}function g(){return b().map(t=>h(t.providerId))}function h(t){return i(t)}function k(){return g()}const w=["providers"],I={targets:u(o,["identity.providers","identity.register-idp"]),goals:u(p,["identity.account.add"])},M={capability:y,async activate(i){const r=a(i,y);return r.disposed()||(r.onDispose(t("identity",k)),r.onDispose(e(w)),r.onDispose(m()),s(r,w),r.register("setup-panel",{id:"identity",tab:"identity",rail:"Identity",Panel:d,order:30}),r.register("setup-panel",{id:"mfa",tab:"mfa",rail:"MFA",Panel:j,order:40}),r.register("webmcp-tool",f(c)),n(r,I)),r.handle()}};export{y as CAPABILITY,w as IDENTITY_VIEWS_OWNED,I as TUTORIAL,b as applySavedIdentityConnectors,M as capabilityRuntime,h as identityOperation,k as runSavedIdentityConnectors,v as savedIdentityOperation,g as startIdentityConnectors};

package/dist/assets/cap-identity.local-iam-DdhiDQdb.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/main-BKK5N8Uh.css","assets/InvokeScreen-CsvSkues.css"])))=>i.map(i=>d[i]);
+import{i as e,u as i,e as s,b as a,I as t,L as n,p as r,a as o}from"./useLocalConsent-LY9hCn8F.js";import{p as l,j as c,k as d,c as p,i as u}from"./vault-ui-seam-BQGS7RR6.js";import{f as h}from"./signals-DdOHdr--.js";import{g as m}from"./vaults-B043odav.js";import{u as g,h as y,g as j,r as f,I as b}from"./identity-view-paths-Bi1yigZk.js";import{c as v,r as x,I as _,K as k,M as w,O as A,Q as I,S as z,e as N,o as P,T}from"./main-BrkS-iow.js";import{b as C}from"./section-nav-goals-B_N-ZW2I.js";import{j as L,r as S}from"./react-dom-BwC4eQlG.js";import{b as q,u as D,L as O}from"./react-router-XsJY84ug.js";import{P as E}from"./PageTreeBranch-OgsaK684.js";import{_ as R}from"./hosted-model-authority-CcNPE44H.js";import{u as M}from"./wake-lock-C_y0fQco.js";import{C as B}from"./cli-app-integration-crypto-TwyER0q4.js";function V(s){const[a]=q(),{hash:t,pathname:n}=D(),r=g(),o=r.find(e=>e===a.get("view"))??r[0]??"people",l="/identity/authorize"===n?"/identity/authorize?cli=1":"/identity"===n?`/identity?view=${o}${t}`:"",c=e(i(),r);return L.jsx("div",{className:"railtree__kids",id:"identity-tree",children:c.map(e=>L.jsx(E,{node:e,level:2,current:l},e.id))})}const $=S.lazy(()=>R(()=>Promise.resolve().then(()=>X),void 0).then(e=>({default:e.LocalAuthorize}))),U=S.lazy(()=>R(()=>import("./cli-app-integration-crypto-TwyER0q4.js").then(e=>e.a),__vite__mapDeps([0,1])).then(e=>({default:e.CliAuthorizePanel})));function W(){const{search:e}=D(),i="1"===new URLSearchParams(e).get("cli");return L.jsx(S.Suspense,i?{fallback:null,children:L.jsx(U,{})}:{fallback:null,children:L.jsx($,{})})}const Y="identity.local-iam",F=["devices","service-accounts"],K={targets:l(b,["nav.identity","identity.devices","identity.service-accounts"]),goals:[...C,...l(_,["identity.applications.manage","identity.local.agent.keys.manage","identity.local.application.authorize","identity.local.passkeys.manage","identity.local.directory.manage","identity.local.organizations.member"])],routes:y},J=Object.freeze(Object.defineProperty({__proto__:null,CAPABILITY:Y,IDENTITY_VIEWS_OWNED:F,TUTORIAL:K,capabilityRuntime:{capability:Y,async activate(e){const i=v(e,Y);if(i.disposed())return i.handle();const r=m.ensureDefaultAccess;return m.ensureDefaultAccess=s,i.onDispose(()=>{m.ensureDefaultAccess=r}),i.onDispose(c(n)),i.onDispose(a()),i.onDispose(j(F)),i.register("section",{id:"identity",to:"/identity",label:"Identity",segment:"identity",jump:"i",icon:"user",order:40,Tree:V}),i.register("route",{id:"identity",path:"/identity",element:t,framed:!0,order:40}),i.register("route",{id:"identity-authorize",path:"/identity/authorize",element:W,framed:!0,order:41}),i.register("command-path",{path:"/identity",label:"Identity"}),i.register("command-path",{path:"/identity/authorize?cli=1",label:"Pair CLI"}),f(i,F),i.register("keymap-jump",{key:"i",path:"/identity"}),i.register("unlock-effect",{id:"receipts-flush",run:({tomb:e})=>h(e).then(()=>{})}),x(i,K),i.handle()}}},Symbol.toStringTag,{value:"Module"}));function Q({tomb:e,request:i}){const s=o(e,i);return L.jsxs("section",{className:"panel","aria-label":"Application sign-in","aria-busy":s.busy,children:[L.jsx("div",{className:"panel__head",children:L.jsxs("h1",{children:[i.agent?"Authorize agent access to":"Sign in to"," ",s.application||"an application"]})}),L.jsxs("div",{className:"panel__body",children:[L.jsxs("p",{children:["Requesting site:"," ",L.jsx("code",{className:"identity-ref",children:new URL(i.redirectUri).origin})]}),L.jsxs("details",{children:[L.jsx("summary",{children:"Exact callback address"}),L.jsx("p",{className:"identity-ref",children:i.redirectUri})]}),s.agent?L.jsxs("div",{children:[L.jsxs("p",{children:["Agent requesting access: ",L.jsx("strong",{children:s.agent.name})]}),L.jsxs("details",{children:[L.jsx("summary",{children:"Agent identity and enrolled key"}),L.jsx("p",{className:"identity-ref",children:s.agent.id}),L.jsx("p",{className:"identity-ref",children:s.agentKeyId})]})]}):null,L.jsxs("p",{children:["Requested permissions: ",L.jsx("code",{children:i.scopes.join(" ")})]}),L.jsx("p",{className:"hint",children:"Shares no vault contents."}),L.jsx(k,{id:"local-authorize:consent",title:"Application sign-in",message:s.error}),s.loaded||s.error?null:L.jsx("output",{children:"Reading application registration…"}),L.jsx(G,{model:s})]})]})}function Z({status:e,session:i,agent:s}){return"active"===e?"Application connected.":"closed"===e?"Connection ended.":"approved"===e?"Finishing sign-in…":"waiting"===e?s?"Waiting for agent proof…":"Waiting for application…":i?"Passkey verified.":"Verify to continue."}function G({model:e}){const i=S.useRef(null),{busy:s,loaded:a,status:t}=e;return S.useEffect(()=>{a&&!s&&w()&&A(I(i.current))}),L.jsxs("div",{ref:i,children:[a&&"closed"!==t&&"active"!==t&&"approved"!==t?L.jsx(H,{model:e}):null,L.jsx("p",{className:"hint",children:L.jsx("output",{"aria-label":"Application connection status",children:Z(e)})}),"active"===t?L.jsx("div",{className:"actions",children:L.jsx("button",{type:"button",className:"btn",onClick:e.close,children:"End application session"})}):null,"closed"===t?L.jsx(O,{to:"/identity?view=applications",children:"Manage applications"}):null]})}function H({model:e}){const{session:i,busy:s,status:a}=e;return L.jsxs(L.Fragment,{children:[L.jsxs("div",{className:"field",children:[L.jsx("label",{className:"label",htmlFor:"local-consent-person",children:e.agent?"Approving person":"Person"}),L.jsxs("select",{id:"local-consent-person",value:e.person,disabled:s||null!==i,onChange:i=>e.setPerson(i.target.value),children:[L.jsx("option",{value:"",children:"Choose a local person"}),e.people.map(e=>L.jsx("option",{value:e.id,children:e.name},e.id))]})]}),0===e.people.length?L.jsx("p",{children:e.agent?"No enabled owners or admins belong to this application's organization. Assign membership in Identity before approving agent access.":"No enabled people belong to this application's organization. Assign membership in Identity before signing in."}):null,L.jsx(z,{label:i?e.agent?"Allow agent access":"Allow application":s?"Verifying passkey…":"Verify with passkey",icon:i?void 0:L.jsx(T,{size:18}),disabled:i?s||"connected"!==a:s||!e.person||"connected"!==a,onClick:()=>{e.run(Boolean(i))},children:L.jsx(N,{label:"Deny",disabled:s,onClick:()=>{e.deny()},children:L.jsx(P,{size:16})})})]})}const X=Object.freeze(Object.defineProperty({__proto__:null,LocalAuthorize:function(){const{search:e}=D(),{tomb:i}=M(),s=S.useMemo(()=>{try{return r(e)}catch{return null}},[e]);return s?L.jsx(Q,{tomb:i,request:s},`${i}:${e}`):L.jsxs("section",{className:"panel","aria-label":"Application sign-in",children:[L.jsx("div",{className:"panel__head",children:L.jsx("h1",{children:"Invalid application request"})}),L.jsxs("div",{className:"panel__body",children:[L.jsx(k,{id:"local-authorize:request",title:"Invalid application request",message:"Start sign-in again from the registered application."}),L.jsx(O,{to:"/identity?view=applications",children:"Manage applications"})]})]})}},Symbol.toStringTag,{value:"Module"})),ee="CLI pairing is optional and only works on your own deployment, where a passkey approves the terminal. Local CLI approval is blocked on this site.",ie="Couldn't check for CLI requests.",se="Authorize with passkey",ae="No passkey is stored for CLI approval. Pair again in this browser before a request can be approved.",te="This browser cannot use a passkey, so CLI approval cannot succeed.",ne="The approval service could not be reached.";function re(e){switch(e){case"wrongSession":return"The passkey proof was rejected.";case"expired":return"That request expired.";case"cli_app_pairing_required":return"Pairing is missing. Pair again before approving.";case"origin_required":return"This page's origin was not accepted.";default:return`That approval did not succeed (${e}).`}}async function oe(e,i,s,a,t){const n={requestId:s[0],terminalSessionId:s[1],decision:a,respondNonce:s[3]},r="approve"===a&&t?{...n,humanProof:t}:n,o=await d(`${e}/v1/cli/app-integration/respond`,{method:"POST",credentials:"omit",cache:"no-store",headers:{...i,"content-type":"application/json"},body:JSON.stringify(r)});let l="approval_unreadable";try{const e=await o.json();p(e)&&(u(e.status)&&e.status.length>0?l=e.status:u(e.error)&&e.error.length>0&&(l=e.error))}catch{l=o.ok?"approval_unreadable":"approval_failed"}return{ok:o.ok&&("approved"===l||"denied"===l),status:l}}async function le(e){if(e.busy)return;let i;e.setBusy(!0),e.setMark(null);try{i=await R(()=>import("./cli-app-integration-crypto-TwyER0q4.js").then(e=>e.b),__vite__mapDeps([0,1]))}catch{return e.setBusy(!1),void e.setMark("Authorize needs a connection to load on this device.")}try{const s=await i.mintCliAuthorizePasskeyProof(e.row);e.setBusy(!1),await e.finish("approve",s)}catch(s){e.setBusy(!1),e.setMark(s instanceof B?s.message:"The passkey step did not finish.")}}export{ee as C,ie as a,ne as b,re as c,se as d,ae as e,te as f,J as g,oe as p,le as r};

package/dist/assets/cap-identity.siop-C80liHvH.js

@@ -0,0 +1 @@
+import{j as e,r as s}from"./react-dom-BwC4eQlG.js";import{K as i,U as n,f as o,S as t,e as a,o as r,T as l,V as c,M as d,O as u,Q as p,W as h,c as f,r as y,I as m}from"./main-BrkS-iow.js";import{S as b}from"./InvokeScreen-C-kFFYVF.js";import{p as g}from"./vault-ui-seam-BQGS7RR6.js";import{e as j}from"./signals-DdOHdr--.js";import"./model-provider-B6oAnQX9.js";import{s as S}from"./local-applications-rigvedS6.js";import{u as x,a as I,b as v,s as w,c as P,d as k,r as E,e as B,f as C,g as N,h as R,S as z}from"./SiopAuthorize-D_OIu8gb.js";import{x as A}from"./drop-open-BjgdLxWM.js";import{u as T}from"./react-router-XsJY84ug.js";function L({state:s}){const{person:i,people:n,busy:o,socialBusy:t,session:a,setPerson:r}=s;return e.jsxs("div",{className:"field",children:[e.jsx("label",{className:"label",htmlFor:"siop-consent-person",children:"Person"}),e.jsxs("select",{id:"siop-consent-person",value:i,disabled:o||t||null!==a,onChange:e=>r(e.target.value),children:[e.jsx("option",{value:"",children:"Choose a local person"}),n.map(s=>e.jsx("option",{value:s.id,children:s.name},s.id))]})]})}function U({state:s,chooseSocial:i}){const{socialChoices:t,person:a,busy:r,socialBusy:l,socialProof:c}=s;return e.jsxs("div",{className:"siop-social","aria-label":"Social sign-in",children:[e.jsx("h2",{children:"Social sign-in"}),a?null:e.jsx(b,{tone:"idle",label:"Choose a local person first."}),e.jsx("ul",{children:t.map(s=>{const t=n(s.providerId);return e.jsxs("li",{className:"siop-social__row",children:[e.jsx("button",{type:"button",className:"icon-btn icon-btn--sm"+(t?` ${t.className}`:""),"aria-label":`Continue with ${s.label}`,title:`Continue with ${s.label}`,disabled:r||l||!a||Boolean(c),onClick:()=>i(s),children:e.jsx(t?t.Icon:o,{size:16})}),e.jsxs("span",{className:"go-verb","aria-hidden":"true",children:[s.label,s.accountLabel?` · ${s.accountLabel}`:""]})]},s.id)})})]})}function V(e){const{finished:s,socialProof:i,session:n}=e;return s?"Finishing sign-in…":i?`Signed in with ${i.label}. ${n?"Passkey verified.":"Verify the selected person with a passkey."}`:n?"Passkey verified.":"Verify to continue."}function _({state:s,actions:n,request:o}){const{finished:t,session:a,busy:r,application:l,redirectOrigin:c,error:d,loaded:u,root:p,people:h,socialChoices:f,socialError:y,socialBusy:m,person:b}=s;return e.jsxs("section",{className:"panel","aria-label":"Self-issued sign-in","aria-busy":r,children:[e.jsx("div",{className:"panel__head",children:e.jsxs("h1",{children:["Self-issued sign-in to ",l||"an application"]})}),e.jsxs("div",{className:"panel__body",children:[e.jsxs("p",{children:["Requesting site:"," ",e.jsx("code",{className:"identity-ref",children:c})]}),e.jsxs("details",{children:[e.jsx("summary",{children:"Exact callback address"}),e.jsx("p",{className:"identity-ref",children:o.redirectUri})]}),e.jsxs("p",{children:["Requested permissions: ",e.jsx("code",{children:"openid"})]}),e.jsx("p",{className:"hint",children:"Shares no vault contents."}),e.jsx(i,{id:"siop-authorize:consent",title:"Self-issued sign-in",message:d}),u||d?null:e.jsx("output",{children:"Reading application registration…"}),e.jsxs("div",{ref:p,children:[!u||t||d?null:e.jsxs(e.Fragment,{children:[e.jsx(L,{state:s}),0===h.length?e.jsx("p",{children:"No enabled people belong to this application's organization. Assign membership in Identity before signing in."}):null,f.length>0&&!a?e.jsx(U,{state:s,chooseSocial:n.chooseSocial}):null,y?e.jsx(i,{id:"siop-authorize:social",title:"Social sign-in",message:y}):null,e.jsx(D,{signedIn:Boolean(a),busy:r||m,canVerify:Boolean(b),onAllow:n.allow,onVerify:n.verifyPasskey,onDeny:n.deny})]}),e.jsx("p",{className:"hint",children:e.jsx("output",{"aria-label":"Self-issued sign-in status",children:V(s)})})]})]})]})}function D(s){const{signedIn:i,busy:n}=s;return e.jsx(t,{label:i?"Allow Self-Issued sign-in":n?"Verifying passkey…":"Verify with passkey",icon:i?void 0:e.jsx(l,{size:18}),disabled:n||!(i||s.canVerify),onClick:i?s.onAllow:s.onVerify,children:e.jsx(a,{label:"Deny",disabled:n,onClick:s.onDeny,children:e.jsx(r,{size:16})})})}function $(e,s,i){const{busy:n,finished:o,setFinished:t}=i,a=x(async()=>{t(!0),await E(e,s),globalThis.location.replace(B(s))});return{chooseSocial:e=>function(e,s){const{busy:i,socialBusy:n,session:o,person:t,finished:a,setSocialError:r,setError:l,setSocialProof:d,setSocialBusy:u}=s;if(i||n||o||!t||a)return;if(r(""),l(""),"connection"===e.source){if(!e.connectionId)return;return void d({source:"connection",providerId:e.providerId,label:e.accountLabel?`${e.label} · ${e.accountLabel}`:e.label,personId:t,at:Date.now(),connectionId:e.connectionId})}if(!e.upstream||!e.upstreamId)return;const p={id:crypto.randomUUID(),source:"identity",providerId:e.providerId,label:e.label,personId:t,at:Date.now(),upstreamId:e.upstreamId};w(p),u(!0),c(e.upstream,{returnTo:P(p.id),providerHint:e.upstream.providerHint}).catch(e=>{k(),u(!1),r(e instanceof Error?e.message:"That social sign-in did not start.")})}(e,i),verifyPasskey:()=>{!async function(e,s){const{busy:i,person:n,finished:o,generation:t,setBusy:a,setSocialError:r,setError:l,setSession:c}=s;if(i||!n||o)return;const d=t.current;a(!0),r(""),l("");try{const s=await S(e,n);d===t.current&&c(s)}catch(u){d===t.current&&(c(null),l(u instanceof j?u.message:"Sign-in was not completed. Retry with your enrolled passkey."))}finally{d===t.current&&a(!1)}}(e,i)},allow:()=>{!async function(e,s,i){const{busy:n,session:o,socialProof:t,finished:a,generation:r,setBusy:l,setError:c,setFinished:d,setSession:u}=i;if(n||!o&&!t||a)return;const p=r.current;l(!0),c("");try{const i=t?await I(e,t,s):o?await v(e,o,s):null;if(!i||p!==r.current)return;const{redirectUrl:n}=i;d(!0),globalThis.location.replace(n)}catch(h){p===r.current&&(u(null),c(h instanceof j?h.message:"Self-Issued sign-in was not completed. Retry with your enrolled passkey."))}finally{p===r.current&&l(!1)}}(e,s,i)},deny:function(){n||o||a()}}}function O(e,i){const n=function(e){const[i,n]=s.useState([]),[o,t]=s.useState(""),[a,r]=s.useState(""),[l,c]=s.useState(null),[d,u]=s.useState(null),[p,h]=s.useState(!1),[f,y]=s.useState(""),[m,b]=s.useState(!1),[g,j]=s.useState(!1),[S,x]=s.useState(""),[I,v]=s.useState(!1),w=C(),{search:P}=T();return{people:i,setPeople:n,application:o,setApplication:t,person:a,setPerson:r,session:l,setSession:c,socialProof:d,setSocialProof:u,socialBusy:p,setSocialBusy:h,socialError:f,setSocialError:y,busy:m,setBusy:b,loaded:g,setLoaded:j,error:S,setError:x,finished:I,setFinished:v,socialChoices:w,search:P,root:s.useRef(null),generation:s.useRef(0),redirectOrigin:s.useMemo(()=>{try{return new URL(e.redirectUri).origin}catch{return"unknown origin"}},[e.redirectUri])}}(i),{person:o,socialProof:t,setSocialProof:a,loaded:r,busy:l,socialBusy:c,finished:f,root:y}=n;return function(e,i,n){const{generation:o,setApplication:t,setPeople:a,setLoaded:r,setError:l}=n;s.useEffect(()=>{const s=++o.current;return(async()=>{try{const n=await N(e,i),l=await A(e);if(s!==o.current)return;const c=new Set(l.memberships.filter(e=>e.organizationId===n.application.organizationId).map(e=>e.principalId)),d=l.entries.find(e=>e.id===n.application.applicationId&&"application"===e.kind&&e.enabled);t(d?.name??n.application.applicationId),a(l.entries.filter(e=>"person"===e.kind&&e.enabled&&c.has(e.id))),r(!0)}catch{s===o.current&&l("This Self-Issued request is unavailable. Check its registration in Identity, then start again from the application.")}})(),()=>{o.current++}},[e,i,o,t,a,r,l])}(e,i,n),function(e){const{loaded:i,people:n,person:o,search:t,setPerson:a,setSocialError:r,setSocialProof:l}=e;s.useEffect(()=>{if(!i)return;const e=new URLSearchParams(t).get("social"),s=R(e);if(!s)return;if(s.personId!==o)return void(n.some(e=>e.id===s.personId)?a(s.personId):(k(),r("Choose the local person you started social sign-in with.")));if("identity"!==s.source)return;const c=h();if(!c||c.upstreamId!==s.upstreamId||c.expiresAt<=Date.now())return k(),void r("That social sign-in expired. Choose it again.");k(),l({source:"identity",providerId:s.providerId,label:s.label,personId:s.personId,at:Date.now(),upstreamId:s.upstreamId})},[i,n,o,t,a,r,l])}(n),s.useEffect(()=>{t&&t.personId!==o&&a(null)},[o,t,a]),s.useEffect(()=>{!r||l||c||f||!d()||u(p(y.current))}),n}const F="identity.siop",q={goals:g(m,["identity.local.siop.authorize"])},M=Object.freeze(Object.defineProperty({__proto__:null,CAPABILITY:F,TUTORIAL:q,capabilityRuntime:{capability:F,async activate(e){const s=f(e,F);return s.disposed()||(s.register("route",{id:"identity-siop",path:"/identity/siop",element:z,framed:!0,order:42}),y(s,q)),s.handle()}}},Symbol.toStringTag,{value:"Module"}));export{_ as S,$ as a,M as r,O as u};

package/dist/assets/cap-networking.tailnet-c5h7F7pL.js

@@ -0,0 +1 @@
+import{T as e,l as t,i as s,h as r}from"./certs-CDCfMuEi.js";import{a as i,n,b as o,t as a,p as l,f as c,c as h,T as d,d as u,e as p,g as f,h as m,o as w,w as g,i as v,j as b,k as y,r as T,l as k,m as P,q as x}from"./tailscale-artifacts-FyY85j_Y.js";import{s as E}from"./FeatureSections-BG-JsWID.js";import{S as j,a2 as C,X as L,K as R,e as S,a8 as H,m as U,o as N,a9 as A,aa as I,ab as q,ac as M,c as z}from"./main-BrkS-iow.js";import{r as O,j as _}from"./react-dom-BwC4eQlG.js";import{s as D}from"./bucket-saved-vQCiVvN_.js";import{i as K}from"./vault-ui-seam-BQGS7RR6.js";import{d as W,s as G,v as $}from"./drop-open-BjgdLxWM.js";import"./identity-BVf8yWa4.js";import"./federation-configured-restoration-DWAXgzcz.js";import"./native-auth-return-BTXjvSvx.js";import{C as V}from"./MethodPicker-CqQTyAaT.js";import{C as F,S as B,a as J}from"./InvokeScreen-C-kFFYVF.js";import{u as Q}from"./wake-lock-C_y0fQco.js";import{G as X}from"./idp-presets-B1M-P0Ek.js";import{b as Y}from"./signals-DdOHdr--.js";import{d as Z,o as ee,e as te,l as se,s as re,n as ie,r as ne,a as oe,b as ae,_ as le,f as ce,N as he,u as de,g as ue,t as pe}from"./native-worker-zod-5c0ed887-B342B6ko.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./vault-credential-custody-DpnBb4qo.js";import"./vaults-B043odav.js";import"./model-provider-B6oAnQX9.js";import"./features-9FeW22VH.js";import"./identity-view-paths-Bi1yigZk.js";import"./react-router-XsJY84ug.js";import"./seams-DJ_lslby.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./entra-instances-NyEKYI5c.js";import"./vault-list-path-Bh2_KZkq.js";function fe(){const e=O.useSyncExternalStore(i,n,n);if(!e)return null;const{state:t,node:s}=e;return _.jsx(V,{title:"Connect identity browser node",mark:_.jsx(C,{size:18}),onClose:e.cancel,children:_.jsxs(F,{name:e.label,facts:[{key:"Control server",value:t.controlURL},{key:"Browser node",value:t.hostname}],children:["login"!==t.status||t.authURL?null:_.jsx(j,{label:"Sign in to Tailscale",onClick:()=>s.login()}),t.authURL?_.jsx("a",{href:t.authURL,target:"_blank",rel:"noreferrer noopener",children:"Continue signing in with Tailscale"}):null,"approval"===t.status?_.jsx(B,{tone:"err",label:"Approve this browser node in your Tailscale admin console."}):null,t.failure?_.jsx(B,{tone:"err",label:t.failure}):null]})})}function me({children:e}){return _.jsxs(_.Fragment,{children:[e,_.jsx(fe,{})]})}function we(e){return e?[{key:"Writes",value:"the vault, into this device's own place"},{key:"Then",value:"the unlock screen asks for its password"}]:[{key:"Pairs",value:"this vault with the drive"},{key:"Code from",value:"opensesame daemon drive create"}]}function ge({initialCode:e,guest:t,canPair:s,onPair:r,onClose:i}){const[n,o]=O.useState(e),[a,l]=O.useState(!1),[c,h]=O.useState(null),d=t?"Set this device up from the drive":"Pair with this drive",u=s&&n.trim().length>0,p=()=>{u&&!a&&(l(!0),h(null),r(n).catch(e=>h(e instanceof Error?e.message:String(e))).finally(()=>l(!1)))};return _.jsx(V,{title:"Pair with a drive",mark:_.jsx(C,{size:20}),onClose:i,children:_.jsx("form",{"aria-label":"Pair with a drive",onSubmit:e=>{e.preventDefault(),p()},children:_.jsxs(F,{ok:null===c,top:c??void 0,name:"Tailnet drive",facts:we(t),primary:{label:d,submit:!0,busy:a,disabled:!u,onClick:p},children:[_.jsx(L,{id:"tailnet-sync-code",label:"Pairing code",mono:!0,autoComplete:"off",placeholder:"opensesame-drive:v1:…",value:n,disabled:!s,readOnly:a,status:null===c?null:_.jsx(B,{tone:"err",label:c}),onValueChange:e=>{o(e),h(null)}}),_.jsx("output",{className:"visually-hidden","aria-live":"polite",children:c??""}),_.jsx(R,{id:"tailnet:pair",title:"Tailnet pairing",message:c})]})})})}const ve="tailnet-sync",be={state:a,subscribe:o,pair:l,sync:h,forget:c};function ye(e){try{return new URL(e).host}catch{return e}}function Te({state:e,busy:t,run:s}){const{drive:r}=e;return _.jsxs("div",{className:"vault-row",children:[_.jsxs("div",{className:"vault-row__body",children:[_.jsx("span",{className:"vault-row__mark","aria-hidden":"true",children:_.jsx(C,{size:18})}),_.jsxs("span",{className:"vault-row__text",children:[_.jsx("span",{className:"vault-row__name",children:r.label||ye(r.url)}),_.jsx("span",{className:"vault-row__meta",children:ye(r.url)})]})]}),_.jsx("button",{type:"button",className:"icon-btn","aria-label":"Sync now",title:"Sync now",disabled:t||"syncing"===e.phase,onClick:()=>s(()=>be.sync({interactive:!0})),children:_.jsx(U,{size:16})}),_.jsx("button",{type:"button",className:"icon-btn","aria-label":"Stop syncing this vault",title:"Stop syncing this vault",disabled:t,onClick:()=>s(be.forget),children:_.jsx(N,{size:16})})]})}function ke(){const e=O.useSyncExternalStore(be.subscribe,be.state),{status:t,guest:s}=Q(),[r,i]=O.useState(!1),[n,o]=O.useState(null),a=s||"unlocked"===t||"empty"===t;var l;l=O.useCallback(e=>o({code:e}),[]),O.useEffect(()=>{const e=()=>{const e=A();e&&l(e)};return e(),H(e)},[l]);const{drive:c}=e,h=c?function(e){return"syncing"===e.phase?{tone:"idle",label:"Syncing"}:"error"===e.phase?{tone:"err",label:e.error??"Sync failed"}:"blocked"===e.phase?{tone:"warn",label:e.error??"Waiting for local network access"}:e.lastSyncedAt?{tone:"ok",label:`In step at ${new Date(e.lastSyncedAt).toLocaleTimeString()}`}:{tone:"idle",label:"Waiting for the first sync"}}(e):null;return _.jsx(X,{id:"settings.tailnet-sync",children:_.jsxs("section",{className:"panel set__security",id:"tailnet-sync",children:[_.jsxs("div",{className:"panel__head",children:[_.jsx("div",{children:_.jsx("h2",{children:"Tailnet sync"})}),h?_.jsx(B,{tone:h.tone,label:h.label}):null]}),_.jsx("div",{className:"panel__body",children:c?_.jsx(Te,{state:{...e,drive:c},busy:r,run:e=>{W(ve),i(!0),e().catch(e=>G({id:ve,tone:"err",title:"Tailnet sync",body:e instanceof Error?e.message:String(e)})).finally(()=>i(!1))}}):_.jsx(J,{icon:_.jsx(C,{size:16}),label:"Drive on your tailnet",sub:"Not paired",action:_.jsx(S,{small:!0,label:s?"Set this device up from the drive":"Pair with a drive",disabled:r||!a,"aria-haspopup":"dialog",onClick:()=>o({code:""}),children:_.jsx(C,{size:16})})})}),n?_.jsx(ge,{initialCode:n.code,guest:s,canPair:a,onPair:async e=>{await be.pair(e),o(null),requestAnimationFrame(()=>document.querySelector('#tailnet-sync [aria-label="Sync now"]')?.focus())},onClose:()=>o(null)}):null]})})}function Pe(e){const t=new URL(e),s="http:"===t.protocol&&["localhost","127.0.0.1","[::1]"].includes(t.hostname);if("https:"!==t.protocol&&!s||t.username||t.password||"/"!==t.pathname||t.search||t.hash)throw new Error("Use an HTTPS control server or an HTTP loopback test server.");return t}function xe(e,t){const s=new URL(e),r=new URL(t);if(s.username||s.password||s.origin!==r.origin&&("controlplane.tailscale.com"!==r.hostname||"https://login.tailscale.com"!==s.origin))throw new Error("Unexpected Tailscale authorization destination.");return s.href}const Ee=ie().int().min(1).max(Number.MAX_SAFE_INTEGER),je=oe(pe([re().max(32768),re().max(32768)])).max(64).refine(function(e){const t=new TextEncoder;return e.reduce((e,s)=>e+t.encode(s[0]).length+t.encode(s[1]).length,0)<=32768}),Ce=ee({method:le(["GET","HEAD","POST","PUT","PATCH","DELETE"]),url:re().url().max(8192),headers:je.refine(e=>e.length<64),body:ae(Uint8Array).refine(e=>e.byteLength<=1048576)}).strict(),Le=ee({status:ie().int().min(200).max(599),statusText:re().max(32768),url:re().url().max(8192),headers:je,body:ae(Uint8Array).refine(e=>e.byteLength<=4194304)}).strict(),Re=Le.omit({body:!0}),Se=ee({sequence:Ee,body:ue(e=>e instanceof Uint8Array).refine(e=>e.buffer instanceof ArrayBuffer&&e.byteLength<=32768),eof:te()}).strict(),He=oe(ee({origin:re().url().max(2048),prefixes:oe(re().min(1).max(64)).min(1).max(16)}).strict()).min(1).max(16),Ue=de([ce().transform((e,t)=>{const s=d.safeParse(e);return s.success?s.data:(t.addIssue({code:"custom",message:"Invalid peer HTTPS configuration."}),he)}),ee({exitNodeID:re().min(1).max(256),trustMode:se("public"),targets:He}).strict(),ee({exitNodeID:re().min(1).max(256),trustMode:se("operator").default("operator"),operatorCAPEM:re().min(1).max(65536),targets:He}).strict()]),Ne=ce().transform((t,s)=>{const r=e.safeParse(t);return r.success?r.data:(s.addIssue({code:"custom",message:"Invalid peer TLS trust."}),he)}),Ae=ee({ephemeral:te().default(!1),hostname:re().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/),controlURL:re().url(),authKey:re().max(16384),state:ne(re(),re().max(1e6)),assets:ee({runtime:re().url(),wasm:re().url(),nativeHTTP:re().url().optional()}),nativeHTTP:Ue.optional(),peerTLS:Ne.optional()}).refine(e=>!e.ephemeral||""===e.authKey&&0===Object.keys(e.state).length,{message:"Memory-only identity enrollment cannot accept stored node state or an auth key."});Z("kind",[ee({kind:se("nativeHTTPReady")}),ee({kind:se("nativeHTTP"),id:Ee,request:Ce}),ee({kind:se("nativeHTTPStream"),id:Ee,request:Ce}).strict(),ee({kind:se("pullHTTP"),id:Ee,sequence:Ee}).strict(),ee({kind:se("cancelHTTP"),id:Ee}),ee({kind:se("closeHTTP")}),ee({kind:se("start"),config:Ae}),ee({kind:se("login")}),ee({kind:se("get"),id:ie().int(),url:re().url()}),ee({kind:se("decision"),id:ie().int(),url:re().url(),method:re(),allowed:te()})]);const Ie=Z("kind",[ee({kind:se("nativeHTTPReady"),ready:te()}),ee({kind:se("closeHTTP"),closed:te()}),ee({kind:se("nativeHTTP"),id:Ee,result:Le}),ee({kind:se("nativeHTTPStream"),id:Ee,result:Re}).strict(),ee({kind:se("nativeHTTPChunk"),id:Ee,result:Se}).strict(),ee({kind:se("nativeHTTPError"),id:Ee}),ee({kind:se("decision"),id:ie().int(),url:re().url(),method:re()}),ee({kind:se("state"),state:re()}),ee({kind:se("storage"),state:ne(re(),re().max(1e6))}),ee({kind:se("netmap"),value:re().max(4e6)}),ee({kind:se("auth"),url:re().url()}),ee({kind:se("error")}),ee({kind:se("get"),id:ie().int(),status:ie().int(),text:re().max(1e6)})]),qe=ee({self:ee({machineStatus:re(),addresses:oe(re()).max(32)}),peers:oe(ee({})).max(1e4),lockedOut:te()});function Me(e,t,s){const r=t=>e.postMessage(t);return Object.freeze({open:()=>r({kind:"nativeHTTPStream",id:t,request:s}),pull:e=>r({kind:"pullHTTP",id:t,sequence:e}),cancel:()=>r({kind:"cancelHTTP",id:t})})}class ze{response;resolve=()=>{};reject=()=>{};body;credit;opened=!1;ended=!1;next=1;bytes=0;#e;constructor(e){this.#e=e,this.response=new Promise((e,t)=>{this.resolve=e,this.reject=t})}current(){if(this.#e.check(),this.#e.signal.throwIfAborted(),this.ended)throw new Error("Native stream ended.")}start(){this.#e.signal.addEventListener("abort",this.fail,{once:!0});try{this.current(),this.#e.channel.open()}catch{this.fail()}}finish(){this.ended=!0,this.#e.signal.removeEventListener("abort",this.fail),this.#e.retire(),this.credit?.(),this.credit=void 0}cancel(){try{this.#e.channel.cancel()}catch{}}fail=()=>{if(this.ended)return;this.finish(),this.cancel();const e=new Error("Native HTTPS failed on the original browser node.");this.body?.error(e),this.reject(e)};pull(){try{if(this.current(),this.credit)throw new Error("Concurrent native stream credit.");return new Promise(e=>{this.credit=e,this.#e.channel.pull(this.next)})}catch{return this.fail(),Promise.resolve()}}headers(e){if(this.opened)throw new Error("Duplicate native stream headers.");const t=Re.parse(e.result);if(t.url!==this.#e.request.url)throw new Error("Native stream URL changed.");const s=[204,205,304].includes(t.status),r=s?null:new ReadableStream({start:e=>{this.body=e},pull:()=>this.pull(),cancel:()=>this.fail()},{highWaterMark:0}),i=new Response(r,{status:t.status,statusText:t.statusText,headers:t.headers});Object.defineProperty(i,"url",{value:t.url}),this.current(),this.opened=!0,s&&(this.finish(),this.cancel()),this.resolve(i)}chunk(e){const t=Se.parse(e.result);if(!this.opened||!this.credit||t.sequence!==this.next||this.bytes+t.body.byteLength>4194304)throw new Error("Invalid native stream credit.");const s=new Uint8Array(t.body);this.current(),this.bytes+=s.byteLength,this.next++;const r=this.credit;this.credit=void 0,s.byteLength&&this.body?.enqueue(s),t.eof&&(this.body?.close(),this.finish()),r()}complete(e){if(!this.ended)try{if(this.current(),"nativeHTTPStream"===e.kind)this.headers(e);else{if("nativeHTTPChunk"!==e.kind)throw new Error("Unexpected native stream response.");this.chunk(e)}}catch{this.fail()}}}class Oe{constructor(e,t,s,r,i,n){this.check=t,this.connected=s,this.stop=i,this.nativeEnabled=n,this.#t=e,this.#s=r}check;connected;stop;nativeEnabled;#r=new AbortController;#i=0;#n=new Map;#o=new Set;peerUsed=!1;get usedPeer(){return this.peerUsed}retirement=null;retired=null;#t;#s;assertCurrent=()=>{if(this.#r.signal.throwIfAborted(),this.check(),!this.connected())throw new Error("Connect the original browser node first.")};receive(e){if("closeHTTP"===e.kind)return this.retired?.(e.closed),this.retired=null,!0;if("nativeHTTPReady"===e.kind){for(const t of[...this.#o])t(e.ready);return!0}return("nativeHTTP"===e.kind||"nativeHTTPError"===e.kind||"nativeHTTPStream"===e.kind||"nativeHTTPChunk"===e.kind||"get"===e.kind)&&(this.#n.get(e.id)?.complete(e),!0)}close(){if(this.retirement)return this.retirement;this.retirement=new Promise(e=>{this.retired=e}),this.#r.abort();for(const e of[...this.#n.values()])e.fail();this.#n.clear();for(const e of[...this.#o])e(!1);this.#o.clear();try{this.#t.postMessage({kind:"closeHTTP"})}catch{this.retired?.(!1),this.retired=null}return this.retirement}get(e){if(this.#r.signal.throwIfAborted(),this.check(),this.#n.size>=4||!this.connected()||!this.#s(e))return Promise.reject(new Error("Connect a browser node and allow this tailnet service first."));this.peerUsed=!0;const t=++this.#i;return new Promise((s,r)=>{const i=()=>{clearTimeout(n),this.#n.delete(t)},n=setTimeout(()=>{i(),this.stop(),r(new Error("Tailscale peer request timed out; the browser node was disconnected."))},3e4);this.#n.set(t,{fail:()=>{i(),r(new Error("Tailscale node stopped."))},complete:t=>{if("get"===t.kind){i();try{if(this.assertCurrent(),!this.#s(e))throw new Error("The original peer grant ended.");s({status:t.status,text:t.text})}catch{r(new Error("The original Tailscale node changed."))}}}}),this.#t.postMessage({kind:"get",id:t,url:e})})}capture(e){if(this.assertCurrent(),e.throwIfAborted(),!this.nativeEnabled)throw new Error("Configure native HTTPS routing and trust for this browser node.");const t=Y([this.#r.signal,e]),s=()=>{t.throwIfAborted(),this.assertCurrent()};return Object.freeze({signal:t,assertCurrent:s,fetch:async(e,r)=>{s();const i=new Request(e,r),n=Y([t,i.signal,AbortSignal.timeout(3e4)]);if(n.throwIfAborted(),"include"===i.credentials||i.integrity||i.keepalive)throw new Error("Native HTTPS uses explicit headers, without browser cookies, integrity or keepalive.");const o=await async function(e,t){const s=e.body?.getReader();if(!s)return new Uint8Array;const r=[];let i=0;const n=()=>{s.cancel().catch(()=>{})};t.addEventListener("abort",n,{once:!0});try{for(;;){t.throwIfAborted();const e=await s.read();if(t.throwIfAborted(),e.done)break;if(i+=e.value.byteLength,i>1048576)throw new Error("Native HTTPS request body exceeds its limit.");r.push(e.value.slice())}const e=new Uint8Array(i);let n=0;for(const t of r)e.set(t,n),n+=t.length;return e}catch(o){throw await s.cancel().catch(()=>{}),o}finally{t.removeEventListener("abort",n),s.releaseLock()}}(i,n);s(),n.throwIfAborted();const a=Ce.parse({method:i.method,url:i.url,headers:[...i.headers],body:o});return await this.#a(n),s(),n.throwIfAborted(),function(e){return"HEAD"!==e.method&&(e.headers.get("accept")??"").split(",").some(e=>"text/event-stream"===e.split(";")[0]?.trim().toLowerCase())}(i)?this.#l(a,n,s):this.#c(a,n,s)}})}#a(e){return new Promise((t,s)=>{const r=n=>{e.removeEventListener("abort",i),this.#o.delete(r),n&&!e.aborted?t():s(new Error("Native HTTPS is not ready on the original browser node."))},i=()=>r(!1);this.#o.add(r),e.addEventListener("abort",i,{once:!0}),e.aborted?r(!1):this.#t.postMessage({kind:"nativeHTTPReady"})})}#l(e,t,s){if(s(),t.throwIfAborted(),this.#n.size>=4)return Promise.reject(new Error("Native HTTPS request capacity reached."));const r=++this.#i,i=new ze({request:e,signal:t,check:s,channel:Me(this.#t,r,e),retire:()=>this.#n.delete(r)});return this.#n.set(r,i),i.start(),i.response}#c(e,t,s){if(s(),t.throwIfAborted(),this.#n.size>=4)return Promise.reject(new Error("Native HTTPS request capacity reached."));const r=++this.#i;return new Promise((i,n)=>{const o=()=>{t.removeEventListener("abort",a),this.#n.delete(r)},a=()=>{o(),this.#t.postMessage({kind:"cancelHTTP",id:r}),n(new Error("The original native HTTPS request ended."))};this.#n.set(r,{fail:a,complete:r=>{if("get"!==r.kind){o();try{if(s(),t.throwIfAborted(),"nativeHTTP"!==r.kind||r.result.url!==e.url)throw new Error("Native HTTPS failed on the original browser node.");const n=r.result,o="HEAD"===e.method||[204,205,304].includes(n.status);if(o&&n.body.length)throw new Error("Unexpected native HTTPS response body.");const a=new Response(o?null:n.body.slice().buffer,{status:n.status,statusText:n.statusText,headers:n.headers});Object.defineProperty(a,"url",{value:n.url}),s(),t.throwIfAborted(),i(a)}catch{n(new Error("Native HTTPS failed on the original browser node."))}}}}),t.addEventListener("abort",a,{once:!0}),t.aborted?a():this.#t.postMessage({kind:"nativeHTTP",id:r,request:e})})}}function _e(e,t,s){const r=t.nativeHTTP;if(e&&!K(r))throw new Error("This deployment is missing its native HTTPS asset.");const i=e?{...2===e.version?{routeMode:e.routeMode,peerID:e.peerID}:{exitNodeID:e.exitNodeID},targets:e.targets,trustMode:e.trustMode}:void 0;return{nativeHTTP:"operator"===e?.trustMode?{...i,operatorCAPEM:e.operatorCAPEM}:i,asset:K(r)?{nativeHTTP:new URL(r,s).href}:{}}}class De{closing=Promise.resolve(!0);retire(e,t){const s=e?.usedPeer,r=e?.close();if(!r||!s)return void t?.terminate();const i=new Promise(e=>{const t=setTimeout(()=>e(!1),6e4);r.then(s=>{clearTimeout(t),e(s)},()=>{clearTimeout(t),e(!1)})});this.closing=Promise.all([this.closing,i]).then(([e,t])=>e&&t,()=>!1),i.then(()=>t?.terminate())}async ready(){if(!(await this.closing))throw new Error("The original peer transport did not confirm closure.")}}class Ke{#h={status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:""};#d=new Set;#u=null;#p=0;#f=null;#m=null;#w="";#g="";#v={};#b="";#y=Promise.resolve();#T=0;#k=null;#P=null;#x=!1;#E=!1;#j=null;#C=new De;#L;#R;#s;#t=null;constructor(e){this.#L=e.assertCurrent,this.#R=e.approve,this.#s=e.approvePeer}snapshot=()=>this.#h;authorization=()=>{const e=this.#p,t=this.#w;return t&&this.#m&&!this.#T?(this.#S(e),this.#R(this.#m.controlURL,"GET")?(this.#S(e),{connectionId:t,connected:"connected"===this.#h.status}):null):null};subscribe=e=>(this.#d.add(e),()=>this.#d.delete(e));#H(e){this.#h={...this.#h,...e};for(const t of this.#d)t()}#S(e=this.#p){if(this.#L(),e!==this.#p||!this.#f)throw new Error("Tailscale node session ended.");if(this.#f.current().guest)throw new Error("Create your own vault first.");if(this.#m&&u(this.#m,this.#w)!==this.#g)throw new Error("The saved Tailscale browser node changed.");if(this.#m&&!this.#T&&p(this.#m)!==this.#b)throw new Error("Tailscale private state changed. Reconnect the browser node.")}#U(e,s,r){const i=t($);return this.#f=i,this.#S(r),this.#H({status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:"",hostname:e.hostname,controlURL:s.origin,status:"starting"}),i}async start(e){this.stop();const t=this.#p;try{this.#L();const s=Pe(e.controlURL),r=this.#U(e,s,t),i=function(e,t,s,r){return Ae.parse({...e,nativeHTTP:void 0,controlURL:t.origin,authKey:e.authKey??"",state:{},assets:{runtime:new URL(s.runtime,r).href,wasm:new URL(s.wasm,r).href}})}(e,s,f.assets,new URL("/OpenSesame/",location.origin)),n=m(e);await this.#C.ready(),this.#S(t);const o=await w({...i,...n,nativeHTTP:n.nativeHTTP},r.current().tomb,()=>this.#S(t));if(this.#S(t),p(o.record)!==o.credentialReceipt||u(o.record,o.connectionId)!==o.publicReceipt)throw new Error("The saved Tailscale browser node changed during startup.");this.#m=o.record,this.#w=o.connectionId,this.#g=o.publicReceipt,this.#v=o.state,this.#b=o.credentialReceipt;const a=()=>{try{this.#S(t)}catch{this.#N(t)}};this.#k=$.subscribe(a),this.#P=D(a),this.#u=new Worker(new URL("tailscale-node-Bxh73eIz.js",import.meta.url).href,{type:"module",name:"opensesame-tailscale"});const l=new MessageChannel;this.#t=l.port1,this.#j=new Oe(l.port1,()=>this.#S(t),()=>"connected"===this.#h.status&&0===this.#T,this.#s,()=>this.stop(),void 0!==o.record.nativeHTTP);const c=_e(o.record.nativeHTTP,f.assets,new URL("/OpenSesame/",location.origin));this.#A(l.port1,this.#j,t),this.#u.onerror=()=>this.#N(t),this.#u.postMessage({kind:"start",config:{...i,state:o.state,nativeHTTP:c.nativeHTTP,peerTLS:o.record.peerTLS,assets:{...i.assets,...c.asset}}},[l.port2])}catch(s){throw t===this.#p&&(this.stop(),this.#H({status:"error",failure:s instanceof Error?s.message:"Could not start the browser node."})),s}}#A(e,t,s){e.onmessage=e=>{const r=Ie.safeParse(e.data);r.success&&"closeHTTP"===r.data.kind?t.receive(r.data):this.#I(e.data,s)}}#I(e,t){if(t!==this.#p)return;const s=Ie.safeParse(e);if(!s.success)return void this.#N(t);const r=s.data;"storage"!==r.kind?this.#y.then(()=>{this.#S(t),this.#q(r,t)}).catch(()=>this.#N(t)):this.#M(r.state,t)}#M(e,t){this.#y=this.#y.then(async()=>{if(this.#S(t),!this.#m)throw new Error("Browser node credential is missing.");const s=this.#m,r={...e};this.#T++,this.#H({});try{const e=await g(s,this.#v,r,()=>this.#S(t));if(this.#S(t),this.#m!==s||p(s)!==e)throw new Error("Tailscale private state changed after persistence.");this.#v=r,this.#b=e}finally{t===this.#p&&(this.#T--,this.#H({}))}this.#S(t)}),this.#y.catch(()=>this.#N(t))}#q(e,t){if(!this.#j?.receive(e))if("decision"===e.kind){const{id:s,url:r,method:i}=e,n=new URL(r),o="log.tailscale.com"!==n.hostname&&this.#R(n.href,i);this.#S(t),this.#t?.postMessage({kind:"decision",id:s,url:r,method:i,allowed:o})}else if("state"===e.kind)this.#x="Running"===e.state,"NeedsLogin"===e.state?this.#H({status:"login"}):"NeedsMachineAuth"===e.state&&this.#H({status:"approval"}),this.#z();else if("netmap"===e.kind){const t=qe.parse(JSON.parse(e.value));this.#E=!t.lockedOut&&"MachineAuthorized"===t.self.machineStatus,this.#H({addresses:t.self.addresses,peerCount:t.peers.length}),this.#z()}else"auth"===e.kind?this.#H({status:"login",authURL:xe(e.url,this.#h.controlURL)}):"error"===e.kind&&this.#N(t)}#z(){this.#x&&this.#E&&this.#h.addresses.length>0?this.#H({status:"connected",authURL:""}):"connected"===this.#h.status&&this.#H({status:"starting",addresses:[]})}async forget(){this.stop(),this.#L();const e=t($);try{const t=()=>{this.#L(),e.current()};await v(e.current().tomb,t)}finally{e.close()}}login(){this.#S(),this.#t?.postMessage({kind:"login"})}captureNativeHTTP(e){if(this.#S(),!this.#j)throw new Error("Connect the original browser node first.");return this.#j.capture(e)}get(e){return this.#S(),this.#j?this.#j.get(e):Promise.reject(new Error("Connect a browser node first."))}#N(e){e===this.#p&&(this.stop(),this.#H({status:"error",failure:"The Tailscale browser node stopped. Check network access and reconnect."}))}stop(){this.#p++,this.#C.retire(this.#j,this.#u),this.#j=null,this.#u=null,this.#t=null,this.#k?.(),this.#k=null,this.#P?.(),this.#P=null,this.#f?.close(),this.#f=null,this.#m=null,this.#w="",this.#g="",this.#v={},this.#b="",this.#T=0,this.#y=Promise.resolve(),this.#x=!1,this.#E=!1,this.#H({status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:""})}}const We=qe.and(ee({self:ee({machineKey:re().min(1).max(1024),nodeKey:re().min(1).max(1024)})}));class Ge{constructor(e,t,s,r=()=>new Worker(new URL("tailscale-node-Bxh73eIz.js",import.meta.url).href,{type:"module",name:"opensesame-identity-peering"})){this.owner=e,this.policy=t,this.assets=s,this.makeWorker=r,this.policyMethods={assertCurrent:t.assertCurrent,approve:t.approve,approvePeer:t.approvePeer,approveNative:t.approveNative},e.signal.addEventListener("abort",this.abort,{once:!0})}owner;policy;assets;makeWorker;view={status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:""};lifetime=new AbortController;listeners=new Set;worker=null;channel=null;requests=null;closing=null;closed=null;started=!1;running=!1;authorized=!1;loginRequested=!1;originalSelf="";origins=new Set;policyMethods;abort=()=>{this.stop()};check=()=>{this.lifetime.signal.throwIfAborted(),this.owner.signal.throwIfAborted(),this.owner.assertCurrent(),this.assertPolicy(),this.policyMethods.assertCurrent.call(this.policy),this.assertPolicy(),this.lifetime.signal.throwIfAborted(),this.owner.signal.throwIfAborted()};assertPolicy=()=>{const e=this.policyMethods;if(this.policy.assertCurrent!==e.assertCurrent||this.policy.approve!==e.approve||this.policy.approvePeer!==e.approvePeer||this.policy.approveNative!==e.approveNative)throw new Error("Original identity peering policy changed.")};snapshot=()=>this.view;subscribe=e=>(this.listeners.add(e),()=>this.listeners.delete(e));publish(e){this.view={...this.view,...e};for(const t of this.listeners)t()}connected=()=>"connected"===this.view.status;start(e){if(this.check(),this.started)throw new Error("The original identity peering attempt already started.");this.started=!0;try{const t=Pe(e.controlURL);if(!this.policyMethods.approve.call(this.policy,t.href,"GET"))throw new Error("Approve Networking for this control server first.");if(this.check(),!e.nativeHTTP)throw new Error("Configure native HTTPS routing and trust for this identity attempt.");const s=_e(e.nativeHTTP,this.assets,new URL(this.assets.runtime)),r=Ae.parse({hostname:`opensesame-id-${crypto.randomUUID().replaceAll("-","").slice(0,20)}`,controlURL:t.origin,authKey:"",state:{},ephemeral:!0,assets:{...this.assets,...s.asset},nativeHTTP:s.nativeHTTP});if(!r.nativeHTTP)throw new Error("Original native HTTPS route is unavailable.");this.origins=new Set(r.nativeHTTP.targets.map(e=>e.origin)),this.check();const i=this.makeWorker();this.worker=i;const n=new MessageChannel;this.channel=n.port1,this.requests=new Oe(n.port1,this.check,this.connected,e=>this.policyMethods.approvePeer.call(this.policy,e),this.abort,!0),n.port1.onmessage=e=>this.receive(e),i.onerror=()=>this.fail(),this.publish({status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:"",hostname:r.hostname,controlURL:t.origin,status:"starting"}),this.check(),i.postMessage({kind:"start",config:r},[n.port2])}catch(t){throw this.fail(),t}}receive(e){try{const t=Ie.parse(e.data);if("closeHTTP"===t.kind)return void this.closed?.(t.closed);if(this.lifetime.signal.aborted)return;if(this.check(),this.requests?.receive(t))return;this.apply(t)}catch{this.fail()}}apply(e){if("decision"===e.kind){const t=new URL(e.url),s="log.tailscale.com"!==t.hostname&&this.policyMethods.approve.call(this.policy,t.href,e.method);this.check(),this.channel?.postMessage({kind:"decision",id:e.id,url:e.url,method:e.method,allowed:s})}else if("state"===e.kind){if(this.connected()&&"Running"!==e.state)throw new Error("Original identity browser node stopped.");this.running="Running"===e.state,"NeedsLogin"===e.state?this.publish({status:"login"}):"NeedsMachineAuth"===e.state&&this.publish({status:"approval"}),this.updateConnected()}else"netmap"===e.kind?this.netmap(e.value):"auth"===e.kind?this.authorize(e.url):"error"!==e.kind&&"storage"!==e.kind||this.fail()}netmap(e){const t=We.parse(JSON.parse(e)),s=JSON.stringify([t.self.machineKey,t.self.nodeKey]);if(this.originalSelf&&this.originalSelf!==s)throw new Error("Original identity browser node changed.");if(this.originalSelf=s,this.authorized=!t.lockedOut&&"MachineAuthorized"===t.self.machineStatus,!this.authorized&&this.connected())throw new Error("Original identity browser node lost authorization.");this.publish({addresses:t.self.addresses,peerCount:t.peers.length}),this.updateConnected()}updateConnected(){this.running&&this.authorized&&this.view.addresses.length>0?this.publish({status:"connected",authURL:""}):this.connected()&&this.fail()}authorize(e){const t=new URL(e),s=new URL(this.view.controlURL);if(t.username||t.password||t.origin!==s.origin&&("controlplane.tailscale.com"!==s.hostname||"https://login.tailscale.com"!==t.origin))throw new Error("Unexpected identity peering authorization destination.");this.publish({status:"login",authURL:t.href})}login(){if(this.check(),!this.worker||"login"!==this.view.status||this.loginRequested)throw new Error("Start a fresh identity peering attempt before explicit login.");this.loginRequested=!0,this.channel?.postMessage({kind:"login"})}captureNativeHTTP(e){if(this.check(),!this.requests)throw new Error("Start the original identity browser node first.");const t=this.requests.capture(AbortSignal.any([e,this.owner.signal,this.lifetime.signal])),s=(e,s)=>{this.check(),t.assertCurrent();const r=new URL(e),i=this.origins.has(r.origin)&&this.policyMethods.approveNative.call(this.policy,r.href,s);return this.check(),t.assertCurrent(),i};return Object.freeze({signal:t.signal,assertCurrent:t.assertCurrent,supportsNativeOrigin:e=>new URL(e).origin===e&&s(e,"GET"),fetch:(e,r)=>{const i=e instanceof Request?e.url:e.toString(),n=r?.method??(e instanceof Request?e.method:"GET");if(!s(i,n.toUpperCase()))throw new Error("Approve this original native identity endpoint before sending.");const o=new Request(e,r);if(!s(o.url,o.method))throw new Error("Approve this original native identity endpoint before sending.");return t.fetch(o)}})}fail(){this.stop(),this.publish({status:"error",failure:"Identity peering ended. Start sign-in again with a fresh browser node."})}stop(){if(this.closing)return this.closing;this.lifetime.abort(),this.owner.signal.removeEventListener("abort",this.abort);const e=this.worker;return this.closing=new Promise(t=>{const s=setTimeout(()=>t(!1),3e4);this.closed=e=>{clearTimeout(s),t(e)},e&&this.requests?this.requests.close():this.closed(!0)}).finally(()=>{e?.terminate(),e&&(e.onmessage=null,e.onerror=null),this.channel?.close(),this.channel=null,this.worker=null,this.requests=null,this.closed=null,this.origins.clear(),this.publish({status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:"",failure:this.view.failure,status:"error"===this.view.status?"error":"stopped"})}),this.closing}}const $e="networking.tailnet",Ve="tailnet-vault-sync";function Fe(e="tailscale"){return r(e)}function Be(e){return e.ok?(y({providerId:e.providerId,operation:e.operation,fields:{...e.action},secret:{...e.secrets}}),function(e){const t=x();if(e.secrets.auth_key&&t["x-tailscale-auth-key"]!==e.secrets.auth_key)return!1;for(const[s,r]of Object.entries(e.action))if(t[`x-tailnet-${s.replaceAll("_","-")}`]!==r)return!1;return!0}(e)?{ok:!0,providerId:e.providerId,operation:e.operation,fields:{...e.action},secret:{...e.secrets}}:{ok:!1,providerId:e.providerId}):(y(null),{ok:!1,providerId:e.providerId})}function Je(e="tailscale"){return Be(Fe(e))}function Qe(){const e=Fe();return Be(e),e}const Xe={capability:$e,async activate(e){const t=z(e,$e);return t.disposed()||(function(e,t){const r=e.lease,i=r.signal,n=e.egress,o=n.decide,a=t.disposed,l=()=>e.lease===r&&r.signal===i&&e.egress===n&&n.decide===o&&t.disposed===a,c=()=>{if(!l()||i.aborted||a.call(t)||!l()||i.aborted)throw new Error("Enable Networking to connect a browser node.")},h={assertCurrent:c,approve:(e,t)=>{c();const s=new URL(e);if("CONNECT"===t){if(!["wss:","ws:"].includes(s.protocol))return!1;s.protocol="wss:"===s.protocol?"https:":"http:"}else if(!["https:","http:"].includes(s.protocol))return!1;return o.call(n,s,{capability:"networking.tailnet",purpose:M}).ok},approvePeer:e=>(c(),o.call(n,e,{capability:"networking.tailnet",purpose:q,class:"peer-or-local-network"}).ok)},d=function(e){return new Ke(e)}(h),u=new URL("/OpenSesame/",location.origin),p=b(e=>new Ge(e,{...h,approveNative:(e,t)=>{c();const s=o.call(n,e,{capability:"networking.tailnet",purpose:I});return c(),"CONNECT"!==t&&s.ok}},{runtime:new URL(f.assets.runtime,u).href,wasm:new URL(f.assets.wasm,u).href,nativeHTTP:new URL(f.assets.nativeHTTP,u).href})),m=s(d),w=$.onLock(()=>d.stop()),g=()=>{d.stop(),p()};i.addEventListener("abort",g,{once:!0}),t.onDispose(()=>{i.removeEventListener("abort",g),d.stop(),p(),w(),m()})}(e,t),t.register("shell-wrapper",{id:"native-oidc-peering",Wrapper:me,Gate:fe,order:15}),t.onDispose(T(Qe)),t.register("background-job",{id:Ve,start:e=>{e.aborted||(k(),e.addEventListener("abort",P,{once:!0}))}}),t.onDispose(P),t.register("settings-panel",{id:"tailnet-sync",label:"Tailnet sync",category:E("feature-networking"),Panel:ke,order:10})),t.handle()}};export{$e as CAPABILITY,Ve as TAILNET_SYNC_JOB,Be as applySavedTailnet,Xe as capabilityRuntime,Je as performTailnetSync,Qe as readSavedTailnet,Fe as savedTailnetOperation};

package/dist/assets/cap-networking.tailnet-devices-BeZz-plo.js

@@ -0,0 +1 @@
+import{r as e,s as a,p as t,v as n,j as s,K as i,d as l,a as r,b as o,o as d,E as c,k as u,t as m,T as h,c as j,e as x,D as p,n as b,f as v,g as y,h as f}from"./tailnet-devices-CRKI2IIc.js";import{j as g,r as k}from"./react-dom-BwC4eQlG.js";import{K as w,v as N,X as C,e as _,Y as z,o as S,Z as $,_ as E,n as R,$ as A,y as D,a0 as T,z as P,a1 as K,a2 as L,a3 as F,a4 as V,R as M,a5 as O,a6 as B,c as I,a7 as Q,r as U}from"./main-BrkS-iow.js";import{S as Z,C as G}from"./InvokeScreen-C-kFFYVF.js";import{u as J,G as X}from"./idp-presets-B1M-P0Ek.js";import{C as Y}from"./MethodPicker-CqQTyAaT.js";import{a as q}from"./wake-lock-C_y0fQco.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./identity-BVf8yWa4.js";import"./model-provider-B6oAnQX9.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./tailnet-plugin-pairing-DTK4jAlP.js";import"./drop-open-BjgdLxWM.js";import"./signals-DdOHdr--.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";import"./identity-view-paths-Bi1yigZk.js";import"./vault-list-path-Bh2_KZkq.js";const H=[["device.authorize","Approved"],["device.deauthorize","Put out"],["device.rename","Renamed"],["device.tags","Tagged"],["device.key_expiry","Changed key expiry for"],["device.expire","Expired the key of"],["device.routes","Changed routes of"],["device.delete","Removed"],["key.create","Minted the auth key"],["key.delete","Revoked the auth key"]];function W(e,t){return`${H.find(([e])=>e===t.action)?.[1]??t.action} ${function(e,t){const n=e.loaded?.devices.find(e=>e.id===t);if(n)return a(n);const s=e.loaded?.keys.find(e=>e.id===t);return s?.description||t}(e,t.target)}`.trim()}function ee({model:a}){const t=(a.loaded?.audit??[]).slice(0,20),n=a.loaded?.at??Date.now();return g.jsxs("section",{className:"panel","aria-label":"Tailnet activity",children:[g.jsx("div",{className:"panel__head",children:g.jsx("h2",{children:"Activity"})}),g.jsxs("div",{className:"panel__body",children:[a.loaded?.auditError?g.jsx("div",{className:"actions",children:g.jsx(Z,{tone:"err",label:a.loaded.auditError})}):0===t.length?g.jsx("div",{className:"actions",children:g.jsx(Z,{tone:"idle",label:"Nothing changed through this daemon yet."})}):null,g.jsx("ul",{className:"identity-rows tailnet-activity",children:t.map(t=>g.jsx("li",{className:"identity-row",children:g.jsxs("div",{className:"identity-row__id",children:[g.jsxs("div",{className:"identity-row__title",children:[g.jsx("span",{children:W(a,t)}),g.jsx(Z,{tone:t.status<300?"ok":"err",label:t.status<300?"Done":`Refused (${t.status})`})]}),g.jsx("span",{className:"identity-row__when",children:[t.label||t.pairing,e(new Date(1e3*t.at).toISOString(),n)].filter(Boolean).join(" · ")})]})},`${t.at}-${t.action}-${t.target}`))})]})]})}function ae({id:e,label:a,on:t,disabled:n=!1,onChange:s}){return g.jsxs("div",{className:"tailnet-switch",children:[g.jsx("span",{id:`${e}-label`,children:a}),g.jsx("button",{id:e,type:"button",className:"toggle",role:"switch","aria-checked":t,"aria-labelledby":`${e}-label`,disabled:n,onClick:()=>s(!t)})]})}function te({error:e}){return g.jsxs(g.Fragment,{children:[e?g.jsx("p",{className:"vexport__marks",children:g.jsx(Z,{tone:"err",label:e})}):null,g.jsx(w,{id:"tailnet:devices",title:"Tailnet",message:e})]})}const ne={description:"",seconds:86400,reusable:!1,ephemeral:!1,preauthorized:!0,tags:""};function se({id:e,label:a,value:t}){const n=q(),[s,i]=k.useState("");return g.jsx(C,{id:e,label:a,mono:!0,readOnly:!0,value:t,status:s?g.jsx(Z,{tone:"ok",label:s}):null,tail:g.jsx(_,{label:`Copy the ${a.toLowerCase()}`,small:!0,onClick:()=>{n(t).then(e=>i("copied"===e?"Copied":"The clipboard is unavailable"))},children:g.jsx(z,{size:15})})})}function ie({created:a,now:t}){return g.jsxs(g.Fragment,{children:[g.jsx(se,{id:"tailnet-new-key",label:"Auth key",value:a.key}),g.jsx(se,{id:"tailnet-join-command",label:"Join command",value:s(a.key)}),g.jsx("p",{className:"vexport__marks",children:g.jsx(Z,{tone:"warn",label:`Shown once. Expires ${e(a.expires,t)??"as set"}.`})})]})}function le({tags:e,tagsNeeded:a}){return null===e?g.jsx(Z,{tone:"err",label:"Each tag is a lowercase name that starts with a letter"}):a?g.jsx(Z,{tone:"warn",label:"The daemon's OAuth client mints tagged keys only"}):null}function re({options:e,set:a,tags:t,tagsNeeded:s}){return g.jsxs(g.Fragment,{children:[g.jsx(C,{id:"tailnet-key-description",label:"Description",autoComplete:"off",placeholder:"lab runners",value:e.description,onValueChange:e=>a({description:e}),status:n(e.description)?null:g.jsx(Z,{tone:"err",label:"At most 50 letters, digits, spaces and hyphens"})}),g.jsx("div",{className:"tailnet-choices",role:"radiogroup","aria-label":"Key lasts",children:i.map(t=>g.jsx("button",{type:"button",className:"tailnet-choice","aria-pressed":e.seconds===t.seconds,onClick:()=>a({seconds:t.seconds}),children:t.label},t.seconds))}),g.jsx(ae,{id:"tailnet-key-reusable",label:"Reusable",on:e.reusable,onChange:e=>a({reusable:e})}),g.jsx(ae,{id:"tailnet-key-ephemeral",label:"Ephemeral device",on:e.ephemeral,onChange:e=>a({ephemeral:e})}),g.jsx(ae,{id:"tailnet-key-preauthorized",label:"Pre-approved",on:e.preauthorized,onChange:e=>a({preauthorized:e})}),g.jsx(C,{id:"tailnet-key-tags",label:"Tags",mono:!0,autoComplete:"off",placeholder:"tag:ci",value:e.tags,onValueChange:e=>a({tags:e}),status:g.jsx(le,{tags:t,tagsNeeded:s})})]})}function oe(e){return[{key:"Uses",value:e.reusable?"any number of devices":"one device"},{key:"Approval",value:e.preauthorized?"none needed":"waits for an admin"}]}function de({model:e,oauth:a,onClose:s}){const[i,l]=k.useState(ne),[r,o]=k.useState(null),d=t(i.tags),c=a&&0===(d?.length??0),u=n(i.description)&&null!==d&&!c&&!e.busy,m=()=>{if(!u||null===d)return;let a=null;e.run(async()=>{a=await e.admin.createKey({description:i.description.trim(),reusable:i.reusable,ephemeral:i.ephemeral,preauthorized:i.preauthorized,tags:d,expirySeconds:i.seconds})}).then(()=>o(a))},h=()=>{o(null),s()};return g.jsx(Y,{title:"Add a device",mark:g.jsx(N,{size:20}),onClose:h,children:g.jsx("form",{"aria-label":"Add a device",onSubmit:e=>{e.preventDefault(),r?h():m()},children:g.jsxs(G,{ok:""===e.error,top:r?"Auth key minted":void 0,name:r?r.description||r.id:"A new auth key",facts:oe(i),primary:r?{label:"Done",submit:!0,onClick:h}:{label:"Mint an auth key",submit:!0,busy:e.busy,disabled:!u,onClick:m},children:[r?g.jsx(ie,{created:r,now:e.loaded?.at??Date.now()}):g.jsx(re,{options:i,set:e=>l({...i,...e}),tags:d,tagsNeeded:c}),g.jsx(te,{error:e.error})]})})})}function ce({model:e,arm:a,label:t,confirmLabel:n,keepLabel:s,onConfirm:i,children:l}){const r=k.useRef(null),{armed:o,setArmed:d,busy:c}=e,u=o?.action===a.action&&o.id===a.id;return g.jsxs(g.Fragment,{children:[g.jsx(_,{keyRef:r,label:u?n:t,small:!0,armed:u,disabled:c,onClick:()=>u?i():d(a),children:l}),u?g.jsx(_,{label:s,small:!0,disabled:c,onClick:()=>{d(null),r.current?.focus()},children:g.jsx(S,{size:16})}):null]})}const ue="tailnet-add-device",me=e=>`tailnet-device-edit-${e}`,he=/^(ios|ipados|android)$/i;function je(e){return[e.os,e.clientVersion?`Tailscale ${e.clientVersion}`:"",e.user,...e.tags].filter(Boolean).join(" · ")}function xe({device:e,name:a,model:t,onEdit:n}){const{busy:s,admin:i,run:l}=t;return g.jsxs("div",{className:"actions",children:[e.authorized?null:g.jsx(_,{label:`Approve ${a}`,small:!0,disabled:s,onClick:()=>{l(()=>i.setAuthorized(e.id,!0),A(me(e.id)))},children:g.jsx(R,{size:16})}),g.jsx(_,{id:me(e.id),label:`Settings for ${a}`,small:!0,disabled:s,onClick:()=>n(e),children:g.jsx(D,{size:16})}),e.external?null:g.jsx(ce,{model:t,arm:{action:"expire",id:e.id},label:`Expire ${a}'s key`,confirmLabel:`Confirm expiring ${a}'s key; it must sign in again`,keepLabel:`Keep ${a}'s key`,onConfirm:()=>{l(()=>i.expire(e.id),A(me(e.id)))},children:g.jsx(T,{size:16})}),g.jsx(ce,{model:t,arm:{action:"remove",id:e.id},label:`Remove ${a} from the tailnet`,confirmLabel:`Confirm removing ${a} from the tailnet`,keepLabel:`Keep ${a}`,onConfirm:()=>{l(()=>i.deleteDevice(e.id),A(ue))},children:g.jsx(P,{size:16})})]})}function pe({device:e,model:t,now:n,onEdit:s}){const i=a(e);return g.jsx("li",{className:"identity-row tailnet-row",id:`tailnet-device-${e.id}`,children:g.jsxs("div",{className:"identity-row__main",children:[g.jsx("span",{className:"identity-row__mark","aria-hidden":"true",children:he.test(e.os)?g.jsx($,{size:18}):g.jsx(E,{size:18})}),g.jsxs("div",{className:"identity-row__id",children:[g.jsx("div",{className:"identity-row__title",children:g.jsx("h3",{children:i})}),g.jsx("code",{className:"identity-ref",children:e.addresses[0]??e.name}),g.jsx("span",{className:"identity-row__when",children:je(e)}),g.jsx("span",{className:"tailnet-row__marks",children:l(e,n).map(e=>g.jsx(Z,{tone:e.tone,label:e.label},e.label))})]}),t.canManage?g.jsx(xe,{device:e,name:i,model:t,onEdit:s}):null]})})}function be(e){return{name:a(e),tags:e.tags.join(" "),authorized:e.authorized,expiry:!e.keyExpiryDisabled,routes:e.enabledRoutes}}const ve=(e,a)=>e.length===a.length&&e.every(e=>a.includes(e));function ye(e,a,t){const n=e.filter(e=>!a.includes(e));return t?[...n,...a]:n}function fe(a,t){const n=a.keyExpiryDisabled?"never":e(a.expires,t)??"unknown";return[{key:"Addresses",value:a.addresses.join(", ")||"none"},{key:"System",value:`${a.os} ${a.clientVersion}`.trim()},{key:"Owner",value:a.user||"tagged"},{key:"Key expires",value:n}]}function ge({device:e,draft:a,set:t}){return g.jsxs(g.Fragment,{children:[o(e).map(e=>g.jsx(ae,{id:`tailnet-route-${e.replace(/[^a-z0-9]/gi,"-")}`,label:`Route ${e}`,on:a.routes.includes(e),onChange:n=>t({routes:ye(a.routes,[e],n)})},e)),d(e)?g.jsx(ae,{id:"tailnet-device-exit",label:"Exit node",on:c.every(e=>a.routes.includes(e)),onChange:e=>t({routes:ye(a.routes,c,e)})}):null]})}function ke({device:e,draft:a,set:n}){return g.jsxs(g.Fragment,{children:[g.jsx(C,{id:"tailnet-device-name",label:"Name",mono:!0,autoComplete:"off",value:a.name,onValueChange:e=>n({name:e}),status:r(a.name)?null:g.jsx(Z,{tone:"err",label:"One label of lowercase letters, digits and hyphens"})}),g.jsx(C,{id:"tailnet-device-tags",label:"Tags",mono:!0,autoComplete:"off",placeholder:"tag:web tag:ci",value:a.tags,onValueChange:e=>n({tags:e}),status:null===t(a.tags)?g.jsx(Z,{tone:"err",label:"Each tag is a lowercase name that starts with a letter"}):null}),g.jsx(ae,{id:"tailnet-device-authorized",label:"Approved on the tailnet",on:a.authorized,onChange:e=>n({authorized:e})}),g.jsx(ae,{id:"tailnet-device-expiry",label:"Key expires",on:a.expiry,onChange:e=>n({expiry:e})}),g.jsx(ge,{device:e,draft:a,set:n})]})}function we({device:e,model:n,now:s,onClose:i}){const l=`Settings for ${a(e)}`,[o,d]=k.useState(()=>be(e)),c=t(o.tags),u=null!==c&&function(e,a,t){const n=be(e);return a.name!==n.name||!ve(t,e.tags)||a.authorized!==n.authorized||a.expiry!==n.expiry||!ve(a.routes,n.routes)}(e,o,c)&&r(o.name)&&!n.busy,m=()=>{u&&null!==c&&n.run(()=>async function(e,a,t,n){const s=be(a),i=a.id,l=t.authorized!==s.authorized;l&&!t.authorized&&await e.setAuthorized(i,!1),t.name!==s.name&&await e.rename(i,t.name.trim()),ve(n,a.tags)||await e.setTags(i,n),t.expiry!==s.expiry&&await e.setKeyExpiryDisabled(i,!t.expiry),ve(t.routes,s.routes)||await e.setRoutes(i,t.routes),l&&t.authorized&&await e.setAuthorized(i,!0)}(n.admin,e,o,c),A(me(e.id))).then(e=>{e&&i()})};return g.jsx(Y,{title:l,mark:g.jsx(E,{size:20}),onClose:i,children:g.jsx("form",{"aria-label":l,onSubmit:e=>{e.preventDefault(),m()},children:g.jsxs(G,{ok:""===n.error,name:e.name||a(e),facts:fe(e,s),primary:{label:"Save changes",submit:!0,busy:n.busy,disabled:!u,onClick:m},children:[g.jsx(ke,{device:e,draft:o,set:e=>d({...o,...e})}),g.jsx(te,{error:n.error})]})})})}function Ne({model:a}){const t=a.loaded?.keys??[],n=a.loaded?.at??Date.now();return g.jsxs("section",{className:"panel","aria-label":"Tailnet auth keys",children:[g.jsx("div",{className:"panel__head",children:g.jsx("h2",{children:"Auth keys"})}),g.jsxs("div",{className:"panel__body",children:[a.loaded?.keysError?g.jsx("div",{className:"actions",children:g.jsx(Z,{tone:"err",label:a.loaded.keysError})}):0===t.length?g.jsx("div",{className:"actions",children:g.jsx(Z,{tone:"idle",label:"No auth keys."})}):null,g.jsx("ul",{className:"identity-rows",children:t.map(t=>{const s=t.description||t.id,i=e(t.expires,n);return g.jsx("li",{className:"identity-row",children:g.jsxs("div",{className:"identity-row__main",children:[g.jsx("span",{className:"identity-row__mark","aria-hidden":"true",children:g.jsx(K,{size:18})}),g.jsxs("div",{className:"identity-row__id",children:[g.jsxs("div",{className:"identity-row__title",children:[g.jsx("h3",{children:s}),g.jsx(Z,t.invalid||t.revoked?{tone:"idle",label:"No longer valid"}:{tone:"ok",label:i?`Expires ${i}`:"Valid"})]}),g.jsx("code",{className:"identity-ref",children:t.id}),g.jsx("span",{className:"identity-row__when",children:u(t)})]}),a.canManage?g.jsx("div",{className:"actions",children:g.jsx(ce,{model:a,arm:{action:"revoke",id:t.id},label:`Revoke the auth key ${s}`,confirmLabel:`Confirm revoking the auth key ${s}`,keepLabel:`Keep the auth key ${s}`,onConfirm:()=>{a.run(()=>a.admin.deleteKey(t.id),A(ue))},children:g.jsx(P,{size:16})})}):null]})},t.id)})})]})]})}function Ce(e,a){const t=j(e),n=t?[{key:"Daemon",value:new URL(t.url).host},{key:"Role",value:t.role},{key:"Named",value:t.label||"unnamed"}]:[{key:"Code from",value:"opensesame daemon tailnet pair"}];return a&&n.push({key:"Replaces",value:[a.label,a.host].filter(Boolean).join(" at ")}),n}function _e({initialCode:e,current:a,blocked:t,onPair:n,onClose:s}){const[i,l]=k.useState(e),[r,o]=k.useState(!1),[d,c]=k.useState(""),u=""===t,j=u&&i.trim().length>0&&!r,x=()=>{j&&(o(!0),c(""),n(i).then(s,e=>c(m(e instanceof h?e:new h("unreachable")))).finally(()=>o(!1)))};return g.jsx(Y,{title:"Pair with the tailnet daemon",mark:g.jsx(L,{size:20}),onClose:s,children:g.jsx("form",{"aria-label":"Pair with the tailnet daemon",onSubmit:e=>{e.preventDefault(),x()},children:g.jsxs(G,{ok:""===d,name:"Tailnet devices",facts:[...Ce(i,a),{key:"Kept",value:u?"sealed in this vault":"nowhere"}],primary:{label:a?"Replace the paired daemon":"Pair with this daemon",submit:!0,busy:r,disabled:!j,onClick:x},children:[g.jsx(C,{id:"tailnet-admin-code",label:"Pairing code",mono:!0,autoComplete:"off",placeholder:"opensesame-tailnet:v1:…",value:i,disabled:!u,readOnly:r,onValueChange:e=>{l(e),c("")}}),g.jsx(te,{error:d||t})]})})})}const ze=new h("unreachable");function Se(e){return m(e instanceof h?e:ze)}function $e(e,a,t){return"attention"===a?e.filter(e=>b(e,t)).length:"online"===a?e.filter(e=>e.connected).length:"offline"===a?e.filter(e=>!e.connected).length:e.length}function Ee(e){const a=e.pairBlocker();return a?m(new h(a)):""}function Re({admin:e}){return g.jsx(Z,{tone:"idle",label:Ee(e)||"No daemon paired for device management."})}function Ae({model:e}){const{target:a,loaded:t,error:n,admin:s}=e;return g.jsxs("div",{className:"actions",children:[n?g.jsxs(g.Fragment,{children:[g.jsx(Z,{tone:"err",label:n}),g.jsx("span",{role:"alert",className:"visually-hidden",children:n})]}):null,a?null:g.jsx(Re,{admin:s}),!a||t||n?null:g.jsx(Z,{tone:"idle",label:"Reading the tailnet…"}),t&&!t.status.connected?g.jsx(Z,{tone:"warn",label:"The daemon has no tailnet connected."}):null,a&&t?g.jsx("span",{className:"identity-row__when",children:["-"===t.status.tailnet?"":t.status.tailnet,a.label,a.host,a.role].filter(Boolean).join(" · ")}):null]})}function De({model:e,onAdd:a,onPair:t}){const{target:n,loaded:s,busy:i,canManage:l}=e;return n?g.jsxs("fieldset",{className:"vtree__keys","aria-label":"Tailnet device commands",children:[l&&s?.status.connected?g.jsx(X,{id:"identity.tailnet-devices.add",children:g.jsx(_,{id:ue,label:"Add a device",small:!0,disabled:i,onClick:a,children:g.jsx(N,{size:15})})}):null,g.jsx(M,{label:"Reload tailnet devices",disabled:i,onReload:e.reload}),g.jsx(ce,{model:e,arm:{action:"forget",id:"pairing"},label:"Forget this daemon's pairing",confirmLabel:"Confirm forgetting this daemon's pairing",keepLabel:"Keep this daemon's pairing",onConfirm:()=>{e.run(()=>e.admin.forget())},children:g.jsx(O,{size:15})})]}):e.admin.canPair()?g.jsx("fieldset",{className:"vtree__keys","aria-label":"Tailnet device commands",children:g.jsx(_,{id:"tailnet-pair",label:"Pair with the tailnet daemon",small:!0,onClick:t,children:g.jsx(L,{size:15})})}):null}function Te({devices:e,filter:a,now:t,onFilter:n}){return g.jsx("div",{className:"tailnet-choices",role:"radiogroup","aria-label":"Show devices",children:p.map(s=>g.jsxs("button",{type:"button",className:"tailnet-choice","aria-pressed":a===s.id,onClick:()=>n(s.id),children:[s.label," ",$e(e,s.id,t)]},s.id))})}function Pe({admin:e}){const a=function(e){k.useSyncExternalStore(e.subscribe,()=>e.target()?.revision??-1);const a=e.target(),[t,n]=k.useState(null),[s,i]=k.useState(""),[l,r]=k.useState(!1),[o,d]=k.useState(null),c=k.useRef(0),u=F(l),j=k.useCallback(async()=>{const a=++c.current;if(e.target())try{const t=await async function(e){const a=Promise.allSettled([e.listKeys(),e.audit()]),[t,n]=await Promise.all([e.status(),e.listDevices()]),[s,i]=await a;return{status:t,devices:n,keys:"fulfilled"===s.status?s.value:[],keysError:"rejected"===s.status?Se(s.reason):"",audit:"fulfilled"===i.status?i.value:[],auditError:"rejected"===i.status?Se(i.reason):"",at:Date.now()}}(e);if(a!==c.current)return;n(t),d(e=>e&&[...t.devices,...t.keys].some(a=>a.id===e.id)?e:null)}catch(t){if(a!==c.current)return;i(m(t instanceof h?t:ze))}else n(null)},[e]);return k.useEffect(()=>(j(),e.subscribe(()=>{i(""),j()})),[e,j]),function(e,a){k.useEffect(()=>{const t=setInterval(()=>{"visible"===document.visibilityState&&e()},6e4);return()=>{clearInterval(t),a.current+=1}},[e,a])}(j,c),{admin:e,target:a,loaded:t,error:s,setError:i,busy:l,armed:o,setArmed:d,canManage:"manage"===a?.role,reload:()=>{i(""),j()},run:async function(e,a){if(l)return!1;r(!0),i("");try{return await e(),d(null),await j(),a&&u(a),!0}catch(t){return i(m(t instanceof h?t:ze)),await j(),!1}finally{r(!1)}}}}(e),t=J("identity.tailnet-devices"),[n,s]=k.useState("all"),[i,l]=k.useState(null),[r,o]=k.useState(!1),[d,c]=k.useState(null);var u;k.useEffect(()=>{const e=()=>{const e=B();e&&u(e)};return e(),V(e)},[u=c]);const j=a.loaded,p=j?.at??Date.now(),b=j?x(j.devices,n,"",p):[];return g.jsxs(g.Fragment,{children:[g.jsxs("section",{ref:t,className:"panel","aria-label":"Tailnet devices",children:[g.jsxs("div",{className:"panel__head",children:[g.jsx("h2",{children:"Tailnet devices"}),g.jsx(De,{model:a,onAdd:()=>o(!0),onPair:()=>c("")})]}),g.jsxs("div",{className:"panel__body",children:[g.jsx(Ae,{model:a}),j&&j.devices.length>0?g.jsx(Te,{devices:j.devices,filter:n,now:p,onFilter:s}):null,j&&0===b.length?g.jsx("div",{className:"actions",children:g.jsx(Z,{tone:"idle",label:0===j.devices.length?"No devices on the tailnet.":"No devices match."})}):null,g.jsx("ul",{className:"identity-rows",children:b.map(e=>g.jsx(pe,{device:e,model:a,now:p,onEdit:l},e.id))})]})]}),j?g.jsx(Ne,{model:a}):null,j?g.jsx(ee,{model:a}):null,i?g.jsx(we,{device:i,model:a,now:p,onClose:()=>l(null)}):null,r?g.jsx(de,{model:a,oauth:"oauth"===j?.status.credential,onClose:()=>o(!1)}):null,null!==d?g.jsx(_e,{initialCode:d,current:a.target,blocked:Ee(e),onPair:a=>e.pair(a),onClose:()=>c(null)}):null]})}const Ke="networking.tailnet-devices",Le={targets:y,goals:v},Fe={capability:Ke,async activate(e){const a=I(e,Ke);if(a.disposed())return a.handle();const t=f(e.egress,Ke);return a.onDispose(Q(()=>k.createElement(Pe,{admin:t}))),U(a,Le),a.handle()}};export{Ke as CAPABILITY,Le as TUTORIAL,Fe as capabilityRuntime};

package/dist/assets/cap-notifications.local-QwuLGxJM.js

@@ -0,0 +1 @@
+import{l as e}from"./device-inbox-BoaNI30L.js";import{s as t,p as s,N as o,n as i,r as n,Q as a,w as r,l,a as c}from"./local-notifications-files-CWGvPHb8.js";import{d,s as u,v as m}from"./drop-open-BjgdLxWM.js";import{ad as f,ae as p,e as b,o as v,v as h,af as j,ag as y,ah as g,c as k,r as w}from"./main-BrkS-iow.js";import{s as T}from"./FeatureSections-BG-JsWID.js";import{r as x,j as N}from"./react-dom-BwC4eQlG.js";import{u as _}from"./wake-lock-C_y0fQco.js";import{a as q}from"./InvokeScreen-C-kFFYVF.js";import{u as L}from"./idp-presets-B1M-P0Ek.js";import{s as P,g as S}from"./signals-DdOHdr--.js";import"./model-provider-B6oAnQX9.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./hosted-model-authority-CcNPE44H.js";import"./identity-BVf8yWa4.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";import"./features-9FeW22VH.js";import"./identity-view-paths-Bi1yigZk.js";const E="local-requests",O=/^\(\d+\) /;function z(){return void 0!==globalThis.document}function A(){return{tabTitle:z(),system:void 0!==globalThis.Notification?Notification.permission:"unsupported"}}function R(e){if(z()){const t=document.title.replace(O,"");document.title=e>0?`(${e}) ${t}`:t}const t=globalThis.navigator,s=e>0?t?.setAppBadge?.(e):t?.clearAppBadge?.();s?.catch(()=>{})}function $(e){let t=null;const n=()=>{t?.close(),t=null};return{inApp(e){if(null===e)return void d(E);const t=i(e);u({id:E,tone:"warn",title:t.title,body:t.body,open:{to:o,label:"Review requests"}})},tabTitle:R,toast(e,t){const s=i(t);p({id:e.ref,tone:"warn",title:s.title,body:s.body,open:{to:o,label:"Review requests"}})},desktop:f,system(a,r){n();const l=i(r);try{const i=new Notification(l.title,{body:l.body,tag:"opensesame-local-request",data:a});i.onclick=()=>{globalThis.focus(),i.close(),null!==s(i.data)&&e(o)},t=i}catch{}},closeSystem:n}}function B(e){const s=[P(()=>e("change")),S(()=>e("other-tab")),t(()=>e("preference"))];if(z()){const t=()=>e("visible");document.addEventListener("visibilitychange",t),globalThis.addEventListener("focus",t),s.push(()=>{document.removeEventListener("visibilitychange",t),globalThis.removeEventListener("focus",t)})}return()=>{for(const e of s)e()}}function C(e,t,s){const o=e.destinations.filter(e=>e!==t);return{version:1,destinations:s?[...o,t]:o}}function Q({label:e,on:t,keyLabel:s,onPress:o}){return N.jsx(q,{icon:N.jsx(j,{size:16}),label:e,mark:t?{tone:"ok",label:"On"}:{tone:"idle",label:"Off"},sub:"",action:N.jsx(b,{small:!0,label:s,onClick:o,children:N.jsx(t?v:h,{size:16})})})}function D(){const{tomb:e}=_(),{preference:s,save:o}=function(e){const[s,o]=x.useState(null),i=x.useCallback(()=>{n(e).then(o,()=>o(a))},[e]);return x.useEffect(()=>(i(),t(i)),[i]),{preference:s,save:t=>{r(e,t).catch(()=>{})}}}(e),[i,l]=x.useState(()=>A().system),c=L("settings.local-notifications");if(null===s)return null;const d=e=>s.destinations.includes(e),u="granted"===i&&d("system"),m="default"===i?"Allow system notifications":u?"Turn off system notifications":"Turn on system notifications";return N.jsxs("section",{className:"panel",id:"local-notifications",ref:c,children:[N.jsx("div",{className:"panel__head",children:N.jsx("h2",{children:"On this device"})}),N.jsxs("div",{className:"panel__body",children:["default"===i||"granted"===i?N.jsx(Q,{label:"System notifications",on:u,keyLabel:m,onPress:()=>{"default"===i?(async()=>{const e=await Notification.requestPermission();l(e),"granted"!==e||d("system")||o(C(s,"system",!0))})():o(C(s,"system",!u))}}):null,z()?N.jsx(Q,{label:"Tab title and badge",on:d("tab_title"),keyLabel:d("tab_title")?"Turn off tab title and badge":"Turn on tab title and badge",onPress:()=>o(C(s,"tab_title",!d("tab_title")))}):null]})]})}const F="notifications.local",I={targets:g,goals:y},M="feature-local-notifications",Z={capability:F,async activate(t){const s=k(t,F);return s.disposed()||(s.register("settings-panel",{id:"local-notifications",label:"On this device",category:T(M),Panel:D,order:10,files:l(()=>m.activeTomb?.()??"")}),s.register("unlock-effect",{id:"local-request-watch",run:({tomb:s,signal:o})=>{return c({list:(i={list:()=>e(s),preference:()=>n(s)}).list,preference:i.preference,environment:A,hidden:()=>z()&&document.hidden,deliver:$(t.navigate),subscribe:B,now:()=>Date.now(),later:(e,t)=>{const s=setTimeout(e,t);return()=>clearTimeout(s)}},o);var i}}),w(s,I)),s.handle()}};export{F as CAPABILITY,M as SECTION,I as TUTORIAL,Z as capabilityRuntime};

package/dist/assets/cap-notifications.routing-CF-Wp35c.js

@@ -0,0 +1 @@
+import{s as e,f as s,d as n}from"./identity-BVf8yWa4.js";import{e as t,w as a,x as i,o as l,v as o,u as r,g as c,a as d,b as u,f as m,R as h,ai as f,aj as b,ak as j,al as p,am as x,c as w,r as k}from"./main-BrkS-iow.js";import{j as v,r as g}from"./react-dom-BwC4eQlG.js";import{p as N,C as _,R as y,a as $,c as z,b as C,d as S,A as O,B as R,i as E,n as A,e as F}from"./notifications-DlWvurGh.js";import{y as M,N as D}from"./drop-open-BjgdLxWM.js";import{S as I}from"./InvokeScreen-C-kFFYVF.js";import{O as B}from"./OpenFileKey-DKFq5mOf.js";import"./signals-DdOHdr--.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./model-provider-B6oAnQX9.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";const P=(e,s,n)=>`notif-${e}-${s}-${n}`;function T({cls:e,kind:s,index:n,count:o,route:r,session:c,refocus:d}){const u=M(s),m=_[e],h=function(e,s){const n=e?.steps.find(e=>e.kind===s);if(n)return{tone:"ok",label:`Used: ${n.sentence}`};const t=e?.excluded.find(e=>e.kind===s);return t?{tone:t.refusedByPolicy?"err":"warn",label:t.why}:{tone:"idle",label:"Not read yet"}}(r,s),f=t=>{const a=-1===t?"down":"up";d([P(e,s,-1===t?"up":"down"),P(e,s,a)]),c.edit({kind:"move",cls:e,index:n,direction:t})};return v.jsxs("li",{className:"notif-row",children:[v.jsxs("span",{className:"notif-row__name",children:[n+1,". ",u]}),v.jsx(I,{tone:h.tone,label:h.label}),v.jsxs("span",{className:"notif-row__keys",children:[v.jsx(t,{small:!0,id:P(e,s,"up"),label:`Move ${u} earlier for ${m}`,disabled:0===n,onClick:()=>f(-1),children:v.jsx(a,{size:16})}),v.jsx(t,{small:!0,id:P(e,s,"down"),label:`Move ${u} later for ${m}`,disabled:n===o-1,onClick:()=>f(1),children:v.jsx(i,{size:16})}),"in_app"===s?null:v.jsx(t,{small:!0,label:`Remove ${u} from ${m}`,onClick:()=>{d([`notif-${e}-add-key`,`notif-${e}-head`]),c.edit({kind:"remove",cls:e,channel:s})},children:v.jsx(l,{size:16})})]})]})}function U({cls:e,state:s,session:n}){const t=$(s,e),[a,i]=g.useState(""),l=t.find(e=>e.kind===a)??t[0]??null;if(null===l)return null;const r=`notif-${e}-add`;return v.jsxs("form",{className:"notif-add",onSubmit:s=>{s.preventDefault(),n.edit({kind:"add",cls:e,channel:l.kind})},children:[v.jsx("label",{htmlFor:r,children:"Add a channel"}),v.jsxs("div",{className:"field-inline",children:[v.jsx("select",{id:r,value:l.kind,onChange:e=>i(e.target.value),children:t.map(e=>v.jsx("option",{value:e.kind,children:e.name},e.kind))}),v.jsx("button",{type:"submit",id:`${r}-key`,className:"icon-btn","aria-label":`Add ${l.name} to ${_[e]}`,title:`Add ${l.name} to ${_[e]}`,children:v.jsx(o,{size:16})})]})]})}function q({cls:e,on:s,session:n}){const t="Tell me on every destination that works, not just the first";return v.jsxs("div",{className:"sw",children:[v.jsx("span",{className:"sw__name",children:"Every destination that works"}),v.jsx("button",{type:"button",className:"toggle",role:"switch","aria-checked":s,"aria-label":t,title:t,onClick:()=>{n.edit({kind:"fanOut",cls:e,fanOut:!s})}})]})}function H({cls:e,state:s,session:n,mark:t,busy:a}){const i=function(e){const s=g.useRef([]);return g.useEffect(()=>{const n=s.current;if(!e&&0!==n.length)for(const e of n){const n=document.getElementById(e);if(n instanceof HTMLButtonElement&&!n.disabled)return n.focus(),void(s.current=[])}}),e=>{s.current=e}}(a),l=N(s.document,e),o=s.routes[e],r=l.channels,c=`notif-${e}-head`;return v.jsxs("section",{className:"panel notif","aria-labelledby":c,children:[v.jsxs("div",{className:"panel__head",children:[v.jsx("h2",{id:c,tabIndex:-1,children:_[e]}),v.jsxs("div",{className:"actions",children:[t?v.jsx(I,{tone:t.tone,label:t.label}):null,v.jsx(B,{path:y,name:"routing.json"})]})]}),v.jsxs("div",{className:"panel__body",children:[v.jsxs("ol",{className:"notif-rows",children:[r.map((s,t)=>v.jsx(T,{cls:e,kind:s,index:t,count:r.length,route:o,session:n,refocus:i},s)),r.includes("in_app")?null:v.jsxs("li",{className:"notif-row",children:[v.jsxs("span",{className:"notif-row__name",children:[r.length+1,". ",M("in_app")]}),v.jsx(I,{tone:"ok",label:"Always last in the route"})]})]}),v.jsx(U,{cls:e,state:s,session:n}),"security_event"===e?v.jsx(q,{cls:e,on:l.fanOut,session:n}):null]})]})}const K=new C(401,"unauthorized").message;function L({view:e,session:s,mark:n}){const a=d(),{connect:i,connecting:l}=u(),{signedOut:r}=e,c=r?{tone:"warn",label:K}:n,f=new Set(e.state?z(e.state).map(e=>e.kind):[]);return v.jsxs("section",{className:"panel notif",id:"notif-channels",children:[v.jsxs("div",{className:"panel__head",children:[v.jsx("h2",{children:"Channels"}),v.jsxs("div",{className:"actions",children:[c?v.jsx(I,{tone:c.tone,label:c.label}):null,r?v.jsx(t,{small:!0,label:"Connect",disabled:l||!a,onClick:()=>{i()},children:v.jsx(m,{size:15})}):null,e.state?v.jsx(B,{path:S,name:"channels.json"}):null,v.jsx(h,{label:"Read the channels again",disabled:!a,onReload:()=>s.reload()})]})]}),v.jsxs("div",{className:"panel__body",children:[v.jsx("p",{className:"notif-standing",children:O}),v.jsx("ul",{className:"notif-rows","aria-busy":e.busy,children:(e.state?.channels??[]).map(e=>v.jsxs("li",{className:"notif-row",children:[v.jsxs("span",{className:"notif-row__text",children:[v.jsx("span",{className:"notif-row__name",children:e.name}),v.jsx("span",{className:"notif-row__meta",children:e.sentence})]}),v.jsx(I,{tone:e.configured?"ok":"idle",label:e.configured?"Set up here":"Not set up here"}),f.has(e.kind)?v.jsx("span",{className:"notif-row__keys",children:v.jsx(t,{small:!0,label:`Connect ${e.name}`,onClick:()=>{s.bind(e.kind)},children:v.jsx(o,{size:16})})}):null]},e.kind))})]})]})}function Q({begun:e}){return v.jsxs("li",{className:"notif-row",children:[v.jsxs("span",{className:"notif-row__text",children:[v.jsx("span",{className:"notif-row__name",children:v.jsx("code",{children:e.nonce})}),v.jsx("span",{className:"notif-row__meta",children:e.words})]}),v.jsx(I,{tone:"warn",label:"Waiting to be confirmed"}),e.authorizeUrl?v.jsx("span",{className:"notif-row__keys",children:v.jsx("a",{className:"icon-btn icon-btn--sm",href:e.authorizeUrl,target:"_blank",rel:"noopener noreferrer","aria-label":"Finish connecting where it opens",title:"Finish connecting where it opens",children:v.jsx(f,{size:16})})}):null]})}function W({view:e,session:s,mark:n}){const a=e.state?.bindings??[];return v.jsxs("section",{className:"panel notif",id:"notif-destinations",children:[v.jsxs("div",{className:"panel__head",children:[v.jsx("h2",{children:"Destinations"}),v.jsxs("div",{className:"actions",children:[n?v.jsx(I,{tone:n.tone,label:n.label}):null,v.jsx(B,{path:R,name:"bindings.json"})]})]}),v.jsxs("div",{className:"panel__body",children:[v.jsxs("ul",{className:"notif-rows",children:[e.begun?v.jsx(Q,{begun:e.begun}):null,a.map(e=>{return v.jsxs("li",{className:"notif-row",children:[v.jsx("span",{className:"notif-row__text",children:v.jsxs("span",{className:"notif-row__name",children:[e.name,e.label?` · ${e.label}`:""]})}),v.jsx(I,{tone:(n=e.state,"active"===n?"ok":"pending"===n?"warn":"err"),label:e.stateSentence}),v.jsx("span",{className:"notif-row__keys",children:v.jsx(t,{small:!0,label:`Disconnect ${e.name}${e.label?` · ${e.label}`:""}`,onClick:()=>{s.unbind(e.id)},children:v.jsx(l,{size:16})})})]},e.id);var n})]}),0!==a.length||e.begun?null:v.jsx("p",{className:"hint",children:"No destinations connected."})]})]})}function G({session:e}){const s=r(),n=function(e){const s=r(),n=c();return g.useEffect(()=>{e.ensure()},[e,s,n]),g.useSyncExternalStore(e.subscribe,e.view,e.view)}(e),[t,a]=g.useState("channels"),i=g.useMemo(()=>({...e,edit:s=>(a(s.cls),e.edit(s)),bind:s=>(a("destinations"),e.bind(s)),unbind:s=>(a("destinations"),e.unbind(s)),reload:()=>{a("channels"),e.reload()}}),[e]);if(!s)return null;const l=function(e){return e.busy?null:e.error?{tone:"err",label:e.error}:e.status?{tone:"ok",label:e.status}:null}(n),o=e=>t===e?l:null,{state:d}=n;return v.jsxs(v.Fragment,{children:[v.jsx(L,{view:n,session:i,mark:o("channels")}),d?v.jsxs(v.Fragment,{children:[v.jsx(W,{view:n,session:i,mark:o("destinations")}),D.map(e=>v.jsx(H,{cls:e,state:d,session:i,mark:o(e),busy:n.busy},e))]}):null,v.jsx("output",{className:"visually-hidden","aria-live":"polite",children:l?.label??""})]})}const J={state:null,status:null,error:null,begun:null,busy:!1,signedOut:!1};function V(e){return{state:e.state,status:e.status,error:e.error,begun:e.begun??null,busy:!1,signedOut:!1}}const X="notifications.routing",Y={targets:x,goals:p,routes:j};function Z(){return s()?n()?.principalId??null:null}const ee={capability:X,async activate(n){const t=w(n,X);if(t.disposed())return t.handle();const a=function(e,s=E){let n=F(s);const t=function(){let e=J,s=!1;const n=new Set;return{view:()=>e,closed:()=>s,publish(t){if(!s){e=t;for(const e of n)e();b()}},subscribe:e=>(n.add(e),()=>{n.delete(e)}),close(){s=!0,n.clear(),e=J}}}();let a;async function i(e){const s=t.view();if(s.busy||t.closed())return null;t.publish({...s,busy:!0,status:null,error:null,begun:null});const n=await e();return t.publish(V(n)),n}function l(){if(t.closed())return;const i=e();i!==a&&(a=i,n=F(s),null!==i?(t.publish({...J,busy:!0}),n.load().then(e=>{if(a!==i)return;const s=V(e);t.publish({...s,state:null===e.error?s.state:null})})):t.publish({...J,signedOut:!0}))}return{files:A({current:()=>(queueMicrotask(l),t.view().state),replace:async e=>await i(()=>n.replace(e))??{state:n.state(),status:null,error:"Another change is still being saved. Try again."}}),ensure:l,view:t.view,subscribe:t.subscribe,reload(){a=void 0,l()},edit:e=>i(()=>n.edit(e)),bind:e=>i(()=>n.bind(e)),unbind:e=>i(()=>n.unbind(e)),showRoute:e=>i(()=>n.showRoute(e)),dispose:t.close}}(Z);t.onDispose(()=>a.dispose());const i=()=>g.createElement(G,{session:a});let l=null,o=[];const r=()=>{if(t.disposed())return;const e=s();if(e&&null===l)l=t.register("settings-category",{id:"notifications",label:"Notifications",guideId:"settings.notifications",Panel:i,panels:[{id:"notif-channels",label:"Channels"}],order:300,files:a.files}),o=k(t,Y);else if(!e&&null!==l){l.revoke(),l=null;for(const e of o)e.revoke();o=[]}};return r(),t.onDispose(e(r)),t.handle()}};export{X as CAPABILITY,Y as TUTORIAL,ee as capabilityRuntime};

package/dist/assets/cap-notifications.web-push-DAddcIp-.js

@@ -0,0 +1 @@
+import{o as e,E as t,h as n,c as i,i as s,m as r}from"./vault-ui-seam-BQGS7RR6.js";import{u as a,g as o,e as c,o as u,v as l,af as h,c as p,an as d,ao as f,ap as w}from"./main-BrkS-iow.js";import{i as b}from"./identity-BVf8yWa4.js";import{z as y,B as m,C as v,P as g,d as k,s as T,D as j}from"./drop-open-BjgdLxWM.js";import{r as P,j as E}from"./react-dom-BwC4eQlG.js";import{k as M,c as N,b as S}from"./model-provider-B6oAnQX9.js";import{h as q}from"./signals-DdOHdr--.js";import{a as W}from"./InvokeScreen-C-kFFYVF.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./seams-DJ_lslby.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./react-router-XsJY84ug.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";class R extends Error{constructor(e,t){super(t),this.code=e,this.name="PushError"}code}function U(e){return Promise.reject(new t("capability-not-approved","notifications.web-push",new URL(e,"https://invalid.example").origin))}const x={fetchFn:async function(e,t){return U(e)},serviceWorkerContainer:function(){const t=e(globalThis);return t.navigator?.serviceWorker??null},pushApiAvailable:function(){return"PushManager"in globalThis&&"Notification"in globalThis},requestPermission:async function(){return Notification.requestPermission()},workerIsPush:e=>!0,readyWaitMs:8e3,pushWorkerWaitMs:1e4,requestTimeoutMs:15e3,subscribeWaitMs:3e4,pause:function(e){return new Promise(t=>setTimeout(t,e))}};function I(){return null!==x.serviceWorkerContainer()&&x.pushApiAvailable()}async function A(){const e=x.serviceWorkerContainer();if(!e)return null;let t;const n=new Promise(e=>{t=setTimeout(()=>e(null),x.readyWaitMs)});try{return await Promise.race([e.ready,n])}finally{clearTimeout(t)}}async function C(){const e=await A();return!!e&&null!==await e.pushManager.getSubscription()}function _(e){return"NotAllowedError"===e?new R("denied","Notifications are blocked for this site, so nothing can be delivered here. Requests still wait for you in the app."):"AbortError"===e||"NetworkError"===e?new R("unavailable","This browser's push service could not be reached, so push was not turned on. Try again later; requests still wait for you in the app."):"NotSupportedError"===e||"SecurityError"===e?new R("unsupported","This browser cannot subscribe to push from here. Requests still wait for you in the app."):new R("failed","This browser could not subscribe to push. Requests still wait for you in the app.")}async function O(e,t){let i;const s=new Promise((e,t)=>{i=setTimeout(()=>t(_("AbortError")),x.subscribeWaitMs)});try{return await Promise.race([e.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:n(t)}),s])}catch(r){if(r instanceof R)throw r;throw _(r instanceof Error?r.name:"")}finally{clearTimeout(i)}}async function $(e,n,r,a=[]){const o=new AbortController,c=setTimeout(()=>o.abort(),x.requestTimeoutMs);try{let c;try{c=await x.fetchFn(`${p=e.baseUrl,p.replace(/\/$/,"")}${n}`,{...r,signal:o.signal,headers:{...r.headers??{},"content-type":"application/json",accept:"application/json",authorization:`Bearer ${e.accessToken}`}})}catch(d){throw null!==(h=d instanceof t?d.code:null)?new R("blocked",`This installation may not reach the sign-in service for push (${h}), so notifications were not changed.`):new R("unavailable","The sign-in service is not reachable from here, so notifications were not changed.")}if(!c.ok&&!a.includes(c.status))throw new R((u=c.status,l=await async function(e){const t=await e.clone().json().catch(()=>null);return i(t)&&s(t.error)?t.error:null}(c),404===u?"unsupported":409===u&&"endpoint_already_registered"===l?"conflict":409===u&&"subscription_limit_reached"===l?"limit":"failed"),`The server refused that (${c.status}).`);return await c.json().catch(()=>null)}finally{clearTimeout(c)}var u,l,h,p}async function z(t,n){const r=n.toJSON(),a=r.endpoint??n.endpoint,o=r.keys?.p256dh,c=r.keys?.auth;if(!s(a)||!s(o)||!s(c))throw new R("failed","This browser produced a push subscription without its keys, so it could not be registered.");const u=await $(t,"/v1/notification-channels/push/subscriptions",{method:"POST",body:JSON.stringify({endpoint:a,keys:{p256dh:o,auth:c},...t.deviceLabel?{deviceLabel:t.deviceLabel}:void 0})});return e(i(u)?u:{})}async function L(e,t){await $(e,`/v1/notification-channels/push/subscriptions/${encodeURIComponent(t)}`,{method:"DELETE"},[404])}async function D(e,t){for(const n of y())if(n!==t){try{await L(e,n)}catch{return}m(n)}else m(n)}function F(e){e&&v(e)}const K="push-on-this-device";function B({baseUrl:e}){const t=a(),n=o(),r=I(),[p,d]=P.useState(null),[f,w]=P.useState(!1),b=P.useRef(!1),y=t&&null!==n&&r;P.useEffect(()=>{if(!r)return;let e=!0;return C().then(t=>{e&&d(t)},()=>{e&&d(!1)}),()=>{e=!1}},[r]);const m=n?.accessToken??null;return P.useEffect(()=>{y&&null!==m&&D({baseUrl:e(),accessToken:m},M(g))},[y,m,e]),null===p||!p&&!y?null:E.jsxs("section",{className:"panel",id:"push-on-this-device",children:[E.jsx("div",{className:"panel__head",children:E.jsx("h2",{children:"Push"})}),E.jsx("div",{className:"panel__body",children:E.jsx(W,{icon:E.jsx(h,{size:16}),label:"Push on this device",mark:p?{tone:"ok",label:"On"}:{tone:"idle",label:"Off"},sub:"",action:E.jsx(c,{small:!0,label:p?"Turn off push on this device":"Turn on push on this device","aria-busy":f||void 0,onClick:()=>{(async()=>{if(!b.current){b.current=!0,k(K),w(!0);try{const t=y&&null!==n?{baseUrl:e(),accessToken:n.accessToken}:null;d(await async function(e,t){if(e){const e=M(g);let n=!1;try{n=(await async function(e){const t=await A(),n=t?await t.pushManager.getSubscription():null;let i=!1;try{e.subscriptionId&&e.baseUrl&&e.accessToken&&(await L({baseUrl:e.baseUrl,accessToken:e.accessToken},e.subscriptionId),i=!0)}finally{await(n?.unsubscribe())}return{browser:null!==n,server:i}}({...t,subscriptionId:e??void 0})).server}finally{N(g),n||F(e)}return n||T({id:K,tone:"warn",title:"Push on this device",body:"Push is off on this device. The sign-in service was not told, so it may still list it."}),!1}if(null===t)return!1;const n=M(g),r=await async function(e){if(!I())throw new R("unsupported","This browser cannot receive push notifications. Requests still wait for you in the app.");await async function(){const e=await x.requestPermission();if("granted"!==e)throw new R("denied","denied"===e?"Notifications are blocked for this site, so nothing can be delivered here. Requests still wait for you in the app.":"Notifications were not allowed for this site, so nothing can be delivered here. Requests still wait for you in the app.")}();const t=await async function(){if(!x.serviceWorkerContainer())throw new R("unsupported","This browser has no service worker here, so it cannot receive push notifications. That changes nothing about approving requests — they still wait for you in the app.");const e=await A();if(!e)throw new R("unavailable","No service worker is running for this app yet, so push cannot be turned on. Reload the page and try again.");const t=Date.now()+x.pushWorkerWaitMs;for(;!x.workerIsPush(e);){if(Date.now()>=t)throw new R("unavailable","The push worker is still being installed on this device. Try again in a moment.");await x.pause(100)}return e}(),n=q(await async function(e){const t=await $(e,"/v1/notification-channels/push/key",{method:"GET"}),n=i(t)?t.publicKey:void 0;if(!s(n)||0===n.length)throw new R("unsupported","This deployment has no push signing key, so push notifications are not available here.");return n}(e)),{subscription:r,created:a}=await async function(e,t){const n=await e.pushManager.getSubscription();return n&&function(e,t){const n=e.options?.applicationServerKey;if(!n)return!0;const i=new Uint8Array(n);return i.length===t.length&&i.every((e,n)=>e===t[n])}(n,t)?{subscription:n,created:!1}:(await(n?.unsubscribe().catch(()=>!1)),{subscription:await O(e,t),created:!0})}(t,n);try{return await z(e,r)}catch(o){if(o instanceof R&&"conflict"===o.code)return async function(e,t,n,i){await i.unsubscribe().catch(()=>!1);const s=await O(t,n);try{return await z(e,s)}catch(o){throw await s.unsubscribe().catch(()=>!1),o}}(e,t,n,r);throw(a||o instanceof R&&"limit"===o.code)&&await r.unsubscribe().catch(()=>!1),o}}(t);return n&&r.id&&n!==r.id&&F(n),r.id&&S(g,r.id),await D(t,r.id||null),!0}(p,t))}catch(t){T({id:K,tone:"err",title:"Push on this device",body:t instanceof Error?t.message:String(t)}),d(await C().catch(()=>!1))}finally{b.current=!1,w(!1)}}})()},children:E.jsx(p?u:l,{size:16})})})})]})}const J="notifications.web-push",V={capability:J,async activate(e){const t=p(e,J);if(t.disposed())return t.handle();if(await e.hydrate([g,j]),t.disposed())return t.handle();const n=await async function(){try{const e=(await r().distribution()).workerVariants.find(e=>"push"===e.id);return e?d(e.scriptPath):null}catch{return null}}();if(t.disposed())return t.handle();const i=x.workerIsPush;return x.fetchFn=(t,n)=>e.egress.fetch(t,n,{capability:J,purpose:f}),null!==n&&(x.workerIsPush=e=>w(e.active?.scriptURL??null,n)),t.onDispose(()=>{x.fetchFn=U,x.workerIsPush=i}),t.register("settings-panel",{id:"push-on-this-device",label:"Push",category:"general",Panel:()=>P.createElement(B,{baseUrl:b}),order:40}),t.handle()}};export{J as CAPABILITY,V as capabilityRuntime};

package/dist/assets/cap-sharing.household-BeYPmwj5.js

@@ -0,0 +1 @@
+import{c as o}from"./main-BrkS-iow.js";import"./vault-ui-seam-BQGS7RR6.js";import"./native-worker-noble-ciphers-708367a7-BPuD3lXB.js";import"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import"./signals-DdOHdr--.js";import"./model-provider-B6oAnQX9.js";import"./identity-BVf8yWa4.js";import"./hosted-model-authority-CcNPE44H.js";import"./native-worker-zod-5c0ed887-B342B6ko.js";import"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import"./drop-open-BjgdLxWM.js";import"./react-dom-BwC4eQlG.js";import"./seams-DJ_lslby.js";import"./react-router-XsJY84ug.js";const r="sharing.household",t={capability:r,activate:async t=>o(t,r).handle()};export{r as CAPABILITY,t as capabilityRuntime};