@sema-agent/client-core 0.111.0 → 0.112.1

package/dist/consoleCaPin.js

@@ -0,0 +1,827 @@
+import { hasUnsafeAddressCharacter, isCenterRelativePath } from './engineAddress.js';
+import { isLoopbackWireUrl } from './engineWireSdk.js';
+import { usableClockMs } from './clockReading.js';
+import { capForDisplay } from './fleetTaskDesc.js';
+import { SETTINGS_HTTP_URL_FLAWS, SETTINGS_STARTS_WITH_HTTP_SCHEME } from './generated/settingsSchemaFns.js';
+import { SETTINGS_SHA256_DIGEST_RE } from './generated/settingsSchemaTables.js';
+import { msg, renderMessage } from './i18n/translate.js';
+import { engineNamespaceKeyFor } from './sessionMap.js';
+import { sha256BytesHex } from './sha256Bytes.js';
+import { slotReadOf } from './wireFailureShape.js';
+export const CA_PIN_LIMITS = Object.freeze({
+    addressMaxChars: 2048,
+    authorityMaxChars: 300,
+    fingerprintsMax: 16,
+    fingerprintMaxChars: 128,
+    bodyMaxBytes: 1_048_576,
+    servedMax: 16,
+    pemMaxBytes: 16_384,
+    budgetMs: 120_000,
+    roundMs: 10_000,
+    retriesMax: 3,
+    waitCapMs: 60_000,
+    jitterMaxMs: 2_000,
+});
+const isCanonicalFingerprint = (v) => typeof v === 'string' && SETTINGS_SHA256_DIGEST_RE.test(v);
+function refuseAddress(reason) {
+    return Object.freeze({ ok: false, reason });
+}
+function refuseOrigin(reason) {
+    return Object.freeze({ ok: false, reason });
+}
+function rawAuthorityOf(s) {
+    const from = s.indexOf('//') + 2;
+    let end = s.length;
+    for (let i = from; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 0x2f || c === 0x3f || c === 0x23) {
+            end = i;
+            break;
+        }
+    }
+    return s.slice(from, end);
+}
+function rawHostOf(authority) {
+    const lower = authority.toLowerCase();
+    if (lower.startsWith('[')) {
+        const close = lower.indexOf(']');
+        return close < 0 ? lower : lower.slice(0, close + 1);
+    }
+    const colon = lower.lastIndexOf(':');
+    return colon < 0 ? lower : lower.slice(0, colon);
+}
+function hasTrailingDot(rawHost, parsed) {
+    return rawHost.endsWith('.') || parsed.hostname.endsWith('.');
+}
+function ipNotCanonical(rawHost, parsed) {
+    const h = parsed.hostname;
+    const isIp = h.startsWith('[') || /^[\d.]+$/.test(h);
+    return isIp && rawHost !== h;
+}
+export function readCenterAddress(raw, seat) {
+    try {
+        const seatWord = seat;
+        if (seatWord !== 'invite' && seatWord !== 'address')
+            return refuseAddress('bad_input');
+        const rawValue = raw;
+        if (typeof rawValue !== 'string')
+            return refuseAddress('empty');
+        const s = rawValue.trim();
+        if (s.length === 0)
+            return refuseAddress('empty');
+        if (s.length > CA_PIN_LIMITS.addressMaxChars)
+            return refuseAddress('too_long');
+        if (hasUnsafeAddressCharacter(s))
+            return refuseAddress('unsafe_character');
+        const schemeOk = seat === 'invite' ? /^https:\/\//i.test(s) : SETTINGS_STARTS_WITH_HTTP_SCHEME(s);
+        if (!schemeOk)
+            return refuseAddress('scheme');
+        const authority = rawAuthorityOf(s);
+        if (authority.length === 0)
+            return refuseAddress('scheme');
+        if (authority.includes('@'))
+            return refuseAddress('userinfo');
+        if (authority.includes('%'))
+            return refuseAddress('percent_in_host');
+        const flaw = SETTINGS_HTTP_URL_FLAWS(s, seat === 'address' ? ['query', 'fragment'] : ['query'])[0];
+        if (flaw === 'not-http-url')
+            return refuseAddress('unparseable');
+        if (flaw === 'query' || flaw === 'fragment')
+            return refuseAddress(flaw);
+        const u = new URL(s);
+        const rawHost = rawHostOf(authority);
+        if (hasTrailingDot(rawHost, u))
+            return refuseAddress('trailing_dot');
+        if (ipNotCanonical(rawHost, u))
+            return refuseAddress('ip_not_canonical');
+        if (seat === 'address' && u.protocol === 'http:' && !isLoopbackWireUrl(u.href))
+            return refuseAddress('plaintext_remote');
+        const hashAt = s.indexOf('#');
+        const afterAuthority = s.indexOf('//') + 2 + authority.length;
+        const rawPath = s.slice(afterAuthority, hashAt < 0 ? s.length : hashAt);
+        const pathOk = seat === 'invite' ? rawPath === '' || rawPath === '/' : rawPath === '' || isCenterRelativePath(rawPath);
+        if (!pathOk)
+            return refuseAddress('path');
+        const fingerprints = [];
+        if (seat === 'invite' && hashAt >= 0) {
+            const fragment = s.slice(hashAt + 1);
+            if (!fragment.startsWith('ca='))
+                return refuseAddress('fragment');
+            for (const item of fragment.slice(3).split(',')) {
+                if (!isCanonicalFingerprint(item))
+                    return refuseAddress('fingerprint');
+                if (!fingerprints.includes(item))
+                    fingerprints.push(item);
+            }
+            if (fingerprints.length > CA_PIN_LIMITS.fingerprintsMax)
+                return refuseAddress('too_many_fingerprints');
+        }
+        return Object.freeze({
+            ok: true,
+            seat,
+            origin: u.origin,
+            centerKey: engineNamespaceKeyFor(u.href),
+            fingerprints: Object.freeze(fingerprints),
+        });
+    }
+    catch {
+        return refuseAddress('bad_input');
+    }
+}
+export function trustOriginOf(url) {
+    try {
+        const urlValue = url;
+        if (typeof urlValue !== 'string')
+            return refuseOrigin('empty');
+        const s = urlValue.trim();
+        if (s.length === 0)
+            return refuseOrigin('empty');
+        const scheme = /^(https?|wss?):\/\//i.exec(s);
+        if (scheme === null)
+            return refuseOrigin('scheme');
+        const authority = rawAuthorityOf(s);
+        if (authority.length === 0)
+            return refuseOrigin('scheme');
+        if (authority.length > CA_PIN_LIMITS.authorityMaxChars)
+            return refuseOrigin('too_long');
+        if (hasUnsafeAddressCharacter(authority))
+            return refuseOrigin('unsafe_character');
+        if (authority.includes('@'))
+            return refuseOrigin('userinfo');
+        if (authority.includes('%'))
+            return refuseOrigin('percent_in_host');
+        const word = (scheme[1] ?? '').toLowerCase();
+        const httpScheme = word === 'wss' || word === 'https' ? 'https' : 'http';
+        let u;
+        try {
+            u = new URL(`${httpScheme}://${authority}/`);
+        }
+        catch {
+            return refuseOrigin('unparseable');
+        }
+        const rawHost = rawHostOf(authority);
+        if (hasTrailingDot(rawHost, u))
+            return refuseOrigin('trailing_dot');
+        if (ipNotCanonical(rawHost, u))
+            return refuseOrigin('ip_not_canonical');
+        return Object.freeze({ ok: true, origin: u.origin });
+    }
+    catch {
+        return refuseOrigin('unparseable');
+    }
+}
+function refuseFingerprints(reason, index) {
+    return Object.freeze(index === undefined ? { ok: false, reason } : { ok: false, reason, index });
+}
+function ownArrayItems(v) {
+    if (!Array.isArray(v))
+        return undefined;
+    const len = slotReadOf(v, 'length');
+    if (len.presence !== 'present' || typeof len.value !== 'number')
+        return undefined;
+    const out = [];
+    for (let i = 0; i < len.value; i++) {
+        const item = slotReadOf(v, String(i));
+        if (item.presence !== 'present')
+            return undefined;
+        out.push(item.value);
+    }
+    return out;
+}
+export function caFingerprintsOf(texts) {
+    try {
+        const items = ownArrayItems(texts);
+        if (items === undefined)
+            return refuseFingerprints('bad_input');
+        const out = [];
+        for (let i = 0; i < items.length; i++) {
+            const t = items[i];
+            if (typeof t !== 'string')
+                return refuseFingerprints('bad_input');
+            if (t.length > CA_PIN_LIMITS.fingerprintMaxChars)
+                return refuseFingerprints('fingerprint', i);
+            if (!t.startsWith('sha256:'))
+                return refuseFingerprints('prefix', i);
+            const body = t.slice('sha256:'.length);
+            let hex;
+            if (/^[0-9a-fA-F]{64}$/.test(body))
+                hex = body.toLowerCase();
+            else if (/^[0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){31}$/.test(body))
+                hex = body.replace(/:/g, '').toLowerCase();
+            else
+                return refuseFingerprints('fingerprint', i);
+            const fp = `sha256:${hex}`;
+            if (!out.includes(fp))
+                out.push(fp);
+        }
+        if (out.length > CA_PIN_LIMITS.fingerprintsMax)
+            return refuseFingerprints('too_many_fingerprints');
+        return Object.freeze({ ok: true, fingerprints: Object.freeze(out) });
+    }
+    catch {
+        return refuseFingerprints('bad_input');
+    }
+}
+export function caFingerprintOfDer(der) {
+    return `sha256:${sha256BytesHex(der)}`;
+}
+export function caFingerprintDisplay(fp) {
+    if (!isCanonicalFingerprint(fp))
+        return undefined;
+    return (fp.slice('sha256:'.length).toUpperCase().match(/../g) ?? []).join(':');
+}
+function refuseBody(reason, index) {
+    return Object.freeze(index === undefined ? { kind: 'refused', reason } : { kind: 'refused', reason, index });
+}
+const TYPED_ARRAY_PROTO = Object.getPrototypeOf(Uint8Array.prototype);
+const typedArrayTag = Object.getOwnPropertyDescriptor(TYPED_ARRAY_PROTO, Symbol.toStringTag)?.get;
+const typedArrayLength = Object.getOwnPropertyDescriptor(TYPED_ARRAY_PROTO, 'length')?.get;
+const uint8Set = Uint8Array.prototype.set;
+function byteLengthOf(v) {
+    if (typeof v !== 'object' || v === null || typedArrayTag === undefined || typedArrayLength === undefined)
+        return undefined;
+    try {
+        if (typedArrayTag.call(v) !== 'Uint8Array')
+            return undefined;
+        const n = typedArrayLength.call(v);
+        return typeof n === 'number' ? n : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function copyBytes(v, n) {
+    try {
+        const copy = new Uint8Array(n);
+        uint8Set.call(copy, v);
+        return copy;
+    }
+    catch {
+        return undefined;
+    }
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+const PEM_HEAD = '-----BEGIN CERTIFICATE-----\n';
+const PEM_TAIL = '-----END CERTIFICATE-----\n';
+function pemOfDer(der) {
+    let bin = '';
+    for (let i = 0; i < der.length; i++)
+        bin += String.fromCharCode(der[i] ?? 0);
+    const b64 = btoa(bin);
+    let body = '';
+    for (let i = 0; i < b64.length; i += 64)
+        body += `${b64.slice(i, i + 64)}\n`;
+    return PEM_HEAD + body + PEM_TAIL;
+}
+function canonicalPemDer(pem) {
+    if (!pem.startsWith(PEM_HEAD) || !pem.endsWith(PEM_TAIL) || pem.length <= PEM_HEAD.length + PEM_TAIL.length)
+        return undefined;
+    const b64 = pem.slice(PEM_HEAD.length, pem.length - PEM_TAIL.length).replace(/\n/g, '');
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64))
+        return undefined;
+    let bin;
+    try {
+        bin = atob(b64);
+    }
+    catch {
+        return undefined;
+    }
+    const der = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        der[i] = bin.charCodeAt(i);
+    return pemOfDer(der) === pem ? der : undefined;
+}
+function derElementEnd(der, off, limit, depth) {
+    if (depth > 32 || off >= limit)
+        return -1;
+    const tag = der[off] ?? 0;
+    let p = off + 1;
+    if ((tag & 0x1f) === 0x1f) {
+        let n = 0;
+        while (p < limit && ((der[p] ?? 0) & 0x80) !== 0) {
+            if (n === 0 && der[p] === 0x80)
+                return -1;
+            p++;
+            if (++n > 4)
+                return -1;
+        }
+        if (p >= limit)
+            return -1;
+        p++;
+    }
+    if (p >= limit)
+        return -1;
+    const first = der[p] ?? 0;
+    p++;
+    let len;
+    if (first < 0x80)
+        len = first;
+    else {
+        const n = first & 0x7f;
+        if (n === 0 || n > 4 || p + n > limit || der[p] === 0)
+            return -1;
+        len = 0;
+        for (let i = 0; i < n; i++)
+            len = len * 256 + (der[p + i] ?? 0);
+        if (len < 0x80)
+            return -1;
+        p += n;
+    }
+    const end = p + len;
+    if (end > limit)
+        return -1;
+    if ((tag & 0x20) !== 0) {
+        let q = p;
+        while (q < end) {
+            q = derElementEnd(der, q, end, depth + 1);
+            if (q < 0)
+                return -1;
+        }
+    }
+    return end;
+}
+function derShapeCanonical(der) {
+    return der.length > 0 && derElementEnd(der, 0, der.length, 0) === der.length;
+}
+function isoOfOpensslTime(t) {
+    const m = /^([A-Z][a-z]{2}) ([ 1-3]\d) (\d{2}):(\d{2}):(\d{2}) (\d{4}) GMT$/.exec(t);
+    if (m === null)
+        return undefined;
+    const month = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'].indexOf(m[1] ?? '');
+    const day = Number((m[2] ?? '').trim());
+    const [hh, mm, ss, yyyy] = [Number(m[3]), Number(m[4]), Number(m[5]), Number(m[6])];
+    if (month < 0 || day < 1 || hh > 23 || mm > 59 || ss > 60)
+        return undefined;
+    const ms = Date.UTC(yyyy, month, day, hh, mm, ss);
+    const d = new Date(ms);
+    if (d.getUTCDate() !== day || d.getUTCMonth() !== month)
+        return undefined;
+    const pad = (x, w = 2) => String(x).padStart(w, '0');
+    return `${pad(yyyy, 4)}-${pad(month + 1)}-${pad(day)}T${pad(hh)}:${pad(mm)}:${pad(ss)}Z`;
+}
+function readFacts(v) {
+    if (typeof v !== 'object' || v === null)
+        return undefined;
+    const raw = slotReadOf(v, 'raw');
+    const subject = slotReadOf(v, 'subject');
+    const notAfter = slotReadOf(v, 'notAfter');
+    const selfSigned = slotReadOf(v, 'selfSigned');
+    if (raw.presence !== 'present' || subject.presence !== 'present' || notAfter.presence !== 'present' || selfSigned.presence !== 'present')
+        return undefined;
+    if (typeof subject.value !== 'string' || typeof notAfter.value !== 'string' || typeof selfSigned.value !== 'boolean')
+        return undefined;
+    const n = byteLengthOf(raw.value);
+    if (n === undefined)
+        return undefined;
+    const bytes = copyBytes(raw.value, n);
+    if (bytes === undefined)
+        return undefined;
+    return { raw: bytes, subject: subject.value, notAfter: notAfter.value, selfSigned: selfSigned.value };
+}
+function servedOf(fingerprint, pem, facts) {
+    const subject = capForDisplay(facts.subject.split('\n').join(', '), 256);
+    const notAfter = isoOfOpensslTime(facts.notAfter);
+    return Object.freeze({
+        fingerprint,
+        pem,
+        selfSigned: facts.selfSigned,
+        ...(subject.length > 0 ? { subject } : {}),
+        ...(notAfter !== undefined ? { notAfter } : {}),
+    });
+}
+function namedOf(request) {
+    const slot = slotReadOf(request, 'named');
+    if (slot.presence === 'absent')
+        return [];
+    if (slot.presence !== 'present')
+        return undefined;
+    const items = ownArrayItems(slot.value);
+    if (items === undefined)
+        return undefined;
+    const out = [];
+    for (const item of items) {
+        if (!isCanonicalFingerprint(item))
+            return undefined;
+        if (!out.includes(item))
+            out.push(item);
+    }
+    return out.length <= CA_PIN_LIMITS.fingerprintsMax ? out : undefined;
+}
+export function readCaBootstrapBody(body, request) {
+    try {
+        const req = request;
+        if (typeof req !== 'object' || req === null)
+            return refuseBody('bad_input');
+        const named = namedOf(req);
+        if (named === undefined)
+            return refuseBody('bad_input');
+        const parserSlot = slotReadOf(req, 'parseCertificate');
+        if (parserSlot.presence === 'absent')
+            return refuseBody('parser_unavailable');
+        if (parserSlot.presence !== 'present' || typeof parserSlot.value !== 'function')
+            return refuseBody('bad_input');
+        const parse = parserSlot.value;
+        const n = byteLengthOf(body);
+        if (n === undefined)
+            return refuseBody('bad_input');
+        if (n > CA_PIN_LIMITS.bodyMaxBytes)
+            return refuseBody('body_too_large');
+        const bytes = copyBytes(body, n);
+        if (bytes === undefined)
+            return refuseBody('bad_input');
+        let doc;
+        try {
+            doc = JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes));
+        }
+        catch {
+            return refuseBody('body_not_json');
+        }
+        if (typeof doc !== 'object' || doc === null || Array.isArray(doc))
+            return refuseBody('body_shape');
+        const configured = slotReadOf(doc, 'configured');
+        if (configured.presence !== 'present' || typeof configured.value !== 'boolean')
+            return refuseBody('body_shape');
+        if (configured.value === false)
+            return named.length > 0 ? refuseBody('unconfigured_with_fingerprints') : Object.freeze({ kind: 'unconfigured' });
+        const certsSlot = slotReadOf(doc, 'certificates');
+        if (certsSlot.presence !== 'present' || !Array.isArray(certsSlot.value))
+            return refuseBody('body_shape');
+        const items = ownArrayItems(certsSlot.value);
+        if (items === undefined)
+            return refuseBody('body_shape');
+        if (items.length === 0 || items.length > CA_PIN_LIMITS.servedMax)
+            return refuseBody('served_count');
+        const served = [];
+        for (let i = 0; i < items.length; i++) {
+            const item = items[i];
+            if (typeof item !== 'object' || item === null || Array.isArray(item))
+                return refuseBody('body_shape', i);
+            const pemSlot = slotReadOf(item, 'pem');
+            if (pemSlot.presence !== 'present' || typeof pemSlot.value !== 'string')
+                return refuseBody('body_shape', i);
+            const pem = pemSlot.value;
+            if (pem.length > CA_PIN_LIMITS.pemMaxBytes)
+                return refuseBody('certificate_too_large', i);
+            const der = canonicalPemDer(pem);
+            if (der === undefined || !derShapeCanonical(der))
+                return refuseBody('certificate_not_canonical', i);
+            const fingerprint = caFingerprintOfDer(der);
+            if (served.some((c) => c.fingerprint === fingerprint))
+                return refuseBody('served_duplicate', i);
+            let factsRaw;
+            try {
+                factsRaw = parse(der.slice());
+            }
+            catch {
+                return refuseBody('certificate_unparseable', i);
+            }
+            const facts = readFacts(factsRaw);
+            if (facts === undefined)
+                return refuseBody('certificate_unparseable', i);
+            if (!bytesEqual(facts.raw, der))
+                return refuseBody('certificate_not_canonical', i);
+            served.push(servedOf(fingerprint, pem, facts));
+        }
+        const anchors = [];
+        for (let k = 0; k < named.length; k++) {
+            const at = served.findIndex((c) => c.fingerprint === named[k]);
+            if (at < 0)
+                return refuseBody('named_not_served', k);
+            const hit = served[at];
+            if (hit === undefined || hit.selfSigned !== true)
+                return refuseBody('anchor_not_self_signed', at);
+            anchors.push(hit);
+        }
+        return Object.freeze({ kind: 'served', certificates: Object.freeze(served), anchors: Object.freeze(anchors) });
+    }
+    catch {
+        return refuseBody('bad_input');
+    }
+}
+function stopReasons() {
+    const all = {
+        bad_input: true, cancelled: true, timed_out: true, transport_failed: true, content_type: true, ca_unavailable: true, endpoint_missing: true,
+        unexpected_status: true, retry_after_unusable: true, retry_after_too_long: true, retries_exhausted: true, budget_exhausted: true,
+    };
+    return Object.keys(all);
+}
+function stopOf(reason, extra = {}) {
+    return Object.freeze({
+        action: 'stop',
+        reason,
+        ...(extra.status !== undefined ? { status: extra.status } : {}),
+        ...(extra.retryAfterSec !== undefined ? { retryAfterSec: extra.retryAfterSec } : {}),
+        ...(extra.remainingSec !== undefined ? { remainingSec: extra.remainingSec } : {}),
+    });
+}
+function stateOf(f) {
+    return Object.freeze({
+        phase: f.phase,
+        deadlineMs: f.deadlineMs,
+        lastNowMs: f.lastNowMs,
+        attempts: f.attempts,
+        ...(f.roundDeadlineMs !== undefined ? { roundDeadlineMs: f.roundDeadlineMs } : {}),
+        ...(f.notBeforeMs !== undefined ? { notBeforeMs: f.notBeforeMs } : {}),
+        ...(f.retryAfterSec !== undefined ? { retryAfterSec: f.retryAfterSec } : {}),
+        ...(f.stop !== undefined ? { stop: f.stop } : {}),
+    });
+}
+function stopped(base, stop) {
+    return Object.freeze({ state: stateOf({ phase: 'stopped', deadlineMs: base.deadlineMs, lastNowMs: base.lastNowMs, attempts: base.attempts, stop }), decision: stop });
+}
+export function caBootstrapOpen(nowMs) {
+    const t = usableClockMs(nowMs);
+    if (t === null)
+        return stateOf({ phase: 'stopped', deadlineMs: 0, lastNowMs: 0, attempts: 0, stop: stopOf('bad_input') });
+    return stateOf({ phase: 'idle', deadlineMs: t + CA_PIN_LIMITS.budgetMs, lastNowMs: t, attempts: 0 });
+}
+function intSlotOf(o, key, min) {
+    const r = slotReadOf(o, key);
+    if (r.presence === 'absent')
+        return { value: undefined };
+    if (r.presence !== 'present' || typeof r.value !== 'number' || !Number.isInteger(r.value) || r.value < min)
+        return undefined;
+    return { value: r.value };
+}
+function stopFrom(v) {
+    if (typeof v !== 'object' || v === null)
+        return undefined;
+    const action = slotReadOf(v, 'action');
+    if (action.presence !== 'present' || action.value !== 'stop')
+        return undefined;
+    const reasonSlot = slotReadOf(v, 'reason');
+    if (reasonSlot.presence !== 'present' || typeof reasonSlot.value !== 'string')
+        return undefined;
+    const word = stopReasons().find((w) => w === reasonSlot.value);
+    if (word === undefined)
+        return undefined;
+    const status = intSlotOf(v, 'status', Number.NEGATIVE_INFINITY);
+    const retry = intSlotOf(v, 'retryAfterSec', 1);
+    const remaining = intSlotOf(v, 'remainingSec', 0);
+    if (status === undefined || retry === undefined || remaining === undefined)
+        return undefined;
+    const retryHome = word === 'retry_after_too_long' || word === 'retries_exhausted';
+    if ((status.value !== undefined) !== (word === 'unexpected_status'))
+        return undefined;
+    if (retry.value === undefined ? retryHome : !(retryHome || word === 'budget_exhausted'))
+        return undefined;
+    if ((remaining.value !== undefined) !== (word === 'budget_exhausted'))
+        return undefined;
+    return stopOf(word, {
+        ...(status.value !== undefined ? { status: status.value } : {}),
+        ...(retry.value !== undefined ? { retryAfterSec: retry.value } : {}),
+        ...(remaining.value !== undefined ? { remainingSec: remaining.value } : {}),
+    });
+}
+function readState(v) {
+    if (typeof v !== 'object' || v === null)
+        return undefined;
+    const o = v;
+    const read = (k) => {
+        const r = slotReadOf(o, k);
+        if (r.presence === 'unreadable')
+            return undefined;
+        return { present: r.presence === 'present', value: r.value };
+    };
+    const phase = read('phase');
+    const deadline = read('deadlineMs');
+    const last = read('lastNowMs');
+    const attempts = read('attempts');
+    const round = read('roundDeadlineMs');
+    const notBefore = read('notBeforeMs');
+    const ra = read('retryAfterSec');
+    const stop = read('stop');
+    if (!phase || !deadline || !last || !attempts || !round || !notBefore || !ra || !stop)
+        return undefined;
+    const p = phase.value;
+    if (p !== 'idle' && p !== 'in-flight' && p !== 'reading' && p !== 'waiting' && p !== 'stopped')
+        return undefined;
+    const d = usableClockMs(deadline.value);
+    const l = usableClockMs(last.value);
+    const a = attempts.value;
+    if (d === null || l === null || typeof a !== 'number' || !Number.isInteger(a) || a < 0 || a > CA_PIN_LIMITS.retriesMax + 1)
+        return undefined;
+    const out = { phase: p, deadlineMs: d, lastNowMs: l, attempts: a };
+    const wantRound = p === 'in-flight' || p === 'reading';
+    const wantWait = p === 'waiting';
+    const wantStop = p === 'stopped';
+    if (round.present !== wantRound || notBefore.present !== wantWait || ra.present !== wantWait || stop.present !== wantStop)
+        return undefined;
+    if (p === 'idle' && a !== 0)
+        return undefined;
+    if (wantRound) {
+        const r = usableClockMs(round.value);
+        if (r === null || r > d || a < 1)
+            return undefined;
+        out.roundDeadlineMs = r;
+    }
+    if (wantWait) {
+        const nb = usableClockMs(notBefore.value);
+        const sec = ra.value;
+        if (nb === null || typeof sec !== 'number' || !Number.isInteger(sec) || sec < 1 || sec * 1000 > CA_PIN_LIMITS.waitCapMs)
+            return undefined;
+        if (nb + CA_PIN_LIMITS.roundMs > d || a < 1 || a > CA_PIN_LIMITS.retriesMax)
+            return undefined;
+        out.notBeforeMs = nb;
+        out.retryAfterSec = sec;
+    }
+    if (wantStop) {
+        const minted = stopFrom(stop.value);
+        if (minted === undefined)
+            return undefined;
+        out.stop = minted;
+    }
+    return out;
+}
+function retryAfterSecOf(v) {
+    if (typeof v !== 'string')
+        return undefined;
+    const t = v.replace(/^[ \t]+|[ \t]+$/g, '');
+    return /^[1-9][0-9]{0,8}$/.test(t) ? Number(t) : undefined;
+}
+function isJsonMediaType(v) {
+    if (typeof v !== 'string')
+        return false;
+    const semi = v.indexOf(';');
+    return (semi < 0 ? v : v.slice(0, semi)).replace(/^[ \t]+|[ \t]+$/g, '').toLowerCase() === 'application/json';
+}
+export function caBootstrapStep(state, event, nowMs) {
+    let s;
+    try {
+        s = readState(state);
+        if (s === undefined)
+            return stopped({ deadlineMs: 0, lastNowMs: 0, attempts: 0 }, stopOf('bad_input'));
+        if (s.phase === 'stopped' && s.stop !== undefined)
+            return Object.freeze({ state, decision: s.stop });
+        const base = { deadlineMs: s.deadlineMs, lastNowMs: s.lastNowMs, attempts: s.attempts };
+        if (typeof event !== 'object' || event === null)
+            return stopped(base, stopOf('bad_input'));
+        const typeSlot = slotReadOf(event, 'type');
+        if (typeSlot.presence !== 'present')
+            return stopped(base, stopOf('bad_input'));
+        const type = typeSlot.value;
+        if (type === 'cancelled')
+            return stopped(base, stopOf('cancelled'));
+        const now = usableClockMs(nowMs);
+        if (now === null || now < s.lastNowMs)
+            return stopped(base, stopOf('bad_input'));
+        const at = { deadlineMs: s.deadlineMs, lastNowMs: now, attempts: s.attempts };
+        const D = s.deadlineMs;
+        const remainingSec = Math.max(0, Math.floor((D - now) / 1000));
+        const attempts = s.attempts;
+        const admit = () => {
+            const decision = Object.freeze({ action: 'attempt', timeoutMs: CA_PIN_LIMITS.roundMs });
+            return Object.freeze({ state: stateOf({ phase: 'in-flight', deadlineMs: D, lastNowMs: now, attempts: attempts + 1, roundDeadlineMs: now + CA_PIN_LIMITS.roundMs }), decision });
+        };
+        switch (s.phase) {
+            case 'idle':
+                if (type !== 'begin')
+                    return stopped(at, stopOf('bad_input'));
+                if (now + CA_PIN_LIMITS.roundMs > D)
+                    return stopped(at, stopOf('budget_exhausted', { remainingSec }));
+                return admit();
+            case 'waiting': {
+                if (type !== 'begin')
+                    return stopped(at, stopOf('bad_input'));
+                const notBefore = s.notBeforeMs ?? Number.POSITIVE_INFINITY;
+                const ra = s.retryAfterSec ?? 0;
+                if (now < notBefore) {
+                    const decision = Object.freeze({ action: 'wait', afterMs: notBefore - now, retryAfterSec: ra });
+                    return Object.freeze({ state: stateOf({ ...s, lastNowMs: now }), decision });
+                }
+                if (now + CA_PIN_LIMITS.roundMs > D)
+                    return stopped(at, stopOf('budget_exhausted', { retryAfterSec: ra, remainingSec }));
+                return admit();
+            }
+            case 'in-flight':
+            case 'reading': {
+                const roundDeadline = s.roundDeadlineMs ?? Number.NEGATIVE_INFINITY;
+                if (type === 'timed-out')
+                    return stopped(at, stopOf('timed_out'));
+                if (type === 'failed')
+                    return stopped(at, stopOf('transport_failed'));
+                if (s.phase === 'reading') {
+                    if (type !== 'checkpoint')
+                        return stopped(at, stopOf('bad_input'));
+                    if (now > roundDeadline)
+                        return stopped(at, stopOf('timed_out'));
+                    return Object.freeze({ state: stateOf({ ...s, lastNowMs: now }), decision: Object.freeze({ action: 'proceed' }) });
+                }
+                if (type !== 'response')
+                    return stopped(at, stopOf('bad_input'));
+                if (now > roundDeadline)
+                    return stopped(at, stopOf('timed_out'));
+                const status = slotReadOf(event, 'status');
+                if (status.presence !== 'present' || typeof status.value !== 'number' || !Number.isInteger(status.value))
+                    return stopped(at, stopOf('bad_input'));
+                const code = status.value;
+                if (code === 200) {
+                    const ct = slotReadOf(event, 'contentType');
+                    if (ct.presence === 'present' && isJsonMediaType(ct.value)) {
+                        return Object.freeze({ state: stateOf({ ...s, phase: 'reading', lastNowMs: now }), decision: Object.freeze({ action: 'read-body' }) });
+                    }
+                    return stopped(at, stopOf('content_type'));
+                }
+                if (code === 503)
+                    return stopped(at, stopOf('ca_unavailable'));
+                if (code === 404)
+                    return stopped(at, stopOf('endpoint_missing'));
+                if (code !== 429)
+                    return stopped(at, stopOf('unexpected_status', { status: code }));
+                const raSlot = slotReadOf(event, 'retryAfter');
+                const r = raSlot.presence === 'present' ? retryAfterSecOf(raSlot.value) : undefined;
+                if (r === undefined)
+                    return stopped(at, stopOf('retry_after_unusable'));
+                if (s.attempts >= CA_PIN_LIMITS.retriesMax + 1)
+                    return stopped(at, stopOf('retries_exhausted', { retryAfterSec: r }));
+                if (r * 1000 > CA_PIN_LIMITS.waitCapMs)
+                    return stopped(at, stopOf('retry_after_too_long', { retryAfterSec: r }));
+                if (now + r * 1000 + CA_PIN_LIMITS.roundMs > D)
+                    return stopped(at, stopOf('budget_exhausted', { retryAfterSec: r, remainingSec }));
+                const jSlot = slotReadOf(event, 'jitter');
+                const u = jSlot.presence === 'present' && typeof jSlot.value === 'number' && jSlot.value >= 0 && jSlot.value < 1 ? jSlot.value : 0;
+                const room = Math.min(CA_PIN_LIMITS.jitterMaxMs, CA_PIN_LIMITS.waitCapMs - r * 1000, D - now - r * 1000 - CA_PIN_LIMITS.roundMs);
+                const j = Math.floor(u * Math.max(0, room));
+                const afterMs = r * 1000 + j;
+                const decision = Object.freeze({ action: 'wait', afterMs, retryAfterSec: r });
+                return Object.freeze({ state: stateOf({ phase: 'waiting', deadlineMs: D, lastNowMs: now, attempts: s.attempts, notBeforeMs: now + afterMs, retryAfterSec: r }), decision });
+            }
+            default:
+                return stopped(at, stopOf('bad_input'));
+        }
+    }
+    catch {
+        const base = s ? { deadlineMs: s.deadlineMs, lastNowMs: s.lastNowMs, attempts: s.attempts } : { deadlineMs: 0, lastNowMs: 0, attempts: 0 };
+        return stopped(base, stopOf('bad_input'));
+    }
+}
+function refusalKeys() {
+    return {
+        bad_input: 'centerTrust.refusal.badInput',
+        empty: 'centerTrust.refusal.empty',
+        too_long: 'centerTrust.refusal.tooLong',
+        unsafe_character: 'centerTrust.refusal.unsafeCharacter',
+        scheme: 'centerTrust.refusal.scheme',
+        userinfo: 'centerTrust.refusal.userinfo',
+        percent_in_host: 'centerTrust.refusal.percentInHost',
+        unparseable: 'centerTrust.refusal.unparseable',
+        query: 'centerTrust.refusal.query',
+        fragment: 'centerTrust.refusal.fragment',
+        trailing_dot: 'centerTrust.refusal.trailingDot',
+        ip_not_canonical: 'centerTrust.refusal.ipNotCanonical',
+        plaintext_remote: 'centerTrust.refusal.plaintextRemote',
+        path: 'centerTrust.refusal.path',
+        fingerprint: 'centerTrust.refusal.fingerprint',
+        too_many_fingerprints: 'centerTrust.refusal.tooManyFingerprints',
+        prefix: 'centerTrust.refusal.prefix',
+        parser_unavailable: 'centerTrust.refusal.parserUnavailable',
+        body_too_large: 'centerTrust.refusal.bodyTooLarge',
+        body_not_json: 'centerTrust.refusal.bodyNotJson',
+        body_shape: 'centerTrust.refusal.bodyShape',
+        served_count: 'centerTrust.refusal.servedCount',
+        certificate_too_large: 'centerTrust.refusal.certificateTooLarge',
+        certificate_not_canonical: 'centerTrust.refusal.certificateNotCanonical',
+        certificate_unparseable: 'centerTrust.refusal.certificateUnparseable',
+        served_duplicate: 'centerTrust.refusal.servedDuplicate',
+        named_not_served: 'centerTrust.refusal.namedNotServed',
+        anchor_not_self_signed: 'centerTrust.refusal.anchorNotSelfSigned',
+        unconfigured_with_fingerprints: 'centerTrust.refusal.unconfiguredWithFingerprints',
+        cancelled: 'centerTrust.refusal.cancelled',
+        timed_out: 'centerTrust.refusal.timedOut',
+        transport_failed: 'centerTrust.refusal.transportFailed',
+        content_type: 'centerTrust.refusal.contentType',
+        ca_unavailable: 'centerTrust.refusal.caUnavailable',
+        endpoint_missing: 'centerTrust.refusal.endpointMissing',
+        unexpected_status: 'centerTrust.refusal.unexpectedStatus',
+        retry_after_unusable: 'centerTrust.refusal.retryAfterUnusable',
+        retry_after_too_long: 'centerTrust.refusal.retryAfterTooLong',
+        retries_exhausted: 'centerTrust.refusal.retriesExhausted',
+        budget_exhausted: 'centerTrust.refusal.budgetExhausted',
+    };
+}
+export function caPinRefusalSentence(reason, lang) {
+    const L = CA_PIN_LIMITS;
+    const params = {
+        addressMax: L.addressMaxChars,
+        authorityMax: L.authorityMaxChars,
+        fingerprintsMax: L.fingerprintsMax,
+        bodyMax: L.bodyMaxBytes,
+        servedMax: L.servedMax,
+        pemMax: L.pemMaxBytes,
+        roundSec: L.roundMs / 1000,
+        waitCapSec: L.waitCapMs / 1000,
+        attemptsMax: L.retriesMax + 1,
+        budgetSec: L.budgetMs / 1000,
+    };
+    const keys = refusalKeys();
+    const word = reason;
+    const key = typeof word === 'string' && Object.hasOwn(keys, word) ? keys[word] : 'centerTrust.refusal.unknown';
+    return renderMessage(msg(key, params), lang);
+}