@serfab/cadre-host 0.7.1

package/dist/nat/port-mapper.js

@@ -0,0 +1,226 @@
+import debug from 'debug';
+import { NatError } from './types.js';
+const log = debug('cadre:host:nat-port-mapper');
+/** Default lease TTL: 1 hour. The router must keep our mapping at least this long. */
+export const DEFAULT_LEASE_TTL_MS = 60 * 60 * 1000;
+/** Default refresh cadence: half the TTL, so two refreshes per lease. */
+export const DEFAULT_REFRESH_MS = 30 * 60 * 1000;
+/**
+ * Default factory: loads @achingbrain/nat-port-mapper. Wrapped in dynamic
+ * import so a missing dep at install time doesn't crash the package.
+ */
+export async function createDefaultPortMapper(opts = {}) {
+    let mod;
+    try {
+        mod = (await import('@achingbrain/nat-port-mapper'));
+    }
+    catch (err) {
+        throw new NatError('mapping_failed', `@achingbrain/nat-port-mapper is not installed: ${err.message}`);
+    }
+    let client;
+    try {
+        client = await mod.upnpNat({
+            description: opts.description ?? 'sereus-cadre-host',
+            ttl: Math.round((opts.ttlMs ?? DEFAULT_LEASE_TTL_MS) / 1000),
+        });
+    }
+    catch (err) {
+        throw new NatError('mapping_failed', `upnpNat() failed: ${err.message}`);
+    }
+    return new NatPortMapperAdapter(client, opts.ttlMs ?? DEFAULT_LEASE_TTL_MS);
+}
+class NatPortMapperAdapter {
+    constructor(client, defaultTtlMs) {
+        this.client = client;
+        this.defaultTtlMs = defaultTtlMs;
+    }
+    async map(opts) {
+        const ttlMs = opts.ttlMs ?? this.defaultTtlMs;
+        const protocol = opts.protocol ?? 'tcp';
+        let externalIp = null;
+        try {
+            externalIp = await this.client.externalIp();
+        }
+        catch (err) {
+            log('externalIp() failed: %s', err.message);
+        }
+        try {
+            await this.client.map({
+                localPort: opts.internalPort,
+                externalPort: opts.externalPort,
+                protocol,
+                ttl: Math.round(ttlMs / 1000),
+            });
+        }
+        catch (err) {
+            throw new NatError('mapping_failed', `router refused mapping for port ${opts.externalPort}: ${err.message}`);
+        }
+        return {
+            mode: 'auto-upnp',
+            externalIp,
+            externalPort: opts.externalPort,
+            internalPort: opts.internalPort,
+            protocol,
+            leaseExpiresAt: new Date(Date.now() + ttlMs),
+        };
+    }
+    async verify(externalPort, protocol = 'tcp') {
+        void externalPort;
+        void protocol;
+        // The current library doesn't expose an introspection API. Treat a
+        // working externalIp() as a proxy for "router still reachable" — refresh
+        // failures will surface via re-running map().
+        try {
+            await this.client.externalIp();
+            return true;
+        }
+        catch (err) {
+            log('verify() failed: %s', err.message);
+            return false;
+        }
+    }
+    async externalIp() {
+        try {
+            return await this.client.externalIp();
+        }
+        catch (err) {
+            log('externalIp() failed: %s', err.message);
+            return null;
+        }
+    }
+    async unmap(externalPort, protocol = 'tcp') {
+        try {
+            await this.client.unmap({ externalPort, protocol });
+        }
+        catch (err) {
+            log('unmap(%d) failed: %s', externalPort, err.message);
+        }
+    }
+    async stop() {
+        try {
+            await this.client.stop();
+        }
+        catch (err) {
+            log('stop() failed: %s', err.message);
+        }
+    }
+}
+/**
+ * Long-running orchestrator over a PortMapper. Owns the refresh timer and
+ * surfaces the latest state for the NatService snapshot.
+ */
+export class PortMapperService {
+    constructor(opts) {
+        this.refreshHandle = null;
+        this.started = false;
+        this.mapper = opts.mapper;
+        this.externalPort = opts.externalPort;
+        this.internalPort = opts.internalPort;
+        this.protocol = opts.protocol ?? 'tcp';
+        this.ttlMs = opts.ttlMs ?? DEFAULT_LEASE_TTL_MS;
+        this.refreshMs = opts.refreshMs ?? DEFAULT_REFRESH_MS;
+        this.nowFn = opts.now ?? (() => new Date());
+        this.setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+        this.clearTimer = opts.clearTimer ?? ((h) => clearTimeout(h));
+        this.state = {
+            mode: 'disabled',
+            externalPort: this.externalPort,
+            internalPort: this.internalPort,
+            routerExternalIp: null,
+            leaseExpiresAt: null,
+            lastError: null,
+        };
+    }
+    getState() {
+        return { ...this.state };
+    }
+    /** Install the mapping and schedule periodic refresh. */
+    async start() {
+        if (this.started)
+            return;
+        this.started = true;
+        await this.installMapping();
+        this.scheduleRefresh();
+    }
+    /** Release the mapping and clear timers. Idempotent. */
+    async stop() {
+        if (!this.started)
+            return;
+        this.started = false;
+        if (this.refreshHandle) {
+            this.clearTimer(this.refreshHandle);
+            this.refreshHandle = null;
+        }
+        try {
+            await this.mapper.unmap(this.externalPort, this.protocol);
+        }
+        catch (err) {
+            log('unmap during stop failed: %s', err.message);
+        }
+        try {
+            await this.mapper.stop();
+        }
+        catch (err) {
+            log('mapper.stop() failed: %s', err.message);
+        }
+        this.state = {
+            ...this.state,
+            mode: 'disabled',
+            routerExternalIp: null,
+            leaseExpiresAt: null,
+        };
+    }
+    /** Force an immediate verify+refresh cycle (used by testReachability). */
+    async refresh() {
+        if (!this.started)
+            return this.getState();
+        const ok = await this.mapper.verify(this.externalPort, this.protocol).catch(() => false);
+        if (!ok) {
+            log('verify() returned false; re-mapping');
+            await this.installMapping();
+            return this.getState();
+        }
+        // Refresh: re-issue the mapping to extend the lease.
+        await this.installMapping();
+        return this.getState();
+    }
+    scheduleRefresh() {
+        if (this.refreshHandle)
+            this.clearTimer(this.refreshHandle);
+        this.refreshHandle = this.setTimer(() => {
+            void this.refresh().catch((err) => log('refresh timer error: %s', err.message));
+            // Re-arm after the call to avoid drift.
+            this.scheduleRefresh();
+        }, this.refreshMs);
+    }
+    async installMapping() {
+        try {
+            const r = await this.mapper.map({
+                externalPort: this.externalPort,
+                internalPort: this.internalPort,
+                protocol: this.protocol,
+                ttlMs: this.ttlMs,
+            });
+            this.state = {
+                mode: r.mode,
+                externalPort: r.externalPort,
+                internalPort: r.internalPort,
+                routerExternalIp: r.externalIp,
+                leaseExpiresAt: r.leaseExpiresAt,
+                lastError: null,
+            };
+            log('mapped port %d (mode=%s, externalIp=%s)', r.externalPort, r.mode, r.externalIp ?? '?');
+        }
+        catch (err) {
+            const message = err.message;
+            this.state = {
+                ...this.state,
+                mode: 'failed',
+                leaseExpiresAt: null,
+                lastError: message,
+            };
+            log('mapping failed: %s', message);
+        }
+    }
+}
+//# sourceMappingURL=port-mapper.js.map

package/dist/nat/port-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-mapper.js","sourceRoot":"","sources":["../../src/nat/port-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAwB,MAAM,YAAY,CAAC;AAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmDjD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAG1C,EAAE;IACJ,IAAI,GAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,8BAAwC,CAAC,CAAwB,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,kDAAmD,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB;YACpD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,IAAI,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB;IACxB,YACmB,MAA2B,EAC3B,YAAoB;QADpB,WAAM,GAAN,MAAM,CAAqB;QAC3B,iBAAY,GAAZ,YAAY,CAAQ;IACpC,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,IAAoB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACxC,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,yBAAyB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ;gBACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,mCAAmC,IAAI,CAAC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,UAAU;YACV,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ;YACR,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,WAA0B,KAAK;QAChE,KAAK,YAAY,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,mEAAmE;QACnE,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,yBAAyB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,WAA0B,KAAK;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,sBAAsB,EAAE,YAAY,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,mBAAmB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF;AA2BD;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IAe5B,YAAY,IAA8B;QAHlC,kBAAa,GAA0B,IAAI,CAAC;QAC5C,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,GAAG;YACX,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YACX,GAAG,IAAI,CAAC,KAAK;YACb,IAAI,EAAE,UAAU;YAChB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;QACD,qDAAqD;QACrD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACtC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,yBAAyB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3F,wCAAwC;YACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,GAAG;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,gBAAgB,EAAE,CAAC,CAAC,UAAU;gBAC9B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,SAAS,EAAE,IAAI;aAChB,CAAC;YACF,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;YACvC,IAAI,CAAC,KAAK,GAAG;gBACX,GAAG,IAAI,CAAC,KAAK;gBACb,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC;YACF,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF"}

package/dist/nat/reachability.d.ts

@@ -0,0 +1,19 @@
+import type { DirectReachability, PortForwardMode } from './types.js';
+export interface ReachabilityInput {
+    portMode: PortForwardMode;
+    cgnatDetected: boolean;
+}
+/**
+ * v1 reachability heuristic.
+ *
+ * Returns:
+ *   - 'cgnat' when CGNAT was detected (highest signal — UPnP succeeded but our
+ *     external IP isn't actually reachable from the open internet).
+ *   - 'unreachable' when port mapping failed.
+ *   - 'reachable' when an auto mapping succeeded.
+ *   - 'unknown' otherwise (manual config, disabled UPnP, etc).
+ *
+ * A future ticket will replace this with libp2p AutoNAT or a sereus-owned
+ * dial-back probe (see the follow-up section of `6.3-cadre-host-nat`).
+ */
+export declare function evaluateReachability(input: ReachabilityInput): DirectReachability;

package/dist/nat/reachability.js

@@ -0,0 +1,29 @@
+/**
+ * v1 reachability heuristic.
+ *
+ * Returns:
+ *   - 'cgnat' when CGNAT was detected (highest signal — UPnP succeeded but our
+ *     external IP isn't actually reachable from the open internet).
+ *   - 'unreachable' when port mapping failed.
+ *   - 'reachable' when an auto mapping succeeded.
+ *   - 'unknown' otherwise (manual config, disabled UPnP, etc).
+ *
+ * A future ticket will replace this with libp2p AutoNAT or a sereus-owned
+ * dial-back probe (see the follow-up section of `6.3-cadre-host-nat`).
+ */
+export function evaluateReachability(input) {
+    if (input.cgnatDetected)
+        return 'cgnat';
+    switch (input.portMode) {
+        case 'auto-upnp':
+        case 'auto-natpmp':
+            return 'reachable';
+        case 'failed':
+            return 'unreachable';
+        case 'manual':
+        case 'disabled':
+        default:
+            return 'unknown';
+    }
+}
+//# sourceMappingURL=reachability.js.map

package/dist/nat/reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.js","sourceRoot":"","sources":["../../src/nat/reachability.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC;IACxC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,WAAW,CAAC;QACjB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/nat/secrets/file-store.d.ts

@@ -0,0 +1,23 @@
+import type { SecretsStore } from './index.js';
+/**
+ * Filesystem fallback for `SecretsStore`. Writes to `<rootDir>/nat-secrets.json`
+ * with mode 0o600.
+ *
+ * This is NOT a substitute for the OS keychain — the file is plain JSON, only
+ * protected by POSIX permissions. We use it only when keytar is unavailable
+ * and the caller has been warned (see `createSecretsStore`).
+ *
+ * Windows: chmod is a no-op (mode bits don't apply), so the file is readable
+ * by any user on the same machine. This is documented.
+ */
+export declare class FileSecretsStore implements SecretsStore {
+    private readonly path;
+    constructor(rootDir: string);
+    filePath(): string;
+    set(account: string, value: string): Promise<void>;
+    get(account: string): Promise<string | null>;
+    delete(account: string): Promise<boolean>;
+    list(): Promise<string[]>;
+    private load;
+    private save;
+}

package/dist/nat/secrets/file-store.js

@@ -0,0 +1,102 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+import debug from 'debug';
+import { NatError } from '../types.js';
+const log = debug('cadre:host:nat-secrets:file');
+const FILE_VERSION = 1;
+/**
+ * Filesystem fallback for `SecretsStore`. Writes to `<rootDir>/nat-secrets.json`
+ * with mode 0o600.
+ *
+ * This is NOT a substitute for the OS keychain — the file is plain JSON, only
+ * protected by POSIX permissions. We use it only when keytar is unavailable
+ * and the caller has been warned (see `createSecretsStore`).
+ *
+ * Windows: chmod is a no-op (mode bits don't apply), so the file is readable
+ * by any user on the same machine. This is documented.
+ */
+export class FileSecretsStore {
+    constructor(rootDir) {
+        mkdirSync(rootDir, { recursive: true });
+        this.path = join(rootDir, 'nat-secrets.json');
+    }
+    filePath() {
+        return this.path;
+    }
+    async set(account, value) {
+        const data = this.load();
+        data.entries[account] = value;
+        this.save(data);
+    }
+    async get(account) {
+        const data = this.load();
+        return Object.prototype.hasOwnProperty.call(data.entries, account)
+            ? data.entries[account]
+            : null;
+    }
+    async delete(account) {
+        const data = this.load();
+        if (!Object.prototype.hasOwnProperty.call(data.entries, account))
+            return false;
+        delete data.entries[account];
+        this.save(data);
+        return true;
+    }
+    async list() {
+        return Object.keys(this.load().entries);
+    }
+    load() {
+        if (!existsSync(this.path)) {
+            return { version: FILE_VERSION, entries: {} };
+        }
+        let raw;
+        try {
+            raw = readFileSync(this.path, 'utf8');
+        }
+        catch (err) {
+            throw new NatError('storage_error', `failed to read nat-secrets file at ${this.path}: ${err.message}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            throw new NatError('storage_error', `nat-secrets file at ${this.path} is not valid JSON: ${err.message}`);
+        }
+        if (!isFileShape(parsed)) {
+            throw new NatError('storage_error', `nat-secrets file at ${this.path} has unexpected shape`);
+        }
+        return parsed;
+    }
+    save(data) {
+        mkdirSync(dirname(this.path), { recursive: true });
+        const payload = JSON.stringify({ ...data, version: FILE_VERSION }, null, 2);
+        const tmp = `${this.path}.tmp`;
+        writeFileSync(tmp, payload, { encoding: 'utf8', mode: 0o600 });
+        renameSync(tmp, this.path);
+        // chmod again after rename — some platforms reset perms on rename.
+        if (process.platform !== 'win32') {
+            try {
+                chmodSync(this.path, 0o600);
+            }
+            catch (err) {
+                log('chmod 0600 on %s failed: %s', this.path, err.message);
+            }
+        }
+    }
+}
+function isFileShape(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const obj = v;
+    if (obj.version !== FILE_VERSION)
+        return false;
+    if (!obj.entries || typeof obj.entries !== 'object')
+        return false;
+    for (const val of Object.values(obj.entries)) {
+        if (typeof val !== 'string')
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=file-store.js.map

package/dist/nat/secrets/file-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store.js","sourceRoot":"","sources":["../../../src/nat/secrets/file-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,CAAC,CAAC;AAQvB;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAG3B,YAAY,OAAe;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAChD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,KAAa;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAE;YACxB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,eAAe,EACf,sCAAsC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,eAAe,EACf,uBAAuB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAChB,eAAe,EACf,uBAAuB,IAAI,CAAC,IAAI,uBAAuB,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,IAAI,CAAC,IAAe;QAC1B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,mEAAmE;QACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,IAAI,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAkC,CAAC,EAAE,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nat/secrets/index.d.ts

@@ -0,0 +1,36 @@
+import { KeytarSecretsStore } from './keytar-store.js';
+import { FileSecretsStore } from './file-store.js';
+/** Service name used as the keytar collection. */
+export declare const KEYTAR_SERVICE = "sereus-cadre-host";
+/**
+ * Abstract credential store. Keys are opaque to the store
+ * (e.g. "ddns:duckdns:token").
+ */
+export interface SecretsStore {
+    set(account: string, value: string): Promise<void>;
+    get(account: string): Promise<string | null>;
+    delete(account: string): Promise<boolean>;
+    list(): Promise<string[]>;
+}
+export { KeytarSecretsStore, FileSecretsStore };
+/**
+ * Try the OS keychain (keytar) first; fall back to a 0600 JSON file in the
+ * cadre-host rootDir. The fallback path is documented in `docs/cadre-host.md`.
+ *
+ * `keytar` is loaded via dynamic import inside a try/catch so a missing native
+ * dependency never crashes package import. The same applies to runtime errors
+ * (some Linux desktops have keytar installed but no DBus secret service).
+ */
+export declare function createSecretsStore(rootDir: string): Promise<SecretsStore>;
+/** Subset of keytar's surface that KeytarSecretsStore uses. */
+export interface KeytarLike {
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    getPassword(service: string, account: string): Promise<string | null>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+    findCredentials(service: string): Promise<Array<{
+        account: string;
+        password: string;
+    }>>;
+}
+/** Build the keytar account key for a DDNS credential. */
+export declare function ddnsAccount(providerId: string, fieldKey: string): string;

package/dist/nat/secrets/index.js

@@ -0,0 +1,56 @@
+import debug from 'debug';
+import { NatError } from '../types.js';
+import { KeytarSecretsStore } from './keytar-store.js';
+import { FileSecretsStore } from './file-store.js';
+const log = debug('cadre:host:nat-secrets');
+/** Service name used as the keytar collection. */
+export const KEYTAR_SERVICE = 'sereus-cadre-host';
+export { KeytarSecretsStore, FileSecretsStore };
+/**
+ * Try the OS keychain (keytar) first; fall back to a 0600 JSON file in the
+ * cadre-host rootDir. The fallback path is documented in `docs/cadre-host.md`.
+ *
+ * `keytar` is loaded via dynamic import inside a try/catch so a missing native
+ * dependency never crashes package import. The same applies to runtime errors
+ * (some Linux desktops have keytar installed but no DBus secret service).
+ */
+export async function createSecretsStore(rootDir) {
+    // First, try to load keytar.
+    let keytarMod;
+    try {
+        keytarMod = await import('keytar');
+    }
+    catch (err) {
+        log('keytar unavailable (%s); using file fallback', err.message);
+        return makeFileFallback(rootDir, `keytar not installed: ${err.message}`);
+    }
+    // Probe with a sentinel write — some installs load but throw at runtime.
+    const ks = new KeytarSecretsStore(KEYTAR_SERVICE, keytarMod);
+    const probeAccount = '__cadre_host_probe__';
+    try {
+        await ks.set(probeAccount, '1');
+        await ks.delete(probeAccount);
+        log('using keytar for DDNS credentials (service=%s)', KEYTAR_SERVICE);
+        return ks;
+    }
+    catch (err) {
+        log('keytar probe failed (%s); using file fallback', err.message);
+        return makeFileFallback(rootDir, `keytar runtime error: ${err.message}`);
+    }
+}
+function makeFileFallback(rootDir, reason) {
+    const store = new FileSecretsStore(rootDir);
+    // eslint-disable-next-line no-console
+    console.warn(`[cadre-host] DDNS credentials will be stored UNENCRYPTED at ` +
+        `${store.filePath()} (${reason}). Install keytar's native dependencies ` +
+        `for OS keychain protection.`);
+    return store;
+}
+/** Build the keytar account key for a DDNS credential. */
+export function ddnsAccount(providerId, fieldKey) {
+    if (!providerId || !fieldKey) {
+        throw new NatError('invalid_config', 'providerId and fieldKey are required');
+    }
+    return `ddns:${providerId}:${fieldKey}`;
+}
+//# sourceMappingURL=index.js.map

package/dist/nat/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nat/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAalD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,6BAA6B;IAC7B,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO,gBAAgB,CAAC,OAAO,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,yEAAyE;IACzE,MAAM,EAAE,GAAG,IAAI,kBAAkB,CAAC,cAAc,EAAE,SAAuB,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,sBAAsB,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,gDAAgD,EAAE,cAAc,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,+CAA+C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC7E,OAAO,gBAAgB,CAAC,OAAO,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,8DAA8D;QAC9D,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,MAAM,0CAA0C;QACxE,6BAA6B,CAC9B,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,QAAgB;IAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,UAAU,IAAI,QAAQ,EAAE,CAAC;AAC1C,CAAC"}

package/dist/nat/secrets/keytar-store.d.ts

@@ -0,0 +1,18 @@
+import type { KeytarLike, SecretsStore } from './index.js';
+/**
+ * SecretsStore backed by the OS keychain via the `keytar` npm package.
+ *
+ * The keytar module is injected (rather than imported here) so:
+ *   - The native dependency is loaded lazily by `createSecretsStore` and
+ *     unavailable platforms fall through cleanly to the file store.
+ *   - Unit tests can stub the entire keytar surface.
+ */
+export declare class KeytarSecretsStore implements SecretsStore {
+    private readonly service;
+    private readonly keytar;
+    constructor(service: string, keytar: KeytarLike);
+    set(account: string, value: string): Promise<void>;
+    get(account: string): Promise<string | null>;
+    delete(account: string): Promise<boolean>;
+    list(): Promise<string[]>;
+}

package/dist/nat/secrets/keytar-store.js

@@ -0,0 +1,52 @@
+import debug from 'debug';
+import { NatError } from '../types.js';
+const log = debug('cadre:host:nat-secrets:keytar');
+/**
+ * SecretsStore backed by the OS keychain via the `keytar` npm package.
+ *
+ * The keytar module is injected (rather than imported here) so:
+ *   - The native dependency is loaded lazily by `createSecretsStore` and
+ *     unavailable platforms fall through cleanly to the file store.
+ *   - Unit tests can stub the entire keytar surface.
+ */
+export class KeytarSecretsStore {
+    constructor(service, keytar) {
+        this.service = service;
+        this.keytar = keytar;
+    }
+    async set(account, value) {
+        try {
+            await this.keytar.setPassword(this.service, account, value);
+        }
+        catch (err) {
+            throw new NatError('secrets_unavailable', `keytar setPassword failed: ${err.message}`);
+        }
+    }
+    async get(account) {
+        try {
+            return await this.keytar.getPassword(this.service, account);
+        }
+        catch (err) {
+            throw new NatError('secrets_unavailable', `keytar getPassword failed: ${err.message}`);
+        }
+    }
+    async delete(account) {
+        try {
+            return await this.keytar.deletePassword(this.service, account);
+        }
+        catch (err) {
+            throw new NatError('secrets_unavailable', `keytar deletePassword failed: ${err.message}`);
+        }
+    }
+    async list() {
+        try {
+            const creds = await this.keytar.findCredentials(this.service);
+            log('keytar findCredentials returned %d entries', creds.length);
+            return creds.map((c) => c.account);
+        }
+        catch (err) {
+            throw new NatError('secrets_unavailable', `keytar findCredentials failed: ${err.message}`);
+        }
+    }
+}
+//# sourceMappingURL=keytar-store.js.map

package/dist/nat/secrets/keytar-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keytar-store.js","sourceRoot":"","sources":["../../../src/nat/secrets/keytar-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,GAAG,GAAG,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAC7B,YACmB,OAAe,EACf,MAAkB;QADlB,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,KAAa;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,8BAA+B,GAAa,CAAC,OAAO,EAAE,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,8BAA+B,GAAa,CAAC,OAAO,EAAE,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,GAAG,CAAC,4CAA4C,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}