@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/web-device-login.d.ts

@@ -1,153 +0,0 @@
-export declare const DEVICE_LOGIN_TTL_MS: number;
-export declare const MAX_PENDING_DEVICE_LOGINS = 8;
-export declare const MAX_PENDING_PER_PEER = 2;
-/** Requests one address, and the whole fleet, may ask for per DEVICE_LOGIN_CREATE_WINDOW_MS. */
-export declare const DEVICE_LOGIN_CREATE_WINDOW_MS: number;
-export declare const DEVICE_LOGIN_CREATES_PER_PEER = 6;
-export declare const DEVICE_LOGIN_CREATES_GLOBAL = 20;
-/**
- * The approving side's breaker: this many wrong codes in the window pause it. Shorter than a request's life on purpose
- * (a pause that outlasted it would end every request waiting): ten tries per two minutes is still hopeless against a
- * 40-bit code among at most eight, and the person approving is already an owner-verified session.
- */
-export declare const DEVICE_APPROVE_WINDOW_MS: number;
-export declare const DEVICE_APPROVE_THRESHOLD = 10;
-export declare const DEVICE_APPROVE_PAUSE_MS: number;
-/** Where a request came from, for the approver: this computer, or somewhere on the network (LAN, tailnet). */
-export type DeviceLoginPeer = "host" | "network";
-export type DeviceLoginState = "pending" | "approved" | "denied";
-/** What the approving device may see of a request. */
-export interface DeviceLoginView {
-    /** As typed: `ABCD-EFGH`. */
-    readonly code: string;
-    readonly label: string;
-    readonly peer: DeviceLoginPeer;
-    readonly address: string;
-    readonly expiresAt: number;
-    readonly state: DeviceLoginState;
-}
-export type DeviceLoginCreate = {
-    readonly kind: "ok";
-    readonly requestId: string;
-    readonly code: string;
-    readonly expiresAt: number;
-}
-/** Too many asked for from this address, or the fleet over. */
- | {
-    readonly kind: "limited";
-    readonly retryAfterMs: number;
-}
-/** The room is full (or this address already has its share waiting). */
- | {
-    readonly kind: "full";
-};
-export type DeviceLoginPoll = {
-    readonly kind: "pending";
-    readonly expiresAt: number;
-}
-/** Approved, and now spent: the caller makes the session. Never returned twice for one request. */
- | {
-    readonly kind: "claimed";
-    readonly label: string;
-    readonly approvedBy: string;
-} | {
-    readonly kind: "denied";
-}
-/** Expired, spent, withdrawn, made under another token, or never made: deliberately indistinguishable. */
- | {
-    readonly kind: "expired";
-};
-export type DeviceLoginMatch = {
-    readonly kind: "ok";
-    readonly view: DeviceLoginView;
-}
-/** Wrong, expired, or none waiting: deliberately indistinguishable. */
- | {
-    readonly kind: "invalid";
-} | {
-    readonly kind: "paused";
-    readonly retryAfterMs: number;
-};
-export type DeviceLoginDecision = {
-    readonly kind: "ok";
-    readonly view: DeviceLoginView;
-} | {
-    readonly kind: "invalid";
-} | {
-    readonly kind: "paused";
-    readonly retryAfterMs: number;
-}
-/** The code was already approved or denied (and not yet taken up): what it is now. */
- | {
-    readonly kind: "decided";
-    readonly state: DeviceLoginState;
-};
-export interface DeviceLoginRequestsOptions {
-    readonly now?: () => number;
-    /** For tests that need a known code. */
-    readonly generate?: () => string;
-    readonly onEvent?: (event: "created" | "approved" | "denied" | "claimed" | "breaker-open") => void;
-}
-/**
- * The key the per-address limits count by. An IPv4 address (also one an IPv6 socket reports as `::ffff:a.b.c.d`) is its
- * own key. An IPv6 address counts by its /64: a single network hands one machine a whole /64, so keying by the full
- * address would give one host as many allowances as it has addresses. Whatever is not an IP address (`unknown`) is its
- * own key. Never read from a header: only the socket's peer.
- */
-export declare function peerKeyOf(address: string): string;
-export declare class DeviceLoginRequests {
-    private readonly entries;
-    private readonly createdByPeer;
-    private created;
-    private approveFailures;
-    private approvePausedUntil;
-    private readonly now;
-    private readonly generate;
-    private readonly onEvent;
-    constructor(opts?: DeviceLoginRequestsOptions);
-    /** How many requests are waiting (or approved and not yet taken up) — for tests and status lines. */
-    get size(): number;
-    /** How many addresses the creation rate limit is holding stamps for (for tests: it must not grow without bound). */
-    get rateTableSize(): number;
-    /**
-     * A new request. `replaces` is the request id the same browser held (its cookie): it is withdrawn first, so "get a
-     * new code" never counts against the room — but it does count against the rate. `label`, `peer` and `address` are
-     * the server's own reading of the request (never body input); they are what the approver is shown.
-     */
-    create(input: {
-        epoch: string;
-        peerKey: string;
-        label: string;
-        peer: DeviceLoginPeer;
-        address: string;
-        replaces?: string;
-    }): DeviceLoginCreate;
-    /**
-     * The new browser asks where its request stands. An approved one is spent by this very call (`claimed`): the caller
-     * then makes the session, and a second poll with the same id finds nothing. A denied one is told once and forgotten.
-     * An unknown, malformed, expired or other-token id is `expired` — the answer never says which.
-     */
-    poll(requestId: string | undefined, currentEpoch: string): DeviceLoginPoll;
-    /** The browser leaves the page (or asks again): its request is withdrawn. Whatever the id, nothing is said. */
-    cancel(requestId: string | undefined): void;
-    /** The approving side types a code: the request it names, for the confirm screen. A wrong code counts. */
-    lookup(input: string, currentEpoch: string): DeviceLoginMatch;
-    /**
-     * Approve or deny the request this code names. Only a pending one changes: one already decided says what it is now,
-     * so a second tap approves nothing twice. `by` is the approving session's handle (logged, never shown to the device).
-     */
-    decide(input: string, decision: "approved" | "denied", by: string, currentEpoch: string): DeviceLoginDecision;
-    /** `/dashboard revoke`: every request is withdrawn. */
-    revokeAll(): void;
-    /** How long the approving side stays paused by its breaker (0 when it is closed). */
-    approvePausedForMs(): number;
-    private codeTaken;
-    private match;
-    private prune;
-}
-export declare const DEVICE_LOGIN_COOKIE = "agend_device_login";
-export declare const DEVICE_LOGIN_PATH = "/auth/device-login";
-export declare function buildDeviceLoginCookie(requestId: string, secure: boolean, webToken: string, maxAgeSeconds: number): string;
-export declare function clearDeviceLoginCookie(secure: boolean, webToken: string): string;
-/** The request id this browser holds, if the cookie header carries a well-formed one. */
-export declare function readDeviceLoginCookie(cookieHeader: string | undefined, webToken: string): string | undefined;

package/dist/web-device-login.js

@@ -1,278 +0,0 @@
-/**
- * Device-code sign-in (Refs #3061, P2a): a new browser shows an 8-character code; a device that is already signed in AND
- * is this fleet's verified owner types that code under Settings → Access & security → Add device and approves it; the
- * new browser then signs itself in.
- *
- * What is kept here is only the requests — never a credential. Approval moves a request from `pending` to `approved`
- * and nothing else: no cookie, session id or token passes from the approving device to the new one. The new browser
- * mints its own session in its own request (auth-api `POST /auth/device-login/poll`), by presenting the request id it
- * was given when it asked. That id is 256 random bits, is never shown to the approver, and travels only in an HttpOnly
- * cookie scoped to /auth/device-login.
- *
- * The rules, each of them a property worth testing on its own:
- * - **Short-lived and single-use.** A request lives five minutes from when it was asked for — approving does not extend
- *   it — and the poll that claims an approved request spends it. A second claim, a second approval of the same code and
- *   a code that has expired are all refused.
- * - **Rotating the web token withdraws every request** (each carries the token epoch it was made under), as it does an
- *   unused login code. So does `/dashboard revoke` (`revokeAll`).
- * - **Bounded.** At most MAX_PENDING_DEVICE_LOGINS requests at once, MAX_PENDING_PER_PEER per address, and a limit on
- *   how many one address — and the fleet — may ask for in a window, so a stranger on the network cannot fill the room
- *   or run the fleet out of memory. A full room refuses new requests; it never evicts a waiting person's.
- * - **A breaker on the approving side.** Typing a code that matches no request is a wrong try; enough of them pause every
- *   lookup and decision, correct codes included. With no request waiting there is nothing to guess: it counts against
- *   nothing (as for login codes). The approving side is already an owner-verified session, so this guards against a
- *   mistake, a stolen owner session guessing at someone else's code, and a phishing line "read me the code".
- * - **The approver learns only what it needs to decide:** the device's label, whether it asked from this computer or the
- *   network, its address, and the time left. Never the request id.
- *
- * Deliberately knows nothing of HTTP, sessions or who the approver is: the caller has already decided that.
- * In memory only — a restart drops every request, as it does an unused login code.
- */
-import { createHash, randomBytes } from "node:crypto";
-import { isIPv4, isIPv6 } from "node:net";
-import { constantTimeMatches, formatOneTimeCode, generateOneTimeCode, normalizeOneTimeCode } from "./auth/one-time-code.js";
-import { fleetCookieName } from "./web-cookie-names.js";
-export const DEVICE_LOGIN_TTL_MS = 5 * 60 * 1000;
-export const MAX_PENDING_DEVICE_LOGINS = 8;
-export const MAX_PENDING_PER_PEER = 2;
-/** Requests one address, and the whole fleet, may ask for per DEVICE_LOGIN_CREATE_WINDOW_MS. */
-export const DEVICE_LOGIN_CREATE_WINDOW_MS = 10 * 60 * 1000;
-export const DEVICE_LOGIN_CREATES_PER_PEER = 6;
-export const DEVICE_LOGIN_CREATES_GLOBAL = 20;
-/**
- * The approving side's breaker: this many wrong codes in the window pause it. Shorter than a request's life on purpose
- * (a pause that outlasted it would end every request waiting): ten tries per two minutes is still hopeless against a
- * 40-bit code among at most eight, and the person approving is already an owner-verified session.
- */
-export const DEVICE_APPROVE_WINDOW_MS = 15 * 60 * 1000;
-export const DEVICE_APPROVE_THRESHOLD = 10;
-export const DEVICE_APPROVE_PAUSE_MS = 2 * 60 * 1000;
-/** Compared against when nothing waits, so "no request" costs what "wrong code" costs. */
-const NO_REQUEST_PLACEHOLDER = "AAAAAAAA";
-/**
- * The key the per-address limits count by. An IPv4 address (also one an IPv6 socket reports as `::ffff:a.b.c.d`) is its
- * own key. An IPv6 address counts by its /64: a single network hands one machine a whole /64, so keying by the full
- * address would give one host as many allowances as it has addresses. Whatever is not an IP address (`unknown`) is its
- * own key. Never read from a header: only the socket's peer.
- */
-export function peerKeyOf(address) {
-    const a = address.replace(/%.*$/, "").toLowerCase(); // a zone id (fe80::1%eth0) is not part of the address
-    const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(a);
-    if (dotted)
-        return dotted[1];
-    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(a);
-    if (hex) {
-        const hi = parseInt(hex[1], 16), lo = parseInt(hex[2], 16);
-        return `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
-    }
-    if (isIPv4(a) || !isIPv6(a))
-        return a;
-    const halves = a.split("::");
-    const groups = (part) => (part ? part.split(":").flatMap(g => {
-        if (!g.includes("."))
-            return [g];
-        const [b0, b1, b2, b3] = g.split(".").map(Number); // an embedded IPv4 is two groups
-        return [((b0 << 8) | b1).toString(16), ((b2 << 8) | b3).toString(16)];
-    }) : []);
-    const head = groups(halves[0]), tail = halves.length > 1 ? groups(halves[1]) : [];
-    const all = halves.length > 1 ? [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill("0"), ...tail] : head;
-    return `${all.slice(0, 4).map(g => parseInt(g || "0", 16).toString(16)).join(":")}::/64`;
-}
-/** The key a request id is kept under: its hash, so the map never holds what the new browser presents. */
-function keyOf(requestId) {
-    return createHash("sha256").update(`agend-device-login-v1:${requestId}`).digest("hex");
-}
-const REQUEST_ID = /^[0-9a-f]{64}$/;
-export class DeviceLoginRequests {
-    entries = new Map();
-    createdByPeer = new Map();
-    created = [];
-    approveFailures = [];
-    approvePausedUntil = 0;
-    now;
-    generate;
-    onEvent;
-    constructor(opts = {}) {
-        this.now = opts.now ?? (() => Date.now());
-        this.generate = opts.generate ?? generateOneTimeCode;
-        this.onEvent = opts.onEvent ?? (() => { });
-    }
-    /** How many requests are waiting (or approved and not yet taken up) — for tests and status lines. */
-    get size() { this.prune(); return this.entries.size; }
-    /** How many addresses the creation rate limit is holding stamps for (for tests: it must not grow without bound). */
-    get rateTableSize() { return this.createdByPeer.size; }
-    /**
-     * A new request. `replaces` is the request id the same browser held (its cookie): it is withdrawn first, so "get a
-     * new code" never counts against the room — but it does count against the rate. `label`, `peer` and `address` are
-     * the server's own reading of the request (never body input); they are what the approver is shown.
-     */
-    create(input) {
-        const now = this.now();
-        this.prune();
-        if (input.replaces && REQUEST_ID.test(input.replaces))
-            this.entries.delete(keyOf(input.replaces));
-        const cutoff = now - DEVICE_LOGIN_CREATE_WINDOW_MS;
-        this.created = this.created.filter(t => t > cutoff);
-        // The whole per-address table, not just this address: one whose every stamp is out of the window is forgotten, so
-        // addresses seen once never pile up (the table holds at most what the window admitted — DEVICE_LOGIN_CREATES_GLOBAL).
-        for (const [key, stamps] of this.createdByPeer) {
-            const live = stamps.filter(t => t > cutoff);
-            if (live.length)
-                this.createdByPeer.set(key, live);
-            else
-                this.createdByPeer.delete(key);
-        }
-        const mine = this.createdByPeer.get(input.peerKey) ?? [];
-        if (mine.length >= DEVICE_LOGIN_CREATES_PER_PEER)
-            return { kind: "limited", retryAfterMs: Math.max(1000, mine[0] + DEVICE_LOGIN_CREATE_WINDOW_MS - now) };
-        if (this.created.length >= DEVICE_LOGIN_CREATES_GLOBAL)
-            return { kind: "limited", retryAfterMs: Math.max(1000, this.created[0] + DEVICE_LOGIN_CREATE_WINDOW_MS - now) };
-        let waitingHere = 0;
-        for (const e of this.entries.values())
-            if (e.peerKey === input.peerKey)
-                waitingHere++;
-        if (this.entries.size >= MAX_PENDING_DEVICE_LOGINS || waitingHere >= MAX_PENDING_PER_PEER)
-            return { kind: "full" };
-        // A code no other waiting request has (the room is eight; a clash is a one-in-a-trillion retry).
-        let code = this.generate();
-        for (let n = 0; n < 16 && this.codeTaken(code); n++)
-            code = this.generate();
-        if (this.codeTaken(code))
-            return { kind: "full" };
-        const requestId = randomBytes(32).toString("hex");
-        const expiresAt = now + DEVICE_LOGIN_TTL_MS;
-        this.entries.set(keyOf(requestId), { code, label: input.label, peer: input.peer, address: input.address, peerKey: input.peerKey,
-            epoch: input.epoch, createdAt: now, expiresAt, state: "pending" });
-        this.created.push(now);
-        this.createdByPeer.set(input.peerKey, [...mine, now]);
-        this.onEvent("created");
-        return { kind: "ok", requestId, code: formatOneTimeCode(code), expiresAt };
-    }
-    /**
-     * The new browser asks where its request stands. An approved one is spent by this very call (`claimed`): the caller
-     * then makes the session, and a second poll with the same id finds nothing. A denied one is told once and forgotten.
-     * An unknown, malformed, expired or other-token id is `expired` — the answer never says which.
-     */
-    poll(requestId, currentEpoch) {
-        if (!requestId || !REQUEST_ID.test(requestId))
-            return { kind: "expired" };
-        this.prune();
-        const key = keyOf(requestId), e = this.entries.get(key);
-        if (!e)
-            return { kind: "expired" };
-        if (e.epoch !== currentEpoch) {
-            this.entries.delete(key);
-            return { kind: "expired" };
-        }
-        if (e.state === "pending")
-            return { kind: "pending", expiresAt: e.expiresAt };
-        this.entries.delete(key);
-        if (e.state === "denied")
-            return { kind: "denied" };
-        this.onEvent("claimed");
-        return { kind: "claimed", label: e.label, approvedBy: e.decidedBy ?? "" };
-    }
-    /** The browser leaves the page (or asks again): its request is withdrawn. Whatever the id, nothing is said. */
-    cancel(requestId) {
-        if (requestId && REQUEST_ID.test(requestId))
-            this.entries.delete(keyOf(requestId));
-    }
-    /** The approving side types a code: the request it names, for the confirm screen. A wrong code counts. */
-    lookup(input, currentEpoch) {
-        const m = this.match(input, currentEpoch);
-        return m.kind === "found" ? { kind: "ok", view: viewOf(m.entry) } : m;
-    }
-    /**
-     * Approve or deny the request this code names. Only a pending one changes: one already decided says what it is now,
-     * so a second tap approves nothing twice. `by` is the approving session's handle (logged, never shown to the device).
-     */
-    decide(input, decision, by, currentEpoch) {
-        const m = this.match(input, currentEpoch);
-        if (m.kind !== "found")
-            return m;
-        const e = m.entry;
-        if (e.state !== "pending")
-            return { kind: "decided", state: e.state };
-        e.state = decision;
-        e.decidedBy = by;
-        this.onEvent(decision === "approved" ? "approved" : "denied");
-        return { kind: "ok", view: viewOf(e) };
-    }
-    /** `/dashboard revoke`: every request is withdrawn. */
-    revokeAll() { this.entries.clear(); }
-    /** How long the approving side stays paused by its breaker (0 when it is closed). */
-    approvePausedForMs() { return Math.max(0, this.approvePausedUntil - this.now()); }
-    codeTaken(code) {
-        for (const e of this.entries.values())
-            if (e.code === code)
-                return true;
-        return false;
-    }
-    match(input, currentEpoch) {
-        const now = this.now();
-        if (now < this.approvePausedUntil)
-            return { kind: "paused", retryAfterMs: this.approvePausedUntil - now };
-        const provided = normalizeOneTimeCode(input);
-        // Nothing typed is not a guess; it costs nothing.
-        if (!provided)
-            return { kind: "invalid" };
-        this.prune();
-        for (const [key, e] of this.entries)
-            if (e.epoch !== currentEpoch)
-                this.entries.delete(key); // the token was rotated
-        if (!this.entries.size) {
-            constantTimeMatches(provided, NO_REQUEST_PLACEHOLDER);
-            return { kind: "invalid" };
-        }
-        // Every waiting code is compared, in constant time each: where the match is does not show in the time taken.
-        let hit = null;
-        for (const e of this.entries.values())
-            if (constantTimeMatches(provided, e.code))
-                hit = e;
-        if (hit)
-            return { kind: "found", entry: hit };
-        this.approveFailures = this.approveFailures.filter(t => t > now - DEVICE_APPROVE_WINDOW_MS);
-        this.approveFailures.push(now);
-        if (this.approveFailures.length >= DEVICE_APPROVE_THRESHOLD) {
-            this.approvePausedUntil = now + DEVICE_APPROVE_PAUSE_MS;
-            this.approveFailures = [];
-            this.onEvent("breaker-open");
-        }
-        return { kind: "invalid" };
-    }
-    prune() {
-        const now = this.now();
-        for (const [key, e] of this.entries)
-            if (now >= e.expiresAt)
-                this.entries.delete(key);
-    }
-}
-function viewOf(e) {
-    return { code: formatOneTimeCode(e.code), label: e.label, peer: e.peer, address: e.address, expiresAt: e.expiresAt, state: e.state };
-}
-// ── The new browser's one cookie: the request id, HttpOnly, and sent only to /auth/device-login ──
-export const DEVICE_LOGIN_COOKIE = "agend_device_login";
-export const DEVICE_LOGIN_PATH = "/auth/device-login";
-export function buildDeviceLoginCookie(requestId, secure, webToken, maxAgeSeconds) {
-    return [`${fleetCookieName(DEVICE_LOGIN_COOKIE, webToken)}=${requestId}`, `Path=${DEVICE_LOGIN_PATH}`, "HttpOnly", "SameSite=Strict",
-        `Max-Age=${Math.max(0, Math.floor(maxAgeSeconds))}`, ...(secure ? ["Secure"] : [])].join("; ");
-}
-export function clearDeviceLoginCookie(secure, webToken) {
-    return buildDeviceLoginCookie("", secure, webToken, 0);
-}
-/** The request id this browser holds, if the cookie header carries a well-formed one. */
-export function readDeviceLoginCookie(cookieHeader, webToken) {
-    if (!cookieHeader)
-        return undefined;
-    const name = fleetCookieName(DEVICE_LOGIN_COOKIE, webToken);
-    for (const part of cookieHeader.split(";")) {
-        const at = part.indexOf("=");
-        if (at < 0 || part.slice(0, at).trim() !== name)
-            continue;
-        const value = part.slice(at + 1).trim();
-        if (REQUEST_ID.test(value))
-            return value;
-    }
-    return undefined;
-}
-//# sourceMappingURL=web-device-login.js.map

package/dist/web-device-login.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-device-login.js","sourceRoot":"","sources":["../src/web-device-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC5H,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,gGAAgG;AAChG,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAgE1C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAuB,sDAAsD;IACjI,MAAM,MAAM,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,GAAG,EAAE,CAAC;QAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;IAAC,CAAC;IAClI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACzF,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC,CAAK,iCAAiC;QAC5H,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClI,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC3F,CAAC;AAED,0GAA0G;AAC1G,SAAS,KAAK,CAAC,SAAiB;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,MAAM,OAAO,mBAAmB;IACb,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IACrD,OAAO,GAAa,EAAE,CAAC;IACvB,eAAe,GAAa,EAAE,CAAC;IAC/B,kBAAkB,GAAG,CAAC,CAAC;IACd,GAAG,CAAe;IAClB,QAAQ,CAAe;IACvB,OAAO,CAAkF;IAE1G,YAAY,IAAI,GAA+B,EAAE;QAC/C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,qGAAqG;IACrG,IAAI,IAAI,KAAa,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9D,oHAAoH;IACpH,IAAI,aAAa,KAAa,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D;;;;OAIG;IACH,MAAM,CAAC,KAAmH;QACxH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,GAAG,GAAG,6BAA6B,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACpD,kHAAkH;QAClH,sHAAsH;QACtH,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;gBAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,IAAI,6BAA6B;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,GAAG,6BAA6B,GAAG,GAAG,CAAC,EAAE,CAAC;QAC3J,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,2BAA2B;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,6BAA6B,GAAG,GAAG,CAAC,EAAE,CAAC;QACzK,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,WAAW,EAAE,CAAC;QACtF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,yBAAyB,IAAI,WAAW,IAAI,oBAAoB;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAEnH,iGAAiG;QACjG,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,GAAG,GAAG,mBAAmB,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YAC7H,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,SAA6B,EAAE,YAAoB;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,CAAC;QACvF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,SAA6B;QAClC,IAAI,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,0GAA0G;IAC1G,MAAM,CAAC,KAAa,EAAE,YAAoB;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa,EAAE,QAA+B,EAAE,EAAU,EAAE,YAAoB;QACrF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACtE,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,SAAS,KAAW,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE3C,qFAAqF;IACrF,kBAAkB,KAAa,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAElF,SAAS,CAAC,IAAY;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,KAAa,EAAE,YAAoB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,GAAG,GAAG,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC7C,kDAAkD;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAO,wBAAwB;QAC3H,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,6GAA6G;QAC7G,IAAI,GAAG,GAAiB,IAAI,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAE,GAAG,GAAG,CAAC,CAAC;QAC1F,IAAI,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,wBAAwB,CAAC,CAAC;QAC5F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC5D,IAAI,CAAC,kBAAkB,GAAG,GAAG,GAAG,uBAAuB,CAAC;YACxD,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxF,CAAC;CACF;AAED,SAAS,MAAM,CAAC,CAAQ;IACtB,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACvI,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAe,EAAE,QAAgB,EAAE,aAAqB;IAChH,OAAO,CAAC,GAAG,eAAe,CAAC,mBAAmB,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,EAAE,QAAQ,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB;QAClI,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe,EAAE,QAAgB;IACtE,OAAO,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,YAAgC,EAAE,QAAgB;IACtF,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,eAAe,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/web-remote-access.d.ts

@@ -1,152 +0,0 @@
-import type { LoginCodeOwner } from "./web-login.js";
-export declare const WEB_REMOTE_ACCESS_FILE = "web-remote-access.json";
-/** RFC 6238 as every common authenticator app shows it: SHA-1, 6 digits, 30-second steps. */
-export declare const TOTP_STEP_SECONDS = 30;
-export declare const TOTP_DIGITS = 6;
-/**
- * Steps accepted around now: one either side (#3008 C, the leader: this host is WSL2, whose clock drifts behind after
- * Windows sleeps — accepting only the current and previous code would refuse the phone's newest one).
- */
-export declare const TOTP_PAST_STEPS = 1;
-export declare const TOTP_FUTURE_STEPS = 1;
-/** Diagnosis only (#3008 C): a wrong code is also compared this many steps out, to log how far this clock is off. */
-export declare const TOTP_SKEW_PROBE_STEPS = 2;
-/** 5 wrong codes → a wait. */
-export declare const TOTP_WRONG_LIMIT = 5;
-/** The first wait; #3008 C(b): each further one doubles, up to TOTP_PAUSE_MAX_MS. A correct code resets it. */
-export declare const TOTP_PAUSE_MS: number;
-export declare const TOTP_PAUSE_MAX_MS: number;
-/** #3008 review (Prism P2 1): a state that could not be saved is written again this often until it is. */
-export declare const OUTSIDE_SAVE_RETRY_MS = 30000;
-/** How long a secret being set up waits for its first code. */
-export declare const TOTP_ENROLL_TTL_MS: number;
-export declare function base32Encode(bytes: Uint8Array): string;
-export declare function base32Decode(text: string): Buffer | null;
-/** RFC 4226 HOTP: the code for one counter, as `digits` decimal digits (left-padded). */
-export declare function hotp(secret: Uint8Array, counter: number, digits?: number): string;
-/** The RFC 6238 time step a wall-clock moment falls in. */
-export declare function totpStep(nowMs: number): number;
-/**
- * The step `code` is valid for — the current one or one within the accepted window, newer than `after` — or null. Six
- * digits only (spaces ignored); compared in constant time.
- */
-export declare function matchTotp(secret: Uint8Array, code: string, nowMs: number, after: number): number | null;
-/**
- * Diagnosis only, never acceptance: for a code that did not match, the step offset (beyond the accepted window, at most
- * TOTP_SKEW_PROBE_STEPS out) it would have matched — positive: the phone is ahead of this computer's clock. Else null.
- */
-export declare function totpSkew(secret: Uint8Array, code: string, nowMs: number): number | null;
-/** The `otpauth://` URI an authenticator app reads from the QR code (or the key typed in by hand). */
-export declare function otpauthUri(secretBase32: string, account: string): string;
-/** How many sessions from outside one generation remembers (each is a sign-in with a code; older ones read as revoked). */
-export declare const OUTSIDE_HANDLES_MAX = 64;
-export type TotpVerdict = {
-    kind: "ok";
-}
-/** `skewSteps`: the code would have matched that many steps out — this computer's clock is likely off (logged). */
- | {
-    kind: "wrong";
-    paused: false;
-    skewSteps: number | null;
-}
-/** This wrong code started a wait (a Notice says so): the `wrong` codes that led to it. */
- | {
-    kind: "wrong";
-    paused: true;
-    retryAfterMs: number;
-    wrong: number;
-    skewSteps: number | null;
-} | {
-    kind: "paused";
-    retryAfterMs: number;
-} | {
-    kind: "not_enrolled";
-}
-/** Right, but the step it used could not be saved: refused (else a restart would let it be used again). */
- | {
-    kind: "unavailable";
-};
-export interface RemoteAccessStatus {
-    enrolled: boolean;
-    enrolledAt: number | null;
-    outside: boolean;
-    /** A wait in force now (ms left), else 0. */
-    pausedForMs: number;
-}
-export declare class WebRemoteAccess {
-    private readonly path;
-    private readonly log;
-    private readonly now;
-    private readonly monotonic;
-    private state;
-    private pending;
-    private warned;
-    /** The state in memory is not on disk yet (a write failed): written again, by the next change or the retry timer. */
-    private dirty;
-    private retry;
-    constructor(path: string, log: {
-        warn(obj: object, msg?: string): void;
-    }, now?: () => number, monotonic?: () => number);
-    status(): RemoteAccessStatus;
-    get enrolled(): boolean;
-    /** The sessions authorized from outside since the last revocation (their receipts hold). */
-    get admitted(): ReadonlySet<string>;
-    /**
-     * A session just signed in from outside: its handle is saved as admitted before it is authorized. False: not saved —
-     * the sign-in must not go on (a restart would not know it, and the next revocation could not be proven to end it).
-     */
-    admit(handle: string): boolean;
-    /** Undo a change whose write failed, keeping whatever was already owed to the disk before it (#3015 review r3, P2 1). */
-    private restore;
-    get outside(): boolean;
-    /**
-     * A new secret for the session `handle` to set up (it replaces nothing until confirmEnrollment). Returned once: the
-     * caller shows it to that session and forgets it.
-     */
-    beginEnrollment(handle: string, account: string): {
-        secret: string;
-        uri: string;
-        expiresInMs: number;
-    };
-    /**
-     * The first code from the app being set up, by the session that began it. "ok": it is now the one (a previous one is
-     * replaced; the limiter starts afresh). The caller then ends the sessions signed in with the old one.
-     */
-    confirmEnrollment(handle: string, code: string): "ok" | "wrong" | "expired" | "unsaved";
-    /**
-     * Forget the app; the outside switch goes off with it, and what was authorized from outside ends (handles). In force in
-     * memory at once; false: not saved yet (retried — a restart before that would read the old file).
-     */
-    remove(): boolean;
-    /**
-     * The switch. On only with an app set up. Off ends what was authorized from outside (handles). "unsaved": in force in
-     * memory, not on disk yet (retried; asking again writes it again).
-     */
-    setOutside(on: boolean): "ok" | "not_enrolled" | "unsaved";
-    /** A code typed at sign-in from outside. Each step is accepted once; wrong codes count toward a wait. */
-    verify(code: string): TotpVerdict;
-    /**
-     * Saved: true. Not saved: false (warned once until it works again) — memory keeps the new state, and it is written
-     * again by the next change or every OUTSIDE_SAVE_RETRY_MS until it is (#3008 review, Prism P2 1).
-     */
-    private flush;
-    /** Whether the state in memory is still waiting to be saved. */
-    get unsaved(): boolean;
-    /** Fleet stop: one last write of an unsaved state, then no timer left. */
-    close(): void;
-}
-/**
- * #3008: whose the outside link is — this computer's admin, not a chat account. Never matches a chat owner (those carry
- * a live adapter binding); FleetManager.publicOwnerCurrent permits it only while the switch is on, on a web-only fleet.
- */
-export declare const OUTSIDE_LINK_OWNER: LoginCodeOwner;
-export declare function isOutsideLinkOwner(owner: LoginCodeOwner): boolean;
-/** #3008 B: a dropped link is reopened twice at most — after 30 s, then 2 minutes. */
-export declare const OUTSIDE_LINK_RETRY_MS: readonly number[];
-/** Closes the switch itself made (or the fleet stopping, or its own failed start): nothing to reopen or announce. */
-export declare const OUTSIDE_OWN_CLOSES: ReadonlySet<string>;
-export declare function outsideTimer(fn: () => void, ms: number): {
-    cancel(): void;
-};
-/** A wait as words: "15 minutes" / 「15 分鐘」, "2 hours" / 「2 小時」 (whole minutes under an hour, else whole hours, rounded up). */
-export declare function outsideDuration(ms: number): string;