@temporalabs/treasury 0.1.1 → 0.1.2

package/dist/connect/gate.js

@@ -0,0 +1,115 @@
+/**
+ * The hard gate every call passes before a page opens: what `treasury connect` will put in front of
+ * the operator's wallet at all. It re-derives everything from the calldata and the registry and
+ * trusts nothing the call's own fields say about themselves (`description`, `args`, `function`).
+ *
+ * Allowed, and nothing else:
+ *   - `approve(vault, n)` on a registry vault's own asset, for exactly the amount the deposit after
+ *     it pulls — never unlimited, never to anything but that vault;
+ *   - `deposit(assets, receiver)` on a registry vault, receiver = the connected account;
+ *   - `withdraw(assets, receiver, owner)` / `redeem(shares, receiver, owner)` on a registry vault,
+ *     receiver = owner = the connected account.
+ * Every call carries no value and names a supported chain that matches its vault.
+ *
+ * And one batch is one operation on one vault, on one chain, in one of the shapes the builders
+ * emit: `[approve, deposit]`, `[withdraw]` or `[redeem]`. Calldata must be exactly the canonical
+ * encoding of what it decodes to: no trailing bytes, no stray bits in an address word.
+ *
+ * This is the rule of AGENTS.md / CONTRIBUTING.md that the relay refuses any destination outside
+ * the registry, made executable. Paying an address other than the
+ * connected account is refused here on purpose: that is what the prepare commands are for, with the
+ * operator's own signer.
+ */
+import { decodeFunctionData, encodeFunctionData, getAddress } from "viem";
+import { erc4626Abi } from "../abi/erc4626.js";
+import { isSupportedChainId } from "../client.js";
+import { listVaults } from "../registry.js";
+/** Anything at or above this is an "unlimited" approval, which the gate never admits. */
+const UNLIMITED = 2n ** 128n;
+const same = (a, b) => getAddress(a) === getAddress(b);
+/** The only batches the builders emit; anything else is refused whole. */
+const SHAPES = new Set(["approve,deposit", "withdraw", "redeem"]);
+export function admit(calls, account) {
+    if (calls.length === 0)
+        throw new Error("refused: there is nothing to confirm");
+    // The page switches the wallet to one chain for the whole batch, so a batch never spans two.
+    if (calls.some((c) => c.chainId !== calls[0].chainId))
+        throw new Error("refused: the calls are on more than one chain");
+    const vaults = listVaults();
+    const out = [];
+    calls.forEach((c, i) => {
+        const at = `call ${i + 1} of ${calls.length}`;
+        if (!isSupportedChainId(c.chainId))
+            throw new Error(`refused (${at}): chain ${c.chainId} is not supported`);
+        if (BigInt(c.value) !== 0n)
+            throw new Error(`refused (${at}): it attaches native value, which no vault call needs`);
+        let decoded;
+        try {
+            decoded = decodeFunctionData({ abi: erc4626Abi, data: c.data });
+        }
+        catch {
+            throw new Error(`refused (${at}): its calldata is not an approve, deposit, withdraw or redeem`);
+        }
+        const name = decoded.functionName;
+        const args = (decoded.args ?? []);
+        // Decoding forgives trailing bytes and keeps only the low 20 bytes of an address word; the
+        // wallet would sign the bytes as sent. Admit only calldata that is its own canonical encoding.
+        const canonical = encodeFunctionData({ abi: erc4626Abi, functionName: name, args });
+        if (canonical !== c.data)
+            throw new Error(`refused (${at}): its calldata is not the canonical encoding of ${name} (trailing bytes, stray bits in an address, or hex not in lowercase)`);
+        if (name === "approve") {
+            const vault = vaults.find((v) => v.chainId === c.chainId && same(v.asset.address, c.to));
+            if (!vault)
+                throw new Error(`refused (${at}): approve on ${c.to}, which is not the asset of a listed vault on chain ${c.chainId}`);
+            const [spender, value] = args;
+            const target = vaults.find((v) => v.chainId === c.chainId && same(v.address, spender) && same(v.asset.address, c.to));
+            if (!target)
+                throw new Error(`refused (${at}): the approval goes to ${spender}, not to a listed vault for this asset`);
+            if (value === 0n)
+                throw new Error(`refused (${at}): an approval of 0`);
+            if (value >= UNLIMITED)
+                throw new Error(`refused (${at}): an unlimited approval`);
+            out.push({ kind: "approve", vault: target, amount: value });
+            return;
+        }
+        const vault = vaults.find((v) => v.chainId === c.chainId && same(v.address, c.to));
+        if (!vault)
+            throw new Error(`refused (${at}): ${c.to} is not a listed vault on chain ${c.chainId}`);
+        if (name === "deposit") {
+            const [assets, receiver] = args;
+            if (assets === 0n)
+                throw new Error(`refused (${at}): a deposit of 0`);
+            if (!same(receiver, account))
+                throw new Error(`refused (${at}): the shares would go to ${receiver}, not the connected account ${account}`);
+            out.push({ kind: "deposit", vault, amount: assets });
+            return;
+        }
+        if (name === "withdraw" || name === "redeem") {
+            const [amount, receiver, owner] = args;
+            if (amount === 0n)
+                throw new Error(`refused (${at}): a ${name} of 0`);
+            if (!same(receiver, account))
+                throw new Error(`refused (${at}): the funds would go to ${receiver}, not the connected account ${account}`);
+            if (!same(owner, account))
+                throw new Error(`refused (${at}): it burns the shares of ${owner}, not the connected account ${account}`);
+            out.push({ kind: name, vault, amount });
+            return;
+        }
+        throw new Error(`refused (${at}): ${name} is not something this page hands to a wallet`);
+    });
+    // An approval only ever precedes the deposit it pays for: same vault, same amount, next call.
+    out.forEach((a, i) => {
+        if (a.kind !== "approve")
+            return;
+        const next = out[i + 1];
+        if (!next || next.kind !== "deposit" || next.vault.address !== a.vault.address || next.amount !== a.amount) {
+            throw new Error(`refused (call ${i + 1}): an approval must be followed by a deposit of exactly that amount into the same vault`);
+        }
+    });
+    const shape = out.map((a) => a.kind).join(",");
+    // With the pairing above, these shapes also mean one vault per batch.
+    if (!SHAPES.has(shape))
+        throw new Error(`refused: ${shape} is not a batch this page confirms (only approve+deposit, withdraw, or redeem)`);
+    return out;
+}
+//# sourceMappingURL=gate.js.map

package/dist/connect/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/connect/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,UAAU,EAA0B,MAAM,MAAM,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAiB5C,yFAAyF;AACzF,MAAM,SAAS,GAAG,EAAE,IAAI,IAAI,CAAC;AAE7B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,KAAK,CAAC,KAAiB,EAAE,OAAgB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChF,6FAA6F;IAC7F,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC5G,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,wDAAwD,CAAC,CAAC;QACpH,IAAI,OAAiE,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,gEAAgE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACxD,2FAA2F;QAC3F,+FAA+F;QAC/F,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAA8C,CAAC,CAAC;QAChI,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,oDAAoD,IAAI,sEAAsE,CAAC,CAAC;QAExL,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,EAAE,uDAAuD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACnI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAyB,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtH,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,2BAA2B,OAAO,wCAAwC,CAAC,CAAC;YACvH,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YACvE,IAAI,KAAK,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,IAAyB,CAAC;YACrD,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,6BAA6B,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;YAC3I,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAkC,CAAC;YACrE,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,4BAA4B,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;YAC1I,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,6BAA6B,KAAK,+BAA+B,OAAO,EAAE,CAAC,CAAC;YACrI,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,+CAA+C,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACnI,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,gFAAgF,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/connect/http.d.ts

@@ -0,0 +1,54 @@
+export type Accepted<T> = {
+    ok: true;
+    final: true;
+    value: T;
+    reply?: Record<string, unknown>;
+} | {
+    ok: true;
+    final: false;
+    reply?: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+    fatal?: boolean;
+};
+export type Settled<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface Flow<T> {
+    mode: "connect" | "confirm";
+    ttlMs: number;
+    /** The page served at `/<mode>`, as a function of the flow's secret. */
+    html: (secret: string) => string;
+    csp: string;
+    /** Static assets served at their path. */
+    assets: Record<string, {
+        type: string;
+        body: string | Buffer;
+    }>;
+    info: () => Record<string, unknown>;
+    challenge?: (address: string, origin: string, nonce: string) => string;
+    accept: (body: Record<string, unknown>, ctx: {
+        nonce: string;
+        origin: string;
+        message?: string;
+        challengedAddress?: string;
+    }) => Promise<Accepted<T>>;
+    /** Called with the page's body when it reports a rejection, before the flow ends. */
+    onReject?: (body: Record<string, unknown>) => void;
+    /** Why the flow ended when the time limit ran out; the default says nothing happened. */
+    timeoutReason?: () => string;
+    /** Overrides the cancel grace period (tests). */
+    cancelGraceMs?: number;
+    port: number;
+}
+export interface Handle<T> {
+    url: string;
+    done: Promise<Settled<T>>;
+    close: () => void;
+}
+export declare function serveOnce<T>(flow: Flow<T>): Promise<Handle<T>>;

package/dist/connect/http.js

@@ -0,0 +1,205 @@
+/**
+ * A one-shot localhost server: it exists for one sign-in or one confirmation, answers only requests
+ * that carry its random secret, its own Host and (for POSTs) its own Origin, and closes itself once
+ * the flow settles or times out.
+ *
+ * The page talks back by POSTing to `/challenge` (sign-in only) and `/result`. A `/result` handler
+ * may answer "not yet" (`final: false`) to keep the flow open — the confirm flow uses that to take
+ * one transaction at a time — and anything it refuses with `fatal` ends the flow at once.
+ */
+import http from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { getAddress, isAddress } from "viem";
+const MAX_BODY_BYTES = 16 * 1024;
+/** How long a cancel waits for a result already being checked, so it can carry that verdict. */
+const CANCEL_GRACE_MS = 30_000;
+const same = (a, b) => {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+};
+export async function serveOnce(flow) {
+    const secret = randomBytes(24).toString("hex");
+    // Privy matches allowed origins by exact string, and `localhost` is the host it documents.
+    const origin = `http://localhost:${flow.port}`;
+    let settled = false;
+    let busy = false;
+    /** A cancel or timeout that arrived while a result was being checked; applied once the check ends. */
+    let deferred;
+    const expiresAt = Date.now() + flow.ttlMs;
+    let resolveDone;
+    const done = new Promise((r) => (resolveDone = r));
+    let issued;
+    const json = (res, code, body) => {
+        res.writeHead(code, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff" });
+        res.end(JSON.stringify(body));
+    };
+    const readBody = (req) => new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error("body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => {
+            try {
+                const v = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                if (v === null || typeof v !== "object" || Array.isArray(v))
+                    throw new Error("not an object");
+                resolve(v);
+            }
+            catch {
+                reject(new Error("body is not a JSON object"));
+            }
+        });
+        req.on("error", reject);
+    });
+    const onRequest = (req, res) => {
+        void (async () => {
+            try {
+                if (String(req.headers.host ?? "") !== new URL(origin).host)
+                    return json(res, 403, { ok: false, reason: "bad host" });
+                const url = new URL(req.url ?? "/", origin);
+                if (req.method === "GET") {
+                    if (!same(url.searchParams.get("s") ?? "", secret))
+                        return json(res, 404, { ok: false, reason: "not found" });
+                    if (url.pathname === "/info") {
+                        if (settled)
+                            return json(res, 410, { ok: false, reason: "already finished" });
+                        return json(res, 200, { ...flow.info(), msLeft: Math.max(0, expiresAt - Date.now()) });
+                    }
+                    if (url.pathname === `/${flow.mode}`) {
+                        res.writeHead(200, {
+                            "content-type": "text/html; charset=utf-8",
+                            "cache-control": "no-store",
+                            "referrer-policy": "no-referrer",
+                            "content-security-policy": flow.csp,
+                            "x-content-type-options": "nosniff",
+                        });
+                        return res.end(flow.html(secret));
+                    }
+                    const asset = flow.assets[url.pathname];
+                    if (asset) {
+                        res.writeHead(200, { "content-type": asset.type, "cache-control": "no-store", "x-content-type-options": "nosniff" });
+                        return res.end(asset.body);
+                    }
+                    return json(res, 404, { ok: false, reason: "not found" });
+                }
+                if (req.method === "POST" && (url.pathname === "/challenge" || url.pathname === "/result")) {
+                    if (req.headers.origin !== origin)
+                        return json(res, 403, { ok: false, reason: "bad origin" });
+                    if (!String(req.headers["content-type"] ?? "").startsWith("application/json"))
+                        return json(res, 415, { ok: false, reason: "expected JSON" });
+                    if (settled)
+                        return json(res, 409, { ok: false, reason: "already finished" });
+                    const body = await readBody(req);
+                    if (typeof body["s"] !== "string" || !same(body["s"], secret))
+                        return json(res, 404, { ok: false, reason: "not found" });
+                    if (url.pathname === "/challenge") {
+                        if (!flow.challenge)
+                            return json(res, 404, { ok: false, reason: "not found" });
+                        const a = body["address"];
+                        if (typeof a !== "string" || !isAddress(a))
+                            return json(res, 400, { ok: false, reason: "not an address" });
+                        const address = getAddress(a);
+                        const message = flow.challenge(address, origin, secret);
+                        issued = { address, message };
+                        return json(res, 200, { ok: true, message });
+                    }
+                    if (body["rejected"] === true) {
+                        const reason = typeof body["reason"] === "string" ? body["reason"].slice(0, 300) : "declined in the browser";
+                        flow.onReject?.(body);
+                        finishWhenIdle({ ok: false, reason });
+                        return json(res, 200, { ok: true });
+                    }
+                    // One result at a time: a double click must never hand the same call over twice.
+                    if (busy)
+                        return json(res, 409, { ok: false, reason: "already in progress" });
+                    busy = true;
+                    try {
+                        const r = await flow.accept(body, { nonce: secret, origin, ...(issued ? { message: issued.message, challengedAddress: issued.address } : {}) });
+                        if (!r.ok) {
+                            if (r.fatal)
+                                finish({ ok: false, reason: r.reason });
+                            return json(res, 400, { ok: false, reason: r.reason });
+                        }
+                        if (r.final)
+                            finish({ ok: true, value: r.value });
+                        return json(res, 200, { ok: true, ...r.reply });
+                    }
+                    finally {
+                        busy = false;
+                        if (deferred)
+                            finish(deferred);
+                    }
+                }
+                return json(res, 405, { ok: false, reason: "method not allowed" });
+            }
+            catch (e) {
+                return json(res, 400, { ok: false, reason: e instanceof Error ? e.message : "bad request" });
+            }
+        })();
+    };
+    // `localhost` can resolve to either loopback address, so both are held: a browser that tries
+    // `::1` first must reach this server, never another process waiting on that address.
+    const servers = [http.createServer(onRequest), http.createServer(onRequest)];
+    const closeAll = () => {
+        for (const s of servers) {
+            s.close();
+            s.closeAllConnections();
+        }
+    };
+    const finish = (r) => {
+        if (settled)
+            return;
+        settled = true;
+        resolveDone(r);
+        // A short grace period lets the page receive its last answer before the socket closes.
+        setTimeout(closeAll, 1500).unref();
+    };
+    /**
+     * A cancel that arrives while a result is being checked waits for that check, so the command can
+     * report its verdict — but never longer than the grace period. The time limit does not wait: the
+     * transaction is already on record (`unverified`), and the command must return inside it.
+     */
+    const finishWhenIdle = (r) => {
+        if (!busy)
+            return finish(r);
+        if (deferred)
+            return;
+        deferred = r;
+        setTimeout(() => finish(r), flow.cancelGraceMs ?? CANCEL_GRACE_MS).unref();
+    };
+    const listen = (server, host, optional) => new Promise((resolve, reject) => {
+        server.once("error", (e) => {
+            if (e.code === "EADDRINUSE") {
+                return reject(new Error(`port ${flow.port} is in use on ${host} — another sign-in or confirmation page is probably still open; finish or close it, then retry`));
+            }
+            // A machine with IPv6 switched off has no `::1` for anyone to wait on.
+            if (optional && (e.code === "EADDRNOTAVAIL" || e.code === "EAFNOSUPPORT"))
+                return resolve();
+            reject(e);
+        });
+        server.listen({ port: flow.port, host, ipv6Only: host === "::1" }, () => resolve());
+    });
+    try {
+        await listen(servers[0], "127.0.0.1", false);
+        await listen(servers[1], "::1", true);
+    }
+    catch (e) {
+        closeAll();
+        throw e;
+    }
+    const timer = setTimeout(
+    // A cancel still waiting on a check is the operator's reason; it wins over the clock.
+    () => finish(deferred ?? { ok: false, reason: flow.timeoutReason?.() ?? `nothing happened in the browser within ${Math.round(flow.ttlMs / 60_000)} minutes` }), flow.ttlMs);
+    timer.unref();
+    void done.then(() => clearTimeout(timer));
+    return { url: `${origin}/${flow.mode}?s=${secret}`, done, close: () => finish({ ok: false, reason: "cancelled" }) };
+}
+//# sourceMappingURL=http.js.map

package/dist/connect/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/connect/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE7C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,gGAAgG;AAChG,MAAM,eAAe,GAAG,MAAM,CAAC;AAkC/B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,IAAa;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,2FAA2F;IAC3F,MAAM,MAAM,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,sGAAsG;IACtG,IAAI,QAAgC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1C,IAAI,WAAqC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAwD,CAAC;IAE7D,MAAM,IAAI,GAAG,CAAC,GAAwB,EAAE,IAAY,EAAE,IAAa,EAAE,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9H,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,GAAyB,EAAE,EAAE,CAC7C,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;gBACxE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC9F,OAAO,CAAC,CAA4B,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,MAAM,SAAS,GAAG,CAAC,GAAyB,EAAE,GAAwB,EAAE,EAAE;QACxE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACtH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;gBAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC9G,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;wBAC7B,IAAI,OAAO;4BAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzF,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;wBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,0BAA0B;4BAC1C,eAAe,EAAE,UAAU;4BAC3B,iBAAiB,EAAE,aAAa;4BAChC,yBAAyB,EAAE,IAAI,CAAC,GAAG;4BACnC,wBAAwB,EAAE,SAAS;yBACpC,CAAC,CAAC;wBACH,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACxC,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;wBACrH,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7B,CAAC;oBACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;oBAC3F,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC7I,IAAI,OAAO;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC9E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;oBAEzH,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;wBAClC,IAAI,CAAC,IAAI,CAAC,SAAS;4BAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;wBAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;4BAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBAC3G,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;wBACxD,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;wBAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC/C,CAAC;oBAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;wBAC9B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;wBAC7G,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;wBACtB,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtC,CAAC;oBACD,iFAAiF;oBACjF,IAAI,IAAI;wBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBAC9E,IAAI,GAAG,IAAI,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;wBAChJ,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;4BACV,IAAI,CAAC,CAAC,KAAK;gCAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;4BACrD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzD,CAAC;wBACD,IAAI,CAAC,CAAC,KAAK;4BAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;wBAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClD,CAAC;4BAAS,CAAC;wBACT,IAAI,GAAG,KAAK,CAAC;wBACb,IAAI,QAAQ;4BAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,6FAA6F;IAC7F,qFAAqF;IACrF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAU,CAAC;IACtF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,CAAa,EAAE,EAAE;QAC/B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,uFAAuF;QACvF,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC,CAAC;IACF;;;;OAIG;IACH,MAAM,cAAc,GAAG,CAAC,CAAa,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,CAAC,CAAC;QACb,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAE,IAAY,EAAE,QAAiB,EAAE,EAAE,CACtE,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAwB,EAAE,EAAE;YAChD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,iBAAiB,IAAI,gGAAgG,CAAC,CAAC,CAAC;YACnK,CAAC;YACD,uEAAuE;YACvE,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAC;YAC5F,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;QACX,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,UAAU;IACtB,sFAAsF;IACtF,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,0CAA0C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,EAC9J,IAAI,CAAC,KAAK,CACX,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,MAAM,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACtH,CAAC"}

package/dist/connect/open.d.ts

@@ -0,0 +1,2 @@
+export declare function canOpenBrowser(): boolean;
+export declare function openBrowser(url: string): boolean;

package/dist/connect/open.js

@@ -0,0 +1,35 @@
+/**
+ * Opens a URL in the operator's browser. Refuses — returning false, so the caller prints the URL
+ * instead — when there is evidently no browser to open: over SSH, on Linux with no display, or when
+ * `TREASURY_CONNECT_NO_OPEN` is set.
+ */
+import { spawn } from "node:child_process";
+import { noOpen } from "./config.js";
+export function canOpenBrowser() {
+    if (noOpen())
+        return false;
+    if (process.env["SSH_CONNECTION"] || process.env["SSH_TTY"])
+        return false;
+    if (process.platform === "linux" && !process.env["DISPLAY"] && !process.env["WAYLAND_DISPLAY"])
+        return false;
+    return true;
+}
+export function openBrowser(url) {
+    if (!canOpenBrowser())
+        return false;
+    try {
+        // One literal program per platform: the boundary test pins what this file may start.
+        const child = process.platform === "darwin"
+            ? spawn("open", [url], { stdio: "ignore", detached: true })
+            : process.platform === "win32"
+                ? spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true })
+                : spawn("xdg-open", [url], { stdio: "ignore", detached: true });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=open.js.map

package/dist/connect/open.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.js","sourceRoot":"","sources":["../../src/connect/open.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAM,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,qFAAqF;QACrF,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7E,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/connect/page.d.ts

@@ -0,0 +1,5 @@
+/** Privy's own hosts: its auth and embedded-wallet iframe, its RPC, and the Cloudflare check it uses. */
+export declare const PAGE_CSP: string;
+export declare function readPageBundle(): Buffer;
+/** The HTML shell. `secret` authorises every request the page makes back to this process. */
+export declare function shell(secret: string, title: string): string;

package/dist/connect/page.js

@@ -0,0 +1,69 @@
+/**
+ * The page shell both flows serve, and the browser bundle it loads.
+ *
+ * The bundle (`dist/connect-page.js`) is the React + Privy page built from `connect-page/` — one
+ * Connect button, one Privy modal, and the confirm view. It sits beside the CLI bundle at runtime,
+ * so it is found next to this module once bundled, and at `../../dist/` when run from source.
+ *
+ * The shell carries the visual tokens (temporalabs.com's palette) so the page is styled before the
+ * bundle runs, and a CSP that admits what Privy's modal needs (scripts and connections by host; images from any HTTPS host).
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+/** Privy's own hosts: its auth and embedded-wallet iframe, its RPC, and the Cloudflare check it uses. */
+export const PAGE_CSP = [
+    "default-src 'self'",
+    "script-src 'self' https://challenges.cloudflare.com",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob: https:",
+    "font-src 'self' data:",
+    "object-src 'none'",
+    "base-uri 'self'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+    "child-src https://auth.privy.io",
+    "frame-src https://auth.privy.io https://challenges.cloudflare.com",
+    "connect-src 'self' https://auth.privy.io https://*.rpc.privy.systems",
+    "worker-src 'self'",
+    "manifest-src 'self'",
+].join("; ");
+const here = pathToFileURL(realpathSync(fileURLToPath(import.meta.url)));
+export function readPageBundle() {
+    for (const rel of ["./connect-page.js", "../../dist/connect-page.js"]) {
+        try {
+            return readFileSync(new URL(rel, here));
+        }
+        catch {
+            // try the next layout
+        }
+    }
+    throw new Error("the connect page is not built (dist/connect-page.js is missing) — run `npm ci && npm run build` in connect-page/");
+}
+/** The HTML shell. `secret` authorises every request the page makes back to this process. */
+export function shell(secret, title) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>
+  :root { --ink:#22303F; --navy:#1E3553; --navy-700:#2A456A; --steel:#465569; --slate:#5F6B7B; --paper:#FFFFFF; --ground:#F3F6F9;
+    --hair:rgba(34,48,63,.12); --blue:#76A6D5; --lavender:#B9A7D6; --grey:#B2B2B2; --ok:#2E8B57; --bad:#B4362A; --warn:#8A5A00; }
+  html,body { margin:0; min-height:100%; color:var(--ink); font:15px/1.55 Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif; -webkit-font-smoothing:antialiased; }
+  body { background:
+    radial-gradient(ellipse 48% 60% at 72% 60%, rgba(255,255,255,.9), rgba(255,255,255,0) 72%),
+    radial-gradient(ellipse 60% 75% at 0% 0%, rgba(118,166,213,.16), rgba(118,166,213,0) 70%),
+    radial-gradient(ellipse 55% 65% at 100% 100%, rgba(185,167,214,.17), rgba(185,167,214,0) 70%),
+    linear-gradient(90deg, #e9f1f9 0%, #eff1f6 50%, #efecf6 100%); min-height:100vh; }
+  :focus-visible { outline:2px solid #266cad; outline-offset:2px; }
+</style>
+</head>
+<body>
+<div id="root"></div>
+<script src="/app.js?s=${secret}"></script>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=page.js.map

package/dist/connect/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/connect/page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,yGAAyG;AACzG,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,oBAAoB;IACpB,qDAAqD;IACrD,kCAAkC;IAClC,mCAAmC;IACnC,uBAAuB;IACvB,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,iCAAiC;IACjC,mEAAmE;IACnE,sEAAsE;IACtE,mBAAmB;IACnB,qBAAqB;CACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEzE,MAAM,UAAU,cAAc;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;AACtI,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,KAAa;IACjD,OAAO;;;;;SAKA,KAAK;;;;;;;;;;;;;;;yBAeW,MAAM;;;CAG9B,CAAC;AACF,CAAC"}

package/dist/connect/session.d.ts

@@ -0,0 +1,16 @@
+import type { PendingAck } from "./ack.js";
+export interface Session {
+    account: string;
+    /** `external`: a browser wallet the operator controls. `embedded`: a Privy wallet opened by email or a social login. */
+    walletType: "external" | "embedded";
+    connectedAtIso: string;
+}
+export declare const sessionPath: () => string;
+export declare function readSession(): Session | undefined;
+export declare function writeSession(s: Session): void;
+export declare function clearSession(): boolean;
+/** The one acknowledgement waiting for `--ack` (`ack.ts`). Issuing another replaces it. */
+export declare const pendingAckPath: () => string;
+export declare function writePendingAck(a: PendingAck): void;
+export declare function readPendingAck(): PendingAck | undefined;
+export declare function clearPendingAck(): void;

package/dist/connect/session.js

@@ -0,0 +1,73 @@
+/**
+ * The connected account, remembered between commands in a small file readable only by its owner
+ * (`~/.config/treasury/connect-session.json`, mode 0600; `TREASURY_CONNECT_HOME` moves it).
+ *
+ * It holds no credential: an address, how it signed in, and when. Being "connected" grants nothing
+ * by itself — every transaction is still confirmed by the operator in the browser and in their
+ * wallet — it only fixes WHICH account the confirm page will accept and pay.
+ */
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { getAddress, isAddress } from "viem";
+import { connectHome } from "./config.js";
+const dir = () => connectHome() ?? join(homedir(), ".config", "treasury");
+export const sessionPath = () => join(dir(), "connect-session.json");
+export function readSession() {
+    let raw;
+    try {
+        raw = readFileSync(sessionPath(), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const v = JSON.parse(raw);
+        if (typeof v.account !== "string" || !isAddress(v.account))
+            return undefined;
+        if (v.walletType !== "external" && v.walletType !== "embedded")
+            return undefined;
+        return { account: getAddress(v.account), walletType: v.walletType, connectedAtIso: String(v.connectedAtIso ?? "") };
+    }
+    catch {
+        // A file that does not parse is no session, never a guessed one.
+        return undefined;
+    }
+}
+function writeOwnerOnly(path, value) {
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    // `mode` applies only when the file is created; an existing file keeps its own.
+    chmodSync(path, 0o600);
+}
+export function writeSession(s) {
+    writeOwnerOnly(sessionPath(), s);
+    // A new connection voids any acknowledgement given for the one before it.
+    clearPendingAck();
+}
+export function clearSession() {
+    const had = readSession() !== undefined;
+    rmSync(sessionPath(), { force: true });
+    clearPendingAck();
+    return had;
+}
+/** The one acknowledgement waiting for `--ack` (`ack.ts`). Issuing another replaces it. */
+export const pendingAckPath = () => join(dir(), "connect-ack.json");
+export function writePendingAck(a) {
+    writeOwnerOnly(pendingAckPath(), a);
+}
+export function readPendingAck() {
+    try {
+        const v = JSON.parse(readFileSync(pendingAckPath(), "utf8"));
+        if (typeof v.code !== "string" || typeof v.digest !== "string" || typeof v.issuedAtIso !== "string" || typeof v.expiresAtIso !== "string")
+            return undefined;
+        return { code: v.code, digest: v.digest, issuedAtIso: v.issuedAtIso, expiresAtIso: v.expiresAtIso };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function clearPendingAck() {
+    rmSync(pendingAckPath(), { force: true });
+}
+//# sourceMappingURL=session.js.map

package/dist/connect/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/connect/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAErE,MAAM,UAAU,WAAW;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,gFAAgF;IAChF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACjC,0EAA0E;IAC1E,eAAe,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,KAAK,SAAS,CAAC;IACxC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAEpE,MAAM,UAAU,eAAe,CAAC,CAAa;IAC3C,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAwB,CAAC;QACpF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5J,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC"}