@threadbase-sh/streamer 1.62.0 → 1.64.0

package/dist/feature-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.d.ts","sourceRoot":"","sources":["../src/feature-flags.ts"],"names":[],"mappings":"AAkBA,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,8EAA8E;IAC9E,EAAE,EAAE,aAAa,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;iBAEtB,WAAW;iBAIX,OAAO;iBACP,GAAG,EAAE,wCAAwC;;;iBAG7C,WAAW;iBAIX,OAAO;iBACP,GAAG,EAAE,wCAAwC;;;iBAG7C,WAAW;iBAMX,OAAO;iBACP,GAAG,EAAE,uCAAuC;;;iBAG5C,WAAW;iBAKX,OAAO;iBACP,GAAG,EAAE,yBAAyB;;;iBAG9B,WAAW;iBAGX,OAAO;iBACP,GAAG,EAAE,6BAA6B;;CAEc,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,aAAa,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAiC,aAAa,EAAE,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,qBAAqB,EAG3D,CAAC;AAEJ,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,aAAa,CAE/D;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,CAAC,SAAS,aAAa,EAAE,EAAE,EAAE,CAAC;;;;iBAhFzD,WAAW;iBAIX,OAAO;iBACP,GAAG,EAAE,wCAAwC;;;iBAG7C,WAAW;iBAIX,OAAO;iBACP,GAAG,EAAE,wCAAwC;;;iBAG7C,WAAW;iBAMX,OAAO;iBACP,GAAG,EAAE,uCAAuC;;;iBAG5C,WAAW;iBAKX,OAAO;iBACP,GAAG,EAAE,yBAAyB;;;iBAG9B,WAAW;iBAGX,OAAO;iBACP,GAAG,EAAE,6BAA6B;;KA2CrC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAG7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAK5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,CAwBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG;IACvD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAgCA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE;IACzC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,qBAAqB,CAqBxB;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,aAAa,EAAE,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CAI9E"}

package/dist/handlers/handleListProjects.d.ts

@@ -0,0 +1,3 @@
+import type { ServerResponse } from "http";
+export declare function handleListProjects(url: URL, res: ServerResponse): void;
+//# sourceMappingURL=handleListProjects.d.ts.map

package/dist/handlers/handleListProjects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleListProjects.d.ts","sourceRoot":"","sources":["../../src/handlers/handleListProjects.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AA4D3C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAqCtE"}

package/dist/index.cjs

@@ -11579,6 +11579,55 @@ function parseE2eeRequest(raw) {
   return { version: v, message1 };
 }
 
+// src/e2ee/pair-payload.ts
+var MAX_DEVICE_NAME_CHARS = 100;
+function parseE2eeMsg1Payload(payload) {
+  let raw;
+  try {
+    raw = JSON.parse(payload.toString("utf-8"));
+  } catch {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee message 1 payload is not valid JSON");
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee message 1 payload must be an object");
+  }
+  const { v, deviceName, readOnly } = raw;
+  if (typeof v !== "number" || !Number.isInteger(v)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee message 1 payload v must be an integer");
+  }
+  if (v !== E2EE_EXCHANGE_VERSION) {
+    throw new E2eeRequestError(
+      "E2EE_VERSION_UNSUPPORTED",
+      `e2ee message 1 payload v ${v} is not supported; this server speaks ${E2EE_EXCHANGE_VERSION}`
+    );
+  }
+  if (typeof readOnly !== "boolean") {
+    throw new E2eeRequestError(
+      "E2EE_MALFORMED",
+      "e2ee message 1 payload readOnly must be a boolean"
+    );
+  }
+  if (deviceName !== void 0 && deviceName !== null && typeof deviceName !== "string") {
+    throw new E2eeRequestError(
+      "E2EE_MALFORMED",
+      "e2ee message 1 payload deviceName must be a string when present"
+    );
+  }
+  return {
+    version: v,
+    deviceName: typeof deviceName === "string" ? deviceName.slice(0, MAX_DEVICE_NAME_CHARS) : null,
+    readOnly
+  };
+}
+function encodeE2eeMsg2Payload(fields) {
+  const payload = {
+    v: E2EE_EXCHANGE_VERSION,
+    ...fields,
+    e2eeRequired: true
+  };
+  return Buffer.from(JSON.stringify(payload), "utf-8");
+}
+
 // src/external-tails.ts
 var import_fs16 = require("fs");
 var EXTERNAL_TAIL_RECENCY_MS = RESUME_BUSY_WINDOW_MS;
@@ -16687,6 +16736,7 @@ var StreamerServer = class {
       return;
     }
     let handshake = null;
+    let registration = null;
     if (e2eeRequest) {
       try {
         handshake = readMessage1({
@@ -16704,6 +16754,13 @@ var StreamerServer = class {
         });
         return;
       }
+      try {
+        registration = parseE2eeMsg1Payload(handshake.payload);
+      } catch (err) {
+        const e = err;
+        json(res, 400, { error: e.message, code: e.code });
+        return;
+      }
     }
     let sealed;
     try {
@@ -16726,8 +16783,9 @@ var StreamerServer = class {
     });
     let device = null;
     try {
-      const name = typeof body?.deviceName === "string" ? body.deviceName.slice(0, 100) : null;
-      const preset = body?.readOnly === true ? "read-only" : "full";
+      const name = registration ? registration.deviceName : typeof body?.deviceName === "string" ? body.deviceName.slice(0, 100) : null;
+      const readOnly = registration ? registration.readOnly : body?.readOnly === true;
+      const preset = readOnly ? "read-only" : "full";
       device = this.devicesRepo?.register({
         publicKey: clientPublicKey,
         name,
@@ -16750,23 +16808,34 @@ var StreamerServer = class {
         err
       });
     }
+    if (handshake && !device) {
+      this.log.error("[pair] E2EE pairing failed: the device could not be registered", {
+        event: "pair.e2ee_registration_failed",
+        ip
+      });
+      json(res, 500, {
+        error: "Pairing failed: this server could not register the device. Scan a fresh pairing code and try again.",
+        code: "E2EE_REGISTRATION_FAILED"
+      });
+      return;
+    }
     let e2eeResponse = null;
-    if (handshake) {
+    if (handshake && device) {
       try {
         const { message2 } = writeMessage2(
           handshake,
-          Buffer.from(
-            JSON.stringify({
-              v: E2EE_EXCHANGE_VERSION,
-              deviceId: device?.deviceId ?? null,
-              serverVersion: getVersion(),
-              // Always true on this path: completing a handshake is what pins
-              // the device, and design.md §6.3 says nothing a client sends
-              // ever clears it.
-              e2eeRequired: true
-            }),
-            "utf-8"
-          )
+          // Every result a new client persists or presents as verified, so it
+          // never has to trust the outer, unauthenticated copy of a credential.
+          // The outer response still carries those copies for released builds;
+          // this is what the new client actually reads.
+          encodeE2eeMsg2Payload({
+            deviceId: device.deviceId,
+            deviceToken: device.deviceToken,
+            capabilities: device.capabilities,
+            publicUrl: this.publicUrl,
+            machineName: (0, import_os14.hostname)(),
+            serverVersion: getVersion()
+          })
         );
         e2eeResponse = { v: E2EE_EXCHANGE_VERSION, noise: message2.toString("base64") };
       } catch (err) {