@xrkseek/harness-cli 0.1.3 → 0.1.5

package/node_modules/@xrkseek/server-http/dist/dsh-compat/mobile-access-auth.js

@@ -0,0 +1,349 @@
+/**
+ * dsh-mobile pairing / device session auth (cookie + token digests).
+ */
+import { createHash, randomBytes, timingSafeEqual, } from "node:crypto";
+export const DEVICE_COOKIE = "dsh_ma_device";
+export const SESSION_COOKIE = "dsh_ma_session";
+export const CSRF_COOKIE = "dsh_ma_csrf";
+export const CSRF_HEADER = "x-dsh-mobile-csrf";
+export const LAN_PIN_COOKIE = "dsh_ma_lan";
+export const WAN_PIN_COOKIE = "dsh_ma_wan";
+const DEVICE_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+const SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+const MAX_DEVICES = 32;
+function digestHex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function opaqueToken() {
+    return randomBytes(32).toString("base64url");
+}
+function normalizeLabel(label) {
+    const trimmed = (label ?? "Mobile device").trim();
+    return trimmed.slice(0, 64) || "Mobile device";
+}
+function cookie(name, value, options) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${options.path}`,
+        `Max-Age=${String(Math.max(0, Math.floor(options.maxAgeSeconds)))}`,
+        "SameSite=Strict",
+    ];
+    if (options.tls)
+        parts.push("Secure");
+    if (options.httpOnly)
+        parts.push("HttpOnly");
+    return parts.join("; ");
+}
+export function mintPairingWindow(ttlMs = 300_000) {
+    return {
+        token: opaqueToken(),
+        expiresAt: Date.now() + ttlMs,
+    };
+}
+export function pruneMobileAuth(state, now = Date.now()) {
+    return {
+        ...state,
+        devices: state.devices.filter((d) => !d.revokedAt && d.expiresAt > now),
+        sessions: state.sessions.filter((s) => s.expiresAt > now),
+        pairingToken: state.pairingExpiresAt > now ? state.pairingToken : "",
+        pairingExpiresAt: state.pairingExpiresAt > now ? state.pairingExpiresAt : 0,
+    };
+}
+export function pairDevice(state, token, label, now = Date.now()) {
+    const pruned = pruneMobileAuth(state, now);
+    if (!pruned.pairingToken ||
+        pruned.pairingExpiresAt <= now ||
+        token !== pruned.pairingToken) {
+        throw new Error("authentication_failed");
+    }
+    if (pruned.devices.length >= MAX_DEVICES) {
+        throw new Error("device_limit");
+    }
+    const deviceToken = opaqueToken();
+    const sessionToken = opaqueToken();
+    const csrfToken = opaqueToken();
+    const deviceId = randomBytes(16).toString("hex");
+    const deviceExpiresAt = now + DEVICE_TTL_MS;
+    const sessionExpiresAt = now + SESSION_TTL_MS;
+    const device = {
+        id: deviceId,
+        label: normalizeLabel(label),
+        tokenDigest: digestHex(deviceToken),
+        createdAt: now,
+        expiresAt: deviceExpiresAt,
+        lastSeenAt: now,
+    };
+    const session = {
+        key: digestHex(sessionToken),
+        deviceId,
+        csrfDigest: digestHex(csrfToken),
+        createdAt: now,
+        expiresAt: sessionExpiresAt,
+    };
+    return {
+        state: {
+            pairingToken: "",
+            pairingExpiresAt: 0,
+            devices: [...pruned.devices, device],
+            sessions: [...pruned.sessions, session],
+        },
+        deviceToken,
+        sessionToken,
+        csrfToken,
+        deviceId,
+        deviceExpiresAt,
+        sessionExpiresAt,
+    };
+}
+export function renewSession(state, deviceToken, now = Date.now()) {
+    const pruned = pruneMobileAuth(state, now);
+    const digest = digestHex(deviceToken);
+    const device = pruned.devices.find((d) => {
+        try {
+            return timingSafeEqual(Buffer.from(d.tokenDigest, "hex"), Buffer.from(digest, "hex"));
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!device)
+        throw new Error("authentication_failed");
+    const sessionToken = opaqueToken();
+    const csrfToken = opaqueToken();
+    const sessionExpiresAt = now + SESSION_TTL_MS;
+    const session = {
+        key: digestHex(sessionToken),
+        deviceId: device.id,
+        csrfDigest: digestHex(csrfToken),
+        createdAt: now,
+        expiresAt: sessionExpiresAt,
+    };
+    const devices = pruned.devices.map((d) => d.id === device.id ? { ...d, lastSeenAt: now } : d);
+    return {
+        state: {
+            ...pruned,
+            devices,
+            sessions: [
+                ...pruned.sessions.filter((s) => s.deviceId !== device.id),
+                session,
+            ],
+        },
+        sessionToken,
+        csrfToken,
+        sessionExpiresAt,
+    };
+}
+export function setMobileSessionCookies(res, tokens, tls = false) {
+    const now = Date.now();
+    res.setHeader("set-cookie", [
+        cookie(DEVICE_COOKIE, tokens.deviceToken, {
+            path: "/mobile-access/auth/renew",
+            maxAgeSeconds: Math.floor((tokens.deviceExpiresAt - now) / 1000),
+            httpOnly: true,
+            tls,
+        }),
+        cookie(SESSION_COOKIE, tokens.sessionToken, {
+            path: "/",
+            maxAgeSeconds: Math.floor((tokens.sessionExpiresAt - now) / 1000),
+            httpOnly: true,
+            tls,
+        }),
+        cookie(CSRF_COOKIE, tokens.csrfToken, {
+            path: "/",
+            maxAgeSeconds: Math.floor((tokens.sessionExpiresAt - now) / 1000),
+            httpOnly: true,
+            tls,
+        }),
+    ]);
+}
+export function parseCookieHeader(header, name) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(";")) {
+        const [k, ...rest] = part.trim().split("=");
+        if (k === name)
+            return decodeURIComponent(rest.join("="));
+    }
+    return undefined;
+}
+const ACCESS_PIN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export function accessPinCookieDigest(pin, instanceId) {
+    return digestHex(`access-pin:${instanceId}:${pin}`);
+}
+export function verifyAccessPinCookie(cookieValue, pin, instanceId) {
+    if (!cookieValue || !pin || !instanceId)
+        return false;
+    const expected = accessPinCookieDigest(pin, instanceId);
+    try {
+        return timingSafeEqual(Buffer.from(cookieValue), Buffer.from(expected));
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyMobileSession(state, sessionToken, now = Date.now()) {
+    if (!sessionToken)
+        return false;
+    const key = digestHex(sessionToken);
+    const pruned = pruneMobileAuth(state, now);
+    return pruned.sessions.some((session) => {
+        try {
+            return timingSafeEqual(Buffer.from(session.key, "hex"), Buffer.from(key, "hex"));
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export function setAccessPinCookie(res, cookieName, pin, instanceId, tls = false) {
+    const value = accessPinCookieDigest(pin, instanceId);
+    res.setHeader("set-cookie", [
+        cookie(cookieName, value, {
+            path: "/",
+            maxAgeSeconds: Math.floor(ACCESS_PIN_TTL_MS / 1000),
+            httpOnly: true,
+            tls,
+        }),
+    ]);
+}
+export function publicDevice(device) {
+    return {
+        deviceId: device.id,
+        id: device.id,
+        label: device.label,
+        createdAt: device.createdAt,
+        expiresAt: device.expiresAt,
+        lastActiveAt: device.lastSeenAt,
+        lastSeenAt: device.lastSeenAt,
+    };
+}
+export const PAIR_PAGE_HTML = `<!doctype html>
+<html lang="zh-CN">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>配对 XRK 移动访问</title>
+<main style="font-family:system-ui,sans-serif;max-width:28rem;margin:2rem auto;padding:0 1rem">
+  <h1>配对此设备</h1>
+  <p>输入桌面端显示的配对码，或从二维码链接自动填充。</p>
+  <form id="pair-form">
+    <label style="display:block;margin:.75rem 0">配对码
+      <input id="pair-token" autocomplete="one-time-code" required style="width:100%;padding:.5rem">
+    </label>
+    <label style="display:block;margin:.75rem 0">设备名称
+      <input id="device-label" maxlength="64" autocomplete="off" style="width:100%;padding:.5rem">
+    </label>
+    <button type="submit" style="padding:.5rem 1rem">配对</button>
+    <output id="pair-status" style="display:block;margin-top:.75rem"></output>
+  </form>
+</main>
+<script src="/mobile-access/pair.js" defer></script>
+</html>`;
+export const PAIR_PAGE_JS = `(() => {
+  const params = new URLSearchParams(location.hash.replace(/^#/, ''))
+  const tokenInput = document.getElementById('pair-token')
+  const labelInput = document.getElementById('device-label')
+  const status = document.getElementById('pair-status')
+  const form = document.getElementById('pair-form')
+  const hashToken = params.get('token')
+  if (hashToken && tokenInput) tokenInput.value = hashToken
+  form?.addEventListener('submit', async (event) => {
+    event.preventDefault()
+    status.textContent = '配对中…'
+    const response = await fetch('/mobile-access/auth/pair', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        token: tokenInput?.value ?? '',
+        label: labelInput?.value || undefined,
+      }),
+    })
+    if (!response.ok) {
+      status.textContent = '配对失败（链接可能已过期）'
+      return
+    }
+    location.replace('/')
+  })
+})()
+`;
+export const LOGIN_PAGE_HTML = `<!doctype html>
+<html lang="zh-CN">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>XRK 移动访问</title>
+<main style="font-family:system-ui,sans-serif;max-width:28rem;margin:2rem auto;padding:0 1rem">
+  <h1>正在恢复会话…</h1>
+  <p id="login-progress">正在验证设备凭据。</p>
+  <p id="login-failed" hidden>无法恢复会话，请重新配对。</p>
+  <a href="/mobile-access/pair">打开配对页</a>
+</main>
+<script src="/mobile-access/login.js" defer></script>
+</html>`;
+export const LOGIN_PAGE_JS = `(() => {
+  fetch('/mobile-access/auth/renew', {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  }).then((response) => {
+    if (response.ok) {
+      const next = new URLSearchParams(location.search).get('return') || '/'
+      location.replace(next)
+      return
+    }
+    document.getElementById('login-progress').hidden = true
+    document.getElementById('login-failed').hidden = false
+  }).catch(() => {
+    const el = document.getElementById('login-progress')
+    if (el) el.textContent = '无法连接到主机。'
+  })
+})()
+`;
+function pinPageHtml(mode, title) {
+    return `<!doctype html>
+<html lang="zh-CN">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>${title}</title>
+<main style="font-family:system-ui,sans-serif;max-width:28rem;margin:2rem auto;padding:0 1rem">
+  <h1>${title}</h1>
+  <p>输入桌面端移动访问设置中显示的 ${mode === "wan" ? "远程" : "局域网"} 访问 PIN。</p>
+  <form id="pin-form">
+    <label style="display:block;margin:.75rem 0">PIN
+      <input id="access-pin" inputmode="numeric" autocomplete="one-time-code" required style="width:100%;padding:.5rem">
+    </label>
+    <button type="submit" style="padding:.5rem 1rem">继续</button>
+    <output id="pin-status" style="display:block;margin-top:.75rem"></output>
+  </form>
+</main>
+<script src="/mobile-access/${mode}-pin.js" defer></script>
+</html>`;
+}
+function pinPageJs(mode) {
+    return `(() => {
+  const status = document.getElementById('pin-status')
+  const input = document.getElementById('access-pin')
+  document.getElementById('pin-form')?.addEventListener('submit', async (event) => {
+    event.preventDefault()
+    status.textContent = '验证中…'
+    const response = await fetch('/mobile-access/auth/${mode}-pin', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ pin: input?.value ?? '' }),
+    })
+    if (!response.ok) {
+      status.textContent = 'PIN 不正确'
+      return
+    }
+    const next = new URLSearchParams(location.search).get('return') || '/'
+    location.replace(next)
+  })
+})()
+`;
+}
+export const LAN_PIN_PAGE_HTML = pinPageHtml("lan", "局域网访问");
+export const WAN_PIN_PAGE_HTML = pinPageHtml("wan", "远程访问");
+export const LAN_PIN_PAGE_JS = pinPageJs("lan");
+export const WAN_PIN_PAGE_JS = pinPageJs("wan");
+//# sourceMappingURL=mobile-access-auth.js.map

package/node_modules/@xrkseek/server-http/dist/dsh-compat/mobile-access-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-access-auth.js","sourceRoot":"","sources":["../../src/dsh-compat/mobile-access-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAC/C,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,CAAC;AA2BvB,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,OAKC;IAED,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,OAAO,CAAC,IAAI,EAAE;QACtB,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QACnE,iBAAiB;KAClB,CAAC;IACF,IAAI,OAAO,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAK,GAAG,OAAO;IAI/C,OAAO;QACL,KAAK,EAAE,WAAW,EAAE;QACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtE,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CACzC;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;QACzD,YAAY,EACV,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;QACxD,gBAAgB,EACd,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAsB,EACtB,KAAa,EACb,KAAyB,EACzB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAUhB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,IACE,CAAC,MAAM,CAAC,YAAY;QACpB,MAAM,CAAC,gBAAgB,IAAI,GAAG;QAC9B,KAAK,KAAK,MAAM,CAAC,YAAY,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,GAAG,GAAG,aAAa,CAAC;IAC5C,MAAM,gBAAgB,GAAG,GAAG,GAAG,cAAc,CAAC;IAC9C,MAAM,MAAM,GAAuB;QACjC,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;QAC5B,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,eAAe;QAC1B,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,MAAM,OAAO,GAAwB;QACnC,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC;QAC5B,QAAQ;QACR,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,OAAO;QACL,KAAK,EAAE;YACL,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;YACpC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;SACxC;QACD,WAAW;QACX,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,eAAe;QACf,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAsB,EACtB,WAAmB,EACnB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAOhB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,eAAe,CACpB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,EACjC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAC3B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,gBAAgB,GAAG,GAAG,GAAG,cAAc,CAAC;IAC9C,MAAM,OAAO,GAAwB;QACnC,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,gBAAgB;KAC5B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CACnD,CAAC;IACF,OAAO;QACL,KAAK,EAAE;YACL,GAAG,MAAM;YACT,OAAO;YACP,QAAQ,EAAE;gBACR,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1D,OAAO;aACR;SACF;QACD,YAAY;QACZ,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAmB,EACnB,MAMC,EACD,GAAG,GAAG,KAAK;IAEX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE;QAC1B,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE;YACxC,IAAI,EAAE,2BAA2B;YACjC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YAChE,QAAQ,EAAE,IAAI;YACd,GAAG;SACJ,CAAC;QACF,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;YAC1C,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YACjE,QAAQ,EAAE,IAAI;YACd,GAAG;SACJ,CAAC;QACF,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE;YACpC,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YACjE,QAAQ,EAAE,IAAI;YACd,GAAG;SACJ,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,IAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,UAAkB;IAElB,OAAO,SAAS,CAAC,cAAc,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAA+B,EAC/B,GAAW,EACX,UAAkB;IAElB,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAsB,EACtB,YAAgC,EAChC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,eAAe,CACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CACxB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,UAAkB,EAClB,GAAW,EACX,UAAkB,EAClB,GAAG,GAAG,KAAK;IAEX,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE;QAC1B,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE;YACxB,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;YACnD,QAAQ,EAAE,IAAI;YACd,GAAG;SACJ,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,UAAU;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;QAoBtB,CAAC;AAET,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B3B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;QAYvB,CAAC;AAET,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;CAmB5B,CAAC;AAEF,SAAS,WAAW,CAAC,IAAmB,EAAE,KAAa;IACrD,OAAO;;;;SAIA,KAAK;;QAEN,KAAK;uBACU,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;;;;;;;;;8BAStB,IAAI;QAC1B,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,IAAmB;IACpC,OAAO;;;;;;wDAM+C,IAAI;;;;;;;;;;;;;;CAc3D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC"}

package/node_modules/@xrkseek/server-http/dist/dsh-compat/mobile-access-cpolar-component.d.ts

@@ -0,0 +1,53 @@
+/** Official cpolar 3.3.18 win32 x64 release (dsh-mobile CPOLAR_COMPONENT_RELEASE). */
+export declare const CPOLAR_COMPONENT_RELEASE: {
+    readonly version: "3.3.18";
+    readonly platform: "win32";
+    readonly arch: "x64";
+    readonly downloadUrl: "https://www.cpolar.com/static/downloads/releases/3.3.18/cpolar-stable-windows-amd64-setup.zip";
+    readonly downloadBytes: 7603505;
+    readonly downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830";
+    readonly executableBytes: 19637680;
+    readonly executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41";
+    readonly downloadPage: "https://www.cpolar.com/download";
+    readonly signupUrl: "https://dashboard.cpolar.com/signup";
+    readonly dashboardUrl: "https://dashboard.cpolar.com/auth";
+    readonly termsUrl: "https://www.cpolar.com/tos";
+};
+export interface CpolarComponentStatus {
+    supported: boolean;
+    installed: boolean;
+    configured: boolean;
+    version: string;
+    downloadBytes: number;
+    installedBytes: number;
+    sourceUrl: string;
+    downloadPage: string;
+    signupUrl: string;
+    dashboardUrl: string;
+    termsUrl: string;
+    storagePath: string;
+    errorCode?: string;
+}
+export declare class CpolarComponentManager {
+    readonly executable: string;
+    readonly configFile: string;
+    readonly componentRoot: string;
+    private readonly componentStorage;
+    private readonly stateRoot;
+    private readonly logRoot;
+    private readonly stagingRoot;
+    private readonly stateDirectory;
+    installed: boolean;
+    configured: boolean;
+    errorCode: string | undefined;
+    private queue;
+    constructor(xrkHome: string | undefined);
+    initialize(): Promise<void>;
+    status(): CpolarComponentStatus;
+    private enqueue;
+    install(): Promise<void>;
+    private extractWindowsInstaller;
+    configure(authtoken: string): Promise<void>;
+    purge(): Promise<void>;
+}
+//# sourceMappingURL=mobile-access-cpolar-component.d.ts.map

package/node_modules/@xrkseek/server-http/dist/dsh-compat/mobile-access-cpolar-component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-access-cpolar-component.d.ts","sourceRoot":"","sources":["../../src/dsh-compat/mobile-access-cpolar-component.ts"],"names":[],"mappings":"AAwBA,sFAAsF;AACtF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAgB3B,CAAC;AAgCX,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,sBAAsB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,SAAS,UAAS;IAClB,UAAU,UAAS;IACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAoC;gBAErC,OAAO,EAAE,MAAM,GAAG,SAAS;IA6BjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBjC,MAAM,IAAI,qBAAqB;IAsB/B,OAAO,CAAC,OAAO;IAST,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA8DhB,uBAAuB;IAgC/B,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B"}

package/node_modules/@xrkseek/server-http/dist/dsh-compat/mobile-access-cpolar-component.js

@@ -0,0 +1,233 @@
+/**
+ * cpolar official component install — mirrors dsh-mobile CpolarComponentManager.
+ */
+import { createHash, randomBytes, } from "node:crypto";
+import { copyFile, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import path from "node:path";
+import { dataPath } from "./underlying/json-store.js";
+const execFileAsync = promisify(execFile);
+/** Official cpolar 3.3.18 win32 x64 release (dsh-mobile CPOLAR_COMPONENT_RELEASE). */
+export const CPOLAR_COMPONENT_RELEASE = {
+    version: "3.3.18",
+    platform: "win32",
+    arch: "x64",
+    downloadUrl: "https://www.cpolar.com/static/downloads/releases/3.3.18/cpolar-stable-windows-amd64-setup.zip",
+    downloadBytes: 7603505,
+    downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
+    executableBytes: 19637680,
+    executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
+    downloadPage: "https://www.cpolar.com/download",
+    signupUrl: "https://dashboard.cpolar.com/signup",
+    dashboardUrl: "https://dashboard.cpolar.com/auth",
+    termsUrl: "https://www.cpolar.com/tos",
+};
+function inside(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+async function sha256File(file) {
+    const buf = await readFile(file);
+    return createHash("sha256").update(buf).digest("hex");
+}
+async function regularFile(file, expectedBytes) {
+    try {
+        const { stat } = await import("node:fs/promises");
+        const st = await stat(file);
+        return (st.isFile() &&
+            (expectedBytes === undefined || st.size === expectedBytes));
+    }
+    catch {
+        return false;
+    }
+}
+async function runExe(file, args) {
+    await execFileAsync(file, args, {
+        windowsHide: true,
+        timeout: 120_000,
+    });
+}
+export class CpolarComponentManager {
+    executable;
+    configFile;
+    componentRoot;
+    componentStorage;
+    stateRoot;
+    logRoot;
+    stagingRoot;
+    stateDirectory;
+    installed = false;
+    configured = false;
+    errorCode;
+    queue = Promise.resolve();
+    constructor(xrkHome) {
+        this.stateDirectory = dataPath(xrkHome, "mobile-access");
+        this.componentRoot = path.join(this.stateDirectory, "components", "cpolar");
+        this.componentStorage = path.join(this.componentRoot, CPOLAR_COMPONENT_RELEASE.version);
+        this.executable = path.join(this.componentStorage, "cpolar.exe");
+        this.stateRoot = path.join(this.stateDirectory, "state", "cpolar");
+        this.configFile = path.join(this.stateRoot, "cpolar.yml");
+        this.logRoot = path.join(this.stateDirectory, "logs", "cpolar");
+        this.stagingRoot = path.join(this.stateDirectory, "staging", "cpolar");
+        for (const child of [
+            this.componentRoot,
+            this.componentStorage,
+            this.stateRoot,
+            this.logRoot,
+            this.stagingRoot,
+        ]) {
+            if (!inside(this.stateDirectory, child)) {
+                throw new Error("cpolar path escaped state directory");
+            }
+        }
+    }
+    async initialize() {
+        this.installed = await regularFile(this.executable, CPOLAR_COMPONENT_RELEASE.executableBytes);
+        if (this.installed &&
+            (await sha256File(this.executable)) !==
+                CPOLAR_COMPONENT_RELEASE.executableSha256) {
+            this.installed = false;
+            this.errorCode = "cpolar_component_invalid";
+        }
+        this.configured = await regularFile(this.configFile);
+    }
+    status() {
+        const platform = process.platform;
+        const arch = process.arch;
+        return {
+            supported: platform === CPOLAR_COMPONENT_RELEASE.platform &&
+                arch === CPOLAR_COMPONENT_RELEASE.arch,
+            installed: this.installed,
+            configured: this.configured,
+            version: CPOLAR_COMPONENT_RELEASE.version,
+            downloadBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
+            installedBytes: CPOLAR_COMPONENT_RELEASE.executableBytes,
+            sourceUrl: CPOLAR_COMPONENT_RELEASE.downloadUrl,
+            downloadPage: CPOLAR_COMPONENT_RELEASE.downloadPage,
+            signupUrl: CPOLAR_COMPONENT_RELEASE.signupUrl,
+            dashboardUrl: CPOLAR_COMPONENT_RELEASE.dashboardUrl,
+            termsUrl: CPOLAR_COMPONENT_RELEASE.termsUrl,
+            storagePath: this.componentRoot,
+            ...(this.errorCode ? { errorCode: this.errorCode } : {}),
+        };
+    }
+    enqueue(op) {
+        const task = this.queue.then(op, op);
+        this.queue = task.then(() => undefined, () => undefined);
+        return task;
+    }
+    async install() {
+        return this.enqueue(async () => {
+            if (process.platform !== CPOLAR_COMPONENT_RELEASE.platform ||
+                process.arch !== CPOLAR_COMPONENT_RELEASE.arch) {
+                throw new Error("cpolar_component_unsupported");
+            }
+            await mkdir(this.stagingRoot, { recursive: true, mode: 0o700 });
+            const staging = await mkdtemp(path.join(this.stagingRoot, "install-"));
+            try {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 120_000);
+                timeout.unref();
+                const response = await fetch(CPOLAR_COMPONENT_RELEASE.downloadUrl, {
+                    redirect: "error",
+                    signal: controller.signal,
+                });
+                clearTimeout(timeout);
+                if (!response.ok) {
+                    throw new Error(`cpolar_download_http_${response.status}`);
+                }
+                const bytes = new Uint8Array(await response.arrayBuffer());
+                if (bytes.byteLength !== CPOLAR_COMPONENT_RELEASE.downloadBytes) {
+                    throw new Error("cpolar_download_size_mismatch");
+                }
+                const hash = createHash("sha256").update(bytes).digest("hex");
+                if (hash !== CPOLAR_COMPONENT_RELEASE.downloadSha256) {
+                    throw new Error("cpolar_download_hash_mismatch");
+                }
+                const archive = path.join(staging, "cpolar.zip");
+                await writeFile(archive, bytes, { mode: 0o600 });
+                await this.extractWindowsInstaller(archive, staging);
+                const extracted = path.join(staging, "cpolar.exe");
+                if (!await regularFile(extracted, CPOLAR_COMPONENT_RELEASE.executableBytes) ||
+                    (await sha256File(extracted)) !==
+                        CPOLAR_COMPONENT_RELEASE.executableSha256) {
+                    throw new Error("cpolar_executable_hash_mismatch");
+                }
+                const candidate = path.join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+                await mkdir(candidate, { recursive: true, mode: 0o700 });
+                await copyFile(extracted, path.join(candidate, "cpolar.exe"));
+                await rm(this.componentStorage, { recursive: true, force: true });
+                await rename(candidate, this.componentStorage);
+                this.installed = true;
+                this.errorCode = undefined;
+            }
+            finally {
+                await rm(staging, { recursive: true, force: true });
+            }
+        });
+    }
+    async extractWindowsInstaller(archive, destination) {
+        const unpacked = path.join(destination, "archive");
+        const administrative = path.join(destination, "administrative");
+        await mkdir(unpacked, { recursive: true, mode: 0o700 });
+        await mkdir(administrative, { recursive: true, mode: 0o700 });
+        await runExe("tar.exe", ["-xf", archive, "-C", unpacked]);
+        const entries = await readdir(unpacked, { recursive: true });
+        const msiRel = entries.find((e) => String(e).toLowerCase().endsWith(".msi"));
+        if (!msiRel)
+            throw new Error("cpolar_installer_missing");
+        const msiPath = path.join(unpacked, String(msiRel));
+        await runExe("msiexec.exe", [
+            "/a",
+            msiPath,
+            "/qn",
+            `TARGETDIR=${administrative}`,
+        ]);
+        const adminEntries = await readdir(administrative, { recursive: true });
+        const exeRel = adminEntries.find((e) => path.basename(String(e)).toLowerCase() === "cpolar.exe");
+        if (!exeRel)
+            throw new Error("cpolar_executable_missing");
+        await copyFile(path.join(administrative, String(exeRel)), path.join(destination, "cpolar.exe"));
+    }
+    async configure(authtoken) {
+        return this.enqueue(async () => {
+            const token = authtoken.trim();
+            if (token.length < 20 ||
+                token.length > 512 ||
+                [...token].some((ch) => {
+                    const code = ch.codePointAt(0) ?? 0;
+                    return code <= 0x1f || code === 0x7f || /\s/u.test(ch);
+                })) {
+                throw new Error("cpolar_authtoken_invalid");
+            }
+            await mkdir(this.stateRoot, { recursive: true, mode: 0o700 });
+            const temporary = path.join(this.stateRoot, `.cpolar.${randomBytes(12).toString("hex")}.tmp`);
+            const body = `authtoken: ${JSON.stringify(token)}\nconsole_ui: false\nupdate: false\ninspect_db_size: -1\n`;
+            try {
+                await writeFile(temporary, body, { encoding: "utf8", mode: 0o600 });
+                await rename(temporary, this.configFile);
+            }
+            catch (err) {
+                await rm(temporary, { force: true });
+                throw err;
+            }
+            this.configured = true;
+            this.errorCode = undefined;
+        });
+    }
+    async purge() {
+        return this.enqueue(async () => {
+            await Promise.all([
+                rm(this.componentRoot, { recursive: true, force: true }),
+                rm(this.stateRoot, { recursive: true, force: true }),
+                rm(this.logRoot, { recursive: true, force: true }),
+                rm(this.stagingRoot, { recursive: true, force: true }),
+            ]);
+            this.installed = false;
+            this.configured = false;
+            this.errorCode = undefined;
+        });
+    }
+}
+//# sourceMappingURL=mobile-access-cpolar-component.js.map