openmausbot 0.1.76 → 0.1.78

package/dist-server/enterprise/server/index.js

@@ -513,7 +513,7 @@ __export(core_exports2, {
   parse: () => parse,
   parseAsync: () => parseAsync,
   prettifyError: () => prettifyError,
-  process: () => process,
+  process: () => process2,
   regexes: () => regexes_exports,
   registry: () => registry,
   safeDecode: () => safeDecode,
@@ -11438,7 +11438,7 @@ function initializeContext(params) {
     external: params?.external ?? void 0
   };
 }
-function process(schema, ctx, _params = { path: [], schemaPath: [] }) {
+function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
   var _a3;
   const def = schema._zod.def;
   const seen = ctx.seen.get(schema);
@@ -11475,7 +11475,7 @@ function process(schema, ctx, _params = { path: [], schemaPath: [] }) {
     if (parent) {
       if (!result.ref)
         result.ref = parent;
-      process(parent, ctx, params);
+      process2(parent, ctx, params);
       ctx.seen.get(parent).isParent = true;
     }
   }
@@ -11763,14 +11763,14 @@ function isTransforming(_schema, _ctx) {
 }
 var createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
   const ctx = initializeContext({ ...params, processors });
-  process(schema, ctx);
+  process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
 var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
   const { libraryOptions, target } = params ?? {};
   const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
-  process(schema, ctx);
+  process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
@@ -12016,7 +12016,7 @@ var arrayProcessor = (schema, ctx, _json, params) => {
   if (typeof maximum === "number")
     json2.maxItems = maximum;
   json2.type = "array";
-  json2.items = process(def.element, ctx, {
+  json2.items = process2(def.element, ctx, {
     ...params,
     path: [...params.path, "items"]
   });
@@ -12028,7 +12028,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
   json2.properties = {};
   const shape = def.shape;
   for (const key in shape) {
-    json2.properties[key] = process(shape[key], ctx, {
+    json2.properties[key] = process2(shape[key], ctx, {
       ...params,
       path: [...params.path, "properties", key]
     });
@@ -12051,7 +12051,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
     if (ctx.io === "output")
       json2.additionalProperties = false;
   } else if (def.catchall) {
-    json2.additionalProperties = process(def.catchall, ctx, {
+    json2.additionalProperties = process2(def.catchall, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -12060,7 +12060,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
 var unionProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
   const isExclusive = def.inclusive === false;
-  const options = def.options.map((x, i) => process(x, ctx, {
+  const options = def.options.map((x, i) => process2(x, ctx, {
     ...params,
     path: [...params.path, isExclusive ? "oneOf" : "anyOf", i]
   }));
@@ -12072,11 +12072,11 @@ var unionProcessor = (schema, ctx, json2, params) => {
 };
 var intersectionProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  const a = process(def.left, ctx, {
+  const a = process2(def.left, ctx, {
     ...params,
     path: [...params.path, "allOf", 0]
   });
-  const b = process(def.right, ctx, {
+  const b = process2(def.right, ctx, {
     ...params,
     path: [...params.path, "allOf", 1]
   });
@@ -12093,11 +12093,11 @@ var tupleProcessor = (schema, ctx, _json, params) => {
   json2.type = "array";
   const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
   const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
-  const prefixItems = def.items.map((x, i) => process(x, ctx, {
+  const prefixItems = def.items.map((x, i) => process2(x, ctx, {
     ...params,
     path: [...params.path, prefixPath, i]
   }));
-  const rest = def.rest ? process(def.rest, ctx, {
+  const rest = def.rest ? process2(def.rest, ctx, {
     ...params,
     path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
   }) : null;
@@ -12137,7 +12137,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
   const keyBag = keyType._zod.bag;
   const patterns = keyBag?.patterns;
   if (def.mode === "loose" && patterns && patterns.size > 0) {
-    const valueSchema = process(def.valueType, ctx, {
+    const valueSchema = process2(def.valueType, ctx, {
       ...params,
       path: [...params.path, "patternProperties", "*"]
     });
@@ -12147,12 +12147,12 @@ var recordProcessor = (schema, ctx, _json, params) => {
     }
   } else {
     if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
-      json2.propertyNames = process(def.keyType, ctx, {
+      json2.propertyNames = process2(def.keyType, ctx, {
         ...params,
         path: [...params.path, "propertyNames"]
       });
     }
-    json2.additionalProperties = process(def.valueType, ctx, {
+    json2.additionalProperties = process2(def.valueType, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -12167,7 +12167,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
 };
 var nullableProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  const inner = process(def.innerType, ctx, params);
+  const inner = process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   if (ctx.target === "openapi-3.0") {
     seen.ref = def.innerType;
@@ -12178,20 +12178,20 @@ var nullableProcessor = (schema, ctx, json2, params) => {
 };
 var nonoptionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var defaultProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   json2.default = JSON.parse(JSON.stringify(def.defaultValue));
 };
 var prefaultProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   if (ctx.io === "input")
@@ -12199,7 +12199,7 @@ var prefaultProcessor = (schema, ctx, json2, params) => {
 };
 var catchProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   let catchValue;
@@ -12214,32 +12214,32 @@ var pipeProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
   const inIsTransform = def.in._zod.traits.has("$ZodTransform");
   const innerType = ctx.io === "input" ? inIsTransform ? def.out : def.in : def.out;
-  process(innerType, ctx, params);
+  process2(innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
 var readonlyProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   json2.readOnly = true;
 };
 var promiseProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var lazyProcessor = (schema, ctx, _json, params) => {
   const innerType = schema._zod.innerType;
-  process(innerType, ctx, params);
+  process2(innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
@@ -12291,7 +12291,7 @@ function toJSONSchema(input, params) {
     const defs = {};
     for (const entry of registry2._idmap.entries()) {
       const [_, schema] = entry;
-      process(schema, ctx2);
+      process2(schema, ctx2);
     }
     const schemas = {};
     const external = {
@@ -12314,7 +12314,7 @@ function toJSONSchema(input, params) {
     return { schemas };
   }
   const ctx = initializeContext({ ...params, processors: allProcessors });
-  process(input, ctx);
+  process2(input, ctx);
   extractDefs(ctx, input);
   return finalize(ctx, input);
 }
@@ -12372,7 +12372,7 @@ var JSONSchemaGenerator = class {
    * This must be called before emit().
    */
   process(schema, _params = { path: [], schemaPath: [] }) {
-    return process(schema, this.ctx, _params);
+    return process2(schema, this.ctx, _params);
   }
   /**
    * Emit the final JSON Schema after processing.
@@ -14576,6 +14576,363 @@ function verifyLicenseKey(key, options = {}) {
   return claims;
 }
 
+// enterprise/server/workspace-access.ts
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+// server/enterprise.ts
+import { join as join2 } from "node:path";
+
+// server/proxy-paths.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var SERVER_ROOT = dirname(fileURLToPath(import.meta.url));
+function resolveProxy(relative) {
+  const source = join(SERVER_ROOT, `${relative}.ts`);
+  return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
+}
+var SPAWNED_PROXIES = {
+  browser: resolveProxy("browser-proxy"),
+  computer: resolveProxy("computer-proxy"),
+  localComputer: resolveProxy("local-computer-proxy"),
+  permission: resolveProxy("permission-proxy"),
+  containerMcp: resolveProxy("container-mcp"),
+  vpsContainerMcp: resolveProxy("vps-container-mcp"),
+  agents: resolveProxy("drivers/agents-proxy"),
+  dweb: resolveProxy("drivers/dweb-proxy"),
+  connectors: resolveProxy("connector-proxy"),
+  mcpGate: resolveProxy("mcp-gate"),
+  phone: resolveProxy("drivers/phone-proxy"),
+  // Loaded by the external `pi` process via `-e`, not by this server — but
+  // resolved through the same single source of truth so the packaged layout
+  // check can assert it ships.
+  piMcpExtension: resolveProxy("drivers/pi-mcp-extension")
+};
+
+// server/enterprise.ts
+var layerSchema = external_exports.object({
+  customer: external_exports.string().min(1),
+  features: external_exports.array(external_exports.string().min(1)),
+  expiresAt: external_exports.string().nullable()
+});
+var DEFAULT_DIR = join2(SERVER_ROOT, "..", "enterprise");
+function hostedWorkspaceConfiguration(env = process.env) {
+  try {
+    const origin = (raw) => {
+      if (!raw || raw !== raw.trim()) throw new Error("missing origin");
+      const url2 = new URL(raw);
+      if (url2.protocol !== "https:" || raw !== url2.origin && raw !== `${url2.origin}/`) throw new Error("invalid origin");
+      return url2;
+    };
+    if (!/^[a-z][a-z0-9-]{1,30}$/.test(env.OMB_ADMIN_WORKSPACE ?? "")) return null;
+    if (env.OMB_ADMIN_MEMBERSHIP !== void 0 && !["local", "portal"].includes(env.OMB_ADMIN_MEMBERSHIP)) return null;
+    return { admin: origin(env.OMB_ADMIN_URL), tenant: origin(env.OMB_PUBLIC_URL), workspace: env.OMB_ADMIN_WORKSPACE, portalMembership: env.OMB_ADMIN_MEMBERSHIP === "portal" };
+  } catch {
+    return null;
+  }
+}
+
+// server/request-auth.ts
+import { isIP } from "node:net";
+function isLoopbackHost(host) {
+  if (!host) return false;
+  const value = host.trim().toLowerCase();
+  if (!value) return false;
+  let hostname3 = value;
+  if (value.startsWith("[")) {
+    const close = value.indexOf("]");
+    if (close < 0 || value.length > close + 1 && !/^:\d+$/.test(value.slice(close + 1))) return false;
+    hostname3 = value.slice(1, close);
+  } else {
+    const firstColon = value.indexOf(":");
+    const lastColon = value.lastIndexOf(":");
+    if (firstColon >= 0 && firstColon === lastColon) {
+      if (!/^\d+$/.test(value.slice(firstColon + 1))) return false;
+      hostname3 = value.slice(0, firstColon);
+    }
+  }
+  if (hostname3 === "localhost" || hostname3 === "localhost.") return true;
+  if (isIP(hostname3) === 4) return hostname3.startsWith("127.");
+  return hostname3 === "::1" || hostname3 === "0:0:0:0:0:0:0:1";
+}
+function isAllowedOrigin(origin) {
+  if (!origin) return true;
+  try {
+    const o = new URL(origin);
+    return isLoopbackHost(o.hostname) && (o.protocol === "http:" || o.protocol === "https:");
+  } catch {
+    return false;
+  }
+}
+function headerValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function isProxied(req) {
+  const h = req.headers;
+  return ipcPeer(req) || Boolean(h["x-forwarded-for"] || h["x-forwarded-proto"] || h["x-forwarded-host"] || h["forwarded"]);
+}
+function ipcPeer(req) {
+  const socket = req.socket;
+  return Boolean(socket) && socket.remoteAddress === void 0 && socket.remoteFamily === void 0;
+}
+function requestSource(req) {
+  const peer = req.socket?.remoteAddress || "unknown";
+  const viaLocalProxy = ipcPeer(req) || peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+  const hops = viaLocalProxy ? (headerValue(req.headers["x-forwarded-for"]) ?? "").split(",").map((h) => h.trim()).filter(Boolean) : [];
+  const forwarded = hops.length ? hops[hops.length - 1] : void 0;
+  return sanitizeSource(forwarded || peer);
+}
+function sanitizeSource(value) {
+  const clean = value.replace(/[^\w.:%[\]-]/g, "");
+  return (clean || "unknown").slice(0, 64);
+}
+function parseCookies(header) {
+  const out = /* @__PURE__ */ new Map();
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const name = part.slice(0, eq).trim();
+    if (!name) continue;
+    out.set(name, part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function serializeSessionCookie(name, token, options) {
+  const parts = [`${name}=${token}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${options.maxAgeSeconds}`];
+  if (options.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+
+// server/sessions.ts
+var PAIRING_CODE_TTL_MS = 5 * 6e4;
+function daysMs(value, fallbackDays) {
+  const days = Number(value);
+  const ok = Number.isInteger(days) && days >= 1 && days <= 3650;
+  return (ok ? days : fallbackDays) * 24 * 60 * 6e4;
+}
+var SESSION_TTL_MS = daysMs(process.env.OMB_SESSION_TTL_DAYS, 30);
+var SESSION_MAX_AGE_MS = daysMs(process.env.OMB_SESSION_MAX_DAYS, 180);
+var SESSION_RENEW_WHEN_LEFT_MS = SESSION_TTL_MS / 2;
+function cookieMaxAgeSeconds(session, now = Date.now()) {
+  return Math.max(1, Math.floor((session.expiresAt - now) / 1e3));
+}
+var STREAM_TICKET_TTL_MS = 5 * 6e4;
+var scopeSchema = external_exports.enum(["admin", "client"]);
+var sessionSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  tokenHash: external_exports.string().length(64),
+  label: external_exports.string().max(80),
+  scopes: external_exports.array(scopeSchema).min(1),
+  createdAt: external_exports.number(),
+  lastSeenAt: external_exports.number(),
+  expiresAt: external_exports.number(),
+  /** Set when the session came from an account sign-in rather than a code. */
+  userId: external_exports.string().max(256).optional(),
+  email: external_exports.string().max(320).optional(),
+  /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
+  membershipAuthority: external_exports.literal("portal").optional()
+});
+var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
+
+// server/hosted-contract.ts
+var HOSTED_CONTRACT_VERSION = 1;
+var HOSTED_CONTRACT_METADATA = Object.freeze({
+  contractVersion: HOSTED_CONTRACT_VERSION,
+  supportedContractVersions: Object.freeze([HOSTED_CONTRACT_VERSION]),
+  legacyPolicy: "legacy-v1"
+});
+var HOSTED_CONTRACT_ERROR = "Admin and workspace runtime versions are incompatible. Ask your administrator to update the deployment.";
+function hostedContractCompatible(version2) {
+  return version2 === void 0 ? HOSTED_CONTRACT_VERSION === 1 : version2 === HOSTED_CONTRACT_VERSION;
+}
+
+// enterprise/server/workspace-access.ts
+var START = "/api/auth/hosted/start";
+var CALLBACK = "/api/auth/hosted/callback";
+var TTL_MS = 3e5;
+var MAX_PENDING = 1e3;
+var START_WINDOW_MS = 6e4;
+var STARTS_PER_SOURCE = 20;
+var PROOF = /^[A-Za-z0-9_-]{43}$/;
+var unavailable = { status: 503, error: "Workspace sign-in is unavailable. Try again shortly." };
+var denied = { status: 401, error: "Workspace access ended. Sign in again." };
+var incompatible = { status: 503, error: HOSTED_CONTRACT_ERROR };
+function equal(a, b) {
+  const x = Buffer.from(a), y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+function identity(value) {
+  if (!value || typeof value !== "object") return null;
+  const { email: email3, role } = value;
+  if (typeof email3 !== "string" || email3.length > 320 || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email3)) return null;
+  if (role !== "admin" && role !== "member") return null;
+  return { email: email3.toLowerCase(), scopes: role === "admin" ? ["admin", "client"] : ["client"] };
+}
+function createWorkspaceAccess(options) {
+  const env = options.env ?? process.env;
+  const now = options.now ?? Date.now;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const config2 = hostedWorkspaceConfiguration(env);
+  const cookieName = `__Host-${options.cookieName}_handoff`;
+  const pending = /* @__PURE__ */ new Map();
+  const starts = /* @__PURE__ */ new Map();
+  const observed = /* @__PURE__ */ new Map();
+  let checking = false;
+  const clearCookie = () => serializeSessionCookie(cookieName, "", { secure: true, maxAgeSeconds: 0 });
+  const tenantHost = (req) => config2 !== null && req.headers.host?.toLowerCase() === config2.tenant.host;
+  const localOwner = (req) => !isProxied(req) && isLoopbackHost(req.headers.host) && isAllowedOrigin(typeof req.headers.origin === "string" ? req.headers.origin : void 0);
+  const redirect = (res, to) => {
+    res.writeHead(302, { location: to, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+    res.end();
+  };
+  const failurePage = (res, status, message = "Workspace sign-in could not finish.") => {
+    res.setHeader("set-cookie", clearCookie());
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
+    res.end(`<!doctype html><title>Workspace sign-in</title><p>${message}</p><a href="${START}">Try signing in again</a>`);
+  };
+  const post = async (path, body) => {
+    if (!config2 || !options.entitled()) return { status: 503, body: null };
+    try {
+      const response = await fetchImpl(new URL(path, config2.admin), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ workspace: config2.workspace, ...body, contractVersion: HOSTED_CONTRACT_VERSION }),
+        credentials: "omit",
+        redirect: "error",
+        signal: AbortSignal.timeout(5e3)
+      });
+      const responseBody = response.ok ? await response.json() : null;
+      if (response.ok && responseBody && typeof responseBody === "object" && !hostedContractCompatible(Reflect.get(responseBody, "contractVersion"))) return { status: 409, body: null };
+      return options.entitled() ? { status: response.status, body: responseBody } : { status: 503, body: null };
+    } catch {
+      return { status: 503, body: null };
+    }
+  };
+  const check2 = async (session) => {
+    if (!options.sessions.isLive(session.id)) {
+      observed.delete(session.id);
+      return denied;
+    }
+    const result = await post("/api/handoff/check", { grant: session.userId.slice("portal:".length) });
+    if (result.status === 409) {
+      options.closeSessionStreams(session.id);
+      return incompatible;
+    }
+    if (result.status !== 200 && result.status !== 401) {
+      options.closeSessionStreams(session.id);
+      return unavailable;
+    }
+    const current = identity(result.body);
+    if (!current || current.email !== session.email?.toLowerCase() || session.scopes.some((scope) => !current.scopes.includes(scope))) {
+      options.sessions.revoke(session.id);
+      observed.delete(session.id);
+      return denied;
+    }
+    return options.sessions.isLive(session.id) ? null : denied;
+  };
+  const access = {
+    async handlePublic(req, res, url2) {
+      const path = url2.pathname;
+      if (req.method !== "GET" || !["/", "/pair", START, CALLBACK].includes(path)) return false;
+      if ((path === "/" || path === "/pair") && localOwner(req)) return false;
+      if (!config2 || !options.entitled()) {
+        failurePage(res, 503);
+        return true;
+      }
+      if (!tenantHost(req)) {
+        failurePage(res, 403);
+        return true;
+      }
+      if (path === "/pair") {
+        redirect(res, START);
+        return true;
+      }
+      if (path === "/") {
+        const token = parseCookies(req.headers.cookie).get(options.cookieName);
+        const session = options.sessions.authenticate(token);
+        if (session) {
+          const failure = await access.authorize(req, { kind: "session", session, scopes: session.scopes, via: "cookie" });
+          if (!failure) return false;
+          if (failure.status === 503) {
+            failurePage(res, 503, failure.error);
+            return true;
+          }
+        }
+        redirect(res, START);
+        return true;
+      }
+      if (path === START) {
+        const time3 = now();
+        for (const [state3, value] of pending) if (value.expiresAt <= time3) pending.delete(state3);
+        for (const [source2, value] of starts) if (value.expiresAt <= time3) starts.delete(source2);
+        const source = requestSource(req), recent = starts.get(source);
+        if (pending.size >= MAX_PENDING || (recent?.count ?? 0) >= STARTS_PER_SOURCE || !recent && starts.size >= MAX_PENDING) {
+          res.writeHead(429, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "retry-after": String(START_WINDOW_MS / 1e3) });
+          res.end("<!doctype html><title>Workspace sign-in</title><p>Too many sign-in attempts. Try again shortly.</p>");
+          return true;
+        }
+        starts.set(source, { count: (recent?.count ?? 0) + 1, expiresAt: recent?.expiresAt ?? time3 + START_WINDOW_MS });
+        const state2 = randomBytes(32).toString("base64url");
+        const verifier = randomBytes(32).toString("base64url");
+        pending.set(state2, { verifier, expiresAt: time3 + TTL_MS });
+        res.setHeader("set-cookie", serializeSessionCookie(cookieName, `${state2}.${verifier}`, { secure: true, maxAgeSeconds: TTL_MS / 1e3 }));
+        const target = new URL("/connect", config2.admin);
+        target.search = new URLSearchParams({ workspace: config2.workspace, state: state2, challenge: createHash("sha256").update(verifier).digest("base64url") }).toString();
+        redirect(res, target.href);
+        return true;
+      }
+      const state = url2.searchParams.get("state") ?? "";
+      const code = url2.searchParams.get("code") ?? "";
+      const saved = pending.get(state);
+      const cookie = parseCookies(req.headers.cookie).get(cookieName) ?? "";
+      if (!saved || saved.expiresAt <= now() || !equal(cookie, `${state}.${saved.verifier}`) || !PROOF.test(code) || url2.searchParams.getAll("state").length !== 1 || url2.searchParams.getAll("code").length !== 1) {
+        failurePage(res, 400);
+        return true;
+      }
+      pending.delete(state);
+      res.setHeader("set-cookie", clearCookie());
+      const result = await post("/api/handoff/consume", { code, verifier: saved.verifier });
+      if (result.status === 409) {
+        failurePage(res, 503, incompatible.error);
+        return true;
+      }
+      const user = identity(result.body);
+      const grant = result.body && typeof result.body === "object" ? Reflect.get(result.body, "grant") : null;
+      if (result.status !== 200 || !user || typeof grant !== "string" || !PROOF.test(grant)) {
+        failurePage(res, result.status === 401 ? 401 : 503);
+        return true;
+      }
+      const issued = options.sessions.issuePortal({ email: user.email, grant, scopes: user.scopes });
+      if (!options.sessions.authenticate(issued.token)) {
+        failurePage(res, 403);
+        return true;
+      }
+      res.setHeader("set-cookie", [clearCookie(), serializeSessionCookie(options.cookieName, issued.token, { secure: true, maxAgeSeconds: cookieMaxAgeSeconds(issued.session) })]);
+      redirect(res, "/");
+      return true;
+    },
+    async authorize(req, auth) {
+      if (auth.kind === "loopback") return null;
+      if (!config2 || !options.entitled()) return unavailable;
+      if (!tenantHost(req)) return { status: 403, error: "Use the configured workspace address." };
+      if (!auth.session.userId?.startsWith("portal:") || auth.session.userId.length <= "portal:".length) return denied;
+      observed.set(auth.session.id, auth.session);
+      return check2(auth.session);
+    },
+    async revalidate() {
+      if (checking) return;
+      checking = true;
+      try {
+        await Promise.all([...observed.values()].map(check2));
+      } finally {
+        checking = false;
+      }
+    }
+  };
+  return access;
+}
+
 // enterprise/server/index.ts
 function register(options) {
   if (!options.licenseKey) return null;
@@ -14583,5 +14940,6 @@ function register(options) {
   return { customer: claims.customer, features: claims.features, expiresAt: claims.expires };
 }
 export {
+  createWorkspaceAccess,
   register
 };