rovloom 0.6.0 → 0.6.1

package/dist/src/chunk-5j0gj6w2.js

@@ -1,7 +0,0 @@
-// @bun
-// src/pairing-policy.ts
-var DEFAULT_PAIRING_POLICY_REF = "rovloom_setup_v1";
-
-export { DEFAULT_PAIRING_POLICY_REF };
-
-//# debugId=C4F08DA3B385473E64756E2164756E21

package/dist/src/chunk-vwcntax3.js

@@ -1,228 +0,0 @@
-// @bun
-import {
-  fail2,
-  object2,
-  fields2,
-  id2,
-  boundedJson2,
-  hash2
-} from "./chunk-qt9m2kg2.js";
-import {
-  privatePath,
-  privateFile,
-  createPrivate,
-  syncParentDirectory
-} from "./chunk-0y5542k8.js";
-
-// src/transport/pairing.ts
-class PairingAdmin2 {
-  store;
-  host;
-  constructor(store, host) {
-    this.store = store;
-    this.host = host;
-  }
-  register(name) {
-    if (this.host.authorize("register") !== undefined) {
-      fail2("pairing_admin_forbidden");
-    }
-    return this.store.register(name);
-  }
-  issue(machine, ttlMs = 600000) {
-    if (this.host.authorize("enroll", machine) !== undefined) {
-      fail2("pairing_admin_forbidden");
-    }
-    return this.store.issueEnrollment(machine, ttlMs);
-  }
-}
-
-// src/transport/credentials.ts
-import { constants, closeSync, fstatSync, openSync, readFileSync, renameSync, unlinkSync } from "fs";
-import { randomUUID } from "crypto";
-function validate(value) {
-  const v = object2(value);
-  fields2(v, ["machine_id", "recovery_generation", "credential"]);
-  id2(v.machine_id);
-  id2(v.recovery_generation);
-  if (typeof v.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(v.credential)) {
-    fail2("invalid_device_credential");
-  }
-  return v;
-}
-function saveCredential2(path, input, replace = false) {
-  privatePath(path);
-  const raw = boundedJson2(validate(input), 4096);
-  if (!replace) {
-    createPrivate(path, raw);
-    syncParentDirectory(path, true);
-    return;
-  }
-  privateFile(path);
-  const temporary = path + "." + randomUUID();
-  try {
-    createPrivate(temporary, raw);
-    renameSync(temporary, path);
-    syncParentDirectory(path, true);
-  } finally {
-    try {
-      unlinkSync(temporary);
-    } catch {}
-  }
-}
-function createFileCredentialSink2(path, expected, replace = false) {
-  privatePath(path);
-  id2(expected.machine_id);
-  id2(expected.recovery_generation);
-  let closed = false;
-  let used = false;
-  return {
-    async deliver(input, signal, context) {
-      if (closed || used || signal.aborted) {
-        fail2("credential_sink_closed");
-      }
-      if (input.machine_id !== expected.machine_id || input.recovery_generation !== expected.recovery_generation) {
-        fail2("credential_sink_mismatch");
-      }
-      used = true;
-      saveCredential2(path, input, replace);
-      return { ...context, machine_id: input.machine_id, recovery_generation: input.recovery_generation };
-    },
-    close() {
-      closed = true;
-    }
-  };
-}
-function loadCredential2(path) {
-  privatePath(path);
-  privateFile(path);
-  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-  try {
-    const st = fstatSync(fd);
-    if (!st.isFile() || st.nlink !== 1 || process.platform !== "win32" && ((st.mode & 511) !== 384 || st.uid !== process.getuid?.()) || st.size > 4096) {
-      fail2("unsafe_storage_file");
-    }
-    try {
-      return validate(JSON.parse(readFileSync(fd, "utf8")));
-    } catch {
-      fail2("invalid_device_credential");
-    }
-  } finally {
-    closeSync(fd);
-  }
-}
-
-// src/transport/custody.ts
-import { randomUUID as randomUUID2 } from "crypto";
-function createPairingDelivery2(options) {
-  const timeout = options.timeout_ms ?? 5000;
-  const concurrency = options.concurrency ?? 4;
-  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000 || !Number.isSafeInteger(concurrency) || concurrency < 1 || concurrency > 64) {
-    fail2("pairing_limit");
-  }
-  const pending = new Map;
-  let closed = false;
-  async function transfer(machine, operation, issue) {
-    if (closed || pending.size >= concurrency) {
-      fail2("pairing_unavailable");
-    }
-    id2(machine);
-    const deliveryId = randomUUID2();
-    let sink;
-    try {
-      sink = options.authorizeChannel({ machine_id: machine, delivery_id: deliveryId, operation });
-    } catch {
-      fail2("pairing_channel_forbidden");
-    }
-    if (!sink || typeof sink.deliver !== "function" || typeof sink.close !== "function") {
-      fail2("pairing_channel_forbidden");
-    }
-    if (closed) {
-      try {
-        sink.close();
-      } catch {}
-      fail2("pairing_unavailable");
-    }
-    const controller = new AbortController;
-    let rejectAbort;
-    const aborted = new Promise((_, reject) => {
-      rejectAbort = reject;
-    });
-    const closeSink = () => {
-      controller.abort();
-      try {
-        sink.close();
-      } catch {}
-    };
-    const abort = () => {
-      closeSink();
-      rejectAbort(new Error("pairing_delivery_unknown"));
-    };
-    const timer = setTimeout(abort, timeout);
-    pending.set(deliveryId, { timer, abort });
-    let installedDigest;
-    let sending = false;
-    try {
-      const credential = issue();
-      installedDigest = hash2(credential.credential);
-      const generation = credential.recovery_generation;
-      const revision = options.identities.credentialRevision(machine);
-      sending = true;
-      const delivered = Promise.resolve().then(() => sink.deliver(structuredClone(credential), controller.signal, { delivery_id: deliveryId, revision })).finally(() => {
-        clearTimeout(timer);
-        pending.delete(deliveryId);
-      });
-      const ack = await Promise.race([delivered, aborted]);
-      if (!ack || ack.delivery_id !== deliveryId || ack.revision !== revision || ack.machine_id !== machine || ack.recovery_generation !== generation) {
-        fail2("pairing_ack_mismatch");
-      }
-      if (closed || controller.signal.aborted) {
-        fail2("pairing_delivery_unknown");
-      }
-      return { machine_id: machine, delivery_id: deliveryId, state: "delivered" };
-    } catch {
-      if (installedDigest !== undefined) {
-        try {
-          options.identities.rejectDelivery(machine, installedDigest);
-        } catch {}
-      }
-      return fail2("pairing_delivery_unknown");
-    } finally {
-      clearTimeout(timer);
-      closeSink();
-      if (!sending) {
-        pending.delete(deliveryId);
-      }
-    }
-  }
-  return {
-    async redeem(request) {
-      if (typeof request.enrollment !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(request.enrollment)) {
-        fail2("invalid_enrollment");
-      }
-      return transfer(request.registration_id, "enroll", () => {
-        const device = options.backend.redeem(request.enrollment);
-        if (device.machine_id !== request.registration_id) {
-          fail2("pairing_target_mismatch");
-        }
-        return { ...device, recovery_generation: options.backend.generation() };
-      });
-    },
-    status() {
-      return { closed, pending: pending.size };
-    },
-    close() {
-      if (closed) {
-        return;
-      }
-      closed = true;
-      for (const item of pending.values()) {
-        clearTimeout(item.timer);
-        item.abort();
-      }
-    }
-  };
-}
-
-export { PairingAdmin2, saveCredential2, createFileCredentialSink2, loadCredential2, createPairingDelivery2 };
-
-//# debugId=A739B57897780E2964756E2164756E21

package/dist/src/chunk-ytpfmcp1.js

@@ -1,25 +0,0 @@
-// @bun
-import {
-  writeAdminFiles2,
-  managementSourceExists2,
-  handleAdminCommand2
-} from "./chunk-yv9px0f5.js";
-import"./chunk-wxqhscsw.js";
-import"./chunk-1bf0wmgk.js";
-import"./chunk-z7kkfrgz.js";
-import"./chunk-hpzr94hm.js";
-import"./chunk-5b8g62kw.js";
-import"./chunk-3nnahj0j.js";
-import"./chunk-0y5542k8.js";
-import"./chunk-g7pnjzkk.js";
-import"./chunk-qt9m2kg2.js";
-import"./chunk-9tt13dm0.js";
-import"./chunk-7crhmqn2.js";
-import"./chunk-d71r315c.js";
-export {
-  handleAdminCommand2 as handleAdminCommand,
-  managementSourceExists2 as managementSourceExists,
-  writeAdminFiles2 as writeAdminFiles
-};
-
-//# debugId=989933E8EAB2EB1A64756E2164756E21