@agimon-ai/po-cloudflare 0.0.0-stage → 0.0.2-alpha.1

package/LICENSE

@@ -0,0 +1,149 @@
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -1,3 +1,261 @@
-# Temporary Holding Version
+# @agimon-ai/po-cloudflare
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Po headless sessions on Cloudflare Workers, one Durable Object per session. The package ships the
+built Worker (`dist/`) and its `wrangler.jsonc`. A Workers Paid plan is required: the gzip bundle
+is about 3.4 MiB, over the Free plan's 3 MiB limit.
+
+## Deploy your own
+
+```bash
+npm i @agimon-ai/po-cloudflare wrangler
+cp node_modules/@agimon-ai/po-cloudflare/wrangler.jsonc .
+# In wrangler.jsonc: set "name", "main" to "node_modules/@agimon-ai/po-cloudflare/dist/worker.js" and
+# "assets.directory" to "node_modules/@agimon-ai/po-cloudflare/dist/assets" (the Po web app).
+# Keep the durable_objects bindings and migrations exactly as shipped; migrations are irreversible.
+npx wrangler secret put PO_ATTACH_TOKEN      # at least 32 random characters
+npx wrangler secret put PO_PROVIDER_API_KEY
+npx wrangler deploy --var PO_DEFAULT_PROVIDER:openrouter --var PO_DEFAULT_MODEL:<model> \
+  --var PO_PROVIDER_BASE_URL:https://openrouter.ai/api/v1
+curl -fsS https://<your-worker>/healthz   # ok
+```
+
+Open `https://<your-worker>/` in a browser and sign in once with the attach token: the Worker serves the Po web
+app behind an `__Host-po_owner` cookie (HttpOnly, Secure, SameSite=Strict, 7 days). Ten failed sign-ins lock
+sign-in for 15 minutes. For a custom domain set `--var PO_SELF_HOST_ORIGIN:https://po.example.com`. The
+self-hosted web app lists, creates, chats in and deletes sessions; settings and plugins are not available there
+yet (`/api/compositions` answers `{ "workspaces": [] }` and `/api/web-plugins/*` answers 404). Signed-out
+browsers are sent to the sign-in page at `/api/owner/sign-in` (`/sign-in` serves the same page).
+
+### Signed offline bundle and pairing
+
+Release builds of this package sign the web app at build time with the Agimon release key, so a browser can pin
+that key and its service worker serves only bytes that verify against it, the same trust the local hub's `/pair`
+flow gives. Print this browser's pairing link from the package you deploy:
+
+```bash
+node -e "const m=require('@agimon-ai/po-cloudflare/dist/assets/bundle-manifest.json');console.log('https://<your-worker>/pair#s='+m.publicKey+'&r='+m.manifest.revision)"
+```
+
+Compare the `s=` key with the one in the release notes, sign in, then open the link in the same browser. The
+page verifies every file against the key before the cockpit runs; later deploys signed by the same key update
+the browser on its next visit, and a different key asks you to confirm its fingerprint. The key travels only in
+the URL fragment, which the browser never sends to the Worker. A build without a key still works as before,
+but `/pair`, `/sw.js`, `/bundle-manifest.json` and `/bundle-assets/*` answer 404. Once a browser has paired,
+keep deploying signed builds: an unsigned one cannot update it.
+
+To sign your own build, make an EC P-256 key once, keep it out of git, and pass it to the build:
+
+```bash
+openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -nocrypt -out po-bundle-key.pem
+PO_BUNDLE_SIGNING_KEY_FILE=po-bundle-key.pem pnpm build   # or PO_BUNDLE_SIGNING_KEY="$(cat po-bundle-key.pem)"
+```
+
+The build prints the public key and the `/pair#s=<key>&r=<revision>` link. The revision is the build time in
+seconds unless `PO_BUNDLE_REVISION` sets it; each release needs a higher one than the browser holds.
+
+Scripts and other clients use `Authorization: Bearer <PO_ATTACH_TOKEN>`: session sockets at
+`/api/workspaces/<ws>/sessions/<id>/ws` and the workspace and session list. Signed-in mode (below) adds Po
+identity, orgs and the REST directory; OAuth groups are all-or-nothing, so a partially configured provider
+makes boot fail.
+
+Try it locally on Miniflare, no Cloudflare account needed: `pnpm build`, then `pnpm local:cloud` (signed-in
+mode) or `pnpm local:self-host` (this mode). Each runs `wrangler dev --local` with stub email and model
+servers, signs in, creates a session, chats over the session socket and deletes it. `--keep` leaves it
+running; `PO_LOCAL_PORT` moves it off 8788. With the signing key that built `dist/assets` in the environment,
+`pnpm local:self-host` also verifies the signed manifest and every shell asset, `/sw.js` and `/pair`.
+
+Check a deployed signed-in Worker with `PO_SMOKE_EMAIL=you@example.com PO_SMOKE_PROVIDER_KEY=<key> node
+scripts/smoke.mjs https://<worker>`: health, providers, a refused unauthenticated socket, then email-code sign-in
+(type the code from your inbox), workspace, session, one prompt with a reply, and delete. Leave out
+`PO_SMOKE_PROVIDER_KEY` to use the account's stored key.
+
+## Phase 3 federation admission seam
+
+`src/composition/federation.ts` exports `verifyCloudFederationRequest` for the destination DO.
+It requires TLS, derives the method, target and body from the actual request, calls the shared
+verifier and returns either a refusal Response or verified principal, org, device and optional
+via stamps. Dispatch must use those stamps, never caller-supplied headers. The route must supply
+its own workspace/network/org/operation scope and pinned authority ports. The replay port uses
+DO SQL insert-if-absent and an indexed on-write TTL purge, so live nonces survive object eviction.
+It does not take the session scheduler's alarm slot.
+
+Public REST/plugin dispatch mounting is pending phase 4. This phase does not add a public route,
+claim a configured identity feed, or admit federation via the attach-token WebSocket path.
+The workerd acceptance fixture calls the adapter through a test-only DO route. Destination
+composition must bind current device revocation authority and pinned issuers, use the verified
+identity token's organization authority, fail closed when
+unavailable, and refuse redirects when fetching the pinned origin's JWKS.
+
+## Phase 4 signed-in Po Cloud
+
+Po Cloud is NOT operator-blind. The Agimon operator controls the Worker and its wrapping
+secret and can access org-shared cloud data and provider keys. Encryption at rest does not
+protect against a compromised operator or running Worker.
+
+Set `PO_CLOUD_MODE=signed-in`, configure the identity issuer and its existing secrets, and
+set a separate high-entropy `PO_ORG_KEY_WRAP` secret (at least 32 characters). Keep it stable:
+changing it without rewrapping existing data keys makes stored provider keys unreadable.
+`PO_CLOUD_HOST_ID` defaults to `po-cloud`. Network ID and token audience are the org ID.
+Without signed-in mode, the attach bearer gate and `workspaceId/sessionId` session DO names
+stay unchanged, even if this Worker also serves identity endpoints.
+
+Bootstrap with authenticated `POST /api/auth/personal-org` and `{ "trigger": "cloud-workspace" }`.
+The identity transaction creates the personal org, owner membership and first workspace allocation
+idempotently. Enroll the device and mint its org-bound identity token through the existing identity
+API. Every subsequent workspace/provider REST/socket request needs `Authorization: Bearer <identity-token>` and
+`x-po-envelope`, a JSON C3 signed envelope over the actual method, path/query and body. Root
+workspace-list/create and org-key routes use an empty signed workspace ID. Session routes include
+both workspace and session IDs when present. TLS, configured issuer binding, current membership,
+device key and revocation epoch, audience, destination and durable nonce admission are checked
+before dispatch. Caller-supplied identity stamps are never trusted. Delegated workspace/plugin
+calls remain refused here; roster host proofs provide separate control-plane authority.
+
+Routes mirror the native hostActions reply shapes:
+
+- `POST /api/workspaces` with an optional `name` returns `{ workspace }` (201).
+  Cloud workspaces are virtual folders, not local repository admissions; `root` is refused.
+- `GET /api/workspaces` returns `{ workspaces }` for the current org's identity allocations.
+- `POST /api/workspaces/:id/sessions` with an optional `name` returns `{ sessionId }` (201).
+- `GET /api/workspaces/:id/sessions` and `GET /api/workspaces/:id/sessions/:sessionId` list/read
+  directory summaries. Session runtime state is served over the existing session socket.
+- `GET /api/workspaces/:id/sessions/:sessionId/ws` attaches only an allocated session.
+- `POST /api/orgs/:orgId/provider-key` with `{ "apiKey": "..." }` requires a current owner/admin.
+  There is no public key-read route. The configured OpenAI-compatible provider/model/base URL
+  still come from Worker configuration. `DELETE` on the same route removes the stored key (204).
+- `DELETE /api/workspaces/:id/sessions/:sessionId` purges the session object, then its directory row (204).
+- `GET /api/orgs/:orgId/mcp-servers` lists the org's URL MCP servers as `{ servers: [{ name, url, headerNames }] }`,
+  never header values. `POST` with `{ "name", "url", "headers" }` adds or replaces one (201), and
+  `DELETE /api/orgs/:orgId/mcp-servers/:name` removes it (204). All three require a current owner/admin.
+  URLs must be https and may not name an IP address, localhost or private suffix, `*.workers.dev`, a cloud
+  metadata host, or the issuer's own zone. At most 10 servers per org (429 beyond). Header values are sealed
+  like the provider key. Sessions see these servers only when the Worker var `PO_CLOUD_MCP` is `on` (off by
+  default); requests then run under the same host policy with redirects refused, a 4 MiB response cap and a
+  30 second timeout.
+- Rendered web pages: with the Worker var `PO_CLOUD_WEB` set to `on` (off by default) and the `BROWSER`
+  Browser Rendering binding from `wrangler.jsonc`, signed-in sessions get the code-mode `page` namespace
+  (`fetchPage`, `snapshot`, `screenshot`). One browser per session, one page at a time. Every request a page
+  makes, redirects included, passes the same host policy (http or https). Pages end after 20 seconds,
+  screenshots are capped at 2 MiB, and each org may use 600 browser-seconds per UTC day, counted in the org
+  object; past that, calls fail with a message saying the allowance is used up.
+- Abuse ceilings: at most 100 new sessions per org per hour and 100 workspaces per org (429 beyond).
+  Signed-in session sockets close with code 4401 after 15 minutes so reconnecting re-runs admission.
+
+Cookie admission (native and desktop apps): instead of a token and envelope, a client may send the
+Po identity session cookie plus `x-po-org: <orgId>` for workspace list/create, session
+create/list/read/socket/delete and provider-key set/delete only. Calendar, consents, config,
+compositions, relay and network routes stay device-signed. The org DO resolves the cookie through
+identity `get-session` (cached 30 seconds per cookie hash), then checks membership or workspace
+allocation on every request. TLS is required, `x-po-org` is mandatory, and any `Origin` other than
+none, the issuer or `po://` is refused, so proxies must strip a browser Origin.
+
+`PoNetworkObject` uses `orgId`; session objects use `orgId/workspaceId/sessionId`. Identity
+allocations are authoritative, so invented workspace IDs never create an accessible object.
+The identity durable outbox materializes workspace directory rows with insert-if-absent.
+Cloud requests drain it, and the identity alarm retries pending jobs every 60 seconds alongside
+recovery deadlines. Account-deletion purge jobs tombstone the org first, remove the encrypted
+provider key and wrapped data key, close live tenant sessions and delete their DO storage, then
+clear the directory. The identity job is acknowledged only after all session deletions succeed.
+The retained tombstone rejects stale materialization deliveries and all future cloud writes.
+Directory writes recheck the fence after asynchronous work, so sessions committed before the
+fence are enumerated and later session writes are refused. Legacy bearer DOs are never enumerated.
+A retry repeats deletion safely; failed shutdown/deletion retains the directory for retry.
+Boot restores the persisted work deadline. A failed delivery stays pending;
+a crash after materialization but before acknowledgement retries the same row.
+
+`ponytail:` Workspace config/directory currently lives in the org's network DO, not a separate
+workspace DO. Ceiling: one org DO serialises all workspace directory writes. Upgrade: split to
+`PoWorkspaceObject` per section 4.4 when load or phase 6 workspace-scope negotiation requires it.
+Phase 5 adds roster, voting and relay behavior as described below.
+
+Provider keys are AES-GCM ciphertext in network SQL, under a fresh random per-org data key on each
+replacement. That data key is itself AES-GCM wrapped by a SHA-256-derived key from the Worker
+secret. Both layers have independent random 96-bit IVs and authenticate the org ID as associated
+data. Only ciphertext, IVs and the wrapped key are persisted. Session composition decrypts into
+memory via a trusted binding RPC; signed-in sessions never fall back to the operator provider key.
+New keys apply to newly composed sessions, not already booted sessions. Neither request bodies,
+plaintext keys nor exception messages from cloud dispatch are logged.
+
+## Session Approval and Code mode
+
+Stock session composition includes Approval and Code mode through the existing DO SQLite and
+QuickJS ports. Each one-session DO mounts Approval's generated global root before creating its
+session. The queue is host-global within that tenant-isolated DO, not an org-wide or cross-DO
+aggregate. Other packages contribute portable namespaces with gated members; the verification
+contributor exists only in the test build, not the stock Worker artifact.
+
+## Phase 5 network and ciphertext relay
+
+In signed-in mode, `GET /api/networks/:id/roster` verifies the existing identity token and
+C3 device proof (`workspaceId: ''`), fetches the issuer snapshot and enrolled-device pins,
+and serially applies C6 before publishing its persisted snapshot. Equal epochs may refresh
+only the issuer signature lifetime, never roster content. Removed hosts retain tombstones.
+Cloud generates its own per-network P-256 host key in DO storage and registers its host
+entry through the issuer-signed cloud-host helper. Cloud trust stops at issuer device
+enrollment, not independent physical pins. Cloud remains operator-readable.
+
+`POST /api/networks/:id/network/:operation` uses the shared typed allowlist:
+
+- `roster.read`: `{networkId}` returns the cached signed snapshot.
+- `roster.apply`: a signed snapshot, verified against configured issuer and enrolled pins.
+  Equal/older epochs, forged snapshots and invalid host signatures are refused.
+- `coordinator.vote`: a C9 proposal returns the cloud's signed vote only after durable commit.
+- `coordinator.lease`: a quorum certificate atomically persists its fence and gateway lease.
+- `coordinator.mutate`: `{lease,operation:'directory.put',input:{hostId,manifest}}` atomically
+  checks the receiver fence and stores the directory effect in the same SQL transaction.
+
+Person requests keep C3 and current membership checks. Hosts may call only `roster.read`,
+`coordinator.vote` and `coordinator.lease`, using `x-po-host-proof`: a signed
+`po/host-request/v1` envelope with `{networkId,hostId,destination,method,path,bodyHash,nonce,
+issuedAt,expiresAt}`. Destination is `PO_CLOUD_HOST_ID`, method is `POST`, path is the actual
+pathname and bodyHash is base64url SHA-256 of the exact JSON body. Nonces are durable and
+single-use. Vote/lease callers must be current roster voters. This proof cannot authorize
+workspace or plugin operations. The Worker also forwards issuer `own-hub-link`, `hosts`,
+`changes` routes and host-proof roster reads (`x-po-roster-proof`) to the identity DO.
+
+`GET /api/networks/:id/relay?hostId=<hint>` upgrades only for a current roster host and
+while a valid persisted quorum lease elects Po Cloud. No person token grants socket authority.
+The upgraded socket is initially unadmitted and receives `{challenge,expiresAt}` with a
+32-byte random challenge and 30-second TTL. Reply with a host-key-signed
+`po/host-request/v1` envelope `{networkId,hostId,destination,method:'RELAY',path,nonce,
+issuedAt,expiresAt}`. The nonce must equal this socket's challenge. The envelope lifetime
+is at most 60 seconds and uses the 30 second envelope skew independently of the challenge TTL. The first proof
+attempt consumes the challenge; a bad or late proof closes the socket. Success returns
+`{admitted:true,hostId}`. There is no device C3 requirement for this host-only handshake.
+
+Hibernating socket tags are immutable, so the hint tag is only an index. Every source and
+destination must also have an admitted attachment with the current roster epoch and host
+key. At most four unadmitted sockets may use one hint. Admission replaces older admitted
+sockets; the DO alarm closes expired challenges. Roster changes close old links. Every
+forward refreshes issuer state and rechecks the cloud lease. Frames contain only
+`{destinationHostId,sealed}` and go only to that admitted host. The relay has no channel
+keys and never opens ciphertext. Destinations must use authenticated fresh channels and
+normal C3/C4 freshness, current authority and durable replay admission after decryption.
+
+One-voter networks self-elect during roster synchronization. Lease duration is at most
+30 seconds with a two-second C9 clock bound. C6 snapshots bootstrap the C9 voter set once;
+they never silently replace a committed voter configuration. Multi-voter campaigning and
+quorum configuration transitions are not automated here. Without a valid cloud lease the
+relay pauses; direct authenticated links do not depend on a coordinator. Two voters need
+both votes, so one down means no coordinator. Safety is crash-fault tolerant under bounded
+clocks, not Byzantine-safe. No live Cloudflare deployment or real-device test is claimed.
+
+Replay TTL purge runs **on every admission write in the deployed network DO**, using the phase 3
+indexed SQL expiry delete before insert-if-absent. No in-memory-only replay cache and no replay
+alarm slot are used. Idle expired rows remain until the next admission, but cannot be replayed.
+
+### Verification boundary
+
+`tests/cloud.test.ts` runs the real Worker/DO composition in workerd via the same Wrangler harness
+as existing tests. Its test-only TLS terminator also protects signed header bytes from the local
+harness's origin rewriting. There is no production TLS bypass. Tests cover tenant refusals,
+unallocated IDs, REST reply shapes, role changes, SQL ciphertext inspection, captured Node and
+workerd console output, persisted post-commit outbox recovery, lost acknowledgement retries,
+actual production alarm delivery, deployed on-write nonce purge, in-memory provider decryption
+through modelDependencies, and account purge with a stale materialization delivery/repeated purge.
+The purge test seeds tenant session SQL; purging an actively running model turn is not exercised.
+
+The crash test seeds the durable post-commit shape rather than killing a Worker process. Forced
+identity DO eviction in this local harness produced an initial `ECONNRESET`; a subsequent request
+succeeded. Cold identity alarm delivery after eviction is not verified here. No production retry
+or security bypass was added to conceal this limitation. Real cloud deployment and native-device
+transport integration remain unverified; this phase does not change native hostActions.

package/dist/BrowserWebSocketTransport-C2SC2VeJ.js

@@ -0,0 +1 @@
+export { BrowserWebSocketTransport } from "./puppeteer-cloudflare-B-GHrPGO.js";

package/dist/NodeWebSocketTransport-CKilJesa.js

@@ -0,0 +1,58 @@
+import { i as __toESM, t as __commonJSMin } from "./rolldown-runtime-B-lAHAz2.js";
+import { t as packageVersion } from "./puppeteer-cloudflare-B-GHrPGO.js";
+//#endregion
+//#region ../../../node_modules/.pnpm/@cloudflare+puppeteer@1.4.0_supports-color@8.1.1/node_modules/@cloudflare/puppeteer/lib/esm/puppeteer/node/NodeWebSocketTransport.js
+var import_browser = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function() {
+		throw new Error("ws does not work in the browser. Browser clients must use the native WebSocket object");
+	};
+})))());
+/**
+* @license
+* Copyright 2018 Google Inc.
+* SPDX-License-Identifier: Apache-2.0
+*/
+/**
+* @internal
+*/
+var NodeWebSocketTransport = class NodeWebSocketTransport {
+	static create(url, headers) {
+		return new Promise((resolve, reject) => {
+			const ws = new import_browser.default(url, [], {
+				followRedirects: true,
+				perMessageDeflate: false,
+				allowSynchronousEvents: false,
+				maxPayload: 268435456,
+				headers: {
+					"User-Agent": `Puppeteer ${packageVersion}`,
+					...headers
+				}
+			});
+			ws.addEventListener("open", () => {
+				return resolve(new NodeWebSocketTransport(ws));
+			});
+			ws.addEventListener("error", reject);
+		});
+	}
+	#ws;
+	onmessage;
+	onclose;
+	constructor(ws) {
+		this.#ws = ws;
+		this.#ws.addEventListener("message", (event) => {
+			if (this.onmessage) this.onmessage.call(null, event.data);
+		});
+		this.#ws.addEventListener("close", () => {
+			if (this.onclose) this.onclose.call(null);
+		});
+		this.#ws.addEventListener("error", () => {});
+	}
+	send(message) {
+		this.#ws.send(message);
+	}
+	close() {
+		this.#ws.close();
+	}
+};
+//#endregion
+export { NodeWebSocketTransport };