@agimon-ai/po-web-dashboard 0.0.0-alpha.0

package/dist/types/media.cjs

@@ -0,0 +1,75 @@
+let _agimon_ai_po_core_web = require("@agimon-ai/po-core/web");
+//#region src/types/media.ts
+/** Keyed by lower-case extension without the dot. */
+const MEDIA_TYPES = {
+	avif: {
+		kind: "image",
+		contentType: "image/avif"
+	},
+	bmp: {
+		kind: "image",
+		contentType: "image/bmp"
+	},
+	gif: {
+		kind: "image",
+		contentType: "image/gif"
+	},
+	jpeg: {
+		kind: "image",
+		contentType: "image/jpeg"
+	},
+	jpg: {
+		kind: "image",
+		contentType: "image/jpeg"
+	},
+	png: {
+		kind: "image",
+		contentType: "image/png"
+	},
+	svg: {
+		kind: "image",
+		contentType: "image/svg+xml"
+	},
+	webp: {
+		kind: "image",
+		contentType: "image/webp"
+	},
+	m4v: {
+		kind: "video",
+		contentType: "video/mp4"
+	},
+	mov: {
+		kind: "video",
+		contentType: "video/quicktime"
+	},
+	mp4: {
+		kind: "video",
+		contentType: "video/mp4"
+	},
+	webm: {
+		kind: "video",
+		contentType: "video/webm"
+	},
+	pdf: {
+		kind: "pdf",
+		contentType: "application/pdf"
+	}
+};
+/** The hub refuses to serve a mentioned file past this size. */
+const MAX_SESSION_FILE_BYTES = 26214400;
+/** Session file bytes; paths may be cwd-relative or absolute inside the working directory. */
+const SESSION_FILE_ROUTE = "/api/workspaces/:workspaceId/sessions/:sessionId/file";
+const SESSION_FILE_SHA256_HEADER = "X-File-SHA256";
+const SESSION_FILE_EXPECTED_SHA256_HEADER = "X-Expected-SHA256";
+function sessionFileUrl(sessionId, relativePath) {
+	return `${(0, _agimon_ai_po_core_web.sessionApiPath)(sessionId)}/file?path=${encodeURIComponent(relativePath)}`;
+}
+//#endregion
+exports.MAX_SESSION_FILE_BYTES = MAX_SESSION_FILE_BYTES;
+exports.MEDIA_TYPES = MEDIA_TYPES;
+exports.SESSION_FILE_EXPECTED_SHA256_HEADER = SESSION_FILE_EXPECTED_SHA256_HEADER;
+exports.SESSION_FILE_ROUTE = SESSION_FILE_ROUTE;
+exports.SESSION_FILE_SHA256_HEADER = SESSION_FILE_SHA256_HEADER;
+exports.sessionFileUrl = sessionFileUrl;
+
+//# sourceMappingURL=media.cjs.map

package/dist/types/media.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.cjs","names":["sessionApiPath"],"sources":["../../src/types/media.ts"],"sourcesContent":["import { sessionApiPath } from '@agimon-ai/po-core/web';\n/**\n * How the cockpit previews a file a message mentions: the hub serves it from\n * the session's working directory and the timeline picks the element by\n * kind. Anything not listed here is offered as a plain file link.\n */\nexport type MediaKind = 'image' | 'video' | 'pdf';\n\nexport interface MediaType {\n  kind: MediaKind;\n  contentType: string;\n}\n\n/** Keyed by lower-case extension without the dot. */\nexport const MEDIA_TYPES: Readonly<Record<string, MediaType>> = {\n  avif: { kind: 'image', contentType: 'image/avif' },\n  bmp: { kind: 'image', contentType: 'image/bmp' },\n  gif: { kind: 'image', contentType: 'image/gif' },\n  jpeg: { kind: 'image', contentType: 'image/jpeg' },\n  jpg: { kind: 'image', contentType: 'image/jpeg' },\n  png: { kind: 'image', contentType: 'image/png' },\n  svg: { kind: 'image', contentType: 'image/svg+xml' },\n  webp: { kind: 'image', contentType: 'image/webp' },\n  m4v: { kind: 'video', contentType: 'video/mp4' },\n  mov: { kind: 'video', contentType: 'video/quicktime' },\n  mp4: { kind: 'video', contentType: 'video/mp4' },\n  webm: { kind: 'video', contentType: 'video/webm' },\n  pdf: { kind: 'pdf', contentType: 'application/pdf' },\n};\n\n/** The hub refuses to serve a mentioned file past this size. */\nexport const MAX_SESSION_FILE_BYTES = 25 * 1024 * 1024;\n\n/** Session file bytes; paths may be cwd-relative or absolute inside the working directory. */\nexport const SESSION_FILE_ROUTE = '/api/workspaces/:workspaceId/sessions/:sessionId/file';\nexport const SESSION_FILE_SHA256_HEADER = 'X-File-SHA256';\nexport const SESSION_FILE_EXPECTED_SHA256_HEADER = 'X-Expected-SHA256';\n\nexport function sessionFileUrl(sessionId: string, relativePath: string): string {\n  return `${sessionApiPath(sessionId)}/file?path=${encodeURIComponent(relativePath)}`;\n}\n"],"mappings":";;;AAcA,MAAa,cAAmD;CAC9D,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAa;CAChD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAgB;CACnD,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAkB;CACrD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAO,aAAa;CAAkB;AACrD;;AAGA,MAAa,yBAAyB;;AAGtC,MAAa,qBAAqB;AAClC,MAAa,6BAA6B;AAC1C,MAAa,sCAAsC;AAEnD,SAAgB,eAAe,WAAmB,cAA8B;CAC9E,OAAO,IAAA,GAAGA,uBAAAA,eAAAA,CAAe,SAAS,EAAE,aAAa,mBAAmB,YAAY;AAClF"}

package/dist/types/media.d.mts

@@ -0,0 +1,22 @@
+//#region src/types/media.d.ts
+/**
+ * How the cockpit previews a file a message mentions: the hub serves it from
+ * the session's working directory and the timeline picks the element by
+ * kind. Anything not listed here is offered as a plain file link.
+ */
+export type MediaKind = 'image' | 'video' | 'pdf';
+export interface MediaType {
+  kind: MediaKind;
+  contentType: string;
+}
+/** Keyed by lower-case extension without the dot. */
+export declare const MEDIA_TYPES: Readonly<Record<string, MediaType>>;
+/** The hub refuses to serve a mentioned file past this size. */
+export declare const MAX_SESSION_FILE_BYTES: number;
+/** Session file bytes; paths may be cwd-relative or absolute inside the working directory. */
+export declare const SESSION_FILE_ROUTE = "/api/workspaces/:workspaceId/sessions/:sessionId/file";
+export declare const SESSION_FILE_SHA256_HEADER = "X-File-SHA256";
+export declare const SESSION_FILE_EXPECTED_SHA256_HEADER = "X-Expected-SHA256";
+export declare function sessionFileUrl(sessionId: string, relativePath: string): string;
+//#endregion
+//# sourceMappingURL=media.d.mts.map

package/dist/types/media.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.mts","names":[],"sources":["../../src/types/media.ts"],"mappings":";;;;;;YAMY;iBAEK;EACf,MAAM;EACN;;;qBAIW,aAAa,SAAS,eAAe;;qBAiBrC;;qBAGA;qBACA;qBACA;wBAEG,eAAe,mBAAmB"}

package/dist/types/media.mjs

@@ -0,0 +1,70 @@
+import { sessionApiPath } from "@agimon-ai/po-core/web";
+//#region src/types/media.ts
+/** Keyed by lower-case extension without the dot. */
+const MEDIA_TYPES = {
+	avif: {
+		kind: "image",
+		contentType: "image/avif"
+	},
+	bmp: {
+		kind: "image",
+		contentType: "image/bmp"
+	},
+	gif: {
+		kind: "image",
+		contentType: "image/gif"
+	},
+	jpeg: {
+		kind: "image",
+		contentType: "image/jpeg"
+	},
+	jpg: {
+		kind: "image",
+		contentType: "image/jpeg"
+	},
+	png: {
+		kind: "image",
+		contentType: "image/png"
+	},
+	svg: {
+		kind: "image",
+		contentType: "image/svg+xml"
+	},
+	webp: {
+		kind: "image",
+		contentType: "image/webp"
+	},
+	m4v: {
+		kind: "video",
+		contentType: "video/mp4"
+	},
+	mov: {
+		kind: "video",
+		contentType: "video/quicktime"
+	},
+	mp4: {
+		kind: "video",
+		contentType: "video/mp4"
+	},
+	webm: {
+		kind: "video",
+		contentType: "video/webm"
+	},
+	pdf: {
+		kind: "pdf",
+		contentType: "application/pdf"
+	}
+};
+/** The hub refuses to serve a mentioned file past this size. */
+const MAX_SESSION_FILE_BYTES = 26214400;
+/** Session file bytes; paths may be cwd-relative or absolute inside the working directory. */
+const SESSION_FILE_ROUTE = "/api/workspaces/:workspaceId/sessions/:sessionId/file";
+const SESSION_FILE_SHA256_HEADER = "X-File-SHA256";
+const SESSION_FILE_EXPECTED_SHA256_HEADER = "X-Expected-SHA256";
+function sessionFileUrl(sessionId, relativePath) {
+	return `${sessionApiPath(sessionId)}/file?path=${encodeURIComponent(relativePath)}`;
+}
+//#endregion
+export { MAX_SESSION_FILE_BYTES, MEDIA_TYPES, SESSION_FILE_EXPECTED_SHA256_HEADER, SESSION_FILE_ROUTE, SESSION_FILE_SHA256_HEADER, sessionFileUrl };
+
+//# sourceMappingURL=media.mjs.map

package/dist/types/media.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.mjs","names":[],"sources":["../../src/types/media.ts"],"sourcesContent":["import { sessionApiPath } from '@agimon-ai/po-core/web';\n/**\n * How the cockpit previews a file a message mentions: the hub serves it from\n * the session's working directory and the timeline picks the element by\n * kind. Anything not listed here is offered as a plain file link.\n */\nexport type MediaKind = 'image' | 'video' | 'pdf';\n\nexport interface MediaType {\n  kind: MediaKind;\n  contentType: string;\n}\n\n/** Keyed by lower-case extension without the dot. */\nexport const MEDIA_TYPES: Readonly<Record<string, MediaType>> = {\n  avif: { kind: 'image', contentType: 'image/avif' },\n  bmp: { kind: 'image', contentType: 'image/bmp' },\n  gif: { kind: 'image', contentType: 'image/gif' },\n  jpeg: { kind: 'image', contentType: 'image/jpeg' },\n  jpg: { kind: 'image', contentType: 'image/jpeg' },\n  png: { kind: 'image', contentType: 'image/png' },\n  svg: { kind: 'image', contentType: 'image/svg+xml' },\n  webp: { kind: 'image', contentType: 'image/webp' },\n  m4v: { kind: 'video', contentType: 'video/mp4' },\n  mov: { kind: 'video', contentType: 'video/quicktime' },\n  mp4: { kind: 'video', contentType: 'video/mp4' },\n  webm: { kind: 'video', contentType: 'video/webm' },\n  pdf: { kind: 'pdf', contentType: 'application/pdf' },\n};\n\n/** The hub refuses to serve a mentioned file past this size. */\nexport const MAX_SESSION_FILE_BYTES = 25 * 1024 * 1024;\n\n/** Session file bytes; paths may be cwd-relative or absolute inside the working directory. */\nexport const SESSION_FILE_ROUTE = '/api/workspaces/:workspaceId/sessions/:sessionId/file';\nexport const SESSION_FILE_SHA256_HEADER = 'X-File-SHA256';\nexport const SESSION_FILE_EXPECTED_SHA256_HEADER = 'X-Expected-SHA256';\n\nexport function sessionFileUrl(sessionId: string, relativePath: string): string {\n  return `${sessionApiPath(sessionId)}/file?path=${encodeURIComponent(relativePath)}`;\n}\n"],"mappings":";;;AAcA,MAAa,cAAmD;CAC9D,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAa;CAChD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAgB;CACnD,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,KAAK;EAAE,MAAM;EAAS,aAAa;CAAkB;CACrD,KAAK;EAAE,MAAM;EAAS,aAAa;CAAY;CAC/C,MAAM;EAAE,MAAM;EAAS,aAAa;CAAa;CACjD,KAAK;EAAE,MAAM;EAAO,aAAa;CAAkB;AACrD;;AAGA,MAAa,yBAAyB;;AAGtC,MAAa,qBAAqB;AAClC,MAAa,6BAA6B;AAC1C,MAAa,sCAAsC;AAEnD,SAAgB,eAAe,WAAmB,cAA8B;CAC9E,OAAO,GAAG,eAAe,SAAS,EAAE,aAAa,mBAAmB,YAAY;AAClF"}

package/dist/types/notification.cjs

@@ -0,0 +1,19 @@
+let _agimon_ai_po_core_notification = require("@agimon-ai/po-core/notification");
+//#region src/types/notification.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Reads only a direct, validated Doom notification custom-entry frame. */
+function parseDoomNotificationEntry(frame) {
+	if (!isRecord(frame) || frame.type !== "entry_appended" || !isRecord(frame.entry)) return void 0;
+	const entry = frame.entry;
+	if (entry.type !== "custom" || entry.customType !== _agimon_ai_po_core_notification.DOOM_NOTIFICATION_ENTRY_TYPE || typeof entry.id !== "string" || entry.id.trim().length === 0 || !(0, _agimon_ai_po_core_notification.isDoomNotificationEntryData)(entry.data)) return;
+	return {
+		entryId: entry.id,
+		data: entry.data
+	};
+}
+//#endregion
+exports.parseDoomNotificationEntry = parseDoomNotificationEntry;
+
+//# sourceMappingURL=notification.cjs.map

package/dist/types/notification.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.cjs","names":["DOOM_NOTIFICATION_ENTRY_TYPE","isDoomNotificationEntryData"],"sources":["../../src/types/notification.ts"],"sourcesContent":["import {\n  DOOM_NOTIFICATION_ENTRY_TYPE,\n  type DoomNotificationEntryData,\n  isDoomNotificationEntryData,\n} from '@agimon-ai/po-core/notification';\n\nexport interface DoomNotificationEntry {\n  entryId: string;\n  data: DoomNotificationEntryData;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** Reads only a direct, validated Doom notification custom-entry frame. */\nexport function parseDoomNotificationEntry(frame: unknown): DoomNotificationEntry | undefined {\n  if (!isRecord(frame) || frame.type !== 'entry_appended' || !isRecord(frame.entry)) return undefined;\n  const entry = frame.entry;\n  if (\n    entry.type !== 'custom' ||\n    entry.customType !== DOOM_NOTIFICATION_ENTRY_TYPE ||\n    typeof entry.id !== 'string' ||\n    entry.id.trim().length === 0 ||\n    !isDoomNotificationEntryData(entry.data)\n  ) {\n    return undefined;\n  }\n  return { entryId: entry.id, data: entry.data };\n}\n"],"mappings":";;AAWA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,SAAgB,2BAA2B,OAAmD;CAC5F,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,oBAAoB,CAAC,SAAS,MAAM,KAAK,GAAG,OAAO,KAAA;CAC1F,MAAM,QAAQ,MAAM;CACpB,IACE,MAAM,SAAS,YACf,MAAM,eAAeA,gCAAAA,gCACrB,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,KAC3B,EAAA,GAACC,gCAAAA,4BAAAA,CAA4B,MAAM,IAAI,GAEvC;CAEF,OAAO;EAAE,SAAS,MAAM;EAAI,MAAM,MAAM;CAAK;AAC/C"}

package/dist/types/notification.d.mts

@@ -0,0 +1,10 @@
+import { DoomNotificationEntryData } from "@agimon-ai/po-core/notification";
+//#region src/types/notification.d.ts
+export interface DoomNotificationEntry {
+  entryId: string;
+  data: DoomNotificationEntryData;
+}
+/** Reads only a direct, validated Doom notification custom-entry frame. */
+export declare function parseDoomNotificationEntry(frame: unknown): DoomNotificationEntry | undefined;
+//#endregion
+//# sourceMappingURL=notification.d.mts.map

package/dist/types/notification.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.d.mts","names":[],"sources":["../../src/types/notification.ts"],"mappings":";;iBAMiB;EACf;EACA,MAAM;;;wBAQQ,2BAA2B,iBAAiB"}

package/dist/types/notification.mjs

@@ -0,0 +1,19 @@
+import { DOOM_NOTIFICATION_ENTRY_TYPE, isDoomNotificationEntryData } from "@agimon-ai/po-core/notification";
+//#region src/types/notification.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Reads only a direct, validated Doom notification custom-entry frame. */
+function parseDoomNotificationEntry(frame) {
+	if (!isRecord(frame) || frame.type !== "entry_appended" || !isRecord(frame.entry)) return void 0;
+	const entry = frame.entry;
+	if (entry.type !== "custom" || entry.customType !== DOOM_NOTIFICATION_ENTRY_TYPE || typeof entry.id !== "string" || entry.id.trim().length === 0 || !isDoomNotificationEntryData(entry.data)) return;
+	return {
+		entryId: entry.id,
+		data: entry.data
+	};
+}
+//#endregion
+export { parseDoomNotificationEntry };
+
+//# sourceMappingURL=notification.mjs.map

package/dist/types/notification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.mjs","names":[],"sources":["../../src/types/notification.ts"],"sourcesContent":["import {\n  DOOM_NOTIFICATION_ENTRY_TYPE,\n  type DoomNotificationEntryData,\n  isDoomNotificationEntryData,\n} from '@agimon-ai/po-core/notification';\n\nexport interface DoomNotificationEntry {\n  entryId: string;\n  data: DoomNotificationEntryData;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** Reads only a direct, validated Doom notification custom-entry frame. */\nexport function parseDoomNotificationEntry(frame: unknown): DoomNotificationEntry | undefined {\n  if (!isRecord(frame) || frame.type !== 'entry_appended' || !isRecord(frame.entry)) return undefined;\n  const entry = frame.entry;\n  if (\n    entry.type !== 'custom' ||\n    entry.customType !== DOOM_NOTIFICATION_ENTRY_TYPE ||\n    typeof entry.id !== 'string' ||\n    entry.id.trim().length === 0 ||\n    !isDoomNotificationEntryData(entry.data)\n  ) {\n    return undefined;\n  }\n  return { entryId: entry.id, data: entry.data };\n}\n"],"mappings":";;AAWA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,SAAgB,2BAA2B,OAAmD;CAC5F,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,oBAAoB,CAAC,SAAS,MAAM,KAAK,GAAG,OAAO,KAAA;CAC1F,MAAM,QAAQ,MAAM;CACpB,IACE,MAAM,SAAS,YACf,MAAM,eAAe,gCACrB,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,KAC3B,CAAC,4BAA4B,MAAM,IAAI,GAEvC;CAEF,OAAO;EAAE,SAAS,MAAM;EAAI,MAAM,MAAM;CAAK;AAC/C"}

package/dist/types/remoteAccess.cjs

@@ -0,0 +1,92 @@
+//#region src/types/remoteAccess.ts
+/**
+* Wire vocabulary for remote access, shared by the hub routes and the cockpit.
+*
+* Remote access binds a second loopback listener that a tunnel points at, and
+* everything arriving there must prove it holds a paired session. The
+* discriminator is the listening socket, not a header: a tunnel connects from
+* 127.0.0.1 like every local client, and there is no header a remote caller
+* cannot forge.
+*/
+/** REST surface for the remote-access control plane; local callers only, except turn-off and revoke. */
+const REMOTE_API_ROUTE = "/api/remote";
+/** Direct endpoint that establishes one scoped end-to-end channel. */
+const REMOTE_CHANNEL_ROUTE = `${REMOTE_API_ROUTE}/channel`;
+/** The only authenticated HTTP gateway exposed on the tunnel listener. */
+const REMOTE_HTTP_ROUTE = `${REMOTE_API_ROUTE}/request`;
+/** Device-bound, sealed routes for ephemeral live Web Push registration. */
+/** Trusted native devices; `DELETE ${TRUSTED_DEVICES_ROUTE}/:id` revokes one. Mirrors po-core's constant. */
+const TRUSTED_DEVICES_ROUTE = `${REMOTE_API_ROUTE}/trusted-devices`;
+const REMOTE_PUSH_ROUTE = `${REMOTE_API_ROUTE}/push`;
+const REMOTE_PUSH_KEY_ROUTE = `${REMOTE_PUSH_ROUTE}/key`;
+const PROTOCOL_SOCKET_ROUTE = "/api/ws";
+/** The pairing page a scanned QR opens. Unauthenticated on the tunnel listener. */
+const PAIRING_PAGE_ROUTE = "/pair";
+/** Where the pairing page posts the scanned code. Unauthenticated on the tunnel listener. */
+const PAIRING_CLAIM_ROUTE = "/api/remote/pair";
+/** Polled until the host approves or denies. Unauthenticated on the tunnel listener. */
+const PAIRING_STATUS_ROUTE = "/api/remote/pair/status";
+/** Query parameter naming the pairing request; a path parameter would force a wildcard into the allowlist. */
+const PAIRING_STATUS_QUERY = "request";
+/** URL-fragment fields authenticated by seeing the host's physical QR. */
+const BUNDLE_SIGNING_KEY_PARAM = "s";
+const BUNDLE_MINIMUM_REVISION_PARAM = "r";
+/**
+* Session cookie base name. Rendered `__Host-po_device` by hono's `host`
+* prefix, which refuses the cookie unless it is Secure, Path=/, and
+* Domain-less, so a sibling subdomain can neither read nor overwrite it.
+*/
+const DEVICE_COOKIE = "po_device";
+/**
+* Passkey ceremonies exposed directly on the pairing surface.
+*
+* Sign-in is unauthenticated because it creates a session. Registration requires
+* the paired device cookie issued after host approval, but remains direct so the
+* self-contained pairing page can offer enrolment before loading the cockpit.
+*/
+const PASSKEY_AUTH_BEGIN_ROUTE = "/api/remote/passkeys/authenticate/begin";
+const PASSKEY_AUTH_FINISH_ROUTE = "/api/remote/passkeys/authenticate/finish";
+const PASSKEY_REGISTER_BEGIN_ROUTE = "/api/remote/passkeys/register/begin";
+const PASSKEY_REGISTER_FINISH_ROUTE = "/api/remote/passkeys/register/finish";
+/** Header carrying a step-up assertion for an action that needs more than a live session. */
+const STEP_UP_HEADER = "x-po-assertion";
+/** The vite dev server port; the origin allowlist and vite.config.ts share this. */
+const WEB_DEV_SERVER_PORT = 7534;
+/** How long a scanned pairing code stays claimable. */
+const PAIRING_CODE_TTL_MS = 12e4;
+/** How long the host has to approve or deny a claimed request. */
+const PAIRING_REQUEST_TTL_MS = 18e4;
+/** Cookie lifetime when session expiry is switched off; a session cookie can outlive the laptop. */
+const COOKIE_CEILING_SECONDS = 2592e3;
+/** Hub frame announcing remote-access state; sent to local and remote pages. */
+const REMOTE_STATE_TYPE = "remote_state";
+/** Hub frame announcing a device waiting for approval; sent to local pages only. */
+const REMOTE_PAIRING_REQUEST_TYPE = "remote_pairing_request";
+//#endregion
+exports.BUNDLE_MINIMUM_REVISION_PARAM = BUNDLE_MINIMUM_REVISION_PARAM;
+exports.BUNDLE_SIGNING_KEY_PARAM = BUNDLE_SIGNING_KEY_PARAM;
+exports.COOKIE_CEILING_SECONDS = COOKIE_CEILING_SECONDS;
+exports.DEVICE_COOKIE = DEVICE_COOKIE;
+exports.PAIRING_CLAIM_ROUTE = PAIRING_CLAIM_ROUTE;
+exports.PAIRING_CODE_TTL_MS = PAIRING_CODE_TTL_MS;
+exports.PAIRING_PAGE_ROUTE = PAIRING_PAGE_ROUTE;
+exports.PAIRING_REQUEST_TTL_MS = PAIRING_REQUEST_TTL_MS;
+exports.PAIRING_STATUS_QUERY = PAIRING_STATUS_QUERY;
+exports.PAIRING_STATUS_ROUTE = PAIRING_STATUS_ROUTE;
+exports.PASSKEY_AUTH_BEGIN_ROUTE = PASSKEY_AUTH_BEGIN_ROUTE;
+exports.PASSKEY_AUTH_FINISH_ROUTE = PASSKEY_AUTH_FINISH_ROUTE;
+exports.PASSKEY_REGISTER_BEGIN_ROUTE = PASSKEY_REGISTER_BEGIN_ROUTE;
+exports.PASSKEY_REGISTER_FINISH_ROUTE = PASSKEY_REGISTER_FINISH_ROUTE;
+exports.PROTOCOL_SOCKET_ROUTE = PROTOCOL_SOCKET_ROUTE;
+exports.REMOTE_API_ROUTE = REMOTE_API_ROUTE;
+exports.REMOTE_CHANNEL_ROUTE = REMOTE_CHANNEL_ROUTE;
+exports.REMOTE_HTTP_ROUTE = REMOTE_HTTP_ROUTE;
+exports.REMOTE_PAIRING_REQUEST_TYPE = REMOTE_PAIRING_REQUEST_TYPE;
+exports.REMOTE_PUSH_KEY_ROUTE = REMOTE_PUSH_KEY_ROUTE;
+exports.REMOTE_PUSH_ROUTE = REMOTE_PUSH_ROUTE;
+exports.REMOTE_STATE_TYPE = REMOTE_STATE_TYPE;
+exports.STEP_UP_HEADER = STEP_UP_HEADER;
+exports.TRUSTED_DEVICES_ROUTE = TRUSTED_DEVICES_ROUTE;
+exports.WEB_DEV_SERVER_PORT = WEB_DEV_SERVER_PORT;
+
+//# sourceMappingURL=remoteAccess.cjs.map

package/dist/types/remoteAccess.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccess.cjs","names":[],"sources":["../../src/types/remoteAccess.ts"],"sourcesContent":["/**\n * Wire vocabulary for remote access, shared by the hub routes and the cockpit.\n *\n * Remote access binds a second loopback listener that a tunnel points at, and\n * everything arriving there must prove it holds a paired session. The\n * discriminator is the listening socket, not a header: a tunnel connects from\n * 127.0.0.1 like every local client, and there is no header a remote caller\n * cannot forge.\n */\n\n/** REST surface for the remote-access control plane; local callers only, except turn-off and revoke. */\nexport const REMOTE_API_ROUTE = '/api/remote';\n/** Direct endpoint that establishes one scoped end-to-end channel. */\nexport const REMOTE_CHANNEL_ROUTE = `${REMOTE_API_ROUTE}/channel`;\n/** The only authenticated HTTP gateway exposed on the tunnel listener. */\nexport const REMOTE_HTTP_ROUTE = `${REMOTE_API_ROUTE}/request`;\n/** Device-bound, sealed routes for ephemeral live Web Push registration. */\n/** Trusted native devices; `DELETE ${TRUSTED_DEVICES_ROUTE}/:id` revokes one. Mirrors po-core's constant. */\nexport const TRUSTED_DEVICES_ROUTE = `${REMOTE_API_ROUTE}/trusted-devices`;\nexport const REMOTE_PUSH_ROUTE = `${REMOTE_API_ROUTE}/push`;\nexport const REMOTE_PUSH_KEY_ROUTE = `${REMOTE_PUSH_ROUTE}/key`;\nexport const PROTOCOL_SOCKET_ROUTE = '/api/ws';\n/** The pairing page a scanned QR opens. Unauthenticated on the tunnel listener. */\nexport const PAIRING_PAGE_ROUTE = '/pair';\n/** Where the pairing page posts the scanned code. Unauthenticated on the tunnel listener. */\nexport const PAIRING_CLAIM_ROUTE = '/api/remote/pair';\n/** Polled until the host approves or denies. Unauthenticated on the tunnel listener. */\nexport const PAIRING_STATUS_ROUTE = '/api/remote/pair/status';\n/** Query parameter naming the pairing request; a path parameter would force a wildcard into the allowlist. */\nexport const PAIRING_STATUS_QUERY = 'request';\n/** URL-fragment fields authenticated by seeing the host's physical QR. */\nexport const BUNDLE_SIGNING_KEY_PARAM = 's';\nexport const BUNDLE_MINIMUM_REVISION_PARAM = 'r';\n\n/**\n * Session cookie base name. Rendered `__Host-po_device` by hono's `host`\n * prefix, which refuses the cookie unless it is Secure, Path=/, and\n * Domain-less, so a sibling subdomain can neither read nor overwrite it.\n */\nexport const DEVICE_COOKIE = 'po_device';\n\n/**\n * Passkey ceremonies exposed directly on the pairing surface.\n *\n * Sign-in is unauthenticated because it creates a session. Registration requires\n * the paired device cookie issued after host approval, but remains direct so the\n * self-contained pairing page can offer enrolment before loading the cockpit.\n */\nexport const PASSKEY_AUTH_BEGIN_ROUTE = '/api/remote/passkeys/authenticate/begin';\nexport const PASSKEY_AUTH_FINISH_ROUTE = '/api/remote/passkeys/authenticate/finish';\nexport const PASSKEY_REGISTER_BEGIN_ROUTE = '/api/remote/passkeys/register/begin';\nexport const PASSKEY_REGISTER_FINISH_ROUTE = '/api/remote/passkeys/register/finish';\n\n/** Header carrying a step-up assertion for an action that needs more than a live session. */\nexport const STEP_UP_HEADER = 'x-po-assertion';\n\n/** The vite dev server port; the origin allowlist and vite.config.ts share this. */\nexport const WEB_DEV_SERVER_PORT = 7534;\n\n/** How long a scanned pairing code stays claimable. */\nexport const PAIRING_CODE_TTL_MS = 120_000;\n/** How long the host has to approve or deny a claimed request. */\nexport const PAIRING_REQUEST_TTL_MS = 180_000;\n/** Cookie lifetime when session expiry is switched off; a session cookie can outlive the laptop. */\nexport const COOKIE_CEILING_SECONDS = 30 * 24 * 60 * 60;\n\nexport type TunnelKind = 'quick' | 'named';\nexport type RemoteChannelScope = 'session' | 'protocol' | 'http';\n\n/**\n * How the tunnel is established.\n *\n * `named` carries a hostname rather than discovering one, which is why it is\n * the mode that supports passkeys, a service worker, and durable pairing: all\n * three are bound to the origin, and a quick tunnel's hostname rotates on every\n * start. The token is referenced by path, never stored inline, because it is a\n * Cloudflare account credential and an inlined one ends up in a bug report.\n */\nexport type TunnelConfig =\n  | { kind: 'quick' }\n  | { kind: 'named'; hostname: string; name?: string; tokenFile?: string; configFile?: string };\n\n/**\n * Running the cockpit in a container.\n *\n * Tied to remote access rather than offered separately: the reason to contain\n * the cockpit is that a paired device drives an agent holding a shell, and the\n * containment only means anything if it is in place before the tunnel is.\n *\n * The workspace list is the boundary. A hub inside the container cannot create\n * a session in a path that is not mounted, so arbitrary-directory spawning is\n * closed by construction rather than by a check.\n */\nexport interface SandboxSettings {\n  enabled: boolean;\n  /** Absolute host directories the contained cockpit may work in. */\n  workspaces: string[];\n}\n\n/**\n * A session the handover has to account for.\n *\n * Only what recreating it needs: the container hub spawns a fresh server, so\n * nothing about the host process survives the move.\n */\nexport interface MigratingSession {\n  id: string;\n  cwd: string;\n  name?: string;\n}\n\n/** Nullable numbers are not used: a disabled toggle keeps its value so flipping it back restores it. */\nexport interface RemoteAccessSettings {\n  /** Close the tunnel on a timer. */\n  autoCloseEnabled: boolean;\n  autoCloseMinutes: number;\n  /** Expire paired sessions on idle and on total age. */\n  sessionExpiryEnabled: boolean;\n  idleMinutes: number;\n  absoluteHours: number;\n  tunnel: TunnelConfig;\n  sandbox: SandboxSettings;\n}\n\nexport interface BundlePairingTrust {\n  publicKey: string;\n  fingerprint: string;\n  revision: number;\n}\n\nexport type RemoteAccessStatus = 'off' | 'starting' | 'on' | 'failed';\n\nexport interface PairedDeviceView {\n  id: string;\n  label: string;\n  userAgent: string;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601. */\n  lastSeenAt: string;\n  /** True for the device making the request, so the UI can say \"this device\". */\n  self: boolean;\n}\n\nexport type TrustedDevicePlatform = 'ios' | 'android';\n\n/** What local and remote callers see of a trusted native device: no keys. Mirrors po-core's view. */\nexport interface TrustedDeviceView {\n  id: string;\n  label: string;\n  platform: TrustedDevicePlatform;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601. */\n  lastSeenAt: string;\n  /** True when the calling session signed in with this device's key. */\n  self: boolean;\n}\n\nexport interface PairingRequestView {\n  id: string;\n  userAgent: string;\n  /**\n   * The address Cloudflare's edge reported. Display only: any local process can\n   * reach the tunnel listener directly and set this header to anything, so it\n   * never gates a decision. The UI labels it \"reported by the edge\".\n   */\n  edgeIp: string;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601. */\n  expiresAt: string;\n}\n\nexport interface RemoteAccessStateView {\n  status: RemoteAccessStatus;\n  /** Present once the tunnel reports its hostname. */\n  publicUrl?: string;\n  /** ISO 8601, present while the tunnel is up. */\n  startedAt?: string;\n  /** ISO 8601, absent when auto-close is switched off. */\n  closesAt?: string;\n  /** Why the tunnel failed, once it has. */\n  error?: string;\n  devices: PairedDeviceView[];\n  /** Populated for local callers only; a paired phone must not see approval prompts. */\n  pending: PairingRequestView[];\n  /** Shown to local and remote callers, so a paired device can revoke a lost one. */\n  trustedDevices: TrustedDeviceView[];\n  settings: RemoteAccessSettings;\n}\n\nexport type PairingStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';\n\nexport type TunnelFailure = 'not_installed' | 'spawn_failed' | 'timeout' | 'self_test_failed' | 'exited';\n\nexport interface TunnelStartInput {\n  /** The loopback port the tunnel should publish. */\n  port: number;\n  config: TunnelConfig;\n  /** Arms the exact public origin before the launcher probes through it. */\n  acceptOrigin?: (origin: string) => void;\n  /** Cancels startup and asks the launcher to stop any process it has spawned. */\n  signal?: AbortSignal;\n}\n\nexport type TunnelStartResult =\n  | { ok: true; publicOrigin: string; stop: () => Promise<void> }\n  | { ok: false; failure: TunnelFailure; message: string };\n\n/**\n * Starting a tunnel, as a port rather than a concrete process.\n *\n * Declared here so a test can inject a fake without pulling in the cloudflared\n * adapter, and so `WebServerOptions` can name the seam without reaching across\n * a layer to do it.\n */\nexport type TunnelLauncher = (input: TunnelStartInput) => Promise<TunnelStartResult>;\n\n/** Hub frame announcing remote-access state; sent to local and remote pages. */\nexport const REMOTE_STATE_TYPE = 'remote_state';\n/** Hub frame announcing a device waiting for approval; sent to local pages only. */\nexport const REMOTE_PAIRING_REQUEST_TYPE = 'remote_pairing_request';\n"],"mappings":";;;;;;;;;;;AAWA,MAAa,mBAAmB;;AAEhC,MAAa,uBAAuB,GAAG,iBAAiB;;AAExD,MAAa,oBAAoB,GAAG,iBAAiB;;;AAGrD,MAAa,wBAAwB,GAAG,iBAAiB;AACzD,MAAa,oBAAoB,GAAG,iBAAiB;AACrD,MAAa,wBAAwB,GAAG,kBAAkB;AAC1D,MAAa,wBAAwB;;AAErC,MAAa,qBAAqB;;AAElC,MAAa,sBAAsB;;AAEnC,MAAa,uBAAuB;;AAEpC,MAAa,uBAAuB;;AAEpC,MAAa,2BAA2B;AACxC,MAAa,gCAAgC;;;;;;AAO7C,MAAa,gBAAgB;;;;;;;;AAS7B,MAAa,2BAA2B;AACxC,MAAa,4BAA4B;AACzC,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;;AAG7C,MAAa,iBAAiB;;AAG9B,MAAa,sBAAsB;;AAGnC,MAAa,sBAAsB;;AAEnC,MAAa,yBAAyB;;AAEtC,MAAa,yBAAyB;;AA4JtC,MAAa,oBAAoB;;AAEjC,MAAa,8BAA8B"}

package/dist/types/remoteAccess.d.mts

@@ -0,0 +1,214 @@
+//#region src/types/remoteAccess.d.ts
+/**
+ * Wire vocabulary for remote access, shared by the hub routes and the cockpit.
+ *
+ * Remote access binds a second loopback listener that a tunnel points at, and
+ * everything arriving there must prove it holds a paired session. The
+ * discriminator is the listening socket, not a header: a tunnel connects from
+ * 127.0.0.1 like every local client, and there is no header a remote caller
+ * cannot forge.
+ */
+/** REST surface for the remote-access control plane; local callers only, except turn-off and revoke. */
+export declare const REMOTE_API_ROUTE = "/api/remote";
+/** Direct endpoint that establishes one scoped end-to-end channel. */
+export declare const REMOTE_CHANNEL_ROUTE = "/api/remote/channel";
+/** The only authenticated HTTP gateway exposed on the tunnel listener. */
+export declare const REMOTE_HTTP_ROUTE = "/api/remote/request";
+/** Device-bound, sealed routes for ephemeral live Web Push registration. */
+/** Trusted native devices; `DELETE ${TRUSTED_DEVICES_ROUTE}/:id` revokes one. Mirrors po-core's constant. */
+export declare const TRUSTED_DEVICES_ROUTE = "/api/remote/trusted-devices";
+export declare const REMOTE_PUSH_ROUTE = "/api/remote/push";
+export declare const REMOTE_PUSH_KEY_ROUTE = "/api/remote/push/key";
+export declare const PROTOCOL_SOCKET_ROUTE = "/api/ws";
+/** The pairing page a scanned QR opens. Unauthenticated on the tunnel listener. */
+export declare const PAIRING_PAGE_ROUTE = "/pair";
+/** Where the pairing page posts the scanned code. Unauthenticated on the tunnel listener. */
+export declare const PAIRING_CLAIM_ROUTE = "/api/remote/pair";
+/** Polled until the host approves or denies. Unauthenticated on the tunnel listener. */
+export declare const PAIRING_STATUS_ROUTE = "/api/remote/pair/status";
+/** Query parameter naming the pairing request; a path parameter would force a wildcard into the allowlist. */
+export declare const PAIRING_STATUS_QUERY = "request";
+/** URL-fragment fields authenticated by seeing the host's physical QR. */
+export declare const BUNDLE_SIGNING_KEY_PARAM = "s";
+export declare const BUNDLE_MINIMUM_REVISION_PARAM = "r";
+/**
+ * Session cookie base name. Rendered `__Host-po_device` by hono's `host`
+ * prefix, which refuses the cookie unless it is Secure, Path=/, and
+ * Domain-less, so a sibling subdomain can neither read nor overwrite it.
+ */
+export declare const DEVICE_COOKIE = "po_device";
+/**
+ * Passkey ceremonies exposed directly on the pairing surface.
+ *
+ * Sign-in is unauthenticated because it creates a session. Registration requires
+ * the paired device cookie issued after host approval, but remains direct so the
+ * self-contained pairing page can offer enrolment before loading the cockpit.
+ */
+export declare const PASSKEY_AUTH_BEGIN_ROUTE = "/api/remote/passkeys/authenticate/begin";
+export declare const PASSKEY_AUTH_FINISH_ROUTE = "/api/remote/passkeys/authenticate/finish";
+export declare const PASSKEY_REGISTER_BEGIN_ROUTE = "/api/remote/passkeys/register/begin";
+export declare const PASSKEY_REGISTER_FINISH_ROUTE = "/api/remote/passkeys/register/finish";
+/** Header carrying a step-up assertion for an action that needs more than a live session. */
+export declare const STEP_UP_HEADER = "x-po-assertion";
+/** The vite dev server port; the origin allowlist and vite.config.ts share this. */
+export declare const WEB_DEV_SERVER_PORT = 7534;
+/** How long a scanned pairing code stays claimable. */
+export declare const PAIRING_CODE_TTL_MS = 120000;
+/** How long the host has to approve or deny a claimed request. */
+export declare const PAIRING_REQUEST_TTL_MS = 180000;
+/** Cookie lifetime when session expiry is switched off; a session cookie can outlive the laptop. */
+export declare const COOKIE_CEILING_SECONDS: number;
+export type TunnelKind = 'quick' | 'named';
+export type RemoteChannelScope = 'session' | 'protocol' | 'http';
+/**
+ * How the tunnel is established.
+ *
+ * `named` carries a hostname rather than discovering one, which is why it is
+ * the mode that supports passkeys, a service worker, and durable pairing: all
+ * three are bound to the origin, and a quick tunnel's hostname rotates on every
+ * start. The token is referenced by path, never stored inline, because it is a
+ * Cloudflare account credential and an inlined one ends up in a bug report.
+ */
+export type TunnelConfig = {
+  kind: 'quick';
+} | {
+  kind: 'named';
+  hostname: string;
+  name?: string;
+  tokenFile?: string;
+  configFile?: string;
+};
+/**
+ * Running the cockpit in a container.
+ *
+ * Tied to remote access rather than offered separately: the reason to contain
+ * the cockpit is that a paired device drives an agent holding a shell, and the
+ * containment only means anything if it is in place before the tunnel is.
+ *
+ * The workspace list is the boundary. A hub inside the container cannot create
+ * a session in a path that is not mounted, so arbitrary-directory spawning is
+ * closed by construction rather than by a check.
+ */
+export interface SandboxSettings {
+  enabled: boolean;
+  /** Absolute host directories the contained cockpit may work in. */
+  workspaces: string[];
+}
+/**
+ * A session the handover has to account for.
+ *
+ * Only what recreating it needs: the container hub spawns a fresh server, so
+ * nothing about the host process survives the move.
+ */
+export interface MigratingSession {
+  id: string;
+  cwd: string;
+  name?: string;
+}
+/** Nullable numbers are not used: a disabled toggle keeps its value so flipping it back restores it. */
+export interface RemoteAccessSettings {
+  /** Close the tunnel on a timer. */
+  autoCloseEnabled: boolean;
+  autoCloseMinutes: number;
+  /** Expire paired sessions on idle and on total age. */
+  sessionExpiryEnabled: boolean;
+  idleMinutes: number;
+  absoluteHours: number;
+  tunnel: TunnelConfig;
+  sandbox: SandboxSettings;
+}
+export interface BundlePairingTrust {
+  publicKey: string;
+  fingerprint: string;
+  revision: number;
+}
+export type RemoteAccessStatus = 'off' | 'starting' | 'on' | 'failed';
+export interface PairedDeviceView {
+  id: string;
+  label: string;
+  userAgent: string;
+  /** ISO 8601. */
+  createdAt: string;
+  /** ISO 8601. */
+  lastSeenAt: string;
+  /** True for the device making the request, so the UI can say "this device". */
+  self: boolean;
+}
+export type TrustedDevicePlatform = 'ios' | 'android';
+/** What local and remote callers see of a trusted native device: no keys. Mirrors po-core's view. */
+export interface TrustedDeviceView {
+  id: string;
+  label: string;
+  platform: TrustedDevicePlatform;
+  /** ISO 8601. */
+  createdAt: string;
+  /** ISO 8601. */
+  lastSeenAt: string;
+  /** True when the calling session signed in with this device's key. */
+  self: boolean;
+}
+export interface PairingRequestView {
+  id: string;
+  userAgent: string;
+  /**
+   * The address Cloudflare's edge reported. Display only: any local process can
+   * reach the tunnel listener directly and set this header to anything, so it
+   * never gates a decision. The UI labels it "reported by the edge".
+   */
+  edgeIp: string;
+  /** ISO 8601. */
+  createdAt: string;
+  /** ISO 8601. */
+  expiresAt: string;
+}
+export interface RemoteAccessStateView {
+  status: RemoteAccessStatus;
+  /** Present once the tunnel reports its hostname. */
+  publicUrl?: string;
+  /** ISO 8601, present while the tunnel is up. */
+  startedAt?: string;
+  /** ISO 8601, absent when auto-close is switched off. */
+  closesAt?: string;
+  /** Why the tunnel failed, once it has. */
+  error?: string;
+  devices: PairedDeviceView[];
+  /** Populated for local callers only; a paired phone must not see approval prompts. */
+  pending: PairingRequestView[];
+  /** Shown to local and remote callers, so a paired device can revoke a lost one. */
+  trustedDevices: TrustedDeviceView[];
+  settings: RemoteAccessSettings;
+}
+export type PairingStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+export type TunnelFailure = 'not_installed' | 'spawn_failed' | 'timeout' | 'self_test_failed' | 'exited';
+export interface TunnelStartInput {
+  /** The loopback port the tunnel should publish. */
+  port: number;
+  config: TunnelConfig;
+  /** Arms the exact public origin before the launcher probes through it. */
+  acceptOrigin?: (origin: string) => void;
+  /** Cancels startup and asks the launcher to stop any process it has spawned. */
+  signal?: AbortSignal;
+}
+export type TunnelStartResult = {
+  ok: true;
+  publicOrigin: string;
+  stop: () => Promise<void>;
+} | {
+  ok: false;
+  failure: TunnelFailure;
+  message: string;
+};
+/**
+ * Starting a tunnel, as a port rather than a concrete process.
+ *
+ * Declared here so a test can inject a fake without pulling in the cloudflared
+ * adapter, and so `WebServerOptions` can name the seam without reaching across
+ * a layer to do it.
+ */
+export type TunnelLauncher = (input: TunnelStartInput) => Promise<TunnelStartResult>;
+/** Hub frame announcing remote-access state; sent to local and remote pages. */
+export declare const REMOTE_STATE_TYPE = "remote_state";
+/** Hub frame announcing a device waiting for approval; sent to local pages only. */
+export declare const REMOTE_PAIRING_REQUEST_TYPE = "remote_pairing_request";
+//#endregion
+//# sourceMappingURL=remoteAccess.d.mts.map

package/dist/types/remoteAccess.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccess.d.mts","names":[],"sources":["../../src/types/remoteAccess.ts"],"mappings":";;;;;;;;;;;qBAWa;;qBAEA;;qBAEA;;;qBAGA;qBACA;qBACA;qBACA;;qBAEA;;qBAEA;;qBAEA;;qBAEA;;qBAEA;qBACA;;;;;;qBAOA;;;;;;;;qBASA;qBACA;qBACA;qBACA;;qBAGA;;qBAGA;;qBAGA;;qBAEA;;qBAEA;YAED;YACA;;;;;;;;;;YAWA;EACN;;EACA;EAAe;EAAkB;EAAe;EAAoB;;;;;;;;;;;;;iBAazD;EACf;;EAEA;;;;;;;;iBASe;EACf;EACA;EACA;;;iBAIe;;EAEf;EACA;;EAEA;EACA;EACA;EACA,QAAQ;EACR,SAAS;;iBAGM;EACf;EACA;EACA;;YAGU;iBAEK;EACf;EACA;EACA;;EAEA;;EAEA;;EAEA;;YAGU;;iBAGK;EACf;EACA;EACA,UAAU;;EAEV;;EAEA;;EAEA;;iBAGe;EACf;EACA;;;;;;EAMA;;EAEA;;EAEA;;iBAGe;EACf,QAAQ;;EAER;;EAEA;;EAEA;;EAEA;EACA,SAAS;;EAET,SAAS;;EAET,gBAAgB;EAChB,UAAU;;YAGA;YAEA;iBAEK;;EAEf;EACA,QAAQ;;EAER,gBAAgB;;EAEhB,SAAS;;YAGC;EACN;EAAU;EAAsB,YAAY;;EAC5C;EAAW,SAAS;EAAe;;;;;;;;;YAS7B,kBAAkB,OAAO,qBAAqB,QAAQ;;qBAGrD;;qBAEA"}