@agimon-ai/po-web-dashboard 0.0.0-alpha.0

package/dist/web/lib/remoteApi.cjs

@@ -0,0 +1,100 @@
+const require_remoteAccess = require("../../types/remoteAccess.cjs");
+const require_sealedSession = require("./sealedSession.cjs");
+const require_stepUp = require("./stepUp.cjs");
+//#region src/web/lib/remoteApi.ts
+const UNREACHABLE = "The cockpit hub is unreachable.";
+const JSON_HEADERS = { "Content-Type": "application/json" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* One shape for every remote-access call, mirroring `authApi.ts`: a network
+* failure, a non-2xx answer, and a 2xx body missing what was asked for all come
+* back as `{ error }`, so the dialog has one branch to render.
+*/
+async function request(input, init, pick, send = (target, options) => require_sealedSession.sealedHttpSession.fetch(target, options)) {
+	let response;
+	try {
+		response = await send(input, init);
+	} catch {
+		return { error: UNREACHABLE };
+	}
+	let body;
+	try {
+		body = await response.json();
+	} catch {
+		body = void 0;
+	}
+	if (response.ok && isRecord(body)) {
+		const picked = pick(body);
+		if (picked !== void 0) return picked;
+	}
+	if (isRecord(body) && typeof body.error === "string") return { error: body.error };
+	return { error: `The hub answered ${String(response.status)}.` };
+}
+function pickState(body) {
+	return isRecord(body.state) ? { state: body.state } : void 0;
+}
+async function fetchRemoteState() {
+	return await request(require_remoteAccess.REMOTE_API_ROUTE, void 0, pickState);
+}
+async function enableRemoteAccess() {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/enable`, { method: "POST" }, (body) => {
+		const picked = pickState(body);
+		if (picked === void 0) return void 0;
+		return body.handingOver === true ? {
+			...picked,
+			handingOver: true
+		} : picked;
+	});
+}
+async function disableRemoteAccess() {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/disable`, { method: "POST" }, pickState);
+}
+/** Mints the code the QR encodes. Each call retires the previous one. */
+async function mintPairingCode() {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/codes`, { method: "POST" }, (body) => typeof body.pairUrl === "string" && typeof body.code === "string" && typeof body.manualCode === "string" && typeof body.expiresAt === "string" && typeof body.publicKey === "string" && typeof body.fingerprint === "string" && typeof body.revision === "number" ? {
+		code: body.code,
+		manualCode: body.manualCode,
+		pairUrl: body.pairUrl,
+		expiresAt: body.expiresAt,
+		publicKey: body.publicKey,
+		fingerprint: body.fingerprint,
+		revision: body.revision
+	} : void 0);
+}
+async function approvePairing(requestId) {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/approve`, { method: "POST" }, pickState);
+}
+async function denyPairing(requestId) {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/deny`, { method: "POST" }, pickState);
+}
+async function revokeDevice(id) {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/devices/${encodeURIComponent(id)}`, { method: "DELETE" }, pickState);
+}
+/**
+* Removes a trusted native device and every live session it holds. A remote caller answers a step-up
+* first; a quick-tunnel browser cannot, so the hub refuses it with a message this returns as `error`.
+*/
+async function revokeTrustedDevice(id) {
+	return await request(`${require_remoteAccess.TRUSTED_DEVICES_ROUTE}/${encodeURIComponent(id)}`, { method: "DELETE" }, pickState, (target, options) => require_stepUp.fetchWithStepUp(target, options));
+}
+async function saveRemoteSettings(patch) {
+	return await request(`${require_remoteAccess.REMOTE_API_ROUTE}/settings`, {
+		method: "PUT",
+		headers: JSON_HEADERS,
+		body: JSON.stringify(patch)
+	}, (body) => isRecord(body.settings) ? { settings: body.settings } : void 0);
+}
+//#endregion
+exports.approvePairing = approvePairing;
+exports.denyPairing = denyPairing;
+exports.disableRemoteAccess = disableRemoteAccess;
+exports.enableRemoteAccess = enableRemoteAccess;
+exports.fetchRemoteState = fetchRemoteState;
+exports.mintPairingCode = mintPairingCode;
+exports.revokeDevice = revokeDevice;
+exports.revokeTrustedDevice = revokeTrustedDevice;
+exports.saveRemoteSettings = saveRemoteSettings;
+
+//# sourceMappingURL=remoteApi.cjs.map

package/dist/web/lib/remoteApi.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteApi.cjs","names":["sealedHttpSession","REMOTE_API_ROUTE","TRUSTED_DEVICES_ROUTE","fetchWithStepUp"],"sources":["../../../src/web/lib/remoteApi.ts"],"sourcesContent":["import {\n  REMOTE_API_ROUTE,\n  TRUSTED_DEVICES_ROUTE,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n} from '../../types/remoteAccess';\nimport { sealedHttpSession } from './sealedSession';\nimport { fetchWithStepUp } from './stepUp';\n\nexport type StateResult = { state: RemoteAccessStateView } | { error: string };\n/** Enabling a contained cockpit moves the hub, so the answer says the address is about to change. */\nexport type EnableResult = { state: RemoteAccessStateView; handingOver?: boolean } | { error: string };\nexport type PairingResult =\n  | {\n      code: string;\n      manualCode: string;\n      pairUrl: string;\n      expiresAt: string;\n      publicKey: string;\n      fingerprint: string;\n      revision: number;\n    }\n  | { error: string };\n\nconst UNREACHABLE = 'The cockpit hub is unreachable.';\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * One shape for every remote-access call, mirroring `authApi.ts`: a network\n * failure, a non-2xx answer, and a 2xx body missing what was asked for all come\n * back as `{ error }`, so the dialog has one branch to render.\n */\nasync function request<T>(\n  input: string,\n  init: RequestInit | undefined,\n  pick: (body: Record<string, unknown>) => T | undefined,\n  send: (input: string, init?: RequestInit) => Promise<Response> = (target, options) =>\n    sealedHttpSession.fetch(target, options),\n): Promise<T | { error: string }> {\n  let response: Response;\n  try {\n    response = await send(input, init);\n  } catch {\n    return { error: UNREACHABLE };\n  }\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    body = undefined;\n  }\n  if (response.ok && isRecord(body)) {\n    const picked = pick(body);\n    if (picked !== undefined) return picked;\n  }\n  if (isRecord(body) && typeof body.error === 'string') return { error: body.error };\n  return { error: `The hub answered ${String(response.status)}.` };\n}\n\nfunction pickState(body: Record<string, unknown>): { state: RemoteAccessStateView } | undefined {\n  return isRecord(body.state) ? { state: body.state as unknown as RemoteAccessStateView } : undefined;\n}\n\nexport async function fetchRemoteState(): Promise<StateResult> {\n  return await request(REMOTE_API_ROUTE, undefined, pickState);\n}\n\nexport async function enableRemoteAccess(): Promise<EnableResult> {\n  return await request(`${REMOTE_API_ROUTE}/enable`, { method: 'POST' }, (body) => {\n    const picked = pickState(body);\n    if (picked === undefined) return undefined;\n    return body.handingOver === true ? { ...picked, handingOver: true } : picked;\n  });\n}\n\nexport async function disableRemoteAccess(): Promise<StateResult> {\n  return await request(`${REMOTE_API_ROUTE}/disable`, { method: 'POST' }, pickState);\n}\n\n/** Mints the code the QR encodes. Each call retires the previous one. */\nexport async function mintPairingCode(): Promise<PairingResult> {\n  return await request(`${REMOTE_API_ROUTE}/codes`, { method: 'POST' }, (body) =>\n    typeof body.pairUrl === 'string' &&\n    typeof body.code === 'string' &&\n    typeof body.manualCode === 'string' &&\n    typeof body.expiresAt === 'string' &&\n    typeof body.publicKey === 'string' &&\n    typeof body.fingerprint === 'string' &&\n    typeof body.revision === 'number'\n      ? {\n          code: body.code,\n          manualCode: body.manualCode,\n          pairUrl: body.pairUrl,\n          expiresAt: body.expiresAt,\n          publicKey: body.publicKey,\n          fingerprint: body.fingerprint,\n          revision: body.revision,\n        }\n      : undefined,\n  );\n}\n\nexport async function approvePairing(requestId: string): Promise<StateResult> {\n  return await request(\n    `${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/approve`,\n    { method: 'POST' },\n    pickState,\n  );\n}\n\nexport async function denyPairing(requestId: string): Promise<StateResult> {\n  return await request(\n    `${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/deny`,\n    { method: 'POST' },\n    pickState,\n  );\n}\n\nexport async function revokeDevice(id: string): Promise<StateResult> {\n  return await request(`${REMOTE_API_ROUTE}/devices/${encodeURIComponent(id)}`, { method: 'DELETE' }, pickState);\n}\n\n/**\n * Removes a trusted native device and every live session it holds. A remote caller answers a step-up\n * first; a quick-tunnel browser cannot, so the hub refuses it with a message this returns as `error`.\n */\nexport async function revokeTrustedDevice(id: string): Promise<StateResult> {\n  return await request(\n    `${TRUSTED_DEVICES_ROUTE}/${encodeURIComponent(id)}`,\n    { method: 'DELETE' },\n    pickState,\n    (target, options) => fetchWithStepUp(target, options),\n  );\n}\n\nexport async function saveRemoteSettings(\n  patch: Partial<RemoteAccessSettings>,\n): Promise<{ settings: RemoteAccessSettings } | { error: string }> {\n  return await request(\n    `${REMOTE_API_ROUTE}/settings`,\n    { method: 'PUT', headers: JSON_HEADERS, body: JSON.stringify(patch) },\n    (body) => (isRecord(body.settings) ? { settings: body.settings as unknown as RemoteAccessSettings } : undefined),\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,cAAc;AACpB,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAE1D,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;AAOA,eAAe,QACb,OACA,MACA,MACA,QAAkE,QAAQ,YACxEA,sBAAAA,kBAAkB,MAAM,QAAQ,OAAO,GACT;CAChC,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,KAAK,OAAO,IAAI;CACnC,QAAQ;EACN,OAAO,EAAE,OAAO,YAAY;CAC9B;CACA,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,SAAS,KAAK;CAC7B,QAAQ;EACN,OAAO,KAAA;CACT;CACA,IAAI,SAAS,MAAM,SAAS,IAAI,GAAG;EACjC,MAAM,SAAS,KAAK,IAAI;EACxB,IAAI,WAAW,KAAA,GAAW,OAAO;CACnC;CACA,IAAI,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,UAAU,OAAO,EAAE,OAAO,KAAK,MAAM;CACjF,OAAO,EAAE,OAAO,oBAAoB,OAAO,SAAS,MAAM,EAAE,GAAG;AACjE;AAEA,SAAS,UAAU,MAA6E;CAC9F,OAAO,SAAS,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,MAA0C,IAAI,KAAA;AAC5F;AAEA,eAAsB,mBAAyC;CAC7D,OAAO,MAAM,QAAQC,qBAAAA,kBAAkB,KAAA,GAAW,SAAS;AAC7D;AAEA,eAAsB,qBAA4C;CAChE,OAAO,MAAM,QAAQ,GAAGA,qBAAAA,iBAAiB,UAAU,EAAE,QAAQ,OAAO,IAAI,SAAS;EAC/E,MAAM,SAAS,UAAU,IAAI;EAC7B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,OAAO,KAAK,gBAAgB,OAAO;GAAE,GAAG;GAAQ,aAAa;EAAK,IAAI;CACxE,CAAC;AACH;AAEA,eAAsB,sBAA4C;CAChE,OAAO,MAAM,QAAQ,GAAGA,qBAAAA,iBAAiB,WAAW,EAAE,QAAQ,OAAO,GAAG,SAAS;AACnF;;AAGA,eAAsB,kBAA0C;CAC9D,OAAO,MAAM,QAAQ,GAAGA,qBAAAA,iBAAiB,SAAS,EAAE,QAAQ,OAAO,IAAI,SACrE,OAAO,KAAK,YAAY,YACxB,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,eAAe,YAC3B,OAAO,KAAK,cAAc,YAC1B,OAAO,KAAK,cAAc,YAC1B,OAAO,KAAK,gBAAgB,YAC5B,OAAO,KAAK,aAAa,WACrB;EACE,MAAM,KAAK;EACX,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,aAAa,KAAK;EAClB,UAAU,KAAK;CACjB,IACA,KAAA,CACN;AACF;AAEA,eAAsB,eAAe,WAAyC;CAC5E,OAAO,MAAM,QACX,GAAGA,qBAAAA,iBAAiB,WAAW,mBAAmB,SAAS,EAAE,WAC7D,EAAE,QAAQ,OAAO,GACjB,SACF;AACF;AAEA,eAAsB,YAAY,WAAyC;CACzE,OAAO,MAAM,QACX,GAAGA,qBAAAA,iBAAiB,WAAW,mBAAmB,SAAS,EAAE,QAC7D,EAAE,QAAQ,OAAO,GACjB,SACF;AACF;AAEA,eAAsB,aAAa,IAAkC;CACnE,OAAO,MAAM,QAAQ,GAAGA,qBAAAA,iBAAiB,WAAW,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,SAAS;AAC/G;;;;;AAMA,eAAsB,oBAAoB,IAAkC;CAC1E,OAAO,MAAM,QACX,GAAGC,qBAAAA,sBAAsB,GAAG,mBAAmB,EAAE,KACjD,EAAE,QAAQ,SAAS,GACnB,YACC,QAAQ,YAAYC,eAAAA,gBAAgB,QAAQ,OAAO,CACtD;AACF;AAEA,eAAsB,mBACpB,OACiE;CACjE,OAAO,MAAM,QACX,GAAGF,qBAAAA,iBAAiB,YACpB;EAAE,QAAQ;EAAO,SAAS;EAAc,MAAM,KAAK,UAAU,KAAK;CAAE,IACnE,SAAU,SAAS,KAAK,QAAQ,IAAI,EAAE,UAAU,KAAK,SAA4C,IAAI,KAAA,CACxG;AACF"}

package/dist/web/lib/remoteApi.d.mts

@@ -0,0 +1,45 @@
+import { RemoteAccessSettings, RemoteAccessStateView } from "../../types/remoteAccess.mjs";
+//#region src/web/lib/remoteApi.d.ts
+export type StateResult = {
+  state: RemoteAccessStateView;
+} | {
+  error: string;
+};
+/** Enabling a contained cockpit moves the hub, so the answer says the address is about to change. */
+export type EnableResult = {
+  state: RemoteAccessStateView;
+  handingOver?: boolean;
+} | {
+  error: string;
+};
+export type PairingResult = {
+  code: string;
+  manualCode: string;
+  pairUrl: string;
+  expiresAt: string;
+  publicKey: string;
+  fingerprint: string;
+  revision: number;
+} | {
+  error: string;
+};
+export declare function fetchRemoteState(): Promise<StateResult>;
+export declare function enableRemoteAccess(): Promise<EnableResult>;
+export declare function disableRemoteAccess(): Promise<StateResult>;
+/** Mints the code the QR encodes. Each call retires the previous one. */
+export declare function mintPairingCode(): Promise<PairingResult>;
+export declare function approvePairing(requestId: string): Promise<StateResult>;
+export declare function denyPairing(requestId: string): Promise<StateResult>;
+export declare function revokeDevice(id: string): Promise<StateResult>;
+/**
+ * Removes a trusted native device and every live session it holds. A remote caller answers a step-up
+ * first; a quick-tunnel browser cannot, so the hub refuses it with a message this returns as `error`.
+ */
+export declare function revokeTrustedDevice(id: string): Promise<StateResult>;
+export declare function saveRemoteSettings(patch: Partial<RemoteAccessSettings>): Promise<{
+  settings: RemoteAccessSettings;
+} | {
+  error: string;
+}>;
+//#endregion
+//# sourceMappingURL=remoteApi.d.mts.map

package/dist/web/lib/remoteApi.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteApi.d.mts","names":[],"sources":["../../../src/web/lib/remoteApi.ts"],"mappings":";;YASY;EAAgB,OAAO;;EAA4B;;;YAEnD;EAAiB,OAAO;EAAuB;;EAA4B;;YAC3E;EAEN;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;;wBA6CgB,oBAAoB,QAAQ;wBAI5B,sBAAsB,QAAQ;wBAQ9B,uBAAuB,QAAQ;;wBAK/B,mBAAmB,QAAQ;wBAsB3B,eAAe,oBAAoB,QAAQ;wBAQ3C,YAAY,oBAAoB,QAAQ;wBAQxC,aAAa,aAAa,QAAQ;;;;;wBAQlC,oBAAoB,aAAa,QAAQ;wBASzC,mBACpB,OAAO,QAAQ,wBACd;EAAU,UAAU;;EAA2B"}

package/dist/web/lib/remoteApi.mjs

@@ -0,0 +1,92 @@
+import { REMOTE_API_ROUTE, TRUSTED_DEVICES_ROUTE } from "../../types/remoteAccess.mjs";
+import { sealedHttpSession } from "./sealedSession.mjs";
+import { fetchWithStepUp } from "./stepUp.mjs";
+//#region src/web/lib/remoteApi.ts
+const UNREACHABLE = "The cockpit hub is unreachable.";
+const JSON_HEADERS = { "Content-Type": "application/json" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* One shape for every remote-access call, mirroring `authApi.ts`: a network
+* failure, a non-2xx answer, and a 2xx body missing what was asked for all come
+* back as `{ error }`, so the dialog has one branch to render.
+*/
+async function request(input, init, pick, send = (target, options) => sealedHttpSession.fetch(target, options)) {
+	let response;
+	try {
+		response = await send(input, init);
+	} catch {
+		return { error: UNREACHABLE };
+	}
+	let body;
+	try {
+		body = await response.json();
+	} catch {
+		body = void 0;
+	}
+	if (response.ok && isRecord(body)) {
+		const picked = pick(body);
+		if (picked !== void 0) return picked;
+	}
+	if (isRecord(body) && typeof body.error === "string") return { error: body.error };
+	return { error: `The hub answered ${String(response.status)}.` };
+}
+function pickState(body) {
+	return isRecord(body.state) ? { state: body.state } : void 0;
+}
+async function fetchRemoteState() {
+	return await request(REMOTE_API_ROUTE, void 0, pickState);
+}
+async function enableRemoteAccess() {
+	return await request(`${REMOTE_API_ROUTE}/enable`, { method: "POST" }, (body) => {
+		const picked = pickState(body);
+		if (picked === void 0) return void 0;
+		return body.handingOver === true ? {
+			...picked,
+			handingOver: true
+		} : picked;
+	});
+}
+async function disableRemoteAccess() {
+	return await request(`${REMOTE_API_ROUTE}/disable`, { method: "POST" }, pickState);
+}
+/** Mints the code the QR encodes. Each call retires the previous one. */
+async function mintPairingCode() {
+	return await request(`${REMOTE_API_ROUTE}/codes`, { method: "POST" }, (body) => typeof body.pairUrl === "string" && typeof body.code === "string" && typeof body.manualCode === "string" && typeof body.expiresAt === "string" && typeof body.publicKey === "string" && typeof body.fingerprint === "string" && typeof body.revision === "number" ? {
+		code: body.code,
+		manualCode: body.manualCode,
+		pairUrl: body.pairUrl,
+		expiresAt: body.expiresAt,
+		publicKey: body.publicKey,
+		fingerprint: body.fingerprint,
+		revision: body.revision
+	} : void 0);
+}
+async function approvePairing(requestId) {
+	return await request(`${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/approve`, { method: "POST" }, pickState);
+}
+async function denyPairing(requestId) {
+	return await request(`${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/deny`, { method: "POST" }, pickState);
+}
+async function revokeDevice(id) {
+	return await request(`${REMOTE_API_ROUTE}/devices/${encodeURIComponent(id)}`, { method: "DELETE" }, pickState);
+}
+/**
+* Removes a trusted native device and every live session it holds. A remote caller answers a step-up
+* first; a quick-tunnel browser cannot, so the hub refuses it with a message this returns as `error`.
+*/
+async function revokeTrustedDevice(id) {
+	return await request(`${TRUSTED_DEVICES_ROUTE}/${encodeURIComponent(id)}`, { method: "DELETE" }, pickState, (target, options) => fetchWithStepUp(target, options));
+}
+async function saveRemoteSettings(patch) {
+	return await request(`${REMOTE_API_ROUTE}/settings`, {
+		method: "PUT",
+		headers: JSON_HEADERS,
+		body: JSON.stringify(patch)
+	}, (body) => isRecord(body.settings) ? { settings: body.settings } : void 0);
+}
+//#endregion
+export { approvePairing, denyPairing, disableRemoteAccess, enableRemoteAccess, fetchRemoteState, mintPairingCode, revokeDevice, revokeTrustedDevice, saveRemoteSettings };
+
+//# sourceMappingURL=remoteApi.mjs.map

package/dist/web/lib/remoteApi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteApi.mjs","names":[],"sources":["../../../src/web/lib/remoteApi.ts"],"sourcesContent":["import {\n  REMOTE_API_ROUTE,\n  TRUSTED_DEVICES_ROUTE,\n  type RemoteAccessSettings,\n  type RemoteAccessStateView,\n} from '../../types/remoteAccess';\nimport { sealedHttpSession } from './sealedSession';\nimport { fetchWithStepUp } from './stepUp';\n\nexport type StateResult = { state: RemoteAccessStateView } | { error: string };\n/** Enabling a contained cockpit moves the hub, so the answer says the address is about to change. */\nexport type EnableResult = { state: RemoteAccessStateView; handingOver?: boolean } | { error: string };\nexport type PairingResult =\n  | {\n      code: string;\n      manualCode: string;\n      pairUrl: string;\n      expiresAt: string;\n      publicKey: string;\n      fingerprint: string;\n      revision: number;\n    }\n  | { error: string };\n\nconst UNREACHABLE = 'The cockpit hub is unreachable.';\nconst JSON_HEADERS = { 'Content-Type': 'application/json' };\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * One shape for every remote-access call, mirroring `authApi.ts`: a network\n * failure, a non-2xx answer, and a 2xx body missing what was asked for all come\n * back as `{ error }`, so the dialog has one branch to render.\n */\nasync function request<T>(\n  input: string,\n  init: RequestInit | undefined,\n  pick: (body: Record<string, unknown>) => T | undefined,\n  send: (input: string, init?: RequestInit) => Promise<Response> = (target, options) =>\n    sealedHttpSession.fetch(target, options),\n): Promise<T | { error: string }> {\n  let response: Response;\n  try {\n    response = await send(input, init);\n  } catch {\n    return { error: UNREACHABLE };\n  }\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    body = undefined;\n  }\n  if (response.ok && isRecord(body)) {\n    const picked = pick(body);\n    if (picked !== undefined) return picked;\n  }\n  if (isRecord(body) && typeof body.error === 'string') return { error: body.error };\n  return { error: `The hub answered ${String(response.status)}.` };\n}\n\nfunction pickState(body: Record<string, unknown>): { state: RemoteAccessStateView } | undefined {\n  return isRecord(body.state) ? { state: body.state as unknown as RemoteAccessStateView } : undefined;\n}\n\nexport async function fetchRemoteState(): Promise<StateResult> {\n  return await request(REMOTE_API_ROUTE, undefined, pickState);\n}\n\nexport async function enableRemoteAccess(): Promise<EnableResult> {\n  return await request(`${REMOTE_API_ROUTE}/enable`, { method: 'POST' }, (body) => {\n    const picked = pickState(body);\n    if (picked === undefined) return undefined;\n    return body.handingOver === true ? { ...picked, handingOver: true } : picked;\n  });\n}\n\nexport async function disableRemoteAccess(): Promise<StateResult> {\n  return await request(`${REMOTE_API_ROUTE}/disable`, { method: 'POST' }, pickState);\n}\n\n/** Mints the code the QR encodes. Each call retires the previous one. */\nexport async function mintPairingCode(): Promise<PairingResult> {\n  return await request(`${REMOTE_API_ROUTE}/codes`, { method: 'POST' }, (body) =>\n    typeof body.pairUrl === 'string' &&\n    typeof body.code === 'string' &&\n    typeof body.manualCode === 'string' &&\n    typeof body.expiresAt === 'string' &&\n    typeof body.publicKey === 'string' &&\n    typeof body.fingerprint === 'string' &&\n    typeof body.revision === 'number'\n      ? {\n          code: body.code,\n          manualCode: body.manualCode,\n          pairUrl: body.pairUrl,\n          expiresAt: body.expiresAt,\n          publicKey: body.publicKey,\n          fingerprint: body.fingerprint,\n          revision: body.revision,\n        }\n      : undefined,\n  );\n}\n\nexport async function approvePairing(requestId: string): Promise<StateResult> {\n  return await request(\n    `${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/approve`,\n    { method: 'POST' },\n    pickState,\n  );\n}\n\nexport async function denyPairing(requestId: string): Promise<StateResult> {\n  return await request(\n    `${REMOTE_API_ROUTE}/pairing/${encodeURIComponent(requestId)}/deny`,\n    { method: 'POST' },\n    pickState,\n  );\n}\n\nexport async function revokeDevice(id: string): Promise<StateResult> {\n  return await request(`${REMOTE_API_ROUTE}/devices/${encodeURIComponent(id)}`, { method: 'DELETE' }, pickState);\n}\n\n/**\n * Removes a trusted native device and every live session it holds. A remote caller answers a step-up\n * first; a quick-tunnel browser cannot, so the hub refuses it with a message this returns as `error`.\n */\nexport async function revokeTrustedDevice(id: string): Promise<StateResult> {\n  return await request(\n    `${TRUSTED_DEVICES_ROUTE}/${encodeURIComponent(id)}`,\n    { method: 'DELETE' },\n    pickState,\n    (target, options) => fetchWithStepUp(target, options),\n  );\n}\n\nexport async function saveRemoteSettings(\n  patch: Partial<RemoteAccessSettings>,\n): Promise<{ settings: RemoteAccessSettings } | { error: string }> {\n  return await request(\n    `${REMOTE_API_ROUTE}/settings`,\n    { method: 'PUT', headers: JSON_HEADERS, body: JSON.stringify(patch) },\n    (body) => (isRecord(body.settings) ? { settings: body.settings as unknown as RemoteAccessSettings } : undefined),\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,cAAc;AACpB,MAAM,eAAe,EAAE,gBAAgB,mBAAmB;AAE1D,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;AAOA,eAAe,QACb,OACA,MACA,MACA,QAAkE,QAAQ,YACxE,kBAAkB,MAAM,QAAQ,OAAO,GACT;CAChC,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,KAAK,OAAO,IAAI;CACnC,QAAQ;EACN,OAAO,EAAE,OAAO,YAAY;CAC9B;CACA,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,SAAS,KAAK;CAC7B,QAAQ;EACN,OAAO,KAAA;CACT;CACA,IAAI,SAAS,MAAM,SAAS,IAAI,GAAG;EACjC,MAAM,SAAS,KAAK,IAAI;EACxB,IAAI,WAAW,KAAA,GAAW,OAAO;CACnC;CACA,IAAI,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,UAAU,OAAO,EAAE,OAAO,KAAK,MAAM;CACjF,OAAO,EAAE,OAAO,oBAAoB,OAAO,SAAS,MAAM,EAAE,GAAG;AACjE;AAEA,SAAS,UAAU,MAA6E;CAC9F,OAAO,SAAS,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,MAA0C,IAAI,KAAA;AAC5F;AAEA,eAAsB,mBAAyC;CAC7D,OAAO,MAAM,QAAQ,kBAAkB,KAAA,GAAW,SAAS;AAC7D;AAEA,eAAsB,qBAA4C;CAChE,OAAO,MAAM,QAAQ,GAAG,iBAAiB,UAAU,EAAE,QAAQ,OAAO,IAAI,SAAS;EAC/E,MAAM,SAAS,UAAU,IAAI;EAC7B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,OAAO,KAAK,gBAAgB,OAAO;GAAE,GAAG;GAAQ,aAAa;EAAK,IAAI;CACxE,CAAC;AACH;AAEA,eAAsB,sBAA4C;CAChE,OAAO,MAAM,QAAQ,GAAG,iBAAiB,WAAW,EAAE,QAAQ,OAAO,GAAG,SAAS;AACnF;;AAGA,eAAsB,kBAA0C;CAC9D,OAAO,MAAM,QAAQ,GAAG,iBAAiB,SAAS,EAAE,QAAQ,OAAO,IAAI,SACrE,OAAO,KAAK,YAAY,YACxB,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,eAAe,YAC3B,OAAO,KAAK,cAAc,YAC1B,OAAO,KAAK,cAAc,YAC1B,OAAO,KAAK,gBAAgB,YAC5B,OAAO,KAAK,aAAa,WACrB;EACE,MAAM,KAAK;EACX,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,aAAa,KAAK;EAClB,UAAU,KAAK;CACjB,IACA,KAAA,CACN;AACF;AAEA,eAAsB,eAAe,WAAyC;CAC5E,OAAO,MAAM,QACX,GAAG,iBAAiB,WAAW,mBAAmB,SAAS,EAAE,WAC7D,EAAE,QAAQ,OAAO,GACjB,SACF;AACF;AAEA,eAAsB,YAAY,WAAyC;CACzE,OAAO,MAAM,QACX,GAAG,iBAAiB,WAAW,mBAAmB,SAAS,EAAE,QAC7D,EAAE,QAAQ,OAAO,GACjB,SACF;AACF;AAEA,eAAsB,aAAa,IAAkC;CACnE,OAAO,MAAM,QAAQ,GAAG,iBAAiB,WAAW,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,SAAS;AAC/G;;;;;AAMA,eAAsB,oBAAoB,IAAkC;CAC1E,OAAO,MAAM,QACX,GAAG,sBAAsB,GAAG,mBAAmB,EAAE,KACjD,EAAE,QAAQ,SAAS,GACnB,YACC,QAAQ,YAAY,gBAAgB,QAAQ,OAAO,CACtD;AACF;AAEA,eAAsB,mBACpB,OACiE;CACjE,OAAO,MAAM,QACX,GAAG,iBAAiB,YACpB;EAAE,QAAQ;EAAO,SAAS;EAAc,MAAM,KAAK,UAAU,KAAK;CAAE,IACnE,SAAU,SAAS,KAAK,QAAQ,IAAI,EAAE,UAAU,KAAK,SAA4C,IAAI,KAAA,CACxG;AACF"}

package/dist/web/lib/sealedSession.cjs

@@ -0,0 +1,81 @@
+const require_remoteAccess = require("../../types/remoteAccess.cjs");
+let _agimon_ai_po_web_security_browser = require("@agimon-ai/po-web-security/browser");
+//#region src/web/lib/sealedSession.ts
+/** Each concurrent transport owns independent nonce counters and a purpose-bound server channel. */
+const sealedSession = (0, _agimon_ai_po_web_security_browser.createSealedTransport)();
+const sealedProtocolSession = (0, _agimon_ai_po_web_security_browser.createSealedTransport)();
+/** Plugins import this singleton directly, so it remains the HTTP channel. */
+const sealedHttpSession = _agimon_ai_po_web_security_browser.sealedTransport;
+sealedHttpSession.relayRequestsThrough(require_remoteAccess.REMOTE_HTTP_ROUTE);
+const SCOPED_TRANSPORTS = [
+	["session", sealedSession],
+	["protocol", sealedProtocolSession],
+	["http", sealedHttpSession]
+];
+/** Stored after QR pairing or passkey sign-in so this tab can re-establish the ephemeral channel. */
+const HOST_KEY_STORAGE = "po.channelKey";
+let restoration;
+function rememberHostChannelKey(hostPublicKey) {
+	restoration = void 0;
+	try {
+		window.sessionStorage.setItem(HOST_KEY_STORAGE, hostPublicKey);
+	} catch {}
+}
+function rememberedHostChannelKey() {
+	try {
+		return window.sessionStorage.getItem(HOST_KEY_STORAGE) ?? void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Re-establishes the channel on load, if this device has a host key to use.
+*
+* Session storage rather than local: the channel is ephemeral by design, and a
+* key that outlived the tab would suggest a channel that no longer exists.
+*/
+async function establishSealedSession() {
+	const hostKey = rememberedHostChannelKey();
+	if (hostKey === void 0) return false;
+	for (const [scope, transport] of SCOPED_TRANSPORTS) {
+		const clientPublicKey = await transport.connect(hostKey);
+		if (clientPublicKey === void 0 || !await registerChannel(scope, clientPublicKey)) {
+			resetSealedSessions();
+			return false;
+		}
+	}
+	return true;
+}
+function restoreSealedSession() {
+	restoration ??= establishSealedSession();
+	return restoration;
+}
+function resetSealedSessions() {
+	for (const [, transport] of SCOPED_TRANSPORTS) transport.reset();
+	restoration = void 0;
+}
+async function registerChannel(scope, clientPublicKey) {
+	try {
+		return (await fetch(require_remoteAccess.REMOTE_CHANNEL_ROUTE, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: "same-origin",
+			body: JSON.stringify({
+				scope,
+				clientPublicKey
+			})
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+exports.rememberHostChannelKey = rememberHostChannelKey;
+exports.rememberedHostChannelKey = rememberedHostChannelKey;
+exports.resetSealedSessions = resetSealedSessions;
+exports.restoreSealedSession = restoreSealedSession;
+exports.sealedHttpSession = sealedHttpSession;
+exports.sealedProtocolSession = sealedProtocolSession;
+exports.sealedSession = sealedSession;
+
+//# sourceMappingURL=sealedSession.cjs.map

package/dist/web/lib/sealedSession.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedSession.cjs","names":["createSealedTransport","sealedTransport","REMOTE_HTTP_ROUTE","REMOTE_CHANNEL_ROUTE"],"sources":["../../../src/web/lib/sealedSession.ts"],"sourcesContent":["import { createSealedTransport, sealedTransport } from '@agimon-ai/po-web-security/browser';\n\nimport { REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, type RemoteChannelScope } from '../../types/remoteAccess';\n\n/** Each concurrent transport owns independent nonce counters and a purpose-bound server channel. */\nexport const sealedSession = createSealedTransport();\nexport const sealedProtocolSession = createSealedTransport();\n/** Plugins import this singleton directly, so it remains the HTTP channel. */\nexport const sealedHttpSession = sealedTransport;\nsealedHttpSession.relayRequestsThrough(REMOTE_HTTP_ROUTE);\n\nconst SCOPED_TRANSPORTS = [\n  ['session', sealedSession],\n  ['protocol', sealedProtocolSession],\n  ['http', sealedHttpSession],\n] as const;\n\n/** Stored after QR pairing or passkey sign-in so this tab can re-establish the ephemeral channel. */\nconst HOST_KEY_STORAGE = 'po.channelKey';\n\nlet restoration: Promise<boolean> | undefined;\nexport function rememberHostChannelKey(hostPublicKey: string): void {\n  restoration = undefined;\n  try {\n    window.sessionStorage.setItem(HOST_KEY_STORAGE, hostPublicKey);\n  } catch {\n    // Storage denied; the channel lasts this page load only.\n  }\n}\n\nexport function rememberedHostChannelKey(): string | undefined {\n  try {\n    return window.sessionStorage.getItem(HOST_KEY_STORAGE) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Re-establishes the channel on load, if this device has a host key to use.\n *\n * Session storage rather than local: the channel is ephemeral by design, and a\n * key that outlived the tab would suggest a channel that no longer exists.\n */\nasync function establishSealedSession(): Promise<boolean> {\n  const hostKey = rememberedHostChannelKey();\n  if (hostKey === undefined) return false;\n\n  for (const [scope, transport] of SCOPED_TRANSPORTS) {\n    const clientPublicKey = await transport.connect(hostKey);\n    if (clientPublicKey === undefined || !(await registerChannel(scope, clientPublicKey))) {\n      resetSealedSessions();\n      return false;\n    }\n  }\n  return true;\n}\n\nexport function restoreSealedSession(): Promise<boolean> {\n  restoration ??= establishSealedSession();\n  return restoration;\n}\n\nexport function resetSealedSessions(): void {\n  for (const [, transport] of SCOPED_TRANSPORTS) transport.reset();\n  restoration = undefined;\n}\n\nasync function registerChannel(scope: RemoteChannelScope, clientPublicKey: string): Promise<boolean> {\n  try {\n    const response = await fetch(REMOTE_CHANNEL_ROUTE, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: 'same-origin',\n      body: JSON.stringify({ scope, clientPublicKey }),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;AAKA,MAAa,iBAAA,GAAgBA,mCAAAA,sBAAAA,CAAsB;AACnD,MAAa,yBAAA,GAAwBA,mCAAAA,sBAAAA,CAAsB;;AAE3D,MAAa,oBAAoBC,mCAAAA;AACjC,kBAAkB,qBAAqBC,qBAAAA,iBAAiB;AAExD,MAAM,oBAAoB;CACxB,CAAC,WAAW,aAAa;CACzB,CAAC,YAAY,qBAAqB;CAClC,CAAC,QAAQ,iBAAiB;AAC5B;;AAGA,MAAM,mBAAmB;AAEzB,IAAI;AACJ,SAAgB,uBAAuB,eAA6B;CAClE,cAAc,KAAA;CACd,IAAI;EACF,OAAO,eAAe,QAAQ,kBAAkB,aAAa;CAC/D,QAAQ,CAER;AACF;AAEA,SAAgB,2BAA+C;CAC7D,IAAI;EACF,OAAO,OAAO,eAAe,QAAQ,gBAAgB,KAAK,KAAA;CAC5D,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,eAAe,yBAA2C;CACxD,MAAM,UAAU,yBAAyB;CACzC,IAAI,YAAY,KAAA,GAAW,OAAO;CAElC,KAAK,MAAM,CAAC,OAAO,cAAc,mBAAmB;EAClD,MAAM,kBAAkB,MAAM,UAAU,QAAQ,OAAO;EACvD,IAAI,oBAAoB,KAAA,KAAa,CAAE,MAAM,gBAAgB,OAAO,eAAe,GAAI;GACrF,oBAAoB;GACpB,OAAO;EACT;CACF;CACA,OAAO;AACT;AAEA,SAAgB,uBAAyC;CACvD,gBAAgB,uBAAuB;CACvC,OAAO;AACT;AAEA,SAAgB,sBAA4B;CAC1C,KAAK,MAAM,GAAG,cAAc,mBAAmB,UAAU,MAAM;CAC/D,cAAc,KAAA;AAChB;AAEA,eAAe,gBAAgB,OAA2B,iBAA2C;CACnG,IAAI;EAOF,QAAO,MANgB,MAAMC,qBAAAA,sBAAsB;GACjD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,aAAa;GACb,MAAM,KAAK,UAAU;IAAE;IAAO;GAAgB,CAAC;EACjD,CAAC,EAAA,CACe;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/web/lib/sealedSession.d.mts

@@ -0,0 +1,24 @@
+//#region src/web/lib/sealedSession.d.ts
+/** Each concurrent transport owns independent nonce counters and a purpose-bound server channel. */
+export declare const sealedSession: import("@agimon-ai/po-web-security/browser").SealedTransport & {
+  connect: (hostPublicKey: string) => Promise<string | undefined>;
+  reset: () => void;
+  relayRequestsThrough: (path: string) => void;
+};
+export declare const sealedProtocolSession: import("@agimon-ai/po-web-security/browser").SealedTransport & {
+  connect: (hostPublicKey: string) => Promise<string | undefined>;
+  reset: () => void;
+  relayRequestsThrough: (path: string) => void;
+};
+/** Plugins import this singleton directly, so it remains the HTTP channel. */
+export declare const sealedHttpSession: import("@agimon-ai/po-web-security/browser").SealedTransport & {
+  connect: (hostPublicKey: string) => Promise<string | undefined>;
+  reset: () => void;
+  relayRequestsThrough: (path: string) => void;
+};
+export declare function rememberHostChannelKey(hostPublicKey: string): void;
+export declare function rememberedHostChannelKey(): string | undefined;
+export declare function restoreSealedSession(): Promise<boolean>;
+export declare function resetSealedSessions(): void;
+//#endregion
+//# sourceMappingURL=sealedSession.d.mts.map

package/dist/web/lib/sealedSession.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedSession.d.mts","names":[],"sources":["../../../src/web/lib/sealedSession.ts"],"mappings":";;qBAKa,4DAAa;sCAAb;;;;qBACA,oEAAqB;sCAArB;;;;;qBAEA,gEAAiB;sCAAjB;;;;wBAaG,uBAAuB;wBASvB;wBA4BA,wBAAwB;wBAKxB"}

package/dist/web/lib/sealedSession.mjs

@@ -0,0 +1,75 @@
+import { REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE } from "../../types/remoteAccess.mjs";
+import { createSealedTransport, sealedTransport } from "@agimon-ai/po-web-security/browser";
+//#region src/web/lib/sealedSession.ts
+/** Each concurrent transport owns independent nonce counters and a purpose-bound server channel. */
+const sealedSession = createSealedTransport();
+const sealedProtocolSession = createSealedTransport();
+/** Plugins import this singleton directly, so it remains the HTTP channel. */
+const sealedHttpSession = sealedTransport;
+sealedHttpSession.relayRequestsThrough(REMOTE_HTTP_ROUTE);
+const SCOPED_TRANSPORTS = [
+	["session", sealedSession],
+	["protocol", sealedProtocolSession],
+	["http", sealedHttpSession]
+];
+/** Stored after QR pairing or passkey sign-in so this tab can re-establish the ephemeral channel. */
+const HOST_KEY_STORAGE = "po.channelKey";
+let restoration;
+function rememberHostChannelKey(hostPublicKey) {
+	restoration = void 0;
+	try {
+		window.sessionStorage.setItem(HOST_KEY_STORAGE, hostPublicKey);
+	} catch {}
+}
+function rememberedHostChannelKey() {
+	try {
+		return window.sessionStorage.getItem(HOST_KEY_STORAGE) ?? void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Re-establishes the channel on load, if this device has a host key to use.
+*
+* Session storage rather than local: the channel is ephemeral by design, and a
+* key that outlived the tab would suggest a channel that no longer exists.
+*/
+async function establishSealedSession() {
+	const hostKey = rememberedHostChannelKey();
+	if (hostKey === void 0) return false;
+	for (const [scope, transport] of SCOPED_TRANSPORTS) {
+		const clientPublicKey = await transport.connect(hostKey);
+		if (clientPublicKey === void 0 || !await registerChannel(scope, clientPublicKey)) {
+			resetSealedSessions();
+			return false;
+		}
+	}
+	return true;
+}
+function restoreSealedSession() {
+	restoration ??= establishSealedSession();
+	return restoration;
+}
+function resetSealedSessions() {
+	for (const [, transport] of SCOPED_TRANSPORTS) transport.reset();
+	restoration = void 0;
+}
+async function registerChannel(scope, clientPublicKey) {
+	try {
+		return (await fetch(REMOTE_CHANNEL_ROUTE, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: "same-origin",
+			body: JSON.stringify({
+				scope,
+				clientPublicKey
+			})
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { rememberHostChannelKey, rememberedHostChannelKey, resetSealedSessions, restoreSealedSession, sealedHttpSession, sealedProtocolSession, sealedSession };
+
+//# sourceMappingURL=sealedSession.mjs.map

package/dist/web/lib/sealedSession.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedSession.mjs","names":[],"sources":["../../../src/web/lib/sealedSession.ts"],"sourcesContent":["import { createSealedTransport, sealedTransport } from '@agimon-ai/po-web-security/browser';\n\nimport { REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, type RemoteChannelScope } from '../../types/remoteAccess';\n\n/** Each concurrent transport owns independent nonce counters and a purpose-bound server channel. */\nexport const sealedSession = createSealedTransport();\nexport const sealedProtocolSession = createSealedTransport();\n/** Plugins import this singleton directly, so it remains the HTTP channel. */\nexport const sealedHttpSession = sealedTransport;\nsealedHttpSession.relayRequestsThrough(REMOTE_HTTP_ROUTE);\n\nconst SCOPED_TRANSPORTS = [\n  ['session', sealedSession],\n  ['protocol', sealedProtocolSession],\n  ['http', sealedHttpSession],\n] as const;\n\n/** Stored after QR pairing or passkey sign-in so this tab can re-establish the ephemeral channel. */\nconst HOST_KEY_STORAGE = 'po.channelKey';\n\nlet restoration: Promise<boolean> | undefined;\nexport function rememberHostChannelKey(hostPublicKey: string): void {\n  restoration = undefined;\n  try {\n    window.sessionStorage.setItem(HOST_KEY_STORAGE, hostPublicKey);\n  } catch {\n    // Storage denied; the channel lasts this page load only.\n  }\n}\n\nexport function rememberedHostChannelKey(): string | undefined {\n  try {\n    return window.sessionStorage.getItem(HOST_KEY_STORAGE) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Re-establishes the channel on load, if this device has a host key to use.\n *\n * Session storage rather than local: the channel is ephemeral by design, and a\n * key that outlived the tab would suggest a channel that no longer exists.\n */\nasync function establishSealedSession(): Promise<boolean> {\n  const hostKey = rememberedHostChannelKey();\n  if (hostKey === undefined) return false;\n\n  for (const [scope, transport] of SCOPED_TRANSPORTS) {\n    const clientPublicKey = await transport.connect(hostKey);\n    if (clientPublicKey === undefined || !(await registerChannel(scope, clientPublicKey))) {\n      resetSealedSessions();\n      return false;\n    }\n  }\n  return true;\n}\n\nexport function restoreSealedSession(): Promise<boolean> {\n  restoration ??= establishSealedSession();\n  return restoration;\n}\n\nexport function resetSealedSessions(): void {\n  for (const [, transport] of SCOPED_TRANSPORTS) transport.reset();\n  restoration = undefined;\n}\n\nasync function registerChannel(scope: RemoteChannelScope, clientPublicKey: string): Promise<boolean> {\n  try {\n    const response = await fetch(REMOTE_CHANNEL_ROUTE, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: 'same-origin',\n      body: JSON.stringify({ scope, clientPublicKey }),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;AAKA,MAAa,gBAAgB,sBAAsB;AACnD,MAAa,wBAAwB,sBAAsB;;AAE3D,MAAa,oBAAoB;AACjC,kBAAkB,qBAAqB,iBAAiB;AAExD,MAAM,oBAAoB;CACxB,CAAC,WAAW,aAAa;CACzB,CAAC,YAAY,qBAAqB;CAClC,CAAC,QAAQ,iBAAiB;AAC5B;;AAGA,MAAM,mBAAmB;AAEzB,IAAI;AACJ,SAAgB,uBAAuB,eAA6B;CAClE,cAAc,KAAA;CACd,IAAI;EACF,OAAO,eAAe,QAAQ,kBAAkB,aAAa;CAC/D,QAAQ,CAER;AACF;AAEA,SAAgB,2BAA+C;CAC7D,IAAI;EACF,OAAO,OAAO,eAAe,QAAQ,gBAAgB,KAAK,KAAA;CAC5D,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,eAAe,yBAA2C;CACxD,MAAM,UAAU,yBAAyB;CACzC,IAAI,YAAY,KAAA,GAAW,OAAO;CAElC,KAAK,MAAM,CAAC,OAAO,cAAc,mBAAmB;EAClD,MAAM,kBAAkB,MAAM,UAAU,QAAQ,OAAO;EACvD,IAAI,oBAAoB,KAAA,KAAa,CAAE,MAAM,gBAAgB,OAAO,eAAe,GAAI;GACrF,oBAAoB;GACpB,OAAO;EACT;CACF;CACA,OAAO;AACT;AAEA,SAAgB,uBAAyC;CACvD,gBAAgB,uBAAuB;CACvC,OAAO;AACT;AAEA,SAAgB,sBAA4B;CAC1C,KAAK,MAAM,GAAG,cAAc,mBAAmB,UAAU,MAAM;CAC/D,cAAc,KAAA;AAChB;AAEA,eAAe,gBAAgB,OAA2B,iBAA2C;CACnG,IAAI;EAOF,QAAO,MANgB,MAAM,sBAAsB;GACjD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,aAAa;GACb,MAAM,KAAK,UAAU;IAAE;IAAO;GAAgB,CAAC;EACjD,CAAC,EAAA,CACe;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/web/lib/sessionActivityRenderer.cjs

@@ -0,0 +1,19 @@
+//#region src/web/lib/sessionActivityRenderer.ts
+let render;
+/** Binds the host's live session activity view without exposing host stores to plugins. */
+function bindSessionActivityRenderer(renderer) {
+	render = renderer;
+}
+function releaseSessionActivityRenderer() {
+	render = void 0;
+}
+/** The bound session activity view, or nothing before the app mounts and in unit tests. */
+function renderSessionActivity(sessionId, onOpenConversation) {
+	return render?.(sessionId, onOpenConversation) ?? null;
+}
+//#endregion
+exports.bindSessionActivityRenderer = bindSessionActivityRenderer;
+exports.releaseSessionActivityRenderer = releaseSessionActivityRenderer;
+exports.renderSessionActivity = renderSessionActivity;
+
+//# sourceMappingURL=sessionActivityRenderer.cjs.map

package/dist/web/lib/sessionActivityRenderer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionActivityRenderer.cjs","names":[],"sources":["../../../src/web/lib/sessionActivityRenderer.ts"],"sourcesContent":["import type { ReactNode } from 'react';\n\ntype SessionActivityRenderer = (sessionId: string, onOpenConversation: () => void) => ReactNode;\n\nlet render: SessionActivityRenderer | undefined;\n\n/** Binds the host's live session activity view without exposing host stores to plugins. */\nexport function bindSessionActivityRenderer(renderer: SessionActivityRenderer): void {\n  render = renderer;\n}\n\nexport function releaseSessionActivityRenderer(): void {\n  render = undefined;\n}\n\n/** The bound session activity view, or nothing before the app mounts and in unit tests. */\nexport function renderSessionActivity(sessionId: string, onOpenConversation: () => void): ReactNode {\n  return render?.(sessionId, onOpenConversation) ?? null;\n}\n"],"mappings":";AAIA,IAAI;;AAGJ,SAAgB,4BAA4B,UAAyC;CACnF,SAAS;AACX;AAEA,SAAgB,iCAAuC;CACrD,SAAS,KAAA;AACX;;AAGA,SAAgB,sBAAsB,WAAmB,oBAA2C;CAClG,OAAO,SAAS,WAAW,kBAAkB,KAAK;AACpD"}

package/dist/web/lib/sessionActivityRenderer.d.mts

@@ -0,0 +1,10 @@
+import { ReactNode } from "react";
+//#region src/web/lib/sessionActivityRenderer.d.ts
+type SessionActivityRenderer = (sessionId: string, onOpenConversation: () => void) => ReactNode;
+/** Binds the host's live session activity view without exposing host stores to plugins. */
+export declare function bindSessionActivityRenderer(renderer: SessionActivityRenderer): void;
+export declare function releaseSessionActivityRenderer(): void;
+/** The bound session activity view, or nothing before the app mounts and in unit tests. */
+export declare function renderSessionActivity(sessionId: string, onOpenConversation: () => void): ReactNode;
+//#endregion
+//# sourceMappingURL=sessionActivityRenderer.d.mts.map

package/dist/web/lib/sessionActivityRenderer.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionActivityRenderer.d.mts","names":[],"sources":["../../../src/web/lib/sessionActivityRenderer.ts"],"mappings":";;KAEK,2BAA2B,mBAAmB,mCAAmC;;wBAKtE,4BAA4B,UAAU;wBAItC;;wBAKA,sBAAsB,mBAAmB,iCAAiC"}

package/dist/web/lib/sessionActivityRenderer.mjs

@@ -0,0 +1,17 @@
+//#region src/web/lib/sessionActivityRenderer.ts
+let render;
+/** Binds the host's live session activity view without exposing host stores to plugins. */
+function bindSessionActivityRenderer(renderer) {
+	render = renderer;
+}
+function releaseSessionActivityRenderer() {
+	render = void 0;
+}
+/** The bound session activity view, or nothing before the app mounts and in unit tests. */
+function renderSessionActivity(sessionId, onOpenConversation) {
+	return render?.(sessionId, onOpenConversation) ?? null;
+}
+//#endregion
+export { bindSessionActivityRenderer, releaseSessionActivityRenderer, renderSessionActivity };
+
+//# sourceMappingURL=sessionActivityRenderer.mjs.map

package/dist/web/lib/sessionActivityRenderer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionActivityRenderer.mjs","names":[],"sources":["../../../src/web/lib/sessionActivityRenderer.ts"],"sourcesContent":["import type { ReactNode } from 'react';\n\ntype SessionActivityRenderer = (sessionId: string, onOpenConversation: () => void) => ReactNode;\n\nlet render: SessionActivityRenderer | undefined;\n\n/** Binds the host's live session activity view without exposing host stores to plugins. */\nexport function bindSessionActivityRenderer(renderer: SessionActivityRenderer): void {\n  render = renderer;\n}\n\nexport function releaseSessionActivityRenderer(): void {\n  render = undefined;\n}\n\n/** The bound session activity view, or nothing before the app mounts and in unit tests. */\nexport function renderSessionActivity(sessionId: string, onOpenConversation: () => void): ReactNode {\n  return render?.(sessionId, onOpenConversation) ?? null;\n}\n"],"mappings":";AAIA,IAAI;;AAGJ,SAAgB,4BAA4B,UAAyC;CACnF,SAAS;AACX;AAEA,SAAgB,iCAAuC;CACrD,SAAS,KAAA;AACX;;AAGA,SAAgB,sBAAsB,WAAmB,oBAA2C;CAClG,OAAO,SAAS,WAAW,kBAAkB,KAAK;AACpD"}

package/dist/web/lib/sessionAsset.cjs

@@ -0,0 +1,45 @@
+const require_sealedSession = require("./sealedSession.cjs");
+const require_media = require("../../types/media.cjs");
+let _agimon_ai_po_core_web = require("@agimon-ai/po-core/web");
+//#region src/web/lib/sessionAsset.ts
+/** Fetches one cwd-scoped file through the sealed HTTP channel and owns its short-lived browser URL. */
+async function loadSessionAsset(sessionId, relativePath) {
+	const response = await require_sealedSession.sealedHttpSession.fetch(require_media.sessionFileUrl(sessionId, relativePath), {
+		cache: "no-store",
+		credentials: "same-origin"
+	});
+	if (!response.ok) throw new Error(`The session file could not be loaded (${String(response.status)}).`);
+	const blob = await response.blob();
+	const url = URL.createObjectURL(blob);
+	let disposed = false;
+	return {
+		url,
+		contentType: (response.headers.get("content-type") ?? blob.type).split(";", 1)[0]?.toLowerCase() ?? "",
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			URL.revokeObjectURL(url);
+		}
+	};
+}
+/** Stores one composer file on the host through the sealed HTTP channel, so a tool can be handed its path. */
+async function uploadSessionAttachment(sessionId, file) {
+	const response = await require_sealedSession.sealedHttpSession.fetch(`${(0, _agimon_ai_po_core_web.sessionApiPath)(sessionId)}/attachments?name=${encodeURIComponent(file.name)}`, {
+		method: "POST",
+		body: file,
+		credentials: "same-origin",
+		headers: { "content-type": file.type || "application/octet-stream" }
+	});
+	if (!response.ok) throw new Error(`The attachment could not be uploaded (${String(response.status)}).`);
+	const { path, mimeType, size } = await response.json();
+	return {
+		path,
+		mimeType,
+		size
+	};
+}
+//#endregion
+exports.loadSessionAsset = loadSessionAsset;
+exports.uploadSessionAttachment = uploadSessionAttachment;
+
+//# sourceMappingURL=sessionAsset.cjs.map

package/dist/web/lib/sessionAsset.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAsset.cjs","names":["sealedHttpSession","sessionFileUrl","sessionApiPath"],"sources":["../../../src/web/lib/sessionAsset.ts"],"sourcesContent":["import { sessionApiPath } from '@agimon-ai/po-core/web';\n\nimport { sessionFileUrl } from '../../types/media';\nimport { sealedHttpSession } from './sealedSession';\n\nexport interface SessionAsset {\n  url: string;\n  contentType: string;\n  dispose(): void;\n}\n\n/** Fetches one cwd-scoped file through the sealed HTTP channel and owns its short-lived browser URL. */\nexport async function loadSessionAsset(sessionId: string, relativePath: string): Promise<SessionAsset> {\n  const response = await sealedHttpSession.fetch(sessionFileUrl(sessionId, relativePath), {\n    cache: 'no-store',\n    credentials: 'same-origin',\n  });\n  if (!response.ok) throw new Error(`The session file could not be loaded (${String(response.status)}).`);\n\n  const blob = await response.blob();\n  const url = URL.createObjectURL(blob);\n  let disposed = false;\n  return {\n    url,\n    contentType: (response.headers.get('content-type') ?? blob.type).split(';', 1)[0]?.toLowerCase() ?? '',\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      URL.revokeObjectURL(url);\n    },\n  };\n}\n\nexport interface StoredSessionAttachment {\n  path: string;\n  mimeType: string;\n  size: number;\n}\n\n/** Stores one composer file on the host through the sealed HTTP channel, so a tool can be handed its path. */\nexport async function uploadSessionAttachment(sessionId: string, file: File): Promise<StoredSessionAttachment> {\n  const response = await sealedHttpSession.fetch(\n    `${sessionApiPath(sessionId)}/attachments?name=${encodeURIComponent(file.name)}`,\n    {\n      method: 'POST',\n      body: file,\n      credentials: 'same-origin',\n      headers: { 'content-type': file.type || 'application/octet-stream' },\n    },\n  );\n  if (!response.ok) throw new Error(`The attachment could not be uploaded (${String(response.status)}).`);\n  const { path, mimeType, size } = (await response.json()) as StoredSessionAttachment;\n  return { path, mimeType, size };\n}\n"],"mappings":";;;;;AAYA,eAAsB,iBAAiB,WAAmB,cAA6C;CACrG,MAAM,WAAW,MAAMA,sBAAAA,kBAAkB,MAAMC,cAAAA,eAAe,WAAW,YAAY,GAAG;EACtF,OAAO;EACP,aAAa;CACf,CAAC;CACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,yCAAyC,OAAO,SAAS,MAAM,EAAE,GAAG;CAEtG,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,MAAM,MAAM,IAAI,gBAAgB,IAAI;CACpC,IAAI,WAAW;CACf,OAAO;EACL;EACA,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK,KAAK,KAAA,CAAM,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK;EACpG,UAAU;GACR,IAAI,UAAU;GACd,WAAW;GACX,IAAI,gBAAgB,GAAG;EACzB;CACF;AACF;;AASA,eAAsB,wBAAwB,WAAmB,MAA8C;CAC7G,MAAM,WAAW,MAAMD,sBAAAA,kBAAkB,MACvC,IAAA,GAAGE,uBAAAA,eAAAA,CAAe,SAAS,EAAE,oBAAoB,mBAAmB,KAAK,IAAI,KAC7E;EACE,QAAQ;EACR,MAAM;EACN,aAAa;EACb,SAAS,EAAE,gBAAgB,KAAK,QAAQ,2BAA2B;CACrE,CACF;CACA,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,yCAAyC,OAAO,SAAS,MAAM,EAAE,GAAG;CACtG,MAAM,EAAE,MAAM,UAAU,SAAU,MAAM,SAAS,KAAK;CACtD,OAAO;EAAE;EAAM;EAAU;CAAK;AAChC"}

package/dist/web/lib/sessionAsset.d.mts

@@ -0,0 +1,17 @@
+//#region src/web/lib/sessionAsset.d.ts
+export interface SessionAsset {
+  url: string;
+  contentType: string;
+  dispose(): void;
+}
+/** Fetches one cwd-scoped file through the sealed HTTP channel and owns its short-lived browser URL. */
+export declare function loadSessionAsset(sessionId: string, relativePath: string): Promise<SessionAsset>;
+export interface StoredSessionAttachment {
+  path: string;
+  mimeType: string;
+  size: number;
+}
+/** Stores one composer file on the host through the sealed HTTP channel, so a tool can be handed its path. */
+export declare function uploadSessionAttachment(sessionId: string, file: File): Promise<StoredSessionAttachment>;
+//#endregion
+//# sourceMappingURL=sessionAsset.d.mts.map

package/dist/web/lib/sessionAsset.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAsset.d.mts","names":[],"sources":["../../../src/web/lib/sessionAsset.ts"],"mappings":";iBAKiB;EACf;EACA;EACA;;;wBAIoB,iBAAiB,mBAAmB,uBAAuB,QAAQ;iBAqBxE;EACf;EACA;EACA;;;wBAIoB,wBAAwB,mBAAmB,MAAM,OAAO,QAAQ"}