@agimon-ai/po-web-dashboard 0.0.0-alpha.0

package/dist/web/stores/remoteAccessStore.cjs

@@ -0,0 +1,216 @@
+const require_sealedSession = require("../lib/sealedSession.cjs");
+const require_webauthnClient = require("../lib/webauthnClient.cjs");
+const require_remoteApi = require("../lib/remoteApi.cjs");
+//#region src/web/stores/remoteAccessStore.ts
+const remoteAccessStore = new (require("@tanstack/store")).Store({
+	step: "closed",
+	busy: false
+});
+const pendingSettings = /* @__PURE__ */ new Set();
+function set(patch) {
+	const view = patch.view;
+	if (view !== void 0 && pendingSettings.size > 0) patch = {
+		...patch,
+		view: {
+			...view,
+			settings: [...pendingSettings].reduce((settings, draft) => ({
+				...settings,
+				...draft
+			}), view.settings)
+		}
+	};
+	remoteAccessStore.setState((state) => ({
+		...state,
+		...patch
+	}));
+}
+/** Clears the previous error before an action, so a stale one never outlives its cause. */
+function begin() {
+	set({
+		busy: true,
+		error: void 0
+	});
+}
+function settle(outcome) {
+	if ("error" in outcome) {
+		set({
+			busy: false,
+			error: outcome.error
+		});
+		return false;
+	}
+	set({
+		busy: false,
+		view: outcome.state
+	});
+	return true;
+}
+function openRemoteDialog() {
+	set({
+		step: "options",
+		error: void 0
+	});
+	refreshRemoteState();
+}
+function closeRemoteDialog() {
+	set({
+		step: "closed",
+		error: void 0
+	});
+}
+function showRemoteOptions() {
+	set({
+		step: "options",
+		error: void 0
+	});
+}
+/** Whether this tunnel and this browser can carry a passkey at all. */
+async function refreshPasskeys() {
+	try {
+		const response = await require_sealedSession.sealedHttpSession.fetch("/api/remote/passkeys", { credentials: "same-origin" });
+		if (!response.ok) return;
+		const body = await response.json();
+		set({ passkeys: {
+			supported: body.support.supported && require_webauthnClient.passkeysAvailable(),
+			...body.support.reason === void 0 ? {} : { reason: body.support.reason },
+			count: body.credentials.length
+		} });
+	} catch {}
+}
+async function addPasskey() {
+	begin();
+	const outcome = await require_webauthnClient.registerPasskey();
+	set({
+		busy: false,
+		...outcome.ok ? {} : { error: outcome.error }
+	});
+	await refreshPasskeys();
+}
+async function refreshRemoteState() {
+	const outcome = await require_remoteApi.fetchRemoteState();
+	if ("error" in outcome) {
+		set({ error: outcome.error });
+		return;
+	}
+	set({ view: outcome.state });
+}
+/** Turns the tunnel on and moves straight to the code, which is what the user came for. */
+async function turnRemoteAccessOn() {
+	begin();
+	const outcome = await require_remoteApi.enableRemoteAccess();
+	if (!settle(outcome)) return;
+	if ("handingOver" in outcome && outcome.handingOver === true) {
+		set({ step: "handover" });
+		return;
+	}
+	await Promise.all([newPairingCode(), refreshPasskeys()]);
+	set({ step: "pairing" });
+}
+async function turnRemoteAccessOff() {
+	begin();
+	if (!settle(await require_remoteApi.disableRemoteAccess())) return;
+	set({
+		step: "options",
+		pairUrl: void 0,
+		pairCode: void 0,
+		pairFingerprint: void 0,
+		pairRevision: void 0,
+		pairExpiresAt: void 0
+	});
+}
+async function newPairingCode() {
+	const minted = await require_remoteApi.mintPairingCode();
+	if ("error" in minted) {
+		set({
+			error: minted.error,
+			pairUrl: void 0,
+			pairCode: void 0,
+			pairFingerprint: void 0,
+			pairRevision: void 0
+		});
+		return;
+	}
+	set({
+		pairUrl: minted.pairUrl,
+		pairCode: minted.manualCode,
+		pairFingerprint: minted.fingerprint,
+		pairRevision: minted.revision,
+		pairExpiresAt: minted.expiresAt
+	});
+}
+async function approveDevice(requestId) {
+	settle(await require_remoteApi.approvePairing(requestId));
+}
+async function denyDevice(requestId) {
+	settle(await require_remoteApi.denyPairing(requestId));
+}
+async function revokePairedDevice(id) {
+	begin();
+	settle(await require_remoteApi.revokeDevice(id));
+}
+async function revokeTrustedNativeDevice(id) {
+	begin();
+	settle(await require_remoteApi.revokeTrustedDevice(id));
+}
+let settingsWrites = Promise.resolve();
+async function updateRemoteSettings(patch) {
+	const draft = { ...patch };
+	pendingSettings.add(draft);
+	const view = remoteAccessStore.state.view;
+	if (view !== void 0) set({
+		view: {
+			...view,
+			settings: {
+				...view.settings,
+				...draft
+			}
+		},
+		error: void 0
+	});
+	const write = () => require_remoteApi.saveRemoteSettings(draft);
+	const pending = settingsWrites.then(write, write);
+	settingsWrites = pending;
+	const outcome = await pending;
+	pendingSettings.delete(draft);
+	if ("error" in outcome) {
+		set({ error: outcome.error });
+		if (settingsWrites === pending) refreshRemoteState();
+		return false;
+	}
+	const current = remoteAccessStore.state.view;
+	if (current !== void 0 && settingsWrites === pending) set({
+		view: {
+			...current,
+			settings: outcome.settings
+		},
+		error: void 0
+	});
+	return true;
+}
+/** Applies a state frame the hub pushed, so the page never polls for this. */
+function applyRemoteState(view) {
+	const waiting = remoteAccessStore.state.step === "handover";
+	set({ view });
+	if (waiting && view.status === "on") Promise.all([newPairingCode(), refreshPasskeys()]).then(() => {
+		set({ step: "pairing" });
+	});
+}
+//#endregion
+exports.addPasskey = addPasskey;
+exports.applyRemoteState = applyRemoteState;
+exports.approveDevice = approveDevice;
+exports.closeRemoteDialog = closeRemoteDialog;
+exports.denyDevice = denyDevice;
+exports.newPairingCode = newPairingCode;
+exports.openRemoteDialog = openRemoteDialog;
+exports.refreshPasskeys = refreshPasskeys;
+exports.refreshRemoteState = refreshRemoteState;
+exports.remoteAccessStore = remoteAccessStore;
+exports.revokePairedDevice = revokePairedDevice;
+exports.revokeTrustedNativeDevice = revokeTrustedNativeDevice;
+exports.showRemoteOptions = showRemoteOptions;
+exports.turnRemoteAccessOff = turnRemoteAccessOff;
+exports.turnRemoteAccessOn = turnRemoteAccessOn;
+exports.updateRemoteSettings = updateRemoteSettings;
+
+//# sourceMappingURL=remoteAccessStore.cjs.map

package/dist/web/stores/remoteAccessStore.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccessStore.cjs","names":["Store","sealedHttpSession","passkeysAvailable","registerPasskey","fetchRemoteState","enableRemoteAccess","disableRemoteAccess","mintPairingCode","approvePairing","denyPairing","revokeDevice","revokeTrustedDevice","saveRemoteSettings"],"sources":["../../../src/web/stores/remoteAccessStore.ts"],"sourcesContent":["import { Store } from '@tanstack/store';\n\nimport type { RemoteAccessSettings, RemoteAccessStateView } from '../../types/remoteAccess';\nimport {\n  approvePairing,\n  denyPairing,\n  disableRemoteAccess,\n  enableRemoteAccess,\n  fetchRemoteState,\n  mintPairingCode,\n  revokeDevice,\n  revokeTrustedDevice,\n  saveRemoteSettings,\n} from '../lib/remoteApi';\nimport { sealedHttpSession } from '../lib/sealedSession';\nimport { passkeysAvailable, registerPasskey } from '../lib/webauthnClient';\n\n/** Which panel of the dialog is showing. Options first, then the code to scan. */\nexport type RemoteStep = 'closed' | 'options' | 'handover' | 'pairing';\n\nexport interface PasskeySupportView {\n  supported: boolean;\n  reason?: string;\n  count: number;\n}\n\nexport interface RemoteAccessState {\n  step: RemoteStep;\n  /** Undefined until the passkey surface has been asked about. */\n  passkeys?: PasskeySupportView;\n  /** Undefined until the first load answers. */\n  view?: RemoteAccessStateView;\n  /** The URL the QR encodes; present only while a code is live. */\n  pairUrl?: string;\n  /** Short code accepted by the same pairing claim for manual entry. */\n  pairCode?: string;\n  /** Signing-key fingerprint the user compares during manual pairing. */\n  pairFingerprint?: string;\n  pairRevision?: number;\n  pairExpiresAt?: string;\n  busy: boolean;\n  error?: string;\n}\n\nexport const remoteAccessStore = new Store<RemoteAccessState>({ step: 'closed', busy: false });\nconst pendingSettings = new Set<Partial<RemoteAccessSettings>>();\n\nfunction set(patch: Partial<RemoteAccessState>): void {\n  const view = patch.view;\n  if (view !== undefined && pendingSettings.size > 0)\n    patch = {\n      ...patch,\n      view: {\n        ...view,\n        settings: [...pendingSettings].reduce<RemoteAccessSettings>(\n          (settings, draft) => ({ ...settings, ...draft }),\n          view.settings,\n        ),\n      },\n    };\n  remoteAccessStore.setState((state) => ({ ...state, ...patch }));\n}\n\n/** Clears the previous error before an action, so a stale one never outlives its cause. */\nfunction begin(): void {\n  set({ busy: true, error: undefined });\n}\n\nfunction settle(outcome: { state: RemoteAccessStateView } | { error: string }): boolean {\n  if ('error' in outcome) {\n    set({ busy: false, error: outcome.error });\n    return false;\n  }\n  set({ busy: false, view: outcome.state });\n  return true;\n}\n\nexport function openRemoteDialog(): void {\n  set({ step: 'options', error: undefined });\n  void refreshRemoteState();\n}\n\nexport function closeRemoteDialog(): void {\n  // The code is left to expire on its own rather than cancelled here: closing\n  // the dialog while a phone is mid-scan should not strand it.\n  set({ step: 'closed', error: undefined });\n}\n\nexport function showRemoteOptions(): void {\n  set({ step: 'options', error: undefined });\n}\n\n/** Whether this tunnel and this browser can carry a passkey at all. */\nexport async function refreshPasskeys(): Promise<void> {\n  try {\n    const response = await sealedHttpSession.fetch('/api/remote/passkeys', { credentials: 'same-origin' });\n    if (!response.ok) return;\n    const body = (await response.json()) as {\n      support: { supported: boolean; reason?: string };\n      credentials: unknown[];\n    };\n    set({\n      passkeys: {\n        supported: body.support.supported && passkeysAvailable(),\n        ...(body.support.reason === undefined ? {} : { reason: body.support.reason }),\n        count: body.credentials.length,\n      },\n    });\n  } catch {\n    // The hub is unreachable; the state refresh reports that already.\n  }\n}\n\nexport async function addPasskey(): Promise<void> {\n  begin();\n  const outcome = await registerPasskey();\n  set({ busy: false, ...(outcome.ok ? {} : { error: outcome.error }) });\n  await refreshPasskeys();\n}\n\nexport async function refreshRemoteState(): Promise<void> {\n  const outcome = await fetchRemoteState();\n  if ('error' in outcome) {\n    set({ error: outcome.error });\n    return;\n  }\n  set({ view: outcome.state });\n}\n\n/** Turns the tunnel on and moves straight to the code, which is what the user came for. */\nexport async function turnRemoteAccessOn(): Promise<void> {\n  begin();\n  const outcome = await enableRemoteAccess();\n  if (!settle(outcome)) return;\n  // A contained cockpit is about to close this hub and open another on the same\n  // port. Nothing can be asked of it in between, so the dialog waits for the\n  // socket to come back rather than calling into a server that is going away.\n  if ('handingOver' in outcome && outcome.handingOver === true) {\n    set({ step: 'handover' });\n    return;\n  }\n  await Promise.all([newPairingCode(), refreshPasskeys()]);\n  set({ step: 'pairing' });\n}\n\nexport async function turnRemoteAccessOff(): Promise<void> {\n  begin();\n  if (!settle(await disableRemoteAccess())) return;\n  set({\n    step: 'options',\n    pairUrl: undefined,\n    pairCode: undefined,\n    pairFingerprint: undefined,\n    pairRevision: undefined,\n    pairExpiresAt: undefined,\n  });\n}\n\nexport async function newPairingCode(): Promise<void> {\n  const minted = await mintPairingCode();\n  if ('error' in minted) {\n    set({\n      error: minted.error,\n      pairUrl: undefined,\n      pairCode: undefined,\n      pairFingerprint: undefined,\n      pairRevision: undefined,\n    });\n    return;\n  }\n  set({\n    pairUrl: minted.pairUrl,\n    pairCode: minted.manualCode,\n    pairFingerprint: minted.fingerprint,\n    pairRevision: minted.revision,\n    pairExpiresAt: minted.expiresAt,\n  });\n}\n\nexport async function approveDevice(requestId: string): Promise<void> {\n  settle(await approvePairing(requestId));\n}\n\nexport async function denyDevice(requestId: string): Promise<void> {\n  settle(await denyPairing(requestId));\n}\n\nexport async function revokePairedDevice(id: string): Promise<void> {\n  begin();\n  settle(await revokeDevice(id));\n}\n\nexport async function revokeTrustedNativeDevice(id: string): Promise<void> {\n  begin();\n  settle(await revokeTrustedDevice(id));\n}\n\nlet settingsWrites: Promise<unknown> = Promise.resolve();\n\nexport async function updateRemoteSettings(patch: Partial<RemoteAccessSettings>): Promise<boolean> {\n  // Keep autosave edits responsive, but serialize writes across app replacements.\n  const draft = { ...patch };\n  pendingSettings.add(draft);\n  const view = remoteAccessStore.state.view;\n  if (view !== undefined) set({ view: { ...view, settings: { ...view.settings, ...draft } }, error: undefined });\n  const write = () => saveRemoteSettings(draft);\n  const pending = settingsWrites.then(write, write);\n  settingsWrites = pending;\n  const outcome = await pending;\n  pendingSettings.delete(draft);\n  if ('error' in outcome) {\n    set({ error: outcome.error });\n    if (settingsWrites === pending) void refreshRemoteState();\n    return false;\n  }\n  const current = remoteAccessStore.state.view;\n  if (current !== undefined && settingsWrites === pending)\n    set({ view: { ...current, settings: outcome.settings }, error: undefined });\n  return true;\n}\n\n/** Applies a state frame the hub pushed, so the page never polls for this. */\nexport function applyRemoteState(view: RemoteAccessStateView): void {\n  const waiting = remoteAccessStore.state.step === 'handover';\n  set({ view });\n  // The first frame from the cockpit that took over. It reaches here because\n  // the socket reconnected on its own, which is the only signal the browser\n  // gets that the move finished.\n  if (waiting && view.status === 'on') {\n    void Promise.all([newPairingCode(), refreshPasskeys()]).then(() => {\n      set({ step: 'pairing' });\n    });\n  }\n}\n"],"mappings":";;;;AA4CA,MAAa,oBAAoB,8BAAIA,EAAAA,CAAAA,MAAyB;CAAE,MAAM;CAAU,MAAM;AAAM,CAAC;AAC7F,MAAM,kCAAkB,IAAI,IAAmC;AAE/D,SAAS,IAAI,OAAyC;CACpD,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,KAAa,gBAAgB,OAAO,GAC/C,QAAQ;EACN,GAAG;EACH,MAAM;GACJ,GAAG;GACH,UAAU,CAAC,GAAG,eAAe,CAAC,CAAC,QAC5B,UAAU,WAAW;IAAE,GAAG;IAAU,GAAG;GAAM,IAC9C,KAAK,QACP;EACF;CACF;CACF,kBAAkB,UAAU,WAAW;EAAE,GAAG;EAAO,GAAG;CAAM,EAAE;AAChE;;AAGA,SAAS,QAAc;CACrB,IAAI;EAAE,MAAM;EAAM,OAAO,KAAA;CAAU,CAAC;AACtC;AAEA,SAAS,OAAO,SAAwE;CACtF,IAAI,WAAW,SAAS;EACtB,IAAI;GAAE,MAAM;GAAO,OAAO,QAAQ;EAAM,CAAC;EACzC,OAAO;CACT;CACA,IAAI;EAAE,MAAM;EAAO,MAAM,QAAQ;CAAM,CAAC;CACxC,OAAO;AACT;AAEA,SAAgB,mBAAyB;CACvC,IAAI;EAAE,MAAM;EAAW,OAAO,KAAA;CAAU,CAAC;CACzC,mBAAwB;AAC1B;AAEA,SAAgB,oBAA0B;CAGxC,IAAI;EAAE,MAAM;EAAU,OAAO,KAAA;CAAU,CAAC;AAC1C;AAEA,SAAgB,oBAA0B;CACxC,IAAI;EAAE,MAAM;EAAW,OAAO,KAAA;CAAU,CAAC;AAC3C;;AAGA,eAAsB,kBAAiC;CACrD,IAAI;EACF,MAAM,WAAW,MAAMC,sBAAAA,kBAAkB,MAAM,wBAAwB,EAAE,aAAa,cAAc,CAAC;EACrG,IAAI,CAAC,SAAS,IAAI;EAClB,MAAM,OAAQ,MAAM,SAAS,KAAK;EAIlC,IAAI,EACF,UAAU;GACR,WAAW,KAAK,QAAQ,aAAaC,uBAAAA,kBAAkB;GACvD,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,OAAO;GAC3E,OAAO,KAAK,YAAY;EAC1B,EACF,CAAC;CACH,QAAQ,CAER;AACF;AAEA,eAAsB,aAA4B;CAChD,MAAM;CACN,MAAM,UAAU,MAAMC,uBAAAA,gBAAgB;CACtC,IAAI;EAAE,MAAM;EAAO,GAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;CAAG,CAAC;CACpE,MAAM,gBAAgB;AACxB;AAEA,eAAsB,qBAAoC;CACxD,MAAM,UAAU,MAAMC,kBAAAA,iBAAiB;CACvC,IAAI,WAAW,SAAS;EACtB,IAAI,EAAE,OAAO,QAAQ,MAAM,CAAC;EAC5B;CACF;CACA,IAAI,EAAE,MAAM,QAAQ,MAAM,CAAC;AAC7B;;AAGA,eAAsB,qBAAoC;CACxD,MAAM;CACN,MAAM,UAAU,MAAMC,kBAAAA,mBAAmB;CACzC,IAAI,CAAC,OAAO,OAAO,GAAG;CAItB,IAAI,iBAAiB,WAAW,QAAQ,gBAAgB,MAAM;EAC5D,IAAI,EAAE,MAAM,WAAW,CAAC;EACxB;CACF;CACA,MAAM,QAAQ,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;CACvD,IAAI,EAAE,MAAM,UAAU,CAAC;AACzB;AAEA,eAAsB,sBAAqC;CACzD,MAAM;CACN,IAAI,CAAC,OAAO,MAAMC,kBAAAA,oBAAoB,CAAC,GAAG;CAC1C,IAAI;EACF,MAAM;EACN,SAAS,KAAA;EACT,UAAU,KAAA;EACV,iBAAiB,KAAA;EACjB,cAAc,KAAA;EACd,eAAe,KAAA;CACjB,CAAC;AACH;AAEA,eAAsB,iBAAgC;CACpD,MAAM,SAAS,MAAMC,kBAAAA,gBAAgB;CACrC,IAAI,WAAW,QAAQ;EACrB,IAAI;GACF,OAAO,OAAO;GACd,SAAS,KAAA;GACT,UAAU,KAAA;GACV,iBAAiB,KAAA;GACjB,cAAc,KAAA;EAChB,CAAC;EACD;CACF;CACA,IAAI;EACF,SAAS,OAAO;EAChB,UAAU,OAAO;EACjB,iBAAiB,OAAO;EACxB,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;AACH;AAEA,eAAsB,cAAc,WAAkC;CACpE,OAAO,MAAMC,kBAAAA,eAAe,SAAS,CAAC;AACxC;AAEA,eAAsB,WAAW,WAAkC;CACjE,OAAO,MAAMC,kBAAAA,YAAY,SAAS,CAAC;AACrC;AAEA,eAAsB,mBAAmB,IAA2B;CAClE,MAAM;CACN,OAAO,MAAMC,kBAAAA,aAAa,EAAE,CAAC;AAC/B;AAEA,eAAsB,0BAA0B,IAA2B;CACzE,MAAM;CACN,OAAO,MAAMC,kBAAAA,oBAAoB,EAAE,CAAC;AACtC;AAEA,IAAI,iBAAmC,QAAQ,QAAQ;AAEvD,eAAsB,qBAAqB,OAAwD;CAEjG,MAAM,QAAQ,EAAE,GAAG,MAAM;CACzB,gBAAgB,IAAI,KAAK;CACzB,MAAM,OAAO,kBAAkB,MAAM;CACrC,IAAI,SAAS,KAAA,GAAW,IAAI;EAAE,MAAM;GAAE,GAAG;GAAM,UAAU;IAAE,GAAG,KAAK;IAAU,GAAG;GAAM;EAAE;EAAG,OAAO,KAAA;CAAU,CAAC;CAC7G,MAAM,cAAcC,kBAAAA,mBAAmB,KAAK;CAC5C,MAAM,UAAU,eAAe,KAAK,OAAO,KAAK;CAChD,iBAAiB;CACjB,MAAM,UAAU,MAAM;CACtB,gBAAgB,OAAO,KAAK;CAC5B,IAAI,WAAW,SAAS;EACtB,IAAI,EAAE,OAAO,QAAQ,MAAM,CAAC;EAC5B,IAAI,mBAAmB,SAAS,mBAAwB;EACxD,OAAO;CACT;CACA,MAAM,UAAU,kBAAkB,MAAM;CACxC,IAAI,YAAY,KAAA,KAAa,mBAAmB,SAC9C,IAAI;EAAE,MAAM;GAAE,GAAG;GAAS,UAAU,QAAQ;EAAS;EAAG,OAAO,KAAA;CAAU,CAAC;CAC5E,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAmC;CAClE,MAAM,UAAU,kBAAkB,MAAM,SAAS;CACjD,IAAI,EAAE,KAAK,CAAC;CAIZ,IAAI,WAAW,KAAK,WAAW,MAC7B,QAAa,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW;EACjE,IAAI,EAAE,MAAM,UAAU,CAAC;CACzB,CAAC;AAEL"}

package/dist/web/stores/remoteAccessStore.d.mts

@@ -0,0 +1,48 @@
+import { RemoteAccessSettings, RemoteAccessStateView } from "../../types/remoteAccess.mjs";
+import { Store } from "@tanstack/store";
+//#region src/web/stores/remoteAccessStore.d.ts
+/** Which panel of the dialog is showing. Options first, then the code to scan. */
+export type RemoteStep = 'closed' | 'options' | 'handover' | 'pairing';
+export interface PasskeySupportView {
+  supported: boolean;
+  reason?: string;
+  count: number;
+}
+export interface RemoteAccessState {
+  step: RemoteStep;
+  /** Undefined until the passkey surface has been asked about. */
+  passkeys?: PasskeySupportView;
+  /** Undefined until the first load answers. */
+  view?: RemoteAccessStateView;
+  /** The URL the QR encodes; present only while a code is live. */
+  pairUrl?: string;
+  /** Short code accepted by the same pairing claim for manual entry. */
+  pairCode?: string;
+  /** Signing-key fingerprint the user compares during manual pairing. */
+  pairFingerprint?: string;
+  pairRevision?: number;
+  pairExpiresAt?: string;
+  busy: boolean;
+  error?: string;
+}
+export declare const remoteAccessStore: Store<RemoteAccessState, never>;
+export declare function openRemoteDialog(): void;
+export declare function closeRemoteDialog(): void;
+export declare function showRemoteOptions(): void;
+/** Whether this tunnel and this browser can carry a passkey at all. */
+export declare function refreshPasskeys(): Promise<void>;
+export declare function addPasskey(): Promise<void>;
+export declare function refreshRemoteState(): Promise<void>;
+/** Turns the tunnel on and moves straight to the code, which is what the user came for. */
+export declare function turnRemoteAccessOn(): Promise<void>;
+export declare function turnRemoteAccessOff(): Promise<void>;
+export declare function newPairingCode(): Promise<void>;
+export declare function approveDevice(requestId: string): Promise<void>;
+export declare function denyDevice(requestId: string): Promise<void>;
+export declare function revokePairedDevice(id: string): Promise<void>;
+export declare function revokeTrustedNativeDevice(id: string): Promise<void>;
+export declare function updateRemoteSettings(patch: Partial<RemoteAccessSettings>): Promise<boolean>;
+/** Applies a state frame the hub pushed, so the page never polls for this. */
+export declare function applyRemoteState(view: RemoteAccessStateView): void;
+//#endregion
+//# sourceMappingURL=remoteAccessStore.d.mts.map

package/dist/web/stores/remoteAccessStore.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccessStore.d.mts","names":[],"sources":["../../../src/web/stores/remoteAccessStore.ts"],"mappings":";;;;YAkBY;iBAEK;EACf;EACA;EACA;;iBAGe;EACf,MAAM;;EAEN,WAAW;;EAEX,OAAO;;EAEP;;EAEA;;EAEA;EACA;EACA;EACA;EACA;;qBAGW,mBAAiB,MAAA;wBAiCd;wBAKA;wBAMA;;wBAKM,mBAAmB;wBAoBnB,cAAc;wBAOd,sBAAsB;;wBAUtB,sBAAsB;wBAetB,uBAAuB;wBAavB,kBAAkB;wBAqBlB,cAAc,oBAAoB;wBAIlC,WAAW,oBAAoB;wBAI/B,mBAAmB,aAAa;wBAKhC,0BAA0B,aAAa;wBAOvC,qBAAqB,OAAO,QAAQ,wBAAwB;;wBAuBlE,iBAAiB,MAAM"}

package/dist/web/stores/remoteAccessStore.mjs

@@ -0,0 +1,202 @@
+import { sealedHttpSession } from "../lib/sealedSession.mjs";
+import { passkeysAvailable, registerPasskey } from "../lib/webauthnClient.mjs";
+import { approvePairing, denyPairing, disableRemoteAccess, enableRemoteAccess, fetchRemoteState, mintPairingCode, revokeDevice, revokeTrustedDevice, saveRemoteSettings } from "../lib/remoteApi.mjs";
+import { Store } from "@tanstack/store";
+//#region src/web/stores/remoteAccessStore.ts
+const remoteAccessStore = new Store({
+	step: "closed",
+	busy: false
+});
+const pendingSettings = /* @__PURE__ */ new Set();
+function set(patch) {
+	const view = patch.view;
+	if (view !== void 0 && pendingSettings.size > 0) patch = {
+		...patch,
+		view: {
+			...view,
+			settings: [...pendingSettings].reduce((settings, draft) => ({
+				...settings,
+				...draft
+			}), view.settings)
+		}
+	};
+	remoteAccessStore.setState((state) => ({
+		...state,
+		...patch
+	}));
+}
+/** Clears the previous error before an action, so a stale one never outlives its cause. */
+function begin() {
+	set({
+		busy: true,
+		error: void 0
+	});
+}
+function settle(outcome) {
+	if ("error" in outcome) {
+		set({
+			busy: false,
+			error: outcome.error
+		});
+		return false;
+	}
+	set({
+		busy: false,
+		view: outcome.state
+	});
+	return true;
+}
+function openRemoteDialog() {
+	set({
+		step: "options",
+		error: void 0
+	});
+	refreshRemoteState();
+}
+function closeRemoteDialog() {
+	set({
+		step: "closed",
+		error: void 0
+	});
+}
+function showRemoteOptions() {
+	set({
+		step: "options",
+		error: void 0
+	});
+}
+/** Whether this tunnel and this browser can carry a passkey at all. */
+async function refreshPasskeys() {
+	try {
+		const response = await sealedHttpSession.fetch("/api/remote/passkeys", { credentials: "same-origin" });
+		if (!response.ok) return;
+		const body = await response.json();
+		set({ passkeys: {
+			supported: body.support.supported && passkeysAvailable(),
+			...body.support.reason === void 0 ? {} : { reason: body.support.reason },
+			count: body.credentials.length
+		} });
+	} catch {}
+}
+async function addPasskey() {
+	begin();
+	const outcome = await registerPasskey();
+	set({
+		busy: false,
+		...outcome.ok ? {} : { error: outcome.error }
+	});
+	await refreshPasskeys();
+}
+async function refreshRemoteState() {
+	const outcome = await fetchRemoteState();
+	if ("error" in outcome) {
+		set({ error: outcome.error });
+		return;
+	}
+	set({ view: outcome.state });
+}
+/** Turns the tunnel on and moves straight to the code, which is what the user came for. */
+async function turnRemoteAccessOn() {
+	begin();
+	const outcome = await enableRemoteAccess();
+	if (!settle(outcome)) return;
+	if ("handingOver" in outcome && outcome.handingOver === true) {
+		set({ step: "handover" });
+		return;
+	}
+	await Promise.all([newPairingCode(), refreshPasskeys()]);
+	set({ step: "pairing" });
+}
+async function turnRemoteAccessOff() {
+	begin();
+	if (!settle(await disableRemoteAccess())) return;
+	set({
+		step: "options",
+		pairUrl: void 0,
+		pairCode: void 0,
+		pairFingerprint: void 0,
+		pairRevision: void 0,
+		pairExpiresAt: void 0
+	});
+}
+async function newPairingCode() {
+	const minted = await mintPairingCode();
+	if ("error" in minted) {
+		set({
+			error: minted.error,
+			pairUrl: void 0,
+			pairCode: void 0,
+			pairFingerprint: void 0,
+			pairRevision: void 0
+		});
+		return;
+	}
+	set({
+		pairUrl: minted.pairUrl,
+		pairCode: minted.manualCode,
+		pairFingerprint: minted.fingerprint,
+		pairRevision: minted.revision,
+		pairExpiresAt: minted.expiresAt
+	});
+}
+async function approveDevice(requestId) {
+	settle(await approvePairing(requestId));
+}
+async function denyDevice(requestId) {
+	settle(await denyPairing(requestId));
+}
+async function revokePairedDevice(id) {
+	begin();
+	settle(await revokeDevice(id));
+}
+async function revokeTrustedNativeDevice(id) {
+	begin();
+	settle(await revokeTrustedDevice(id));
+}
+let settingsWrites = Promise.resolve();
+async function updateRemoteSettings(patch) {
+	const draft = { ...patch };
+	pendingSettings.add(draft);
+	const view = remoteAccessStore.state.view;
+	if (view !== void 0) set({
+		view: {
+			...view,
+			settings: {
+				...view.settings,
+				...draft
+			}
+		},
+		error: void 0
+	});
+	const write = () => saveRemoteSettings(draft);
+	const pending = settingsWrites.then(write, write);
+	settingsWrites = pending;
+	const outcome = await pending;
+	pendingSettings.delete(draft);
+	if ("error" in outcome) {
+		set({ error: outcome.error });
+		if (settingsWrites === pending) refreshRemoteState();
+		return false;
+	}
+	const current = remoteAccessStore.state.view;
+	if (current !== void 0 && settingsWrites === pending) set({
+		view: {
+			...current,
+			settings: outcome.settings
+		},
+		error: void 0
+	});
+	return true;
+}
+/** Applies a state frame the hub pushed, so the page never polls for this. */
+function applyRemoteState(view) {
+	const waiting = remoteAccessStore.state.step === "handover";
+	set({ view });
+	if (waiting && view.status === "on") Promise.all([newPairingCode(), refreshPasskeys()]).then(() => {
+		set({ step: "pairing" });
+	});
+}
+//#endregion
+export { addPasskey, applyRemoteState, approveDevice, closeRemoteDialog, denyDevice, newPairingCode, openRemoteDialog, refreshPasskeys, refreshRemoteState, remoteAccessStore, revokePairedDevice, revokeTrustedNativeDevice, showRemoteOptions, turnRemoteAccessOff, turnRemoteAccessOn, updateRemoteSettings };
+
+//# sourceMappingURL=remoteAccessStore.mjs.map

package/dist/web/stores/remoteAccessStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccessStore.mjs","names":[],"sources":["../../../src/web/stores/remoteAccessStore.ts"],"sourcesContent":["import { Store } from '@tanstack/store';\n\nimport type { RemoteAccessSettings, RemoteAccessStateView } from '../../types/remoteAccess';\nimport {\n  approvePairing,\n  denyPairing,\n  disableRemoteAccess,\n  enableRemoteAccess,\n  fetchRemoteState,\n  mintPairingCode,\n  revokeDevice,\n  revokeTrustedDevice,\n  saveRemoteSettings,\n} from '../lib/remoteApi';\nimport { sealedHttpSession } from '../lib/sealedSession';\nimport { passkeysAvailable, registerPasskey } from '../lib/webauthnClient';\n\n/** Which panel of the dialog is showing. Options first, then the code to scan. */\nexport type RemoteStep = 'closed' | 'options' | 'handover' | 'pairing';\n\nexport interface PasskeySupportView {\n  supported: boolean;\n  reason?: string;\n  count: number;\n}\n\nexport interface RemoteAccessState {\n  step: RemoteStep;\n  /** Undefined until the passkey surface has been asked about. */\n  passkeys?: PasskeySupportView;\n  /** Undefined until the first load answers. */\n  view?: RemoteAccessStateView;\n  /** The URL the QR encodes; present only while a code is live. */\n  pairUrl?: string;\n  /** Short code accepted by the same pairing claim for manual entry. */\n  pairCode?: string;\n  /** Signing-key fingerprint the user compares during manual pairing. */\n  pairFingerprint?: string;\n  pairRevision?: number;\n  pairExpiresAt?: string;\n  busy: boolean;\n  error?: string;\n}\n\nexport const remoteAccessStore = new Store<RemoteAccessState>({ step: 'closed', busy: false });\nconst pendingSettings = new Set<Partial<RemoteAccessSettings>>();\n\nfunction set(patch: Partial<RemoteAccessState>): void {\n  const view = patch.view;\n  if (view !== undefined && pendingSettings.size > 0)\n    patch = {\n      ...patch,\n      view: {\n        ...view,\n        settings: [...pendingSettings].reduce<RemoteAccessSettings>(\n          (settings, draft) => ({ ...settings, ...draft }),\n          view.settings,\n        ),\n      },\n    };\n  remoteAccessStore.setState((state) => ({ ...state, ...patch }));\n}\n\n/** Clears the previous error before an action, so a stale one never outlives its cause. */\nfunction begin(): void {\n  set({ busy: true, error: undefined });\n}\n\nfunction settle(outcome: { state: RemoteAccessStateView } | { error: string }): boolean {\n  if ('error' in outcome) {\n    set({ busy: false, error: outcome.error });\n    return false;\n  }\n  set({ busy: false, view: outcome.state });\n  return true;\n}\n\nexport function openRemoteDialog(): void {\n  set({ step: 'options', error: undefined });\n  void refreshRemoteState();\n}\n\nexport function closeRemoteDialog(): void {\n  // The code is left to expire on its own rather than cancelled here: closing\n  // the dialog while a phone is mid-scan should not strand it.\n  set({ step: 'closed', error: undefined });\n}\n\nexport function showRemoteOptions(): void {\n  set({ step: 'options', error: undefined });\n}\n\n/** Whether this tunnel and this browser can carry a passkey at all. */\nexport async function refreshPasskeys(): Promise<void> {\n  try {\n    const response = await sealedHttpSession.fetch('/api/remote/passkeys', { credentials: 'same-origin' });\n    if (!response.ok) return;\n    const body = (await response.json()) as {\n      support: { supported: boolean; reason?: string };\n      credentials: unknown[];\n    };\n    set({\n      passkeys: {\n        supported: body.support.supported && passkeysAvailable(),\n        ...(body.support.reason === undefined ? {} : { reason: body.support.reason }),\n        count: body.credentials.length,\n      },\n    });\n  } catch {\n    // The hub is unreachable; the state refresh reports that already.\n  }\n}\n\nexport async function addPasskey(): Promise<void> {\n  begin();\n  const outcome = await registerPasskey();\n  set({ busy: false, ...(outcome.ok ? {} : { error: outcome.error }) });\n  await refreshPasskeys();\n}\n\nexport async function refreshRemoteState(): Promise<void> {\n  const outcome = await fetchRemoteState();\n  if ('error' in outcome) {\n    set({ error: outcome.error });\n    return;\n  }\n  set({ view: outcome.state });\n}\n\n/** Turns the tunnel on and moves straight to the code, which is what the user came for. */\nexport async function turnRemoteAccessOn(): Promise<void> {\n  begin();\n  const outcome = await enableRemoteAccess();\n  if (!settle(outcome)) return;\n  // A contained cockpit is about to close this hub and open another on the same\n  // port. Nothing can be asked of it in between, so the dialog waits for the\n  // socket to come back rather than calling into a server that is going away.\n  if ('handingOver' in outcome && outcome.handingOver === true) {\n    set({ step: 'handover' });\n    return;\n  }\n  await Promise.all([newPairingCode(), refreshPasskeys()]);\n  set({ step: 'pairing' });\n}\n\nexport async function turnRemoteAccessOff(): Promise<void> {\n  begin();\n  if (!settle(await disableRemoteAccess())) return;\n  set({\n    step: 'options',\n    pairUrl: undefined,\n    pairCode: undefined,\n    pairFingerprint: undefined,\n    pairRevision: undefined,\n    pairExpiresAt: undefined,\n  });\n}\n\nexport async function newPairingCode(): Promise<void> {\n  const minted = await mintPairingCode();\n  if ('error' in minted) {\n    set({\n      error: minted.error,\n      pairUrl: undefined,\n      pairCode: undefined,\n      pairFingerprint: undefined,\n      pairRevision: undefined,\n    });\n    return;\n  }\n  set({\n    pairUrl: minted.pairUrl,\n    pairCode: minted.manualCode,\n    pairFingerprint: minted.fingerprint,\n    pairRevision: minted.revision,\n    pairExpiresAt: minted.expiresAt,\n  });\n}\n\nexport async function approveDevice(requestId: string): Promise<void> {\n  settle(await approvePairing(requestId));\n}\n\nexport async function denyDevice(requestId: string): Promise<void> {\n  settle(await denyPairing(requestId));\n}\n\nexport async function revokePairedDevice(id: string): Promise<void> {\n  begin();\n  settle(await revokeDevice(id));\n}\n\nexport async function revokeTrustedNativeDevice(id: string): Promise<void> {\n  begin();\n  settle(await revokeTrustedDevice(id));\n}\n\nlet settingsWrites: Promise<unknown> = Promise.resolve();\n\nexport async function updateRemoteSettings(patch: Partial<RemoteAccessSettings>): Promise<boolean> {\n  // Keep autosave edits responsive, but serialize writes across app replacements.\n  const draft = { ...patch };\n  pendingSettings.add(draft);\n  const view = remoteAccessStore.state.view;\n  if (view !== undefined) set({ view: { ...view, settings: { ...view.settings, ...draft } }, error: undefined });\n  const write = () => saveRemoteSettings(draft);\n  const pending = settingsWrites.then(write, write);\n  settingsWrites = pending;\n  const outcome = await pending;\n  pendingSettings.delete(draft);\n  if ('error' in outcome) {\n    set({ error: outcome.error });\n    if (settingsWrites === pending) void refreshRemoteState();\n    return false;\n  }\n  const current = remoteAccessStore.state.view;\n  if (current !== undefined && settingsWrites === pending)\n    set({ view: { ...current, settings: outcome.settings }, error: undefined });\n  return true;\n}\n\n/** Applies a state frame the hub pushed, so the page never polls for this. */\nexport function applyRemoteState(view: RemoteAccessStateView): void {\n  const waiting = remoteAccessStore.state.step === 'handover';\n  set({ view });\n  // The first frame from the cockpit that took over. It reaches here because\n  // the socket reconnected on its own, which is the only signal the browser\n  // gets that the move finished.\n  if (waiting && view.status === 'on') {\n    void Promise.all([newPairingCode(), refreshPasskeys()]).then(() => {\n      set({ step: 'pairing' });\n    });\n  }\n}\n"],"mappings":";;;;;AA4CA,MAAa,oBAAoB,IAAI,MAAyB;CAAE,MAAM;CAAU,MAAM;AAAM,CAAC;AAC7F,MAAM,kCAAkB,IAAI,IAAmC;AAE/D,SAAS,IAAI,OAAyC;CACpD,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,KAAa,gBAAgB,OAAO,GAC/C,QAAQ;EACN,GAAG;EACH,MAAM;GACJ,GAAG;GACH,UAAU,CAAC,GAAG,eAAe,CAAC,CAAC,QAC5B,UAAU,WAAW;IAAE,GAAG;IAAU,GAAG;GAAM,IAC9C,KAAK,QACP;EACF;CACF;CACF,kBAAkB,UAAU,WAAW;EAAE,GAAG;EAAO,GAAG;CAAM,EAAE;AAChE;;AAGA,SAAS,QAAc;CACrB,IAAI;EAAE,MAAM;EAAM,OAAO,KAAA;CAAU,CAAC;AACtC;AAEA,SAAS,OAAO,SAAwE;CACtF,IAAI,WAAW,SAAS;EACtB,IAAI;GAAE,MAAM;GAAO,OAAO,QAAQ;EAAM,CAAC;EACzC,OAAO;CACT;CACA,IAAI;EAAE,MAAM;EAAO,MAAM,QAAQ;CAAM,CAAC;CACxC,OAAO;AACT;AAEA,SAAgB,mBAAyB;CACvC,IAAI;EAAE,MAAM;EAAW,OAAO,KAAA;CAAU,CAAC;CACzC,mBAAwB;AAC1B;AAEA,SAAgB,oBAA0B;CAGxC,IAAI;EAAE,MAAM;EAAU,OAAO,KAAA;CAAU,CAAC;AAC1C;AAEA,SAAgB,oBAA0B;CACxC,IAAI;EAAE,MAAM;EAAW,OAAO,KAAA;CAAU,CAAC;AAC3C;;AAGA,eAAsB,kBAAiC;CACrD,IAAI;EACF,MAAM,WAAW,MAAM,kBAAkB,MAAM,wBAAwB,EAAE,aAAa,cAAc,CAAC;EACrG,IAAI,CAAC,SAAS,IAAI;EAClB,MAAM,OAAQ,MAAM,SAAS,KAAK;EAIlC,IAAI,EACF,UAAU;GACR,WAAW,KAAK,QAAQ,aAAa,kBAAkB;GACvD,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,OAAO;GAC3E,OAAO,KAAK,YAAY;EAC1B,EACF,CAAC;CACH,QAAQ,CAER;AACF;AAEA,eAAsB,aAA4B;CAChD,MAAM;CACN,MAAM,UAAU,MAAM,gBAAgB;CACtC,IAAI;EAAE,MAAM;EAAO,GAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;CAAG,CAAC;CACpE,MAAM,gBAAgB;AACxB;AAEA,eAAsB,qBAAoC;CACxD,MAAM,UAAU,MAAM,iBAAiB;CACvC,IAAI,WAAW,SAAS;EACtB,IAAI,EAAE,OAAO,QAAQ,MAAM,CAAC;EAC5B;CACF;CACA,IAAI,EAAE,MAAM,QAAQ,MAAM,CAAC;AAC7B;;AAGA,eAAsB,qBAAoC;CACxD,MAAM;CACN,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,CAAC,OAAO,OAAO,GAAG;CAItB,IAAI,iBAAiB,WAAW,QAAQ,gBAAgB,MAAM;EAC5D,IAAI,EAAE,MAAM,WAAW,CAAC;EACxB;CACF;CACA,MAAM,QAAQ,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;CACvD,IAAI,EAAE,MAAM,UAAU,CAAC;AACzB;AAEA,eAAsB,sBAAqC;CACzD,MAAM;CACN,IAAI,CAAC,OAAO,MAAM,oBAAoB,CAAC,GAAG;CAC1C,IAAI;EACF,MAAM;EACN,SAAS,KAAA;EACT,UAAU,KAAA;EACV,iBAAiB,KAAA;EACjB,cAAc,KAAA;EACd,eAAe,KAAA;CACjB,CAAC;AACH;AAEA,eAAsB,iBAAgC;CACpD,MAAM,SAAS,MAAM,gBAAgB;CACrC,IAAI,WAAW,QAAQ;EACrB,IAAI;GACF,OAAO,OAAO;GACd,SAAS,KAAA;GACT,UAAU,KAAA;GACV,iBAAiB,KAAA;GACjB,cAAc,KAAA;EAChB,CAAC;EACD;CACF;CACA,IAAI;EACF,SAAS,OAAO;EAChB,UAAU,OAAO;EACjB,iBAAiB,OAAO;EACxB,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;AACH;AAEA,eAAsB,cAAc,WAAkC;CACpE,OAAO,MAAM,eAAe,SAAS,CAAC;AACxC;AAEA,eAAsB,WAAW,WAAkC;CACjE,OAAO,MAAM,YAAY,SAAS,CAAC;AACrC;AAEA,eAAsB,mBAAmB,IAA2B;CAClE,MAAM;CACN,OAAO,MAAM,aAAa,EAAE,CAAC;AAC/B;AAEA,eAAsB,0BAA0B,IAA2B;CACzE,MAAM;CACN,OAAO,MAAM,oBAAoB,EAAE,CAAC;AACtC;AAEA,IAAI,iBAAmC,QAAQ,QAAQ;AAEvD,eAAsB,qBAAqB,OAAwD;CAEjG,MAAM,QAAQ,EAAE,GAAG,MAAM;CACzB,gBAAgB,IAAI,KAAK;CACzB,MAAM,OAAO,kBAAkB,MAAM;CACrC,IAAI,SAAS,KAAA,GAAW,IAAI;EAAE,MAAM;GAAE,GAAG;GAAM,UAAU;IAAE,GAAG,KAAK;IAAU,GAAG;GAAM;EAAE;EAAG,OAAO,KAAA;CAAU,CAAC;CAC7G,MAAM,cAAc,mBAAmB,KAAK;CAC5C,MAAM,UAAU,eAAe,KAAK,OAAO,KAAK;CAChD,iBAAiB;CACjB,MAAM,UAAU,MAAM;CACtB,gBAAgB,OAAO,KAAK;CAC5B,IAAI,WAAW,SAAS;EACtB,IAAI,EAAE,OAAO,QAAQ,MAAM,CAAC;EAC5B,IAAI,mBAAmB,SAAS,mBAAwB;EACxD,OAAO;CACT;CACA,MAAM,UAAU,kBAAkB,MAAM;CACxC,IAAI,YAAY,KAAA,KAAa,mBAAmB,SAC9C,IAAI;EAAE,MAAM;GAAE,GAAG;GAAS,UAAU,QAAQ;EAAS;EAAG,OAAO,KAAA;CAAU,CAAC;CAC5E,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAmC;CAClE,MAAM,UAAU,kBAAkB,MAAM,SAAS;CACjD,IAAI,EAAE,KAAK,CAAC;CAIZ,IAAI,WAAW,KAAK,WAAW,MAC7B,QAAa,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW;EACjE,IAAI,EAAE,MAAM,UAAU,CAAC;CACzB,CAAC;AAEL"}

package/dist/web/stores/sessionChannelHoldsStore.cjs

@@ -0,0 +1,43 @@
+//#region src/web/stores/sessionChannelHoldsStore.ts
+/** Dialogs can observe their target without taking focus or stealing another observer's subscription. */
+const heldSessionChannels = new (require("@tanstack/store")).Store(/* @__PURE__ */ new Map());
+const observers = /* @__PURE__ */ new Set();
+function holdSessionChannels(sessionId, receive) {
+	const observer = receive === void 0 ? void 0 : {
+		sessionId,
+		receive
+	};
+	if (observer) observers.add(observer);
+	heldSessionChannels.setState((current) => new Map(current).set(sessionId, (current.get(sessionId) ?? 0) + 1));
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		if (observer) observers.delete(observer);
+		heldSessionChannels.setState((current) => {
+			const next = new Map(current);
+			const remaining = (next.get(sessionId) ?? 1) - 1;
+			if (remaining === 0) next.delete(sessionId);
+			else next.set(sessionId, remaining);
+			return next;
+		});
+	};
+}
+/** Deliver to the observing dialog's composition, even when the target has never been focused. */
+function dispatchHeldSessionChannel(frame) {
+	if (typeof frame.type !== "string" || typeof frame.sessionId !== "string") return;
+	for (const observer of observers) {
+		if (observer.sessionId !== frame.sessionId) continue;
+		try {
+			observer.receive(frame);
+		} catch (error) {
+			console.error("Session channel observer failed", error);
+		}
+	}
+}
+//#endregion
+exports.dispatchHeldSessionChannel = dispatchHeldSessionChannel;
+exports.heldSessionChannels = heldSessionChannels;
+exports.holdSessionChannels = holdSessionChannels;
+
+//# sourceMappingURL=sessionChannelHoldsStore.cjs.map

package/dist/web/stores/sessionChannelHoldsStore.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionChannelHoldsStore.cjs","names":["Store"],"sources":["../../../src/web/stores/sessionChannelHoldsStore.ts"],"sourcesContent":["import { Store } from '@tanstack/store';\n\n/** Dialogs can observe their target without taking focus or stealing another observer's subscription. */\nexport const heldSessionChannels = new Store<ReadonlyMap<string, number>>(new Map());\n\nconst observers = new Set<{ sessionId: string; receive: (frame: Record<string, unknown>) => void }>();\n\nexport function holdSessionChannels(sessionId: string, receive?: (frame: Record<string, unknown>) => void): () => void {\n  const observer = receive === undefined ? undefined : { sessionId, receive };\n  if (observer) observers.add(observer);\n  heldSessionChannels.setState((current) => new Map(current).set(sessionId, (current.get(sessionId) ?? 0) + 1));\n  let released = false;\n  return () => {\n    if (released) return;\n    released = true;\n    if (observer) observers.delete(observer);\n    heldSessionChannels.setState((current) => {\n      const next = new Map(current);\n      const remaining = (next.get(sessionId) ?? 1) - 1;\n      if (remaining === 0) next.delete(sessionId);\n      else next.set(sessionId, remaining);\n      return next;\n    });\n  };\n}\n\n/** Deliver to the observing dialog's composition, even when the target has never been focused. */\nexport function dispatchHeldSessionChannel(frame: Record<string, unknown>): void {\n  if (typeof frame.type !== 'string' || typeof frame.sessionId !== 'string') return;\n  for (const observer of observers) {\n    if (observer.sessionId !== frame.sessionId) continue;\n    try {\n      observer.receive(frame);\n    } catch (error) {\n      console.error('Session channel observer failed', error);\n    }\n  }\n}\n"],"mappings":";;AAGA,MAAa,sBAAsB,8BAAIA,EAAAA,CAAAA,sBAAmC,IAAI,IAAI,CAAC;AAEnF,MAAM,4BAAY,IAAI,IAA8E;AAEpG,SAAgB,oBAAoB,WAAmB,SAAgE;CACrH,MAAM,WAAW,YAAY,KAAA,IAAY,KAAA,IAAY;EAAE;EAAW;CAAQ;CAC1E,IAAI,UAAU,UAAU,IAAI,QAAQ;CACpC,oBAAoB,UAAU,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,YAAY,QAAQ,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC;CAC5G,IAAI,WAAW;CACf,aAAa;EACX,IAAI,UAAU;EACd,WAAW;EACX,IAAI,UAAU,UAAU,OAAO,QAAQ;EACvC,oBAAoB,UAAU,YAAY;GACxC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,MAAM,aAAa,KAAK,IAAI,SAAS,KAAK,KAAK;GAC/C,IAAI,cAAc,GAAG,KAAK,OAAO,SAAS;QACrC,KAAK,IAAI,WAAW,SAAS;GAClC,OAAO;EACT,CAAC;CACH;AACF;;AAGA,SAAgB,2BAA2B,OAAsC;CAC/E,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,cAAc,UAAU;CAC3E,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,cAAc,MAAM,WAAW;EAC5C,IAAI;GACF,SAAS,QAAQ,KAAK;EACxB,SAAS,OAAO;GACd,QAAQ,MAAM,mCAAmC,KAAK;EACxD;CACF;AACF"}

package/dist/web/stores/sessionChannelHoldsStore.d.mts

@@ -0,0 +1,9 @@
+import { Store } from "@tanstack/store";
+//#region src/web/stores/sessionChannelHoldsStore.d.ts
+/** Dialogs can observe their target without taking focus or stealing another observer's subscription. */
+export declare const heldSessionChannels: Store<ReadonlyMap<string, number>, never>;
+export declare function holdSessionChannels(sessionId: string, receive?: (frame: Record<string, unknown>) => void): () => void;
+/** Deliver to the observing dialog's composition, even when the target has never been focused. */
+export declare function dispatchHeldSessionChannel(frame: Record<string, unknown>): void;
+//#endregion
+//# sourceMappingURL=sessionChannelHoldsStore.d.mts.map

package/dist/web/stores/sessionChannelHoldsStore.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionChannelHoldsStore.d.mts","names":[],"sources":["../../../src/web/stores/sessionChannelHoldsStore.ts"],"mappings":";;;qBAGa,qBAAmB,MAAA;wBAIhB,oBAAoB,mBAAmB,WAAW,OAAO;;wBAoBzD,2BAA2B,OAAO"}

package/dist/web/stores/sessionChannelHoldsStore.mjs

@@ -0,0 +1,42 @@
+import { Store } from "@tanstack/store";
+//#region src/web/stores/sessionChannelHoldsStore.ts
+/** Dialogs can observe their target without taking focus or stealing another observer's subscription. */
+const heldSessionChannels = new Store(/* @__PURE__ */ new Map());
+const observers = /* @__PURE__ */ new Set();
+function holdSessionChannels(sessionId, receive) {
+	const observer = receive === void 0 ? void 0 : {
+		sessionId,
+		receive
+	};
+	if (observer) observers.add(observer);
+	heldSessionChannels.setState((current) => new Map(current).set(sessionId, (current.get(sessionId) ?? 0) + 1));
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		if (observer) observers.delete(observer);
+		heldSessionChannels.setState((current) => {
+			const next = new Map(current);
+			const remaining = (next.get(sessionId) ?? 1) - 1;
+			if (remaining === 0) next.delete(sessionId);
+			else next.set(sessionId, remaining);
+			return next;
+		});
+	};
+}
+/** Deliver to the observing dialog's composition, even when the target has never been focused. */
+function dispatchHeldSessionChannel(frame) {
+	if (typeof frame.type !== "string" || typeof frame.sessionId !== "string") return;
+	for (const observer of observers) {
+		if (observer.sessionId !== frame.sessionId) continue;
+		try {
+			observer.receive(frame);
+		} catch (error) {
+			console.error("Session channel observer failed", error);
+		}
+	}
+}
+//#endregion
+export { dispatchHeldSessionChannel, heldSessionChannels, holdSessionChannels };
+
+//# sourceMappingURL=sessionChannelHoldsStore.mjs.map

package/dist/web/stores/sessionChannelHoldsStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionChannelHoldsStore.mjs","names":[],"sources":["../../../src/web/stores/sessionChannelHoldsStore.ts"],"sourcesContent":["import { Store } from '@tanstack/store';\n\n/** Dialogs can observe their target without taking focus or stealing another observer's subscription. */\nexport const heldSessionChannels = new Store<ReadonlyMap<string, number>>(new Map());\n\nconst observers = new Set<{ sessionId: string; receive: (frame: Record<string, unknown>) => void }>();\n\nexport function holdSessionChannels(sessionId: string, receive?: (frame: Record<string, unknown>) => void): () => void {\n  const observer = receive === undefined ? undefined : { sessionId, receive };\n  if (observer) observers.add(observer);\n  heldSessionChannels.setState((current) => new Map(current).set(sessionId, (current.get(sessionId) ?? 0) + 1));\n  let released = false;\n  return () => {\n    if (released) return;\n    released = true;\n    if (observer) observers.delete(observer);\n    heldSessionChannels.setState((current) => {\n      const next = new Map(current);\n      const remaining = (next.get(sessionId) ?? 1) - 1;\n      if (remaining === 0) next.delete(sessionId);\n      else next.set(sessionId, remaining);\n      return next;\n    });\n  };\n}\n\n/** Deliver to the observing dialog's composition, even when the target has never been focused. */\nexport function dispatchHeldSessionChannel(frame: Record<string, unknown>): void {\n  if (typeof frame.type !== 'string' || typeof frame.sessionId !== 'string') return;\n  for (const observer of observers) {\n    if (observer.sessionId !== frame.sessionId) continue;\n    try {\n      observer.receive(frame);\n    } catch (error) {\n      console.error('Session channel observer failed', error);\n    }\n  }\n}\n"],"mappings":";;;AAGA,MAAa,sBAAsB,IAAI,sBAAmC,IAAI,IAAI,CAAC;AAEnF,MAAM,4BAAY,IAAI,IAA8E;AAEpG,SAAgB,oBAAoB,WAAmB,SAAgE;CACrH,MAAM,WAAW,YAAY,KAAA,IAAY,KAAA,IAAY;EAAE;EAAW;CAAQ;CAC1E,IAAI,UAAU,UAAU,IAAI,QAAQ;CACpC,oBAAoB,UAAU,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,YAAY,QAAQ,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC;CAC5G,IAAI,WAAW;CACf,aAAa;EACX,IAAI,UAAU;EACd,WAAW;EACX,IAAI,UAAU,UAAU,OAAO,QAAQ;EACvC,oBAAoB,UAAU,YAAY;GACxC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,MAAM,aAAa,KAAK,IAAI,SAAS,KAAK,KAAK;GAC/C,IAAI,cAAc,GAAG,KAAK,OAAO,SAAS;QACrC,KAAK,IAAI,WAAW,SAAS;GAClC,OAAO;EACT,CAAC;CACH;AACF;;AAGA,SAAgB,2BAA2B,OAAsC;CAC/E,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,cAAc,UAAU;CAC3E,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,cAAc,MAAM,WAAW;EAC5C,IAAI;GACF,SAAS,QAAQ,KAAK;EACxB,SAAS,OAAO;GACd,QAAQ,MAAM,mCAAmC,KAAK;EACxD;CACF;AACF"}