@ai-workbench/connect 0.0.0-stage → 0.7.5

package/lib/archive.js

@@ -0,0 +1,63 @@
+import yauzl from 'yauzl';
+import { createWriteStream, mkdir, symlink } from "./physical-fs.js";
+import { dirname, resolve, relative, isAbsolute } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+export async function unpackZip(zipPath, root, maxBytes, signal) {
+    signal?.throwIfAborted();
+    const zip = await new Promise((yes, no) => yauzl.open(zipPath, { lazyEntries: true, validateEntrySizes: true }, (e, z) => e ? no(e) : yes(z)));
+    const links = [], seen = new Set();
+    let total = 0;
+    const inside = (path) => { const r = relative(root, path); return r !== '' && !r.startsWith('..') && !isAbsolute(r); };
+    try {
+        await new Promise((yes, no) => {
+            zip.on('error', no);
+            zip.on('end', yes);
+            zip.on('entry', (entry) => {
+                void (async () => {
+                    signal?.throwIfAborted();
+                    const path = resolve(root, entry.fileName);
+                    if (!inside(path) || seen.has(path))
+                        throw new Error('ZIP_PATH_INVALID');
+                    seen.add(path);
+                    total += entry.uncompressedSize;
+                    if (total > maxBytes)
+                        throw new Error('EXTRACTED_SIZE_EXCEEDED');
+                    const mode = (entry.externalFileAttributes >>> 16) & 0xffff, type = mode & 0o170000;
+                    if (entry.fileName.endsWith('/')) {
+                        await mkdir(path, { recursive: true, mode: 0o700 });
+                        zip.readEntry();
+                        return;
+                    }
+                    if (type !== 0 && type !== 0o100000 && type !== 0o120000)
+                        throw new Error('ZIP_TYPE_INVALID');
+                    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+                    const stream = await new Promise((res, rej) => zip.openReadStream(entry, (e, s) => e ? rej(e) : res(s)));
+                    if (type === 0o120000) {
+                        const chunks = [];
+                        for await (const c of stream) {
+                            signal?.throwIfAborted();
+                            chunks.push(Buffer.from(c));
+                        }
+                        const target = Buffer.concat(chunks).toString('utf8');
+                        if (isAbsolute(target) || !inside(resolve(dirname(path), target)))
+                            throw new Error('ZIP_LINK_INVALID');
+                        links.push({ path, target });
+                    }
+                    else {
+                        await pipeline(stream, createWriteStream(path, { flags: 'wx', mode: mode & 0o111 ? 0o700 : 0o600 }), { signal });
+                    }
+                    zip.readEntry();
+                })().catch(no);
+            });
+            zip.readEntry();
+        });
+        // All ordinary entries are written before symlinks, so no write can traverse an archive symlink.
+        for (const link of links) {
+            signal?.throwIfAborted();
+            await symlink(link.target, link.path);
+        }
+    }
+    finally {
+        zip.close();
+    }
+}

package/lib/auth-status.d.ts

@@ -0,0 +1,3 @@
+import type { LoginState, Provider, Result } from './api.ts';
+import type { CommandResult } from './ports.ts';
+export declare function parseLoginStatus(provider: Provider, result: CommandResult): Result<LoginState>;

package/lib/auth-status.js

@@ -0,0 +1,18 @@
+import { fail, ok } from "./needs.js";
+export function parseLoginStatus(provider, result) {
+    let v;
+    try {
+        v = JSON.parse(result.stdout);
+    }
+    catch {
+        return fail('AUTH_STATUS_INVALID');
+    }
+    if (!v || typeof v !== 'object' || Array.isArray(v) || Object.keys(v).sort().join(',') !== 'exitCode,loggedIn,protocolVersion,provider')
+        return fail('AUTH_STATUS_INVALID');
+    const status = v;
+    if (status.protocolVersion !== 1 || status.provider !== provider || status.exitCode !== result.exitCode || typeof status.loggedIn !== 'boolean' || result.stderr !== '')
+        return fail('AUTH_STATUS_INVALID');
+    if (status.loggedIn ? result.exitCode !== 0 : provider === 'codex' ? result.exitCode !== 1 : result.exitCode !== 0 && result.exitCode !== 1)
+        return fail('AUTH_STATUS_INVALID');
+    return ok({ provider, loggedIn: status.loggedIn });
+}

package/lib/cache.d.ts

@@ -0,0 +1,21 @@
+import type { Result } from './api.ts';
+import { type ComponentProgress } from './component-download.ts';
+export interface HelperSettings {
+    source: string;
+    cacheDir: string;
+    sha256: string;
+    maxDownloadBytes: number;
+    maxExtractedBytes: number;
+    executable: string;
+}
+interface CacheIo {
+    download: (source: string) => Promise<Response>;
+    unpack: (zip: string, dir: string, maxBytes: number) => Promise<void>;
+}
+export declare function ensureHelper(s: HelperSettings | undefined, io?: {
+    download: CacheIo['download'];
+    unpack?: CacheIo['unpack'];
+    signal?: AbortSignal;
+    onProgress?: (progress: ComponentProgress) => void;
+}): Promise<Result<string>>;
+export {};

package/lib/cache.js

@@ -0,0 +1,156 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { open, lstat, readFile, writeFile, readdir, readlink, realpath, rename, rm, mkdir } from "./physical-fs.js";
+import { join, isAbsolute, relative } from 'node:path';
+import { dependency, fail, ok, need } from "./needs.js";
+import { ComponentDownloadError } from "./component-download.js";
+import { privateDirectory } from "./private-files.js";
+import { unpackZip } from "./archive.js";
+async function treeHash(root) {
+    const hash = createHash('sha256');
+    const walk = async (dir) => {
+        for (const name of (await readdir(dir)).sort()) {
+            const p = join(dir, name), s = await lstat(p), rel = relative(root, p);
+            hash.update(rel + '\0' + (s.mode & 0o777) + '\0');
+            if (s.isDirectory())
+                await walk(p);
+            else if (s.isSymbolicLink()) {
+                const dest = await realpath(p);
+                if (!dest.startsWith(root + '/'))
+                    throw new Error('CACHE_LINK_ESCAPE');
+                hash.update(await readlink(p));
+            }
+            else if (s.isFile())
+                hash.update(await readFile(p));
+            else
+                throw new Error('CACHE_TYPE_INVALID');
+        }
+    };
+    await walk(root);
+    return hash.digest('hex');
+}
+function valid(s) {
+    try {
+        return new URL(s.source).protocol === 'https:' && !new URL(s.source).username && !new URL(s.source).password && isAbsolute(s.cacheDir) && /^[a-f0-9]{64}$/.test(s.sha256) && Number.isSafeInteger(s.maxDownloadBytes) && s.maxDownloadBytes > 0 && Number.isSafeInteger(s.maxExtractedBytes) && s.maxExtractedBytes > 0 && !isAbsolute(s.executable) && !s.executable.split('/').includes('..') && s.executable !== '';
+    }
+    catch {
+        return false;
+    }
+}
+export async function ensureHelper(s, io) {
+    if (!s || !valid(s))
+        return fail('SETTINGS_REQUIRED');
+    if (!io?.download)
+        return dependency('组件官方地址的直接HTTPS下载通道');
+    const final = join(s.cacheDir, s.sha256), payload = join(final, 'runtime'), executable = join(payload, s.executable);
+    let temp, receivedBytes = 0, totalBytes = null;
+    const emit = (phase, errorCode) => io.onProgress?.({ phase, receivedBytes, totalBytes, ...errorCode ? { errorCode } : {} });
+    const cancelled = () => { if (io.signal?.aborted)
+        throw new ComponentDownloadError('COMPONENT_DOWNLOAD_CANCELLED'); };
+    try {
+        cancelled();
+        await privateDirectory(s.cacheDir);
+        let existing = false;
+        try {
+            const st = await lstat(final);
+            if (st.isSymbolicLink() || !st.isDirectory())
+                throw new ComponentDownloadError('COMPONENT_CACHE_INVALID');
+            existing = true;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (existing) {
+            const receipt = JSON.parse(await readFile(join(final, 'receipt.json'), 'utf8'));
+            if (receipt.sha256 !== s.sha256 || receipt.treeHash !== await treeHash(payload))
+                throw new ComponentDownloadError('COMPONENT_CACHE_INVALID');
+            const file = await lstat(executable);
+            if (!file.isFile() || (file.mode & 0o100) === 0)
+                throw new ComponentDownloadError('COMPONENT_CACHE_INVALID');
+            cancelled();
+            emit('ready');
+            return ok(executable);
+        }
+        temp = join(s.cacheDir, 'download-' + randomUUID());
+        await mkdir(temp, { mode: 0o700 });
+        const archive = join(temp, 'electron.zip');
+        emit('downloading');
+        const response = await io.download(s.source);
+        cancelled();
+        if (!response.ok || !response.body)
+            throw new ComponentDownloadError('COMPONENT_DOWNLOAD_RESPONSE');
+        const length = response.headers.get('content-length');
+        if (length !== null) {
+            const n = Number(length);
+            if (!/^\d+$/.test(length) || !Number.isSafeInteger(n) || n < 0)
+                throw new ComponentDownloadError('COMPONENT_DOWNLOAD_LENGTH_INVALID');
+            totalBytes = n;
+            if (n > s.maxDownloadBytes) {
+                await response.body.cancel();
+                throw new ComponentDownloadError('COMPONENT_DOWNLOAD_SIZE');
+            }
+        }
+        emit('downloading');
+        const file = await open(archive, 'wx', 0o600), hash = createHash('sha256');
+        let total = 0;
+        try {
+            for await (const chunk of response.body) {
+                cancelled();
+                total += chunk.byteLength;
+                receivedBytes = total;
+                if (total > s.maxDownloadBytes)
+                    throw new ComponentDownloadError('COMPONENT_DOWNLOAD_SIZE');
+                hash.update(chunk);
+                await file.write(chunk);
+                emit('downloading');
+            }
+        }
+        finally {
+            await file.close();
+        }
+        cancelled();
+        emit('verifying');
+        if (hash.digest('hex') !== s.sha256)
+            throw new ComponentDownloadError('COMPONENT_SHA256_MISMATCH');
+        const runtime = join(temp, 'runtime');
+        await privateDirectory(runtime);
+        emit('unpacking');
+        cancelled();
+        if (io.unpack)
+            await io.unpack(archive, runtime, s.maxExtractedBytes);
+        else
+            await unpackZip(archive, runtime, s.maxExtractedBytes, io.signal);
+        cancelled();
+        let unpacked = 0;
+        const measure = async (dir) => { for (const entry of await readdir(dir, { withFileTypes: true })) {
+            const p = join(dir, entry.name);
+            if (entry.isDirectory())
+                await measure(p);
+            else if (entry.isFile())
+                unpacked += (await lstat(p)).size;
+            if (unpacked > s.maxExtractedBytes)
+                throw new Error('EXTRACTED_SIZE_EXCEEDED');
+        } };
+        await measure(runtime);
+        const exe = join(runtime, s.executable), st = await lstat(exe);
+        if (!st.isFile() || (st.mode & 0o100) === 0)
+            throw new ComponentDownloadError('COMPONENT_EXECUTABLE_INVALID');
+        await writeFile(join(temp, 'receipt.json'), JSON.stringify({ sha256: s.sha256, treeHash: await treeHash(runtime) }), { mode: 0o600 });
+        await rm(archive);
+        cancelled();
+        await rename(temp, final);
+        temp = undefined;
+        cancelled();
+        emit('ready');
+        return ok(executable);
+    }
+    catch (error) {
+        const code = io.signal?.aborted ? 'COMPONENT_DOWNLOAD_CANCELLED' : error instanceof ComponentDownloadError ? error.message : 'COMPONENT_CACHE_IO';
+        emit(code === 'COMPONENT_DOWNLOAD_CANCELLED' ? 'cancelled' : 'failed', code);
+        return { ok: false, error: { ...need('LOGIN_FAILED'), requires: '登录组件从官方地址下载并通过完整校验；未重试或换源', officialReason: code } };
+    }
+    finally {
+        if (temp)
+            await rm(temp, { recursive: true, force: true });
+    }
+}

package/lib/component-download.d.ts

@@ -0,0 +1,25 @@
+export type ComponentPhase = 'idle' | 'downloading' | 'verifying' | 'unpacking' | 'ready' | 'failed' | 'cancelled';
+export interface ComponentProgress {
+    phase: ComponentPhase;
+    receivedBytes: number;
+    totalBytes: number | null;
+    errorCode?: string;
+}
+export interface ComponentDownloadState extends ComponentProgress {
+    instanceId: string;
+    revision: number;
+    attemptId: string | null;
+}
+export declare function createComponentProgress(): {
+    getState: () => ComponentDownloadState;
+    onState(fn: () => void): () => void;
+    begin(): {
+        attemptId: `${string}-${string}-${string}-${string}-${string}`;
+        update: (progress: ComponentProgress) => void;
+    };
+};
+export type ComponentProgressStore = ReturnType<typeof createComponentProgress>;
+export declare class ComponentDownloadError extends Error {
+    constructor(code: string);
+}
+export declare function downloadComponent(source: string, signal: AbortSignal, maxRedirects: number): Promise<Response>;

package/lib/component-download.js

@@ -0,0 +1,73 @@
+import https from 'node:https';
+import { Readable } from 'node:stream';
+import { randomUUID } from 'node:crypto';
+export function createComponentProgress() {
+    let state = { instanceId: randomUUID(), revision: 0, attemptId: null, phase: 'idle', receivedBytes: 0, totalBytes: null };
+    const listeners = new Set();
+    return { getState: () => structuredClone(state), onState(fn) { listeners.add(fn); return () => { listeners.delete(fn); }; }, begin() { const attemptId = randomUUID(); const update = (progress) => { if (state.attemptId !== attemptId)
+            return; state = { ...progress, instanceId: state.instanceId, revision: state.revision + 1, attemptId }; for (const fn of listeners)
+            fn(); }; state = { ...state, attemptId }; update({ phase: 'downloading', receivedBytes: 0, totalBytes: null }); return { attemptId, update }; } };
+}
+export class ComponentDownloadError extends Error {
+    constructor(code) { super(code); this.name = 'ComponentDownloadError'; }
+}
+const sourceUrl = (source) => { let u; try {
+    u = new URL(source);
+}
+catch {
+    throw new ComponentDownloadError('COMPONENT_SOURCE_INVALID');
+} if (u.protocol !== 'https:' || u.username || u.password)
+    throw new ComponentDownloadError('COMPONENT_SOURCE_INVALID'); return u; };
+// 仅固定组件供给。不接收OAuth URL、ProxyLease、认证头或cookie；不读取系统/N代理。
+export async function downloadComponent(source, signal, maxRedirects) {
+    if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0)
+        throw new ComponentDownloadError('COMPONENT_REDIRECT_LIMIT_INVALID');
+    let url = sourceUrl(source);
+    for (let redirects = 0;; redirects++) {
+        if (signal.aborted)
+            throw new ComponentDownloadError('COMPONENT_DOWNLOAD_CANCELLED');
+        const response = await new Promise((yes, no) => {
+            const req = https.request(url, { signal, headers: { Accept: 'application/octet-stream' } }, yes);
+            req.once('error', () => no(new ComponentDownloadError(signal.aborted ? 'COMPONENT_DOWNLOAD_CANCELLED' : 'COMPONENT_DOWNLOAD_NETWORK')));
+            req.end();
+        });
+        const status = response.statusCode ?? 0;
+        if ([301, 302, 303, 307, 308].includes(status)) {
+            const location = response.headers.location;
+            response.destroy();
+            if (redirects >= maxRedirects)
+                throw new ComponentDownloadError('COMPONENT_REDIRECT_LIMIT');
+            if (!location)
+                throw new ComponentDownloadError('COMPONENT_REDIRECT_INVALID');
+            try {
+                url = sourceUrl(new URL(location, url).href);
+            }
+            catch {
+                throw new ComponentDownloadError('COMPONENT_REDIRECT_INVALID');
+            }
+            continue;
+        }
+        if (status !== 200) {
+            response.destroy();
+            throw new ComponentDownloadError('COMPONENT_DOWNLOAD_HTTP_' + status);
+        }
+        const headers = new Headers();
+        for (const name of ['content-length', 'content-type']) {
+            const v = response.headers[name];
+            if (typeof v === 'string')
+                headers.set(name, v);
+        }
+        const reader = Readable.toWeb(response).getReader();
+        const body = new ReadableStream({ async pull(controller) { try {
+                const part = await reader.read();
+                if (part.done)
+                    controller.close();
+                else
+                    controller.enqueue(part.value);
+            }
+            catch {
+                controller.error(new ComponentDownloadError(signal.aborted ? 'COMPONENT_DOWNLOAD_CANCELLED' : 'COMPONENT_DOWNLOAD_BODY'));
+            } }, cancel: reason => reader.cancel(reason) });
+        return new Response(body, { status, headers });
+    }
+}

package/lib/components.d.ts

@@ -0,0 +1,9 @@
+import type { ComponentProgressStore } from './component-download.ts';
+import type { Context } from '@deepseek-ai/cordis';
+export interface ComponentInventory {
+    network: string;
+    connect: string;
+    claude: string;
+    codex?: string;
+}
+export declare function registerComponents(ctx: Context, inventory?: ComponentInventory, temporaryDataParent?: string, component?: ComponentProgressStore): void;

package/lib/components.js

@@ -0,0 +1,121 @@
+import { fail } from "./needs.js";
+import { employeeMessage } from "./startup.js";
+export function registerComponents(ctx, inventory, temporaryDataParent, component) {
+    const api = () => ctx.get('aiWorkbenchConnect');
+    const getState = () => {
+        const network = ctx.get('aiWorkbenchNetwork'), connect = api(), state = connect?.getState(), networkState = network?.getState();
+        return { workspaceBindings: connect?.getWorkspaceBindingState?.() ?? null, loginComponent: { temporaryDataParent: temporaryDataParent ?? null, download: component?.getState() ?? null }, startup: connect?.getLoginPromptState?.() ?? null, inventory: inventory ?? null, network: { serviceProvided: !!network, phase: networkState?.phase ?? 'missing', needCode: networkState?.error?.code ?? networkState?.need?.code }, enrollment: connect?.getEnrollmentState?.() ?? null, connection: connect?.getConnectionState?.() ?? null, connect: { serviceProvided: !!connect, phase: state?.phase ?? 'missing', message: state?.need ? employeeMessage(state.need.code) : '连接服务等待就绪' }, codex: inventory ? { installed: !!inventory.codex, message: inventory.codex ? 'Codex 组件已安装' : 'Codex 组件未安装' } : { installed: null, message: '组件清单未装配' } };
+    };
+    ctx.provide('aiWorkbenchComponents', { getState });
+    ctx.inject(['webServer', 'connection'], host => {
+        const web = host.get('webServer'), connection = host.get('connection');
+        host.effect(() => {
+            const streams = new Set();
+            const off = web.register({ kind: 'prefix', path: '/ai-workbench-connect', handler: async (req, res) => {
+                    const rejected = connection.requestRejection(req);
+                    res.setHeader('Cache-Control', 'no-store');
+                    if (rejected !== undefined) {
+                        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+                        res.statusCode = rejected;
+                        res.end(JSON.stringify({ error: 'forbidden' }));
+                        return;
+                    }
+                    const path = new URL(req.url ?? '/', 'http://dsh').pathname, service = api();
+                    if (req.method === 'GET' && path === '/ai-workbench-connect/events' && service) {
+                        res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
+                        res.statusCode = 200;
+                        let closed = false;
+                        let unprompt = () => { }, unconnection = () => { }, unenrollment = () => { }, unnative = () => { }, undownload = () => { };
+                        const close = () => { if (closed)
+                            return; closed = true; unprompt(); unconnection(); unenrollment(); unnative(); undownload(); streams.delete(close); res.end(); };
+                        const send = () => { if (closed)
+                            return; try {
+                            if (!res.write('data: ' + JSON.stringify(getState()) + '\n\n'))
+                                close();
+                        }
+                        catch {
+                            close();
+                        } };
+                        unprompt = service.onLoginPromptState(send);
+                        unconnection = service.onConnectionState(send);
+                        unenrollment = service.onEnrollmentState?.(send) ?? (() => { });
+                        unnative = service.onWorkspaceBindingState?.(send) ?? (() => { });
+                        undownload = component?.onState(send) ?? (() => { });
+                        streams.add(close);
+                        res.once('close', close);
+                        send();
+                        return;
+                    }
+                    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+                    let actionError, actionErrorCode;
+                    if (req.method === 'POST' && service) {
+                        let result;
+                        if (path === '/ai-workbench-connect/enrollment/import') {
+                            if (Number(req.headers?.['content-length'] ?? 0) > 0 || req.headers?.['transfer-encoding']) {
+                                res.statusCode = 400;
+                                res.end(JSON.stringify({ error: 'no-input-accepted' }));
+                                return;
+                            }
+                            result = await service.importEnrollment();
+                        }
+                        else if (/^\/ai-workbench-connect\/workspace-notice\/[a-zA-Z0-9-]+\/displayed$/.test(path)) {
+                            if (Number(req.headers?.['content-length'] ?? 0) > 0 || req.headers?.['transfer-encoding']) {
+                                res.statusCode = 400;
+                                res.end(JSON.stringify({ error: 'no-input-accepted' }));
+                                return;
+                            }
+                            const id = /\/workspace-notice\/([a-zA-Z0-9-]+)\/displayed$/.exec(path)[1];
+                            result = await service.acknowledgeWorkspaceNotice({ noticeId: id, surface: 'settings', outcome: 'displayed' });
+                        }
+                        else if (path === '/ai-workbench-connect/check')
+                            result = await service.refreshLoginPrompts();
+                        else if (/^\/ai-workbench-connect\/start-login\/(claude|codex)\/[a-zA-Z0-9-]+\/\d+$/.test(path)) {
+                            const [, provider, instance, revision] = /\/start-login\/(claude|codex)\/([a-zA-Z0-9-]+)\/(\d+)$/.exec(path);
+                            const brand = provider, shown = service.getLoginPromptState(), before = service.getConnectionState();
+                            if (before.phase !== 'connected' || shown.instanceId !== instance || shown.revision !== Number(revision) || shown.phase === 'authorizing' || shown.logins[brand] !== false || shown.checkingProviders.includes(brand) || shown.providerNeeds[brand])
+                                result = fail('LOGIN_PROMPT_INVALID');
+                            else {
+                                const requested = await service.requestLoginPrompt(brand, 'user'), after = service.getConnectionState();
+                                if (after.phase !== 'connected' || after.instanceId !== before.instanceId || after.epoch !== before.epoch)
+                                    result = fail('LOGIN_PROMPT_INVALID');
+                                else if (!requested.ok)
+                                    result = requested;
+                                else if (requested.value.phase !== 'login-required' || requested.value.provider !== brand || !requested.value.requestId)
+                                    result = fail('LOGIN_PROMPT_INVALID');
+                                else
+                                    result = await service.respondLoginPrompt(requested.value.requestId, 'authorize');
+                            }
+                        }
+                        else if (/^\/ai-workbench-connect\/(request|authorize)\/(claude|codex)$/.test(path)) {
+                            const provider = /\/(claude|codex)$/.exec(path)[1];
+                            result = await service.requestLoginPrompt(provider, 'user');
+                        }
+                        else if (/^\/ai-workbench-connect\/respond\/[a-zA-Z0-9-]+\/(authorize|defer)$/.test(path)) {
+                            const [, id, action] = /\/respond\/([a-zA-Z0-9-]+)\/(authorize|defer)$/.exec(path);
+                            result = await service.respondLoginPrompt(id, action);
+                        }
+                        else {
+                            res.statusCode = 404;
+                            res.end(JSON.stringify({ error: 'not-found' }));
+                            return;
+                        }
+                        if (!result.ok) {
+                            res.statusCode = 409;
+                            actionErrorCode = result.error.code;
+                            actionError = result.error.code === 'LOGIN_PROMPT_INVALID' ? result.error.message : employeeMessage(result.error.code);
+                        }
+                    }
+                    else if (req.method !== 'GET' || path !== '/ai-workbench-connect/status') {
+                        res.statusCode = 404;
+                        res.end(JSON.stringify({ error: 'not-found' }));
+                        return;
+                    }
+                    if (!actionError)
+                        res.statusCode = 200;
+                    res.end(JSON.stringify({ ...getState(), ...(actionError ? { actionError, actionErrorCode } : {}) }));
+                } });
+            return () => { off(); for (const close of [...streams])
+                close(); };
+        });
+    });
+}

package/lib/connect.d.ts

@@ -0,0 +1,10 @@
+import type { ConnectApi, ConnectState, Provider, ConnectionState, LoginPromptState, LoginPromptResult } from './api.ts';
+import type { Enrollment, Ports } from './ports.ts';
+export declare function validEnrollment(e: Enrollment): boolean;
+export interface ConnectOptions {
+    providers?: Provider[];
+    onConnectionState?: (s: ConnectionState) => void;
+    onPromptState?: (s: LoginPromptState) => void;
+    onPromptResult?: (r: LoginPromptResult) => void;
+}
+export declare function createConnect(ports: Ports, emit: (s: ConnectState) => void, options?: ConnectOptions): ConnectApi;