@atomic-chat/core 0.5.1

package/dist/remote-access/process.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The `cloudflared` child process: how it is launched, what is watched while it runs, and how it
+ * is ended. The arguments and the reading of its output are pure and live next door.
+ *
+ * Deliberately not `spawnManaged`: that keeps every line a process ever wrote (a tunnel runs for
+ * days) and waits without bound for an exit, while a tunnel needs an answer to "could its exit be
+ * confirmed?" — a public URL that may still be served is a state of its own (`stop_failed`).
+ *
+ * PRIVACY: the output names the public URL. It is parsed and dropped, never logged or kept.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/process.rs (image-generation line, `767ff6350`).
+ */
+export interface TunnelTimings {
+    /** For the URL to be minted *and* an edge connection registered. */
+    readyMs: number;
+    /** For the public URL to answer as this server, all probe phases together. */
+    probeTotalMs: number;
+    /** After SIGTERM, before the kill (unix). */
+    termGraceMs: number;
+    /** After the kill, for the exit to be confirmed. */
+    killGraceMs: number;
+}
+export declare const DEFAULT_TUNNEL_TIMINGS: TunnelTimings;
+/** How waiting for a fresh tunnel to become usable ended. */
+export type Ready = 
+/** Minted and registered. */
+{
+    kind: 'url';
+    url: string;
+}
+/** The process ended first. */
+ | {
+    kind: 'exited';
+    sawUrl: boolean;
+}
+/** Still running, but not registered within the limit. */
+ | {
+    kind: 'timed-out';
+    sawUrl: boolean;
+}
+/** It never ran at all (missing, not executable). */
+ | {
+    kind: 'spawn-failed';
+};
+/** One running tunnel process, as the manager sees it; scripted in the manager's tests. */
+export interface TunnelProcess {
+    readonly pid: number | undefined;
+    /** The program that was started, for the crash-recovery journal. */
+    readonly exe: string;
+    waitReady(limitMs: number): Promise<Ready>;
+    /** Resolves when the process has exited. */
+    waitExit(): Promise<void>;
+    /** Ends the process. `false` means its exit could not be confirmed. */
+    terminate(timings: Pick<TunnelTimings, 'termGraceMs' | 'killGraceMs'>): Promise<boolean>;
+    /** Signals only, for a shutdown that cannot wait. */
+    killNow(): void;
+}
+/** Launches a tunnel for `origin`, optionally forcing a transport. `undefined`: there is no binary. */
+export type TunnelSpawner = (origin: string, protocol?: string) => TunnelProcess | undefined | Promise<TunnelProcess | undefined>;
+/** A fully described child process, separate from launching it so tests can run another program. */
+export interface TunnelCommand {
+    program: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function spawnTunnel(command: TunnelCommand, platform?: NodeJS.Platform): TunnelProcess;

package/dist/remote-access/process.js

@@ -0,0 +1,160 @@
+/**
+ * The `cloudflared` child process: how it is launched, what is watched while it runs, and how it
+ * is ended. The arguments and the reading of its output are pure and live next door.
+ *
+ * Deliberately not `spawnManaged`: that keeps every line a process ever wrote (a tunnel runs for
+ * days) and waits without bound for an exit, while a tunnel needs an answer to "could its exit be
+ * confirmed?" — a public URL that may still be served is a state of its own (`stop_failed`).
+ *
+ * PRIVACY: the output names the public URL. It is parsed and dropped, never logged or kept.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/process.rs (image-generation line, `767ff6350`).
+ */
+import { spawn } from 'node:child_process';
+import { OutputParser, readyUrl } from './cloudflared-output.js';
+export const DEFAULT_TUNNEL_TIMINGS = {
+    readyMs: 15_000,
+    probeTotalMs: 45_000,
+    termGraceMs: 5_000,
+    killGraceMs: 5_000,
+};
+/** A line longer than this is fed as it stands; cloudflared never prints one, a hostile stand-in might. */
+const MAX_LINE_BYTES = 64 * 1024;
+export function spawnTunnel(command, platform = process.platform) {
+    const child = spawn(command.program, command.args, {
+        env: command.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    return new ChildTunnel(child, platform, command.program);
+}
+class ChildTunnel {
+    child;
+    platform;
+    exe;
+    parser = new OutputParser();
+    watchers = new Set();
+    exited;
+    spawnFailed = false;
+    gone = false;
+    constructor(child, platform, exe) {
+        this.child = child;
+        this.platform = platform;
+        this.exe = exe;
+        this.exited = new Promise((resolve) => {
+            const settle = () => {
+                this.gone = true;
+                this.notify();
+                resolve();
+            };
+            // Only the process decides that it has exited, never a closed pipe: on Windows a grandchild
+            // can hold a pipe open, and the reverse is possible too.
+            child.once('exit', settle);
+            child.once('error', () => {
+                this.spawnFailed = child.pid === undefined;
+                settle();
+            });
+        });
+        // cloudflared logs to stderr; stdout is read too so neither pipe can fill up and stall it.
+        this.drain(child.stdout);
+        this.drain(child.stderr);
+    }
+    get pid() {
+        return this.child.pid;
+    }
+    drain(pipe) {
+        if (!pipe)
+            return;
+        let pending = '';
+        pipe.setEncoding('utf8');
+        // Keep draining after the URL is known: a full pipe blocks the child.
+        pipe.on('data', (chunk) => {
+            pending += chunk;
+            const lines = pending.split(/\r?\n/);
+            pending = lines.pop() ?? '';
+            if (pending.length > MAX_LINE_BYTES) {
+                lines.push(pending);
+                pending = '';
+            }
+            let changed = false;
+            for (const line of lines)
+                changed = this.parser.feedLine(line) || changed;
+            if (changed)
+                this.notify();
+        });
+        pipe.on('error', () => { });
+    }
+    notify() {
+        for (const watcher of [...this.watchers])
+            watcher();
+    }
+    waitReady(limitMs) {
+        return new Promise((resolve) => {
+            const check = (timedOut = false) => {
+                const parsed = this.parser.snapshot();
+                const url = readyUrl(parsed);
+                const sawUrl = parsed.url !== undefined;
+                const outcome = url !== undefined
+                    ? { kind: 'url', url }
+                    : this.gone
+                        ? this.spawnFailed
+                            ? { kind: 'spawn-failed' }
+                            : { kind: 'exited', sawUrl }
+                        : timedOut
+                            ? { kind: 'timed-out', sawUrl }
+                            : undefined;
+                if (!outcome)
+                    return false;
+                clearTimeout(timer);
+                this.watchers.delete(watcher);
+                resolve(outcome);
+                return true;
+            };
+            const watcher = () => void check();
+            const timer = setTimeout(() => void check(true), limitMs);
+            timer.unref?.();
+            this.watchers.add(watcher);
+            check();
+        });
+    }
+    waitExit() {
+        return this.exited;
+    }
+    exitedWithin(ms) {
+        if (this.gone)
+            return Promise.resolve(true);
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(false), ms);
+            timer.unref?.();
+            void this.exited.then(() => {
+                clearTimeout(timer);
+                resolve(true);
+            });
+        });
+    }
+    async terminate(timings) {
+        if (this.gone)
+            return true;
+        // Windows has no graceful signal for a console-less child; go straight to TerminateProcess.
+        if (this.platform !== 'win32') {
+            this.signal('SIGTERM');
+            if (await this.exitedWithin(timings.termGraceMs))
+                return true;
+        }
+        this.signal('SIGKILL');
+        return this.exitedWithin(timings.killGraceMs);
+    }
+    killNow() {
+        if (!this.gone)
+            this.signal('SIGKILL');
+    }
+    signal(signal) {
+        try {
+            this.child.kill(signal);
+        }
+        catch {
+            // Already gone, or never started.
+        }
+    }
+}
+//# sourceMappingURL=process.js.map

package/dist/remote-access/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/remote-access/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAahE,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,OAAO,EAAE,MAAM;IACf,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;CACnB,CAAA;AAwCD,2GAA2G;AAC3G,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhC,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;QACjD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAA;IACF,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,WAAW;IAQI;IACA;IACR;IATM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAA;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAA;IAChC,MAAM,CAAe;IAC9B,WAAW,GAAG,KAAK,CAAA;IACnB,IAAI,GAAG,KAAK,CAAA;IAEpB,YACmB,KAAmB,EACnB,QAAyB,EACjC,GAAW;QAFH,UAAK,GAAL,KAAK,CAAc;QACnB,aAAQ,GAAR,QAAQ,CAAiB;QACjC,QAAG,GAAH,GAAG,CAAQ;QAEpB,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;gBAChB,IAAI,CAAC,MAAM,EAAE,CAAA;gBACb,OAAO,EAAE,CAAA;YACX,CAAC,CAAA;YACD,4FAA4F;YAC5F,yDAAyD;YACzD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAA;gBAC1C,MAAM,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,2FAA2F;QAC3F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;IACvB,CAAC;IAEO,KAAK,CAAC,IAAkC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACxB,sEAAsE;QACtE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,OAAO,IAAI,KAAK,CAAA;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;YAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACnB,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAA;YACzE,IAAI,OAAO;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC;IAEO,MAAM;QACZ,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;IACrD,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAW,EAAE;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;gBACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAA;gBACvC,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;oBACf,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;oBACtB,CAAC,CAAC,IAAI,CAAC,IAAI;wBACT,CAAC,CAAC,IAAI,CAAC,WAAW;4BAChB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;4BAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;wBAC9B,CAAC,CAAC,QAAQ;4BACR,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;4BAC/B,CAAC,CAAC,SAAS,CAAA;gBACnB,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAA;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC7B,OAAO,CAAC,OAAO,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC,CAAA;YACD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,CAAA;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC1B,KAAK,EAAE,CAAA;QACT,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YAClD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;YACf,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAA2D;QACzE,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1B,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACtB,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAEO,MAAM,CAAC,MAAsB;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;CACF"}

package/dist/remote-access/spawner.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The production spawner: find the binary, make sure the user's own cloudflared configuration cannot
+ * steer the quick tunnel, and start it.
+ */
+import type { TunnelCommand, TunnelProcess, TunnelSpawner } from './process.js';
+export interface CloudflaredSpawnerOptions {
+    /** `--cloudflared-bin`. */
+    explicit?: string | undefined;
+    env: NodeJS.ProcessEnv;
+    resourcesDir?: string | undefined;
+    platform: NodeJS.Platform;
+    /** Where the empty `--config` document lives on Windows, which has no `/dev/null`. */
+    emptyConfigPath: string;
+    exists?: (path: string) => boolean;
+    log?: (message: string) => void;
+    /** Test seam: run something else in place of the resolved command. */
+    launch?: (command: TunnelCommand, platform: NodeJS.Platform) => TunnelProcess;
+}
+/**
+ * An empty configuration document for `--config`, so cloudflared does not read
+ * `~/.cloudflared/config.yml`. Best effort on Windows: without it the tunnel still works for
+ * everybody who has no configuration file of their own.
+ */
+export declare function emptyConfigFor(platform: NodeJS.Platform, windowsPath: string): Promise<string | undefined>;
+export declare function cloudflaredSpawner(options: CloudflaredSpawnerOptions): TunnelSpawner;

package/dist/remote-access/spawner.js

@@ -0,0 +1,49 @@
+/**
+ * The production spawner: find the binary, make sure the user's own cloudflared configuration cannot
+ * steer the quick tunnel, and start it.
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { cloudflaredArgs, resolveCloudflaredBinary, scrubTunnelEnv } from './cloudflared-args.js';
+import { spawnTunnel } from './process.js';
+/**
+ * An empty configuration document for `--config`, so cloudflared does not read
+ * `~/.cloudflared/config.yml`. Best effort on Windows: without it the tunnel still works for
+ * everybody who has no configuration file of their own.
+ */
+export async function emptyConfigFor(platform, windowsPath) {
+    if (platform !== 'win32')
+        return '/dev/null';
+    try {
+        await mkdir(dirname(windowsPath), { recursive: true });
+        await writeFile(windowsPath, '');
+        return windowsPath;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function cloudflaredSpawner(options) {
+    return async (origin, protocol) => {
+        const program = resolveCloudflaredBinary({
+            explicit: options.explicit,
+            env: options.env,
+            resourcesDir: options.resourcesDir,
+            platform: options.platform,
+            exists: options.exists ?? existsSync,
+        });
+        if (program === undefined) {
+            options.log?.('remote access: no cloudflared binary was found for this installation');
+            return undefined;
+        }
+        const emptyConfig = await emptyConfigFor(options.platform, options.emptyConfigPath);
+        const command = {
+            program,
+            args: cloudflaredArgs(origin, protocol, emptyConfig),
+            env: scrubTunnelEnv(options.env),
+        };
+        return (options.launch ?? spawnTunnel)(command, options.platform);
+    };
+}
+//# sourceMappingURL=spawner.js.map

package/dist/remote-access/spawner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawner.js","sourceRoot":"","sources":["../../src/remote-access/spawner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAiB1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAyB,EACzB,WAAmB;IAEnB,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAA;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAChC,OAAO,WAAW,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;QAChC,MAAM,OAAO,GAAG,wBAAwB,CAAC;YACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;SACrC,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,EAAE,CAAC,sEAAsE,CAAC,CAAA;YACrF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACnF,MAAM,OAAO,GAAkB;YAC7B,OAAO;YACP,IAAI,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;YACpD,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnE,CAAC,CAAA;AACH,CAAC"}

package/dist/remote-access/status.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What the tunnel's state machine knows, and what the frontend is told about it. Pure.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/mod.rs (`Phase`, `derive_status`) on the
+ * image-generation line (`767ff6350`).
+ */
+import type { RemoteAccessFailure, RemoteAccessStatus } from '../contracts/index.js';
+export type Phase = {
+    kind: 'off';
+} | {
+    kind: 'starting';
+} | {
+    kind: 'online';
+} | {
+    kind: 'stopping';
+} | {
+    kind: 'failed';
+    error: RemoteAccessFailure;
+};
+export declare const OFF: Phase;
+export declare const failed: (error: RemoteAccessFailure) => Phase;
+export interface TunnelSnapshot {
+    phase: Phase;
+    url: string | undefined;
+}
+/** The running public server as the tunnel needs it; `undefined` while it is stopped. */
+export interface ServerEndpoint {
+    /** Where cloudflared dials: the bound port, and a host that actually listens (see `dialOrigin`). */
+    origin: string;
+    hasApiKey: boolean;
+}
+export declare function deriveStatus(snapshot: TunnelSnapshot, server: ServerEndpoint | undefined): RemoteAccessStatus;
+/**
+ * The origin a local client dials to reach a listener bound to `host`. A wildcard bind listens on
+ * loopback too; a server bound to one specific address does not listen on loopback at all.
+ */
+export declare function dialOrigin(host: string, port: number): string;
+/** The host of a tunnel URL, or `undefined` for something that is not one. */
+export declare function hostOf(url: string): string | undefined;

package/dist/remote-access/status.js

@@ -0,0 +1,49 @@
+/**
+ * What the tunnel's state machine knows, and what the frontend is told about it. Pure.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/mod.rs (`Phase`, `derive_status`) on the
+ * image-generation line (`767ff6350`).
+ */
+export const OFF = { kind: 'off' };
+export const failed = (error) => ({ kind: 'failed', error });
+export function deriveStatus(snapshot, server) {
+    const phase = snapshot.phase;
+    const state = phase.kind === 'failed' ? 'error' : phase.kind;
+    const error = phase.kind === 'failed' ? phase.error : null;
+    const blockReason = server === undefined ? 'server_stopped' : null;
+    // A process that may still be alive must be dealt with before another one is started next to it.
+    const stopFailed = error === 'stop_failed';
+    const idle = state === 'off' || state === 'error';
+    return {
+        state,
+        url: state === 'online' ? (snapshot.url ?? null) : null,
+        error,
+        blockReason,
+        canStart: blockReason === null && idle && !stopFailed,
+        canStop: state === 'starting' || state === 'online' || stopFailed,
+        serverHasApiKey: server?.hasApiKey === true,
+    };
+}
+/**
+ * The origin a local client dials to reach a listener bound to `host`. A wildcard bind listens on
+ * loopback too; a server bound to one specific address does not listen on loopback at all.
+ */
+export function dialOrigin(host, port) {
+    const bare = host.trim().replace(/^\[|\]$/g, '');
+    if (bare === '' || bare === '0.0.0.0')
+        return `http://127.0.0.1:${port}`;
+    if (bare === '::' || bare === '0:0:0:0:0:0:0:0')
+        return `http://[::1]:${port}`;
+    return bare.includes(':') ? `http://[${bare}]:${port}` : `http://${bare}:${port}`;
+}
+/** The host of a tunnel URL, or `undefined` for something that is not one. */
+export function hostOf(url) {
+    try {
+        const host = new URL(url).hostname;
+        return host === '' ? undefined : host;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/remote-access/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/remote-access/status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,CAAC,MAAM,GAAG,GAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AAcxF,MAAM,UAAU,YAAY,CAC1B,QAAwB,EACxB,MAAkC;IAElC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,iGAAiG;IACjG,MAAM,UAAU,GAAG,KAAK,KAAK,aAAa,CAAA;IAC1C,MAAM,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,CAAA;IACjD,OAAO;QACL,KAAK;QACL,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvD,KAAK;QACL,WAAW;QACX,QAAQ,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU;QACrD,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,IAAI,UAAU;QACjE,eAAe,EAAE,MAAM,EAAE,SAAS,KAAK,IAAI;KAC5C,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,oBAAoB,IAAI,EAAE,CAAA;IACxE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,gBAAgB,IAAI,EAAE,CAAA;IAC9E,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAA;AACnF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAClC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/remote-access/wiring.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Everything the tunnel manager needs from the outside, put together in one place so the owner's
+ * wiring stays a single call: how `cloudflared` is found and started, how a URL is proven, and where
+ * the crash-recovery record goes.
+ */
+import type { RemoteAccessManagerDeps } from './manager.js';
+import type { EdgeAddress, Prober } from './probe.js';
+import type { TunnelSpawner, TunnelTimings } from './process.js';
+/**
+ * Test hooks only, like the ChatGPT endpoints': stand in for Cloudflare's edge and trust its
+ * certificate. Production never sets them.
+ */
+export declare const REMOTE_ACCESS_EDGE_ENV = "ATOMIC_REMOTE_ACCESS_EDGE";
+export declare const REMOTE_ACCESS_CA_ENV = "ATOMIC_REMOTE_ACCESS_CA";
+export interface RemoteAccessWiring {
+    /** Test seams: a scripted process, a scripted probe, short timings. */
+    overrides?: {
+        spawner?: TunnelSpawner;
+        prober?: Prober;
+        timings?: Partial<TunnelTimings>;
+    } | undefined;
+    /** `--cloudflared-bin`. */
+    cloudflaredPath?: string | undefined;
+    resourcesDir?: string | undefined;
+    env: NodeJS.ProcessEnv;
+    platform: NodeJS.Platform;
+    journalPath: string;
+    emptyConfigPath: string;
+    instanceId: string;
+    warn: (message: string) => void;
+}
+/** `host:port` of a stand-in for Cloudflare's edge; `undefined` for anything else. */
+export declare function parseEdgeAddress(value: string | undefined): EdgeAddress | undefined;
+export declare function wireRemoteAccess(wiring: RemoteAccessWiring): Promise<Pick<RemoteAccessManagerDeps, 'spawner' | 'prober' | 'timings' | 'journal'>>;

package/dist/remote-access/wiring.js

@@ -0,0 +1,47 @@
+/**
+ * Everything the tunnel manager needs from the outside, put together in one place so the owner's
+ * wiring stays a single call: how `cloudflared` is found and started, how a URL is proven, and where
+ * the crash-recovery record goes.
+ */
+import { readFile } from 'node:fs/promises';
+import { TunnelJournal } from './journal.js';
+import { PublicProber } from './probe.js';
+import { cloudflaredSpawner } from './spawner.js';
+/**
+ * Test hooks only, like the ChatGPT endpoints': stand in for Cloudflare's edge and trust its
+ * certificate. Production never sets them.
+ */
+export const REMOTE_ACCESS_EDGE_ENV = 'ATOMIC_REMOTE_ACCESS_EDGE';
+export const REMOTE_ACCESS_CA_ENV = 'ATOMIC_REMOTE_ACCESS_CA';
+/** `host:port` of a stand-in for Cloudflare's edge; `undefined` for anything else. */
+export function parseEdgeAddress(value) {
+    const match = /^(.+):(\d+)$/.exec(value?.trim() ?? '');
+    if (!match)
+        return undefined;
+    return { host: match[1].replace(/^\[|\]$/g, ''), port: Number(match[2]) };
+}
+export async function wireRemoteAccess(wiring) {
+    const edge = parseEdgeAddress(wiring.env[REMOTE_ACCESS_EDGE_ENV]);
+    const caPath = wiring.env[REMOTE_ACCESS_CA_ENV];
+    const prober = wiring.overrides?.prober ??
+        new PublicProber({
+            ...(edge ? { edgeAddresses: async () => [edge] } : {}),
+            ...(caPath ? { ca: await readFile(caPath) } : {}),
+        });
+    const spawner = wiring.overrides?.spawner ??
+        cloudflaredSpawner({
+            explicit: wiring.cloudflaredPath,
+            env: wiring.env,
+            resourcesDir: wiring.resourcesDir,
+            platform: wiring.platform,
+            emptyConfigPath: wiring.emptyConfigPath,
+            log: wiring.warn,
+        });
+    return {
+        spawner,
+        prober,
+        ...(wiring.overrides?.timings ? { timings: wiring.overrides.timings } : {}),
+        journal: new TunnelJournal(wiring.journalPath, wiring.instanceId, { log: wiring.warn }),
+    };
+}
+//# sourceMappingURL=wiring.js.map

package/dist/remote-access/wiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiring.js","sourceRoot":"","sources":["../../src/remote-access/wiring.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAA;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAgB7D,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO,EAAE,IAAI,EAAG,KAAK,CAAC,CAAC,CAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA0B;IAE1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAC/C,MAAM,MAAM,GACV,MAAM,CAAC,SAAS,EAAE,MAAM;QACxB,IAAI,YAAY,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAA;IACJ,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,EAAE,OAAO;QACzB,kBAAkB,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC,eAAe;YAChC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,GAAG,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,CAAA;IACJ,OAAO;QACL,OAAO;QACP,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;KACxF,CAAA;AACH,CAAC"}

package/dist/router/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Model id → backend resolution (PLAN.md §3.2).
+ *
+ * Ported from: server/proxy.rs (provider lookup), core/sessions/resolver.rs.
+ * See PLAN.md §3.2. Public API of this module is exported from this file only.
+ */
+export * from './resolve.js';

package/dist/router/index.js

@@ -0,0 +1,8 @@
+/**
+ * Model id → backend resolution (PLAN.md §3.2).
+ *
+ * Ported from: server/proxy.rs (provider lookup), core/sessions/resolver.rs.
+ * See PLAN.md §3.2. Public API of this module is exported from this file only.
+ */
+export * from './resolve.js';
+//# sourceMappingURL=index.js.map

package/dist/router/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,cAAc,CAAA"}

package/dist/router/resolve.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Which backend serves a model (PLAN.md §3.2).
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (the provider lookup shared by `/chat/completions`,
+ * `/messages` and `/responses`) and `core/sessions/resolver.rs`.
+ * See PLAN.md §3.2. Public API of this module is exported from this file only.
+ */
+/** A cloud provider the app registered: where to send its models and with which credentials. */
+export interface RemoteProvider {
+    /** Registry key, e.g. `openai`, `openrouter`. */
+    provider: string;
+    apiKey?: string | null;
+    baseUrl?: string | null;
+    customHeaders: Array<{
+        header: string;
+        value: string;
+    }>;
+    /** Model ids the user has enabled for this provider. */
+    models: string[];
+}
+export type LocalProvider = 'llamacpp' | 'llamacpp-upstream' | 'mlx';
+/**
+ * The order local providers are searched in when a request names only a model. The same model id
+ * loaded under two engines resolves to the first; changing the order would silently move traffic.
+ */
+export declare const LOCAL_SEARCH_ORDER: readonly LocalProvider[];
+/**
+ * The remote provider that owns `modelId`, if any. Remote wins over local — a model id the user
+ * enabled for a cloud provider is never served by a local session of the same name.
+ *
+ * Three rules, in order, exactly as the proxy applies them:
+ * 1. a provider that lists the model id;
+ * 2. the text before the first `/` names a registered provider (`openrouter/anthropic/claude`);
+ * 3. the whole id is a provider key.
+ */
+export declare function resolveRemoteProvider(modelId: string, providers: ReadonlyMap<string, RemoteProvider>): RemoteProvider | undefined;
+/**
+ * The proxy's model-id comparison: `.` and `_` are the same character, because clients and
+ * filesystems substitute one for the other (`Qwen3_5-9B` is `Qwen3.5-9B`). Nothing else is folded.
+ */
+export declare function modelIdsMatch(a: string, b: string): boolean;

package/dist/router/resolve.js

@@ -0,0 +1,53 @@
+/**
+ * Which backend serves a model (PLAN.md §3.2).
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (the provider lookup shared by `/chat/completions`,
+ * `/messages` and `/responses`) and `core/sessions/resolver.rs`.
+ * See PLAN.md §3.2. Public API of this module is exported from this file only.
+ */
+/**
+ * The order local providers are searched in when a request names only a model. The same model id
+ * loaded under two engines resolves to the first; changing the order would silently move traffic.
+ */
+export const LOCAL_SEARCH_ORDER = ['llamacpp', 'llamacpp-upstream', 'mlx'];
+/**
+ * The remote provider that owns `modelId`, if any. Remote wins over local — a model id the user
+ * enabled for a cloud provider is never served by a local session of the same name.
+ *
+ * Three rules, in order, exactly as the proxy applies them:
+ * 1. a provider that lists the model id;
+ * 2. the text before the first `/` names a registered provider (`openrouter/anthropic/claude`);
+ * 3. the whole id is a provider key.
+ */
+export function resolveRemoteProvider(modelId, providers) {
+    for (const config of providers.values()) {
+        if (config.models.includes(modelId))
+            return config;
+    }
+    const slash = modelId.indexOf('/');
+    if (slash >= 0) {
+        const byPrefix = providers.get(modelId.slice(0, slash));
+        if (byPrefix)
+            return byPrefix;
+    }
+    return providers.get(modelId);
+}
+/**
+ * The proxy's model-id comparison: `.` and `_` are the same character, because clients and
+ * filesystems substitute one for the other (`Qwen3_5-9B` is `Qwen3.5-9B`). Nothing else is folded.
+ */
+export function modelIdsMatch(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        const x = a[i];
+        const y = b[i];
+        if (x === y)
+            continue;
+        if ((x === '.' && y === '_') || (x === '_' && y === '.'))
+            continue;
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/router/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/router/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,CAAC,UAAU,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAA;AAEpG;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,SAA8C;IAE9C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAA;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACd,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QACrB,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YAAE,SAAQ;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/runtime/foundation-models/errors.d.ts

@@ -0,0 +1,28 @@
+/**
+ * How a Foundation Models server that did not start is explained.
+ *
+ * Ported from: tauri-plugin-foundation-models/src/error.rs (`FoundationModelsError::from_stderr`)
+ * and the startup branches of commands.rs (`load_foundation_models_server`).
+ * Contract: test/fixtures/app/foundation-models-errors.
+ *
+ * One deliberate difference. The Swift server says "Foundation model is downloading or not yet
+ * ready" when the on-device model is still being fetched, and the Rust classifier only looked for
+ * "model not ready" — so the one case with a clear remedy ("wait and try again") reached the user
+ * as an unexpected error. "not yet ready" is recognised here as the same condition.
+ */
+import { AtomicCoreError } from '../../contracts/index.js';
+import type { ExitInfo } from '../llamacpp/errors.js';
+/** Written on stdout once the HTTP server is up (FoundationModelsServerCommand.swift). */
+export declare const FOUNDATION_MODELS_READY_MARKERS: readonly ["server is listening on", "http server listening"];
+/** The prefix of the line the server writes before exiting when the model is unavailable. */
+export declare const FOUNDATION_MODELS_ERROR_PREFIX = "[foundation-models] ERROR:";
+export declare function classifyFoundationModelsStderr(stderr: string): AtomicCoreError;
+/** The reason line, when the server wrote one (the match is case-sensitive, as in the plugin). */
+export declare function foundationModelsErrorLine(text: string): string | undefined;
+/**
+ * An exit before readiness. The server writes its reason and then exits 1; the plugin raced the two
+ * and either error could win. Here the reason, when there is one, always wins.
+ */
+export declare function classifyFoundationModelsExit(exit: ExitInfo, stderr: string): AtomicCoreError;
+export declare function foundationModelsTimeout(timeoutSecs: number): AtomicCoreError;
+export declare function foundationModelsBinaryMissing(path: string): AtomicCoreError;