@bitmagic/cli 0.1.54-dev.0 → 0.1.54-dev.2

package/dist/mobile/bridge.js

@@ -0,0 +1,224 @@
+/**
+ * The mobile bridge: the one server `bitmagic dev` exposes to the local network.
+ *
+ * `dev` normally binds nothing outside loopback. vite serves the game on 127.0.0.1 and the editor
+ * sidecar deliberately stays there too — it writes files in the creator's project, and no phone
+ * needs the shell. So rather than opening either of them up, `--mobile` puts THIS in front: a
+ * reverse proxy that terminates the phone's connection, forwards the game, and does the two things
+ * a plain `--host` on vite could not.
+ *
+ *   1. It serves the CDN. A LAN origin is on no bucket's CORS allowlist, so the phone asking the
+ *      bucket directly gets nothing (`../local-port.ts` documents what that looks like from the
+ *      creator's side: a level with no terrain). Same-origin `/__bm/cdn/<host>/<path>` requests
+ *      land here instead and are fetched server-side, where CORS does not apply.
+ *   2. It injects `rewrite-shim.ts` into every HTML page it passes through, which is what makes
+ *      the engine ask for (1) in the first place.
+ *
+ * WebSocket upgrades are piped straight through to vite, so its HMR client connects from the phone
+ * and the page reloads on a rebuild exactly as the desktop shell does.
+ *
+ * What is NOT here is as deliberate: no route to the sidecar, and therefore no way for anything on
+ * the network to save a scene, start a generation, or read the editor journal. The phone gets the
+ * game and the game's assets.
+ */
+import * as http from 'http';
+import * as https from 'https';
+import * as net from 'net';
+import { Readable } from 'stream';
+import { CDN_PROXY_PREFIX, fromProxyPath } from './asset-hosts.js';
+import { RELOAD_STREAM_PATH } from './rewrite-shim.js';
+import { injectMobileShim } from './rewrite-shim.js';
+/**
+ * The name vite is reached by — a NAME, not a literal address, and that is the whole point.
+ *
+ * vite binds `localhost`, which on a Mac resolves to ::1 first: a bridge dialling 127.0.0.1 gets
+ * ECONNREFUSED from a dev server that is plainly running, and every page comes back 502. Handing
+ * Node the name lets it try both families, so this works whichever one vite ended up on.
+ */
+const LOOPBACK = 'localhost';
+/** Request headers worth carrying to the bucket. Everything else is the browser's business. */
+const FORWARDED_REQUEST_HEADERS = ['range', 'if-none-match', 'if-modified-since', 'accept'];
+/** Response headers worth carrying back. Notably NOT the CORS ones: this response is same-origin. */
+const FORWARDED_RESPONSE_HEADERS = [
+    'content-type', 'content-length', 'content-range', 'accept-ranges',
+    'etag', 'last-modified', 'cache-control',
+];
+function copyHeaders(from, names) {
+    const headers = {};
+    for (const name of names) {
+        const value = from[name];
+        if (typeof value === 'string')
+            headers[name] = value;
+    }
+    return headers;
+}
+/**
+ * Serve one `/__bm/cdn/...` request by fetching it ourselves.
+ *
+ * `range` is forwarded because a browser asks for one on media, and answering a range request with
+ * a whole body is one of the few ways to make a video simply never start.
+ */
+async function proxyAsset(req, res, fetchImpl, log) {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+        res.writeHead(405, { 'Content-Type': 'text/plain' }).end('Only GET and HEAD are proxied.\n');
+        return;
+    }
+    const target = fromProxyPath((req.url ?? '/').split('#')[0]);
+    if (target === null) {
+        // Refused rather than fetched: this route is reachable by anything on the local network, and a
+        // proxy that will fetch any host for any caller is an open relay on the creator's machine.
+        res.writeHead(403, { 'Content-Type': 'text/plain' }).end('Not a bitmagic asset host.\n');
+        return;
+    }
+    let upstream;
+    try {
+        upstream = await fetchImpl(target, {
+            method: req.method,
+            headers: copyHeaders(req.headers, FORWARDED_REQUEST_HEADERS),
+            redirect: 'follow',
+        });
+    }
+    catch (error) {
+        // Worth a line in the terminal: from the phone this looks exactly like the CORS failure the
+        // bridge exists to remove, and the creator cannot see the reason from there.
+        log(`[mobile] could not fetch ${target}: ${error.message}`);
+        res.writeHead(502, { 'Content-Type': 'text/plain' }).end('Upstream asset fetch failed.\n');
+        return;
+    }
+    const headers = {};
+    for (const name of FORWARDED_RESPONSE_HEADERS) {
+        const value = upstream.headers.get(name);
+        if (value !== null)
+            headers[name] = value;
+    }
+    // fetch() DECODES the body but leaves the encoded representation's headers on the response, so a
+    // brotli'd .glb arrives carrying a content-length that describes the COMPRESSED bytes. Forwarded,
+    // it frames the decoded body short, and what the browser gets is a GLB truncated to a fraction of
+    // itself - "Invalid typed array length" out of GLTFBinaryExtension, on every model and every
+    // animation, with a 200 on each request and nothing anywhere saying the bytes are short.
+    // Dropping it lets Node chunk a body whose length we no longer know.
+    if (upstream.headers.get('content-encoding') !== null)
+        delete headers['content-length'];
+    res.writeHead(upstream.status, headers);
+    if (req.method === 'HEAD' || upstream.body === null) {
+        res.end();
+        return;
+    }
+    Readable.fromWeb(upstream.body).pipe(res);
+}
+/**
+ * Forward everything that is not an asset to vite, injecting the shim into HTML on the way back.
+ *
+ * The Host header is REWRITTEN to loopback. vite refuses requests whose Host it does not recognise,
+ * and the phone's is a LAN address it has never heard of — left alone, every request would come
+ * back "Blocked request. This host is not allowed." `accept-encoding` is dropped for the same class
+ * of reason: a gzipped HTML body is one the shim cannot be spliced into, and on loopback the
+ * compression buys nothing.
+ */
+function proxyGame(req, res, gamePort, log) {
+    const headers = { ...req.headers, host: `localhost:${gamePort}` };
+    delete headers['accept-encoding'];
+    const upstream = http.request({ host: LOOPBACK, port: gamePort, method: req.method, path: req.url, headers }, (proxied) => {
+        const type = proxied.headers['content-type'] ?? '';
+        if (!type.includes('text/html')) {
+            res.writeHead(proxied.statusCode ?? 502, proxied.headers);
+            proxied.pipe(res);
+            return;
+        }
+        const chunks = [];
+        proxied.on('data', (chunk) => chunks.push(chunk));
+        proxied.on('end', () => {
+            const body = Buffer.from(injectMobileShim(Buffer.concat(chunks).toString('utf-8')), 'utf-8');
+            const outgoing = { ...proxied.headers, 'content-length': String(body.byteLength) };
+            // The body was buffered to splice it, so whatever framing the upstream chose no longer
+            // describes it — a stale transfer-encoding here hangs the phone on a chunk that never comes.
+            delete outgoing['transfer-encoding'];
+            res.writeHead(proxied.statusCode ?? 502, outgoing);
+            res.end(body);
+        });
+    });
+    upstream.on('error', (error) => {
+        log(`[mobile] game server did not answer: ${error.message}`);
+        if (!res.headersSent)
+            res.writeHead(502, { 'Content-Type': 'text/plain' });
+        res.end('The game server is not answering.\n');
+    });
+    req.pipe(upstream);
+}
+/**
+ * Start the bridge and return the URL to hand the phone.
+ *
+ * Listens on every interface — that is the point of the command — which is why `dev` prints what
+ * that means alongside the URL.
+ */
+export async function startMobileBridge(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const handle = (req, res) => {
+        if ((req.url ?? '/').split('?')[0] === RELOAD_STREAM_PATH) {
+            if (options.subscribe === undefined) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' }).end('No reload channel.\n');
+                return;
+            }
+            options.subscribe(req, res);
+            return;
+        }
+        if ((req.url ?? '/').startsWith(CDN_PROXY_PREFIX)) {
+            void proxyAsset(req, res, fetchImpl, options.log);
+            return;
+        }
+        proxyGame(req, res, options.gamePort, options.log);
+    };
+    const server = options.tls === null
+        ? http.createServer(handle)
+        : https.createServer({ key: options.tls.key, cert: options.tls.cert }, handle);
+    // vite's HMR client opens a WebSocket back to whatever origin served the page, so the phone's
+    // connects HERE. Piped at the socket rather than proxied at the HTTP layer: an upgrade is only
+    // the handshake, and after it the two ends speak a protocol this has no business parsing.
+    server.on('upgrade', (req, socket, head) => {
+        const upstream = net.connect(options.gamePort, LOOPBACK, () => {
+            const lines = [`${req.method} ${req.url} HTTP/1.1`];
+            for (const [name, value] of Object.entries({ ...req.headers, host: `localhost:${options.gamePort}` })) {
+                for (const one of Array.isArray(value) ? value : [value ?? ''])
+                    lines.push(`${name}: ${one}`);
+            }
+            upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+            if (head.length > 0)
+                upstream.write(head);
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+        });
+        // A dead HMR socket is not worth a line of output: the browser retries on its own, and the
+        // page works without it.
+        upstream.on('error', () => socket.destroy());
+        socket.on('error', () => upstream.destroy());
+    });
+    // Sockets are tracked so close() actually finishes: an idle keep-alive connection from a phone
+    // that has since gone to sleep would otherwise hold Ctrl-C open until it times out.
+    const sockets = new Set();
+    const track = (socket) => {
+        sockets.add(socket);
+        socket.on('close', () => sockets.delete(socket));
+    };
+    server.on('connection', track);
+    server.on('secureConnection', track);
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.port, '0.0.0.0', () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    // The port is read back off the socket rather than echoed from the options: passing 0 is how the
+    // test asks the OS for one, and a URL naming port 0 would be a URL nothing can open.
+    const bound = server.address();
+    const port = bound !== null && typeof bound !== 'string' ? bound.port : options.port;
+    return {
+        url: `${options.tls === null ? 'http' : 'https'}://${options.address}:${port}/`,
+        close: () => new Promise((resolve) => {
+            for (const socket of sockets)
+                socket.destroy();
+            server.close(() => resolve());
+        }),
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/mobile/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/mobile/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B,+FAA+F;AAC/F,MAAM,yBAAyB,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAE5F,qGAAqG;AACrG,MAAM,0BAA0B,GAAG;IACjC,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe;IAClE,MAAM,EAAE,eAAe,EAAE,eAAe;CACzC,CAAC;AA+BF,SAAS,WAAW,CAAC,IAA8B,EAAE,KAAe;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,GAAyB,EACzB,GAAwB,EACxB,SAAkC,EAClC,GAA8B;IAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,+FAA+F;QAC/F,2FAA2F;QAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACjC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC;YAC5D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4FAA4F;QAC5F,6EAA6E;QAC7E,GAAG,CAAC,4BAA4B,MAAM,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,6FAA6F;IAC7F,yFAAyF;IACzF,qEAAqE;IACrE,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAA8C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAChB,GAAyB,EACzB,GAAwB,EACxB,QAAgB,EAChB,GAA8B;IAE9B,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,QAAQ,EAAE,EAAE,CAAC;IAClE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,EAC9E,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7F,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnF,uFAAuF;YACvF,6FAA6F;YAC7F,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7B,GAAG,CAAC,wCAAwC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA4B;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAyB,EAAE,GAAwB,EAAQ,EAAE;QAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClD,KAAK,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI;QACjC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAEjF,8FAA8F;IAC9F,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;gBACtG,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,2FAA2F;QAC3F,yBAAyB;QACzB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,oFAAoF;IACpF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAQ,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAErC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iGAAiG;IACjG,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAErF,OAAO;QACL,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG;QAC/E,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/mobile/dev-cert.d.ts

@@ -0,0 +1,30 @@
+export interface DevCert {
+    key: string;
+    cert: string;
+    /** Where the pair lives, so the banner can point at it if a creator wants to trust it properly. */
+    dir: string;
+}
+export interface DevCertDeps {
+    /** `~/.bitmagic` by default. Injected by the test — see the note below. */
+    baseDir?: string;
+    /**
+     * Runs openssl. Returns its exit status and whatever it said, never throws.
+     *
+     * A seam rather than a spy on `child_process`, and `baseDir` above is a parameter rather than a
+     * `$HOME` redirect, for the same reason: `os.homedir()` ignores `$HOME` on some platforms, so a
+     * test that only moved the env var would generate into the creator's REAL `~/.bitmagic`.
+     */
+    run?: (command: string, args: string[]) => {
+        status: number | null;
+        stderr: string;
+    };
+    now?: () => number;
+}
+/**
+ * The certificate for `address`, generated if there is not a usable one already.
+ *
+ * Returns null when openssl is missing or refuses — a machine without it still gets a working
+ * `--mobile`, over http, minus WebGPU. The caller says so; nothing here fails the dev server, and
+ * nothing here is worth an exception: this is a capability, and its absence has a fallback.
+ */
+export declare function ensureDevCert(address: string, deps?: DevCertDeps): DevCert | null;

package/dist/mobile/dev-cert.js

@@ -0,0 +1,114 @@
+/**
+ * The self-signed certificate the mobile bridge serves the phone over.
+ *
+ * TLS is not decoration here. A page on `http://192.168.x.y:3012` is NOT a secure context, and
+ * `navigator.gpu` is only exposed to secure contexts — so over plain http the engine's renderer
+ * pick downgrades to classic WebGL (`RendererPreference.ts`, `withoutUnavailableWebGpu`) and the
+ * one thing a real device is uniquely able to tell us about, Safari's WebGPU pipeline, is exactly
+ * the thing that cannot be observed. https on the LAN address is what gets it back, along with
+ * device orientation and anything else gated the same way.
+ *
+ * The certificate is self-signed, so the phone shows an interstitial once per address. That is the
+ * price and it is worth naming in the banner rather than hiding: the alternative is a WebGL-only
+ * device test that quietly disagrees with production.
+ *
+ * Two details are not arbitrary:
+ *   - the address goes in a subjectAltName as an IP. Safari has not honoured a CN-only certificate
+ *     for years; without the SAN the interstitial has no "visit anyway" to offer at all.
+ *   - 397 days. Apple platforms reject TLS certificates valid for more than 398.
+ *
+ * The pair is CACHED under `~/.bitmagic/dev-certs/` per address, because the exception the creator
+ * tapped through is bound to the certificate: regenerating one per run would make them do it again
+ * every single time.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { spawnSync } from 'child_process';
+import { defaultBaseDir } from '../config/credentials.js';
+/** Apple's ceiling is 398 days; sitting just under it leaves room for clock skew. */
+const VALID_DAYS = 397;
+/**
+ * When a cached pair is considered too old to reuse. Comfortably inside `VALID_DAYS`, so a creator
+ * meets a fresh certificate before an expired one — an expired certificate on iOS is a harder
+ * interstitial than an untrusted one, and on some versions has no way through at all.
+ */
+const REUSE_DAYS = 300;
+function defaultRun(command, args) {
+    const result = spawnSync(command, args, { encoding: 'utf-8' });
+    if (result.error)
+        return { status: null, stderr: result.error.message };
+    return { status: result.status, stderr: result.stderr ?? '' };
+}
+/** OpenSSL and LibreSSL both read this; `-addext` is OpenSSL-only, which is why it is not used. */
+function opensslConfig(address) {
+    return [
+        '[req]',
+        'distinguished_name = dn',
+        'x509_extensions = ext',
+        'prompt = no',
+        '',
+        '[dn]',
+        `CN = Bitmagic dev ${address}`,
+        '',
+        '[ext]',
+        `subjectAltName = IP:${address}`,
+        'basicConstraints = critical, CA:FALSE',
+        'keyUsage = digitalSignature, keyEncipherment',
+        'extendedKeyUsage = serverAuth',
+        '',
+    ].join('\n');
+}
+/**
+ * The certificate for `address`, generated if there is not a usable one already.
+ *
+ * Returns null when openssl is missing or refuses — a machine without it still gets a working
+ * `--mobile`, over http, minus WebGPU. The caller says so; nothing here fails the dev server, and
+ * nothing here is worth an exception: this is a capability, and its absence has a fallback.
+ */
+export function ensureDevCert(address, deps = {}) {
+    const run = deps.run ?? defaultRun;
+    const now = deps.now ?? Date.now;
+    const dir = path.join(deps.baseDir ?? defaultBaseDir(), 'dev-certs');
+    const keyPath = path.join(dir, `${address}.key.pem`);
+    const certPath = path.join(dir, `${address}.crt.pem`);
+    try {
+        const age = now() - fs.statSync(certPath).mtimeMs;
+        if (age < REUSE_DAYS * 24 * 60 * 60 * 1000) {
+            return { key: fs.readFileSync(keyPath, 'utf-8'), cert: fs.readFileSync(certPath, 'utf-8'), dir };
+        }
+    }
+    catch {
+        // No pair yet, or half of one. Either way the answer is to make it.
+    }
+    const configPath = path.join(os.tmpdir(), `bitmagic-dev-cert-${address}-${process.pid}.cnf`);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(configPath, opensslConfig(address));
+        const result = run('openssl', [
+            'req', '-x509', '-newkey', 'rsa:2048', '-sha256', '-nodes',
+            '-days', String(VALID_DAYS),
+            '-keyout', keyPath,
+            '-out', certPath,
+            '-config', configPath,
+        ]);
+        if (result.status !== 0)
+            return null;
+        // The key is a secret even though it protects nothing but a dev server: a world-readable
+        // private key in a home directory is the kind of thing that outlives the reason for it.
+        fs.chmodSync(keyPath, 0o600);
+        return { key: fs.readFileSync(keyPath, 'utf-8'), cert: fs.readFileSync(certPath, 'utf-8'), dir };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            fs.unlinkSync(configPath);
+        }
+        catch {
+            // A leftover config in the temp dir is not a reason to fail, and the OS clears it.
+        }
+    }
+}
+//# sourceMappingURL=dev-cert.js.map

package/dist/mobile/dev-cert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-cert.js","sourceRoot":"","sources":["../../src/mobile/dev-cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,qFAAqF;AACrF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAG,CAAC;AAuBvB,SAAS,UAAU,CAAC,OAAe,EAAE,IAAc;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,mGAAmG;AACnG,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,OAAO;QACP,yBAAyB;QACzB,uBAAuB;QACvB,aAAa;QACb,EAAE;QACF,MAAM;QACN,qBAAqB,OAAO,EAAE;QAC9B,EAAE;QACF,OAAO;QACP,uBAAuB,OAAO,EAAE;QAChC,uCAAuC;QACvC,8CAA8C;QAC9C,+BAA+B;QAC/B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAoB,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QAClD,IAAI,GAAG,GAAG,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3C,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,OAAO,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE;YAC5B,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ;YAC1D,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;YAC3B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,yFAAyF;QACzF,wFAAwF;QACxF,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/mobile/lan-address.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The address a phone on the same network can reach this machine at.
+ *
+ * `bitmagic dev --mobile` has to put a URL on screen that a creator scans and their phone resolves,
+ * and the only thing that can answer "which of my addresses is that" is the host's own interface
+ * list. There is no discovery here and no mDNS: a `.local` name works on Apple devices and fails
+ * quietly on many Android ones, whereas a literal IPv4 works everywhere and is what the certificate
+ * has to name anyway (`dev-cert.ts` puts it in the SAN).
+ *
+ * Only PRIVATE IPv4 addresses are offered. A machine with a public address on an interface would
+ * still bind it — the bridge listens on 0.0.0.0 — but printing it, and drawing a QR of it, would
+ * invite a creator to hand out a URL that is not merely LAN-visible. Loopback is excluded for the
+ * obvious reason, and 169.254/16 because an interface that self-assigned has no network to be on.
+ */
+import type * as os from 'os';
+export interface LanAddress {
+    /** The interface it was found on, so a machine with several can be told which is which. */
+    name: string;
+    address: string;
+}
+/** What `os.networkInterfaces()` returns, as a parameter so the pick is testable off a fixture. */
+export type NetworkInterfaces = ReturnType<typeof os.networkInterfaces>;
+/**
+ * Every address a phone could plausibly reach, best candidate first.
+ *
+ * Returns all of them rather than one, because a laptop on Wi-Fi and Ethernet at once has two right
+ * answers and only the creator knows which network the phone is on — `dev` prints the rest under
+ * the one it drew a QR for.
+ */
+export declare function lanAddresses(interfaces: NetworkInterfaces): LanAddress[];

package/dist/mobile/lan-address.js

@@ -0,0 +1,54 @@
+/**
+ * Ranking, best first. Home and office Wi-Fi is 192.168/16 far more often than anything else, and a
+ * 10/8 address on a laptop is as likely to be a VPN's as the LAN's — a tunnel the phone is not on.
+ * 172.16/12 sits last because Docker's default bridge lives there and reaches nothing.
+ */
+const PREFIXES = [
+    (a) => a[0] === 192 && a[1] === 168,
+    (a) => a[0] === 10,
+    (a) => a[0] === 172 && a[1] >= 16 && a[1] <= 31,
+];
+/** Physical-looking interfaces first: a VPN's utun/tun is a private address the phone cannot use. */
+const PHYSICAL = /^(en|eth|wlan|wl|wifi)/i;
+function octets(address) {
+    const parts = address.split('.');
+    if (parts.length !== 4)
+        return null;
+    const values = parts.map((part) => Number(part));
+    if (values.some((value) => !Number.isInteger(value) || value < 0 || value > 255))
+        return null;
+    return values;
+}
+/**
+ * Every address a phone could plausibly reach, best candidate first.
+ *
+ * Returns all of them rather than one, because a laptop on Wi-Fi and Ethernet at once has two right
+ * answers and only the creator knows which network the phone is on — `dev` prints the rest under
+ * the one it drew a QR for.
+ */
+export function lanAddresses(interfaces) {
+    const found = [];
+    for (const [name, infos] of Object.entries(interfaces)) {
+        for (const info of infos ?? []) {
+            // Node <18.4 reported `family` as the number 4; both forms are accepted so a creator on an
+            // older runtime than package.json asks for does not get a silently empty list.
+            const isIPv4 = info.family === 'IPv4' || info.family === 4;
+            if (!isIPv4 || info.internal)
+                continue;
+            const parts = octets(info.address);
+            if (parts === null)
+                continue;
+            const prefix = PREFIXES.findIndex((matches) => matches(parts));
+            if (prefix === -1)
+                continue;
+            found.push({
+                entry: { name, address: info.address },
+                rank: prefix * 2 + (PHYSICAL.test(name) ? 0 : 1),
+            });
+        }
+    }
+    return found
+        .sort((a, b) => a.rank - b.rank || a.entry.name.localeCompare(b.entry.name))
+        .map((candidate) => candidate.entry);
+}
+//# sourceMappingURL=lan-address.js.map

package/dist/mobile/lan-address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-address.js","sourceRoot":"","sources":["../../src/mobile/lan-address.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,MAAM,QAAQ,GAAG;IACf,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;IACtD,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;IACrC,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;CACnE,CAAC;AAEF,qGAAqG;AACrG,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAE3C,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAA6B;IACxD,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,2FAA2F;YAC3F,+EAA+E;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAK,IAAI,CAAC,MAA4B,KAAK,CAAC,CAAC;YAClF,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACtC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK;SACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/mobile/rewrite-shim.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Where the bridge relays the reload bus, and where the shim listens for it.
+ *
+ * The phone is otherwise outside the dev loop: the auto-reload the desktop enjoys lives in the
+ * shell, which is loopback-only and which no phone loads. Without this, every agent edit ends in
+ * "now pick the phone back up and pull to refresh".
+ *
+ * `/stream` because every streaming endpoint in this codebase ends that way.
+ */
+export declare const RELOAD_STREAM_PATH = "/__bm/reload/stream";
+/**
+ * The shim body. Kept in step with `asset-hosts.ts` by INTERPOLATING the prefix and the suffix list
+ * rather than restating them: the browser half and the server half disagreeing would mean assets
+ * rewritten to a route the bridge does not serve, or served on a route nobody asks for.
+ */
+export declare const MOBILE_SHIM_SOURCE: string;
+/** The shim as a tag, ready to splice into a document. */
+export declare const MOBILE_SHIM_TAG: string;
+/**
+ * `html` with the shim installed ahead of everything else on the page.
+ *
+ * Prefers `</head>`, falls back to the opening `<body>` tag and finally to the front of the
+ * document — an index.html a creator has rewritten still has to get the shim, and a page that
+ * loads its assets before the shim is a page with no terrain.
+ */
+export declare function injectMobileShim(html: string): string;