@linxin666/dsh-remote-web-ui 0.1.1

package/lib/types/mobile/mux.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Mobile-surface live-event client: the plugin's `/m/api/events.mux` SSE
+ * channel (Server-Sent Events — the host bridges the mux stream onto it, so
+ * no WebSocket handshake or framing is needed on this side). The host
+ * pushes mux frames (subscribed baselines, session events, approvals,
+ * questions, queue snapshots, tasks, projections) as soon as the stream
+ * opens — no subscription handshake is needed. Frames arrive as
+ * server-request envelopes whose payload is the mux frame; unknown frame
+ * types are dropped so a newer host never breaks this client.
+ * EventSource reconnects automatically.
+ */
+import type { MuxFrame } from '@deepseek-ai/dsh-host-apiproxy/api/events';
+/** Injectable seams for tests. */
+export interface MuxClientOptions {
+    /** EventSource factory (defaults to the browser EventSource). */
+    sourceFactory?: (url: string) => EventSourceLike;
+}
+/** The EventSource subset this client uses (browser EventSource fits). */
+export interface EventSourceLike {
+    onmessage: ((event: {
+        data: string;
+    }) => void) | null;
+    onerror: ((event: unknown) => void) | null;
+    close(): void;
+}
+/**
+ * Keep one SSE subscription open, fanning validated frames out to
+ * subscribers. EventSource owns reconnection (with its own backoff); this
+ * class only manages the subscription lifecycle.
+ */
+export declare class MuxClient {
+    private readonly sourceFactory;
+    private readonly listeners;
+    private source;
+    private stopped;
+    private readonly url;
+    /**
+     * @param url - the mobile events endpoint (browser-relative).
+     * @param options - seams.
+     */
+    constructor(url?: string, options?: MuxClientOptions);
+    /** Open the stream (idempotent; EventSource reconnects until {@link stop}). */
+    start(): void;
+    /** Close for good. */
+    stop(): void;
+    /** Subscribe to validated frames; returns an unsubscribe function. */
+    onFrame(listener: (frame: MuxFrame) => void): () => void;
+    private connect;
+    private handleMessage;
+    private closeSource;
+}
+//# sourceMappingURL=mux.d.ts.map

package/lib/types/mobile/mux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mux.d.ts","sourceRoot":"","sources":["../../../src/mobile/mux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2CAA2C,CAAA;AAIzE,kCAAkC;AAClC,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,CAAA;CACjD;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1C,KAAK,IAAI,IAAI,CAAA;CACd;AASD;;;;GAIG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAE5B;;;OAGG;gBACS,GAAG,SAAsB,EAAE,OAAO,GAAE,gBAAqB;IAKrE,+EAA+E;IAC/E,KAAK,IAAI,IAAI;IAMb,sBAAsB;IACtB,IAAI,IAAI,IAAI;IAKZ,sEAAsE;IACtE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAKxD,OAAO,CAAC,OAAO;IAaf,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,WAAW;CAapB"}

package/lib/types/mobile/rpc.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Mobile-surface unary RPC over the shared /api transport: the four-quadrant
+ * envelope (client-request → server-response), minted rpcIds, and typed
+ * error mapping. This is a thin, self-contained slice of the harness
+ * apiproxy fetch carrier — the mobile page is an independent bundle and must
+ * not depend on the main UI's module loader, so the wire contract is
+ * reimplemented here over plain fetch.
+ */
+/** Transport-level failure (network, HTTP status, malformed envelope). */
+export declare class RpcTransportError extends Error {
+    constructor(message: string);
+}
+/** A business error the host answered with (200 + err result). */
+export declare class RpcCallError extends Error {
+    /** The wire error (code + message + details). */
+    readonly error: {
+        code: string;
+        message: string;
+    };
+    constructor(error: {
+        code: string;
+        message: string;
+    });
+}
+/** Mint one process-unique rpcId (stable under crypto.randomUUID absence). */
+export declare function mintRpcId(): string;
+/**
+ * One unary call: POST /m/api/<method> (the plugin's own mobile channel —
+ * NOT the connection plugin's /api prefix, so the tunneled Host never needs
+ * to enter the transport trust fence) with the client-request envelope,
+ * resolve the server-response value, reject with the mapped error classes.
+ * @param method - the dotted RPC method, e.g. `session.list`.
+ * @param payload - the business payload.
+ * @param signal - optional abort.
+ * @returns the response value.
+ */
+export declare function callUnary<T>(method: string, payload: unknown, signal?: AbortSignal): Promise<T>;
+//# sourceMappingURL=rpc.d.ts.map

package/lib/types/mobile/rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../../src/mobile/rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,YAAa,SAAQ,KAAK;IACrC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;gBAErC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAKrD;AAID,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAmCZ"}

package/lib/types/mobile/theme-toggle.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Theme toggle button: sits at the right end of every view header and flips
+ * the mobile surface between the light (default) and dark palettes. The
+ * glyph shows the theme you will switch TO (moon in light mode, sun in dark
+ * mode); the choice persists across visits.
+ */
+/**
+ * Render the header theme toggle.
+ * @returns the toggle button.
+ */
+export declare function ThemeToggle(): import("react").JSX.Element;
+//# sourceMappingURL=theme-toggle.d.ts.map

package/lib/types/mobile/theme-toggle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme-toggle.d.ts","sourceRoot":"","sources":["../../../src/mobile/theme-toggle.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH;;;GAGG;AACH,wBAAgB,WAAW,gCAa1B"}

package/lib/types/mobile/views/App.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Mobile surface root: the view state machine (workspaces → sessions →
+ * chat) and the top-level data flows. Deliberately plain React state — no
+ * router, no state library: the surface is three fixed levels with a back
+ * affordance, and every piece of data is fetched on demand.
+ */
+import { listSessions, listWorkspaces, prompt } from '../api.ts';
+/** The session-list row model (list + chat share it). */
+export interface SessionView {
+    sessionId: string;
+    title: string;
+    cwd?: string;
+    updatedAt: number;
+    running: boolean;
+    blank: boolean;
+}
+/** One rendered chat message (produced by the fold). */
+export interface RenderMessage {
+    id: string;
+    kind: 'user' | 'assistant';
+    text: string;
+    seq: number;
+    time: number;
+    pending?: boolean;
+    failed?: boolean;
+    toolSummary?: string;
+}
+/** Map a list row to the surface model; the title comes from projections when present. */
+export declare function toSessionView(item: {
+    sessionId: string;
+    updatedAt: number;
+    running: boolean;
+    blank: boolean;
+    cwd?: string;
+    projections?: {
+        values?: Record<string, unknown>;
+    };
+}): SessionView;
+/** Human clock, e.g. "14:05" or "昨天 20:31". */
+export declare function formatTime(epochMs: number): string;
+/**
+ * The surface root.
+ * @returns the app tree.
+ */
+export declare function App(): import("react").JSX.Element;
+/** Shared error text for the surface's small failure affordances. */
+export declare function errorText(error: unknown): string;
+/**
+ * Actionable hint for transport-level 403s on host-gated channels (model
+ * picker, session creation): the phone's UI bundle is served fresh from disk
+ * per request, while the host-side allowlist lives in the long-running
+ * process — a rebuild without a restart shows the new surface against the
+ * old allowlist (HTTP 403 forbidden).
+ */
+export declare function staleHostHint(message: string): string | undefined;
+/** Fetch one history page (tail by default) — thin wrapper so views share the call shape. */
+export declare function loadHistory(sessionId: string, beforeSeq?: number): Promise<import("../api.ts").HistoryPage>;
+export { listSessions, listWorkspaces, prompt };
+//# sourceMappingURL=App.d.ts.map

package/lib/types/mobile/views/App.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/App.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA2B,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAazF,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAA;CACnD,GAAG,WAAW,CAad;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;GAGG;AACH,wBAAgB,GAAG,gCAwClB;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKhD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIjE;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,4CAEhE;AAED,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,CAAA"}

package/lib/types/mobile/views/ChatView.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Chat level: one session. Loads the history tail page on open, appends
+ * pages upward (loadOlder), folds live mux frames in as they arrive, and
+ * sends prompts through session.prompt.
+ *
+ * Rendering mirrors the desktop web UI's fold discipline on a small screen:
+ * - reasoning text hides behind a collapsed "深度思考" disclosure,
+ * - tool calls behind a collapsed tool disclosure (name + arguments),
+ * - very long assistant text collapses with an explicit expand toggle,
+ * - a toolbar above the composer carries the model (+ thinking effort) and
+ *   permission pickers, both as bottom sheets.
+ */
+import { type SessionView } from './App.tsx';
+import { MuxClient } from '../mux.ts';
+/** Props for the chat view. */
+export interface ChatViewProps {
+    session: SessionView;
+    /** The page-lifetime mux client (undefined before the first effect tick). */
+    mux?: MuxClient | undefined;
+    onBack(): void;
+}
+/** One switchable permission preset (the `permissions` projection shape). */
+export interface PermissionOption {
+    value: string;
+    name: string;
+    description?: string;
+}
+/** The `permissions` projection value: options + the effective current value. */
+export interface PermissionSelectValue {
+    options: PermissionOption[];
+    currentValue: string;
+}
+/**
+ * Render one session's chat.
+ * @param props - the session, the mux client, and the back action.
+ * @returns the chat surface.
+ */
+export declare function ChatView({ session, mux, onBack }: ChatViewProps): import("react").JSX.Element;
+//# sourceMappingURL=ChatView.d.ts.map

package/lib/types/mobile/views/ChatView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChatView.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/ChatView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAIjE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGrC,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,WAAW,CAAA;IACpB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC3B,MAAM,IAAI,IAAI,CAAA;CACf;AAYD,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;CACrB;AAqCD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,aAAa,+BA6M/D"}

package/lib/types/mobile/views/ChatView.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ChatView.test.d.ts.map

package/lib/types/mobile/views/ChatView.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChatView.test.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/ChatView.test.tsx"],"names":[],"mappings":""}

package/lib/types/mobile/views/SessionListView.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Sessions level: one workspace's sessions, loaded incrementally — the
+ * first page fetches session.list with a cursor, scrolling appends further
+ * pages (never the whole list at once). Rows are filtered to the opened
+ * workspace by its owned session ids; extra pages are pulled on demand so
+ * a workspace with many sessions converges without a full transfer.
+ *
+ * Creating a session is this level's other action: the workspace's id is
+ * sent to session.create (the host attaches the new session to it), the
+ * fresh row is prepended optimistically, and the user lands straight in
+ * the new chat — the same "new session opens" flow as the desktop UI.
+ */
+import type { WorkspaceView as WorkspaceRow } from '@deepseek-ai/dsh-host-apiproxy/api/workspace';
+import { type SessionView } from './App.tsx';
+/** Props for the session list. */
+export interface SessionListViewProps {
+    workspace: WorkspaceRow;
+    onBack(): void;
+    onPick(session: SessionView): void;
+}
+/**
+ * Render one workspace's paged session list.
+ * @param props - the workspace, back action, and pick action.
+ * @returns the session list.
+ */
+export declare function SessionListView({ workspace, onBack, onPick }: SessionListViewProps): import("react").JSX.Element;
+//# sourceMappingURL=SessionListView.d.ts.map

package/lib/types/mobile/views/SessionListView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionListView.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/SessionListView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,8CAA8C,CAAA;AAGjG,OAAO,EAAuD,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAGjG,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,YAAY,CAAA;IACvB,MAAM,IAAI,IAAI,CAAA;IACd,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,oBAAoB,+BAiJlF"}

package/lib/types/mobile/views/SessionListView.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SessionListView.test.d.ts.map

package/lib/types/mobile/views/SessionListView.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionListView.test.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/SessionListView.test.tsx"],"names":[],"mappings":""}

package/lib/types/mobile/views/WorkspaceView.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Landing level: the workspace roster. The mobile surface opens straight
+ * here — no new-session homepage — and every workspace row is a thin
+ * fetch from workspace.list (the roster is small; sessions are not loaded
+ * until a workspace is opened).
+ */
+import type { WorkspaceView as WorkspaceRow } from '@deepseek-ai/dsh-host-apiproxy/api/workspace';
+/** Props for the workspace roster. */
+export interface WorkspaceViewProps {
+    /** Open one workspace's session list. */
+    onPick(workspace: WorkspaceRow): void;
+}
+/**
+ * Render the workspace roster.
+ * @param props - the pick action.
+ * @returns the roster.
+ */
+export declare function WorkspaceView({ onPick }: WorkspaceViewProps): import("react").JSX.Element;
+//# sourceMappingURL=WorkspaceView.d.ts.map

package/lib/types/mobile/views/WorkspaceView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceView.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/WorkspaceView.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,8CAA8C,CAAA;AAKjG,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI,CAAA;CACtC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,kBAAkB,+BAmF3D"}

package/lib/types/mobile-api.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The mobile surface's data channel: `/m/api` proxies the host ApiProxy
+ * service for the standalone phone page. The phone's RPC calls ride THIS
+ * prefix instead of the connection plugin's `/api` — so the tunneled Host
+ * never needs to enter the connection trust fence (a distributable plugin
+ * cannot change that fence), and this plugin's own pairing gate is the
+ * access control instead.
+ *
+ * Security model:
+ * - Every request must carry a live paired-device cookie (the same gate
+ *   semantic as the LAN fence), enforced before any host call.
+ * - Only an explicit allowlist of methods is proxied; privileged domains
+ *   (settings, credentials, host actions, goals, subagents, …) are never
+ *   reachable from the phone.
+ * - `session.list` is paged here (the host API returns everything; this
+ *   layer slices stable pages) so the phone never transfers the whole list.
+ * - The live mux stream is bridged over Server-Sent Events on the same
+ *   prefix (one-directional push; answers to questions/approvals ride the
+ *   unary channel), gated identically.
+ */
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
+import type { PairingService } from './pairing.ts';
+/** Route-family dependencies. */
+export interface MobileApiDeps {
+    /** The pairing service (device gate + cookie name). */
+    service: PairingService;
+    /** The host ApiProxy service (injected by the plugin). */
+    apiProxy: ApiProxy;
+}
+/** Mobile API route paths. */
+export declare const MOBILE_API_PATHS: {
+    readonly events: "/m/api/events.mux";
+};
+/**
+ * Build the mobile data-channel routes.
+ * @param deps - pairing service + apiProxy.
+ * @returns the routes to register on webServer.
+ */
+export declare function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[];
+//# sourceMappingURL=mobile-api.d.ts.map

package/lib/types/mobile-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAuClD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CAkHnE"}

package/lib/types/mobile-routes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The mobile surface's page routes: `/m` serves the standalone phone UI
+ * (an independent bundle, built to lib/mobile.js by the mobile tsdown
+ * entry), `/m/mobile.js` serves the bundle itself. The page talks to the
+ * host exclusively through the shared /api transport (paired-device cookie
+ * already crosses the api/gate fence), so no host-side data plumbing is
+ * needed here — only static serving, loopback+paired-fence via the normal
+ * webserver route registration.
+ */
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+/**
+ * Build the mobile page routes.
+ * @returns the two exact routes to register on webServer.
+ */
+export declare function makeMobileRoutes(): WebRoute[];
+//# sourceMappingURL=mobile-routes.d.ts.map

package/lib/types/mobile-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAqC/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAqB7C"}

package/lib/types/pairing.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Pairing state machine: one active one-time token, a device-session table,
+ * and presence tracking. Pure TypeScript with injected clock/randomness so
+ * the whole security semantics are unit-testable without cordis. The
+ * cordis-facing surfaces (routes, the api/gate listener) live next door.
+ *
+ * Security invariants:
+ * - One active token at a time; `issue()` replaces it, so a refreshed QR
+ *   immediately invalidates the previous link.
+ * - A token is consumed by the first successful `accept()` — reuse is
+ *   refused with `'used'`.
+ * - Tokens expire; `accept()` on an expired token is refused like an
+ *   unknown one (no oracle for validity).
+ * - `stop()` revokes every device session and clears the token, so paired
+ *   devices are cut off on their next gated request.
+ */
+/** The observable pairing phases the panel renders. */
+export type PairingPhase = 
+/** The server is not bound all-interfaces: no usable QR exists. */
+'lan-required'
+/** Remote control was stopped; a fresh QR (issue) re-enables it. */
+ | 'stopped'
+/** A token is live and no device has paired with it yet. */
+ | 'waiting'
+/** At least one paired device was active recently. */
+ | 'connected'
+/** Devices are paired but none has been active within the offline window. */
+ | 'disconnected';
+/** One issued pairing token (keyed by its secret). */
+export interface TokenRecord {
+    /** Monotonic issue time (ms epoch), drives refresh ordering. */
+    issuedAt: number;
+    /** Absolute expiry (ms epoch); accept() past this is refused. */
+    expiresAt: number;
+    /** Consumed by the first successful accept(). */
+    consumed: boolean;
+    /** Opaque, non-secret identifier surfaced in snapshots (never the pairing secret). */
+    id: string;
+    /** Workspace the QR link should land the phone in (optional). */
+    workspaceId?: string;
+    /** LAN IP literal the QR link was built from (optional; default first). */
+    address?: string;
+}
+/** One paired device session, keyed by the device id stored in its cookie. */
+export interface DeviceSession {
+    /** Pairing time (ms epoch). */
+    createdAt: number;
+    /** Last time the device passed a gated request or heartbeat. */
+    lastSeenAt: number;
+}
+/** One tunnel status frame (auto-tunnel only; undefined when disabled). */
+export interface TunnelStatus {
+    /** starting: binary/process warming up; running: URL minted; failed: no URL. */
+    state: 'starting' | 'running' | 'failed';
+    /** The minted public URL, once the tunnel reports it. */
+    url?: string;
+    /** Human-readable failure detail. */
+    error?: string;
+}
+/** One snapshot frame pushed to desktop status streams. */
+export interface PairingSnapshot {
+    phase: PairingPhase;
+    /** Whether the server bind is all-interfaces (a QR is constructible). */
+    lanAvailable: boolean;
+    /** The LAN IP literals a QR can be built from (interface order). */
+    lanAddresses: string[];
+    /** Configured public (tunneled) base URL, when present. */
+    publicUrl?: string;
+    /** Auto-tunnel status, while the auto-tunnel feature is active. */
+    tunnel?: TunnelStatus;
+    /** Opaque (non-secret) id of the active token (undefined when stopped/lan-required). */
+    tokenId?: string;
+    /** Absolute expiry of the active token. */
+    tokenExpiresAt?: number;
+    /** Count of ever-paired devices. */
+    deviceCount: number;
+    /** Count of devices active within the offline window. */
+    onlineCount: number;
+}
+/** Service tunables (config-validated upstream; plain numbers here). */
+export interface PairingConfig {
+    /** Token lifetime; the QR stops working after this. */
+    tokenTtlMs: number;
+    /** A device is "online" while its lastSeenAt is newer than this. */
+    offlineAfterMs: number;
+    /** Hard cap on paired device sessions (oldest-evicted when full). */
+    maxDevices: number;
+    /** Cookie name carrying the device id. */
+    cookieName: string;
+}
+/** Result of one accept() attempt. */
+export type AcceptResult = {
+    ok: true;
+    deviceId: string;
+} | {
+    ok: false;
+    code: 'invalid' | 'used';
+};
+/** Thrown by issue() for an address outside the sampled LAN literals. */
+export declare class UnknownLanAddressError extends Error {
+    /**
+     * @param address - the offending literal.
+     */
+    constructor(address: string);
+}
+/** Clock and entropy injection for tests. */
+export interface PairingClock {
+    now(): number;
+    randomToken(): string;
+}
+/** Real clock/entropy: 32 random hex chars per token. */
+export declare const defaultClock: PairingClock;
+/**
+ * The pairing state machine. All mutations notify state listeners after the
+ * commit point that makes them true, and notification dedupes against the
+ * last emitted snapshot — time-driven transitions (a device aging offline)
+ * surface on the next sweep without any mutation.
+ */
+export declare class PairingService {
+    config: PairingConfig;
+    private readonly clock;
+    private readonly tokens;
+    private readonly devices;
+    private readonly listeners;
+    private lastEmitted;
+    private stopped;
+    private tokenSerial;
+    /** LAN base URLs keyed by the advertised IP literal (interface order). */
+    private lanBases;
+    /** Public (tunneled) base URL, e.g. a Cloudflare Tunnel quick URL. */
+    private publicBase;
+    /** Auto-tunnel status, while the auto-tunnel feature is active. */
+    private tunnelStatus;
+    /**
+     * @param config - tunables. The settings surface replaces the object (a
+     * fresh literal) when a committed section changes; every operation reads
+     * the current one.
+     * @param clock - clock/entropy source (injectable for tests).
+     */
+    constructor(config: PairingConfig, clock?: PairingClock);
+    /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
+    get lanBaseUrl(): string | undefined;
+    /** The LAN base URL for one specific literal (undefined when not constructible). */
+    lanBaseUrlFor(address: string): string | undefined;
+    /** The LAN IP literals QR links can be built from (interface order). */
+    get lanAddresses(): string[];
+    /** Set the LAN base URLs once the server bind is known (interface order). */
+    setLanBases(entries: readonly {
+        address: string;
+        base: string;
+    }[]): void;
+    /** The configured public (tunneled) base URL, when present. */
+    get publicBaseUrl(): string | undefined;
+    /** Set or clear the public base URL (a tunnel in front of this server). */
+    setPublicBaseUrl(url: string | undefined): void;
+    /** Set or clear the auto-tunnel status frame (undefined when the feature is off). */
+    setTunnelStatus(status: TunnelStatus | undefined): void;
+    /**
+     * Issue a fresh token, replacing (invalidating) any previous one. A
+     * stopped service re-arms through this call (the panel's refresh button).
+     * @param workspaceId - optional workspace the QR link should land in.
+     * @param address - optional LAN IP literal the QR must be built from; the
+     * default is the public base (when configured) or the first interface.
+     * Unknown addresses are refused.
+     * @returns the token secret and its expiry.
+     * @throws {Error} when no reachable base exists (no all-interfaces bind and
+     * no public base) — callers surface this as the lan-required state instead
+     * of minting an unusable QR.
+     */
+    issue(workspaceId?: string, address?: string): {
+        token: string;
+        expiresAt: number;
+    };
+    /**
+     * Consume a token and bind a device session. One-time: the second
+     * successful call for the same token is impossible because the first
+     * consumes it.
+     * @param token - the token secret from the QR link.
+     * @returns the new device id, or a refusal code.
+     */
+    accept(token: string): AcceptResult;
+    /**
+     * Stop remote control: revoke every device session and clear the token.
+     * The phone's next gated /api request 403s; the panel falls back to
+     * stopped until a fresh QR is issued.
+     */
+    stop(): void;
+    /**
+     * The api/gate path: record activity for a device id and report whether
+     * the request may proceed. Unknown or revoked ids (including any device
+     * after stop()) are refused.
+     * @param deviceId - the cookie value of the requesting device.
+     * @returns true when the device session is live and was refreshed.
+     */
+    touchDevice(deviceId: string): boolean;
+    /** Explicit presence heartbeat (the phone's client sends these). */
+    heartbeat(deviceId: string): boolean;
+    /**
+     * Periodic sweep: re-evaluate the derived snapshot (a device aging past
+     * the offline window flips the phase to disconnected). Emits only when
+     * the snapshot actually changed.
+     */
+    sweep(): void;
+    /** The current snapshot (fresh object per call — stable between emits). */
+    snapshot(): PairingSnapshot;
+    /** Whether a cookie value names a currently live device session. */
+    hasDevice(deviceId: string): boolean;
+    /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
+    onState(listener: (snapshot: PairingSnapshot) => void): () => void;
+    private activeToken;
+    private derivePhase;
+    private isOnlineAt;
+    private notify;
+}
+//# sourceMappingURL=pairing.d.ts.map

package/lib/types/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;GAKG;AACH,qBAAa,cAAc;IAqBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IArBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAE9C;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B;IAGrD,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwBnF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;IAqBnC;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAOZ;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAIb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAgB3B,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf"}

package/lib/types/routes.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The /api/pair route family + the desktop status stream. Exact routes
+ * under /api: the webserver matches exact paths before the connection
+ * plugin's /api prefix, so these handlers own the full response lifecycle
+ * and apply their own trust fence (loopback-only for control endpoints;
+ * loopback-or-LAN for the phone-facing accept/heartbeat/status). The
+ * cookie set on accept is the device identity the api/gate listener checks
+ * on every other /api request.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import { type PairingService, type PairingSnapshot } from './pairing.ts';
+/**
+ * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
+ * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
+ * a malformed config then simply contributes no fence entry (and the panel
+ * falls back to LAN-only URLs).
+ * @param url - the configured public base URL (or undefined).
+ * @returns the `host[:port]` authority the fence should trust.
+ */
+export declare function publicHostOf(url: string | undefined): string | undefined;
+/** Route paths (exact matches under /api). */
+export declare const PAIR_PATHS: {
+    readonly issue: "/api/pair/issue";
+    readonly accept: "/api/pair/accept";
+    readonly stop: "/api/pair/stop";
+    readonly heartbeat: "/api/pair/heartbeat";
+    readonly status: "/api/pair/status";
+    readonly events: "/api/pair/events";
+};
+/** The SSE fan-out for desktop panel status. */
+export declare class PairingEventsStream {
+    private readonly streams;
+    /**
+     * @param service - the pairing service whose snapshots are fanned out.
+     */
+    constructor(service: PairingService);
+    /** Open one stream; the response is owned to completion. */
+    open(req: IncomingMessage, res: ServerResponse): void;
+    /** Push one frame to every open stream (contained per stream). */
+    push(snapshot: PairingSnapshot): void;
+    /** Stream count (tests/diagnostics). */
+    get size(): number;
+}
+/** Route-family dependencies (test seam). */
+export interface PairRoutesDeps {
+    /** The pairing service. */
+    service: PairingService;
+    /** The LAN IP literals the fence accepts (derived from the bind host). */
+    lanAddresses: readonly string[];
+}
+/**
+ * Build the /api/pair route family.
+ * @param deps - service + fence inputs.
+ * @returns the exact routes to register on webServer.
+ */
+export declare function makeRoutes(deps: PairRoutesDeps): WebRoute[];
+//# sourceMappingURL=routes.d.ts.map