@myagentroam/node 0.13.11 → 0.13.12

package/dist/remote-desktop/desktop-byte-stream.js

@@ -0,0 +1,128 @@
+import { Duplex } from 'node:stream';
+import { RemoteDesktopError } from './desktop-error.js';
+const MAX_QUEUED_BYTES = 1024 * 1024;
+const DRAIN_MS = 20;
+/** Sole byte-stream reader/writer/closer after a reliable RTC or relay channel handoff. */
+export class DesktopByteStream extends Duplex {
+    channel;
+    maxMessageBytes;
+    #timer;
+    #pending;
+    constructor(channel, maxMessageBytes) {
+        super({
+            allowHalfOpen: false,
+            readableHighWaterMark: 64 * 1024,
+            writableHighWaterMark: 64 * 1024
+        });
+        this.channel = channel;
+        this.maxMessageBytes = maxMessageBytes;
+        if ((channel.readyState !== 'open' && channel.readyState !== 1) ||
+            !Number.isSafeInteger(maxMessageBytes) ||
+            maxMessageBytes < 1 ||
+            maxMessageBytes > 64 * 1024)
+            throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+        channel.binaryType = 'arraybuffer';
+        channel.onmessage = this.#message;
+        channel.onclose = this.#closed;
+        channel.onerror = this.#failed;
+    }
+    _read() { }
+    _write(chunk, _encoding, callback) {
+        if (!Buffer.isBuffer(chunk) || this.writableLength > MAX_QUEUED_BYTES) {
+            callback(new RemoteDesktopError('DESKTOP_BACKPRESSURE'));
+            return;
+        }
+        this.#pending = { bytes: chunk, offset: 0, callback };
+        this.#drain();
+    }
+    _destroy(error, callback) {
+        if (this.#timer)
+            clearTimeout(this.#timer);
+        this.#timer = undefined;
+        this.channel.onmessage = null;
+        this.channel.onclose = null;
+        this.channel.onerror = null;
+        try {
+            if ('terminate' in this.channel)
+                this.channel.terminate();
+            else
+                this.channel.close();
+        }
+        catch {
+            /* Preserve the original failure. */
+        }
+        const pending = this.#pending;
+        this.#pending = undefined;
+        pending?.callback(error ?? new RemoteDesktopError('DESKTOP_RFB_CLOSED'));
+        callback(error);
+    }
+    #message = (event) => {
+        const data = event.data;
+        const bytes = data instanceof ArrayBuffer
+            ? new Uint8Array(data)
+            : ArrayBuffer.isView(data)
+                ? new Uint8Array(data.buffer, data.byteOffset, data.byteLength)
+                : undefined;
+        if (!bytes) {
+            this.destroy(new RemoteDesktopError('DESKTOP_RFB_INVALID'));
+            return;
+        }
+        if (this.readableLength + bytes.byteLength > MAX_QUEUED_BYTES) {
+            this.destroy(new RemoteDesktopError('DESKTOP_BACKPRESSURE'));
+            return;
+        }
+        if (bytes.byteLength)
+            this.push(Buffer.from(bytes));
+    };
+    #closed = () => {
+        this.destroy();
+    };
+    #failed = () => {
+        this.destroy(new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR'));
+    };
+    #drain() {
+        const pending = this.#pending;
+        if (!pending || this.destroyed)
+            return;
+        if (this.channel.readyState !== 'open' && this.channel.readyState !== 1) {
+            this.destroy(new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR'));
+            return;
+        }
+        try {
+            let sent = 0;
+            while (pending.offset < pending.bytes.length && sent < 4) {
+                const end = Math.min(pending.offset + this.maxMessageBytes, pending.bytes.length);
+                if (this.channel.bufferedAmount + end - pending.offset > MAX_QUEUED_BYTES) {
+                    this.#timer = setTimeout(() => {
+                        this.#timer = undefined;
+                        this.#drain();
+                    }, DRAIN_MS);
+                    this.#timer.unref?.();
+                    return;
+                }
+                const chunk = pending.bytes.subarray(pending.offset, end);
+                // Both transports may retain the view after send returns; the Node
+                // stream write callback lets its caller immediately reuse the buffer.
+                const bytes = Uint8Array.from(chunk);
+                this.channel.send(bytes);
+                pending.offset = end;
+                sent++;
+            }
+        }
+        catch {
+            this.destroy(new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR'));
+            return;
+        }
+        if (pending.offset < pending.bytes.length) {
+            this.#timer = setTimeout(() => {
+                this.#timer = undefined;
+                this.#drain();
+            }, 0);
+            this.#timer.unref?.();
+        }
+        else {
+            this.#pending = undefined;
+            pending.callback();
+        }
+    }
+}

package/dist/remote-desktop/desktop-error.js

@@ -0,0 +1,35 @@
+const messages = {
+    DESKTOP_UNAVAILABLE: 'Remote desktop is unavailable on this Node.',
+    DESKTOP_RFB_INVALID: 'The remote desktop protocol message is invalid.',
+    DESKTOP_RFB_CLOSED: 'The remote desktop input stream is closed.',
+    DESKTOP_INPUT_DENIED: 'This remote desktop attachment cannot send input.',
+    DESKTOP_CONTROL_LOST: 'Remote desktop control is no longer held.',
+    DESKTOP_BACKPRESSURE: 'The remote desktop input buffer exceeded its limit.',
+    DESKTOP_TRANSPORT_ERROR: 'The remote desktop transport failed.',
+    DESKTOP_BACKEND_AUTH_UNAVAILABLE: 'The desktop backend does not offer required authentication.',
+    DESKTOP_BACKEND_AUTH_FAILED: 'The desktop backend rejected authentication.',
+    DESKTOP_BACKEND_CONFIG_INVALID: 'The desktop backend configuration is invalid.',
+    DESKTOP_BACKEND_START_FAILED: 'The desktop backend could not start.',
+    DESKTOP_BACKEND_SOCKET_INVALID: 'The desktop backend socket is not private.',
+    DESKTOP_BACKEND_CLOSED: 'The desktop backend is closed.',
+    DESKTOP_BACKEND_STOP_FAILED: 'The desktop backend could not be stopped.',
+    DESKTOP_BACKEND_STOP_TIMEOUT: 'The desktop backend did not stop in time.',
+    DESKTOP_SETUP_TIMEOUT: 'The remote desktop setup timed out.',
+    DESKTOP_SETUP_CANCELLED: 'The remote desktop setup was cancelled.',
+    DESKTOP_TOPOLOGY_UNAVAILABLE: 'The native desktop topology is unavailable.',
+    DESKTOP_NATIVE_CHANNEL_CLOSED: 'The native desktop control channel is closed.',
+    DESKTOP_NATIVE_ID_UNAVAILABLE: 'A unique native desktop attachment ID could not be created.',
+    DESKTOP_NATIVE_WAIT_IN_PROGRESS: 'Native desktop cleanup is already being awaited.',
+    DESKTOP_NATIVE_CLEANUP_TIMEOUT: 'Native desktop input cleanup timed out.',
+    DESKTOP_NATIVE_CLEANUP_FAILED: 'The native desktop backend could not confirm input cleanup.',
+    DESKTOP_NATIVE_ATTACHMENTS_ACTIVE: 'Desktop attachments are still active.'
+};
+/** Stable, credential-free errors crossing the Node remote-desktop boundary. */
+export class RemoteDesktopError extends Error {
+    code;
+    constructor(code) {
+        super(messages[code]);
+        this.code = code;
+        this.name = 'RemoteDesktopError';
+    }
+}

package/dist/remote-desktop/desktop-service-core.js

@@ -0,0 +1,384 @@
+import { timingSafeEqual } from 'node:crypto';
+import { remoteDesktopDirectNodeCommandSchema, remoteDesktopRelayNodeCommandSchema, remoteDesktopDirectOpenFrameSchema } from '@myagentroam/protocol';
+import { RemoteDesktopError } from './desktop-error.js';
+import { DesktopByteStream } from './desktop-byte-stream.js';
+/** Tracks attachment IDs across transport owners until their cleanup settles. */
+export class DesktopAttachmentRegistry {
+    #ids = new Set();
+    has(id) {
+        return this.#ids.has(id);
+    }
+    reserve(id) {
+        if (this.#ids.has(id))
+            return false;
+        this.#ids.add(id);
+        return true;
+    }
+    release(id) {
+        this.#ids.delete(id);
+    }
+}
+/** Owns attachment channels, deadlines and cleanup for either path; never owns the shared backend. */
+export class DesktopServiceCore {
+    options;
+    #entries = new Map();
+    #registry;
+    #now;
+    #timer;
+    #cleanupWaiters = new Set();
+    #disposed = false;
+    #suspended = false;
+    constructor(options) {
+        this.options = options;
+        this.#registry = options.registry ?? new DesktopAttachmentRegistry();
+        const epoch = Date.now() - performance.now();
+        this.#now = options.now ?? (() => Math.floor(epoch + performance.now()));
+        this.#timer = setInterval(() => this.#sweep(), 1_000);
+        this.#timer.unref();
+    }
+    handle(raw) {
+        const parsed = (this.options.path === 'direct'
+            ? remoteDesktopDirectNodeCommandSchema
+            : remoteDesktopRelayNodeCommandSchema).safeParse(raw);
+        if (!parsed.success)
+            return false;
+        const command = parsed.data;
+        if (command.type === 'desktop.direct.prepare' || command.type === 'desktop.relay.prepare') {
+            this.#prepare(command);
+            return true;
+        }
+        const entry = this.#entries.get(command.attachmentId);
+        if (!entry) {
+            // A shared ready event must reach the path that actually owns the attachment.
+            if (command.type === 'desktop.ready')
+                return false;
+            // Never claim another path's live attachment has already been cleaned up.
+            if (this.#registry.has(command.attachmentId))
+                return true;
+            if (command.type === 'desktop.direct.cancel' || command.type === 'desktop.relay.cancel')
+                this.#emit({
+                    type: 'desktop.direct.closed',
+                    attachmentId: command.attachmentId,
+                    code: command.code
+                });
+            return true;
+        }
+        if (command.type === 'desktop.direct.cancel' || command.type === 'desktop.relay.cancel') {
+            this.#close(entry, command.code);
+        }
+        else if (command.type === 'desktop.direct.heartbeat' ||
+            command.type === 'desktop.relay.heartbeat') {
+            if (!this.#valid(entry) || command.expiresAt <= this.#now())
+                this.#close(entry, 'DESKTOP_LEASE_EXPIRED');
+            else
+                entry.expiresAt = Math.min(command.expiresAt, this.#now() + 30_000);
+        }
+        else if (entry.state === 'OPEN' || entry.state === 'ATTACHED') {
+            entry.ready = true;
+            this.#activate(entry);
+        }
+        return true;
+    }
+    /** Called synchronously on topology, security session or notification-source invalidation. */
+    invalidate(code) {
+        for (const entry of this.#entries.values())
+            this.#close(entry, code);
+    }
+    removeTransport(transportSessionId) {
+        for (const entry of this.#entries.values())
+            if ('transportSessionId' in entry.command &&
+                entry.command.transportSessionId === transportSessionId)
+                this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+    }
+    dispose() {
+        this.#disposed = true;
+        this.invalidate('DESKTOP_SERVER_SHUTDOWN');
+        if (this.#entries.size === 0)
+            clearInterval(this.#timer);
+    }
+    /** Fence synchronously and wait for native cleanup, not delivery of the closed event. */
+    shutdown(signal) {
+        this.dispose();
+        return this.#waitForCleanup(signal);
+    }
+    /** Disable Remote admission without disposing the borrowed transport or its retry owner. */
+    suspend(signal) {
+        this.#suspended = true;
+        this.invalidate('DESKTOP_UNAVAILABLE');
+        return this.#waitForCleanup(signal);
+    }
+    /** A failed or incomplete native cleanup must keep admission fenced. */
+    canResume() {
+        return (!this.#disposed && [...this.#entries.values()].every((entry) => entry.state === 'SETTLED'));
+    }
+    resume() {
+        if (!this.canResume())
+            return false;
+        this.#suspended = false;
+        return true;
+    }
+    #waitForCleanup(signal) {
+        return new Promise((resolve, reject) => {
+            const finish = () => {
+                if ([...this.#entries.values()].some((entry) => entry.state !== 'SETTLED')) {
+                    if (!signal.aborted)
+                        return;
+                    cleanup();
+                    reject(new RemoteDesktopError('DESKTOP_NATIVE_CLEANUP_TIMEOUT'));
+                    return;
+                }
+                cleanup();
+                resolve();
+            };
+            const cleanup = () => {
+                this.#cleanupWaiters.delete(finish);
+                signal.removeEventListener('abort', finish);
+            };
+            this.#cleanupWaiters.add(finish);
+            signal.addEventListener('abort', finish, { once: true });
+            finish();
+        });
+    }
+    #prepare(command) {
+        const existing = this.#entries.get(command.attachmentId);
+        if (existing)
+            return this.#close(existing, 'DESKTOP_RFB_INVALID');
+        // Another path owns this ID; it alone may confirm its cleanup.
+        if (this.#registry.has(command.attachmentId))
+            return;
+        if (this.#disposed ||
+            this.#suspended ||
+            !this.#current(command) ||
+            command.openExpiresAt <= this.#now() ||
+            command.expiresAt <= this.#now() ||
+            !this.#registry.reserve(command.attachmentId)) {
+            this.#emit({
+                type: 'desktop.direct.closed',
+                attachmentId: command.attachmentId,
+                code: 'DESKTOP_CONTROL_UNAVAILABLE'
+            });
+            return;
+        }
+        let transport;
+        try {
+            transport = this.options.transport(command);
+        }
+        catch {
+            this.#registry.release(command.attachmentId);
+            this.#emit({
+                type: 'desktop.direct.closed',
+                attachmentId: command.attachmentId,
+                code: 'DESKTOP_TRANSPORT_ERROR'
+            });
+            return;
+        }
+        if (!transport) {
+            this.#registry.release(command.attachmentId);
+            this.#emit({
+                type: 'desktop.direct.closed',
+                attachmentId: command.attachmentId,
+                code: 'DESKTOP_CONTROL_UNAVAILABLE'
+            });
+            return;
+        }
+        const channel = transport.channel;
+        const entry = {
+            command,
+            channel,
+            transport,
+            deadline: new AbortController(),
+            openExpiresAt: Math.min(command.openExpiresAt, this.#now() + 15_000),
+            state: 'PREPARED',
+            expiresAt: Math.min(command.expiresAt, this.#now() + 30_000),
+            ready: false,
+            initialized: false,
+            closeCode: 'DESKTOP_TRANSPORT_ERROR'
+        };
+        this.#entries.set(command.attachmentId, entry);
+        channel.onmessage = (event) => this.#open(entry, event.data);
+        channel.onclose = () => this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+        channel.onerror = () => this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+        const prepared = () => {
+            if (!this.#valid(entry))
+                return this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+            try {
+                transport.start?.();
+            }
+            catch {
+                return this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+            }
+            if (!this.#emit({
+                type: 'desktop.direct.ready',
+                attachmentId: command.attachmentId,
+                phase: 'PREPARED'
+            }))
+                this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+        };
+        if (transport.start && channel.readyState !== 'open' && channel.readyState !== 1)
+            channel.onopen = prepared;
+        else
+            prepared();
+    }
+    #open(entry, data) {
+        if (entry.state !== 'PREPARED' ||
+            (entry.channel.readyState !== 'open' && entry.channel.readyState !== 1) ||
+            !this.#valid(entry) ||
+            typeof data !== 'string' ||
+            data.length > 8192)
+            return this.#close(entry, 'DESKTOP_RFB_INVALID');
+        let frame;
+        try {
+            frame = JSON.parse(data);
+        }
+        catch {
+            return this.#close(entry, 'DESKTOP_RFB_INVALID');
+        }
+        const parsed = remoteDesktopDirectOpenFrameSchema.safeParse(frame);
+        const expected = Buffer.from(entry.command.grant);
+        const received = parsed.success ? Buffer.from(parsed.data.grant) : Buffer.alloc(0);
+        if (!parsed.success ||
+            parsed.data.attachmentId !== entry.command.attachmentId ||
+            expected.length !== received.length ||
+            !timingSafeEqual(expected, received))
+            return this.#close(entry, 'DESKTOP_NOT_AUTHORIZED');
+        entry.state = 'OPEN';
+        entry.setupExpiresAt = this.#now() + 15_000;
+        if (!this.#emit({
+            type: 'desktop.direct.ready',
+            attachmentId: entry.command.attachmentId,
+            phase: 'OPEN'
+        }))
+            return this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+        try {
+            entry.stream = new DesktopByteStream(entry.channel, entry.transport.maxMessageBytes());
+            entry.attachment = this.options.createAttachment(entry.command, entry.stream, {
+                attached: () => {
+                    if (!this.#valid(entry))
+                        throw new RemoteDesktopError('DESKTOP_TOPOLOGY_UNAVAILABLE');
+                    entry.channel.send(JSON.stringify({ type: 'ATTACHED', attachmentId: entry.command.attachmentId }));
+                    entry.state = 'ATTACHED';
+                    if (!this.#emit({
+                        type: 'desktop.direct.ready',
+                        attachmentId: entry.command.attachmentId,
+                        phase: 'ATTACHED'
+                    }))
+                        throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+                },
+                failed: (code) => this.#close(entry, code)
+            });
+            void entry.attachment.open(entry.deadline.signal).then(() => {
+                entry.initialized = true;
+                this.#activate(entry);
+            }, (error) => this.#close(entry, error instanceof RemoteDesktopError ? error.code : 'DESKTOP_TRANSPORT_ERROR'));
+        }
+        catch (error) {
+            this.#close(entry, error instanceof RemoteDesktopError ? error.code : 'DESKTOP_TRANSPORT_ERROR');
+        }
+    }
+    #activate(entry) {
+        if (!entry.ready || !entry.initialized || entry.state !== 'ATTACHED')
+            return;
+        if (!this.#valid(entry))
+            return this.#close(entry, 'DESKTOP_TOPOLOGY_UNAVAILABLE');
+        entry.state = 'ACTIVE';
+        if (!this.#emit({
+            type: 'desktop.direct.ready',
+            attachmentId: entry.command.attachmentId,
+            phase: 'ACTIVE'
+        }))
+            this.#close(entry, 'DESKTOP_TRANSPORT_ERROR');
+    }
+    #valid(entry) {
+        if (this.#disposed ||
+            entry.state === 'CLOSING' ||
+            entry.state === 'SETTLED' ||
+            entry.expiresAt <= this.#now() ||
+            (entry.state === 'PREPARED' && entry.openExpiresAt <= this.#now()) ||
+            ((entry.state === 'OPEN' || entry.state === 'ATTACHED') &&
+                entry.setupExpiresAt <= this.#now()) ||
+            !this.#current(entry.command))
+            return false;
+        try {
+            return entry.transport.valid();
+        }
+        catch {
+            return false;
+        }
+    }
+    #current(command) {
+        try {
+            return this.options.isCurrent(command);
+        }
+        catch {
+            return false;
+        }
+    }
+    #close(entry, code) {
+        if (entry.state === 'SETTLED')
+            return this.#announceClosed(entry);
+        if (entry.state !== 'CLOSING') {
+            entry.state = 'CLOSING';
+            entry.closeCode = code;
+            entry.deadline.abort();
+            if (!entry.attachment && entry.stream)
+                entry.stream.destroy();
+            else if (!entry.attachment) {
+                entry.channel.onmessage = null;
+                entry.channel.onopen = null;
+                entry.channel.onclose = null;
+                entry.channel.onerror = null;
+                try {
+                    if ('terminate' in entry.channel)
+                        entry.channel.terminate();
+                    else
+                        entry.channel.close();
+                }
+                catch {
+                    /* already closed */
+                }
+            }
+        }
+        if (entry.cleanup)
+            return;
+        const cleanup = entry.attachment?.close(AbortSignal.timeout(5_000)) ?? Promise.resolve();
+        entry.cleanup = cleanup
+            .then(() => {
+            entry.state = 'SETTLED';
+            this.#announceClosed(entry);
+            for (const notify of this.#cleanupWaiters)
+                notify();
+        }, () => { })
+            .finally(() => {
+            delete entry.cleanup;
+        });
+    }
+    #announceClosed(entry) {
+        if (this.#emit({
+            type: 'desktop.direct.closed',
+            attachmentId: entry.command.attachmentId,
+            code: entry.closeCode
+        })) {
+            this.#entries.delete(entry.command.attachmentId);
+            this.#registry.release(entry.command.attachmentId);
+            if (this.#disposed && this.#entries.size === 0)
+                clearInterval(this.#timer);
+        }
+    }
+    #sweep() {
+        for (const entry of this.#entries.values()) {
+            if (entry.state === 'CLOSING' || entry.state === 'SETTLED')
+                this.#close(entry, entry.closeCode);
+            else if (!this.#valid(entry))
+                this.#close(entry, 'DESKTOP_LEASE_EXPIRED');
+        }
+    }
+    #emit(event) {
+        try {
+            const type = event.type.replace('desktop.direct.', `desktop.${this.options.path}.`);
+            return this.options.emit({ ...event, type, nodeGeneration: this.options.nodeGeneration() });
+        }
+        catch {
+            return false;
+        }
+    }
+}

package/dist/remote-desktop/direct-desktop-service.js

@@ -0,0 +1,46 @@
+import { RemoteDesktopError } from './desktop-error.js';
+import { DesktopServiceCore } from './desktop-service-core.js';
+/** Binds reliable Node-created RTC channels to the shared attachment lifecycle. */
+export class DirectDesktopService extends DesktopServiceCore {
+    constructor(options) {
+        super({
+            path: 'direct',
+            ...(options.registry === undefined ? {} : { registry: options.registry }),
+            nodeGeneration: options.nodeGeneration,
+            ...(options.now === undefined ? {} : { now: options.now }),
+            isCurrent: (command) => command.type === 'desktop.direct.prepare' && options.isCurrent(command),
+            createAttachment: (command, stream, callbacks) => {
+                if (command.type !== 'desktop.direct.prepare')
+                    throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+                return options.createAttachment(command, stream, callbacks);
+            },
+            emit: (event) => options.emit(event),
+            transport: (command) => {
+                if (command.type !== 'desktop.direct.prepare')
+                    return undefined;
+                let peer;
+                try {
+                    peer = options.peer(command);
+                }
+                catch {
+                    return undefined;
+                }
+                if (!peer)
+                    return undefined;
+                const channel = peer.createDataChannel(`mar-desktop-${command.attachmentId}`, {
+                    ordered: true
+                });
+                return {
+                    channel,
+                    valid: () => options.peer(command) === peer,
+                    maxMessageBytes: () => {
+                        const negotiated = peer.sctp?.maxMessageSize;
+                        if (negotiated === undefined || !Number.isFinite(negotiated) || negotiated < 0)
+                            throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+                        return negotiated === 0 ? 16_384 : Math.min(16_384, negotiated);
+                    }
+                };
+            }
+        });
+    }
+}

package/dist/remote-desktop/linux-managed-binaries.js

@@ -0,0 +1,46 @@
+import { access, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { execFile } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { dirname, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { managedBinariesPlatformDirectory } from '../managed-binaries.js';
+const run = promisify(execFile);
+/** Resolves only targets included in the managed binaries package, never a system VNC. */
+export async function linuxManagedDesktopBinaries(packageDirectory, platform = process.platform, architecture = process.arch) {
+    if (platform !== 'linux')
+        return undefined;
+    const target = `linux-${architecture}`;
+    if (target !== 'linux-x64')
+        return undefined;
+    try {
+        const manifestDirectory = packageDirectory ??
+            dirname(createRequire(import.meta.url).resolve('@myagentroam/binaries/package.json'));
+        const vendor = resolve(manifestDirectory, 'vendor/tigervnc');
+        const manifest = JSON.parse(await readFile(resolve(vendor, 'manifest.json'), 'utf8'));
+        if (typeof manifest !== 'object' || manifest === null || !('targets' in manifest))
+            return undefined;
+        const targets = manifest.targets;
+        if (typeof targets !== 'object' || targets === null || !(target in targets))
+            return undefined;
+        const entry = targets[target];
+        if (typeof entry !== 'object' ||
+            entry === null ||
+            !('server' in entry) ||
+            !('topology' in entry))
+            return undefined;
+        if (entry.server !== `${target}/x0vncserver` || entry.topology !== `${target}/x11-topology`)
+            return undefined;
+        const binaryVendor = packageDirectory === undefined
+            ? resolve(managedBinariesPlatformDirectory(platform, architecture), 'vendor/tigervnc')
+            : vendor;
+        const binaryPath = resolve(binaryVendor, entry.server);
+        const topologyBinary = resolve(binaryVendor, entry.topology);
+        await Promise.all([access(binaryPath, constants.X_OK), access(topologyBinary, constants.X_OK)]);
+        await run(binaryPath, ['--version'], { timeout: 5_000, maxBuffer: 8_192 });
+        return { binaryPath, topologyBinary };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/remote-desktop/macos-managed-binaries.js

@@ -0,0 +1,19 @@
+import { access } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { join } from 'node:path';
+import { managedBinariesPlatformDirectory } from '../managed-binaries.js';
+/** Discovers the packaged macVNC backend and its display topology helper. */
+export async function macosManagedDesktopBinaries(packageDirectory, platform = process.platform, architecture = process.arch) {
+    if (platform !== 'darwin' || !['arm64', 'x64'].includes(architecture))
+        return undefined;
+    try {
+        const directory = join(packageDirectory ?? managedBinariesPlatformDirectory(platform, architecture), `vendor/macvnc/${platform}-${architecture}`);
+        const binaryPath = join(directory, 'macVNC');
+        const topologyBinary = join(directory, 'macos-topology');
+        await Promise.all([binaryPath, topologyBinary].map((path) => access(path, constants.X_OK)));
+        return { binaryPath, topologyBinary };
+    }
+    catch {
+        return undefined;
+    }
+}