@reclaimprotocol/agent 0.1.24 → 0.1.26

package/src/old/tools/session-logs.ts

@@ -0,0 +1,395 @@
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { dirname, isAbsolute, join } from 'node:path'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import { findProjectRoot } from '../../paths.ts'
+import type {
+	ReclaimOldClient,
+	SessionLogRow,
+	SessionLogsQuery,
+} from '../client.ts'
+
+/** The log-stream service caps a page at 1000 entries however large a
+ *  `limit` asks for, so paging is the only way past it. */
+const MAX_PAGE = 1000
+
+/** Inline default. Small enough to stay readable in a tool result; a bigger
+ *  pull belongs in `saveTo`. */
+const DEFAULT_LIMIT = 200
+
+/** Ceiling on a `saveTo` dump, so a chatty session can't page forever. */
+const DEFAULT_MAX_ENTRIES = 20_000
+
+interface Args extends SessionLogsQuery {
+	sessionId: string
+	/** Substring match on the log line — `logLine` under its dashboard name. */
+	contains?: string
+	/** Keep only entries that carry an `event_type`. Applied here rather than
+	 *  server-side: the devtools route has no `eventTypeOnly` passthrough. */
+	eventsOnly?: boolean
+	saveTo?: string
+	maxEntries?: number
+}
+
+/** An entry's fields minus the ones hoisted into `context`. `event` and
+ *  `metadata` drop out when empty; `device` and `source` appear only on an
+ *  entry that disagrees with a single-valued context. */
+interface CompactEntry {
+	ts: string
+	level: string
+	event?: string
+	logger: string
+	line: string
+	device?: string
+	source?: string
+	metadata?: string
+}
+
+export function sessionLogsTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<Args>(
+		{
+			name: 'session_logs',
+			description:
+				'Fetch the raw log entries the in-app SDK emitted during a '
+				+ 'verification session, each with its event type (for example '
+				+ 'REQUEST_MATCHED, CLAIM_CREATION_STARTED, or PROOF_GENERATED), '
+				+ 'log level, and logger name. This is the data behind the '
+				+ 'dashboard session-logs tab, and it is far more detailed than '
+				+ 'session_analytics_logs, which returns only the coarse milestone '
+				+ 'events. Use it to diagnose a session that stalled, matched '
+				+ 'nothing, or produced no claim. Narrow the result with eventType, '
+				+ 'logLevel, or contains; page through it with limit and offset; or '
+				+ 'set saveTo to write every matching entry to an NDJSON file and '
+				+ 'read that file with your own tools. Old-devtools mode only. You '
+				+ 'must own the app the session belongs to, so call '
+				+ 'reclaim_authenticate first.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					sessionId: {
+						type: 'string',
+						description:
+							'Id of the verification session to read log entries for.',
+					},
+					eventType: {
+						type: 'string',
+						description:
+							'Keep only entries that carry this exact event type, for '
+							+ 'example REQUEST_MATCHED or PROOF_GENERATION_FAILED_'
+							+ 'EXCEPTION. Most entries carry no event type at all, so '
+							+ 'prefer eventsOnly when you want the milestone timeline '
+							+ 'rather than guessing a name.',
+					},
+					eventsOnly: {
+						type: 'boolean',
+						description:
+							'Keep only entries that carry an event type, which gives you '
+							+ 'a compact milestone timeline for the session. This tool '
+							+ 'applies the filter after fetching, so it narrows what you '
+							+ 'read rather than what it fetches.',
+					},
+					logLevel: {
+						type: 'string',
+						enum: ['fine', 'config', 'info', 'warning', 'severe', 'unknown'],
+						description:
+							'Lowest severity to include. Each value is hierarchical: '
+							+ '`fine` includes FINE, CONFIG, INFO, WARNING, and SEVERE; '
+							+ '`info` drops FINE and CONFIG; `severe` keeps only '
+							+ 'failures. Defaults to `fine`, which is wider than the '
+							+ 'backend default of `info`. The FINER and FINEST tiers '
+							+ 'contain PII, and this route rejects them.',
+					},
+					logType: {
+						type: 'string',
+						description:
+							'Exact client-side logger name, which the SDK calls `type` — '
+							+ 'for example reclaim_flutter_sdk.ClaimCreation. This is not '
+							+ 'the event type.',
+					},
+					contains: {
+						type: 'string',
+						description:
+							'Substring that an entry\'s log line must contain.',
+					},
+					providerId: {
+						type: 'string',
+						description:
+							'Keep only entries for this provider. A session can touch '
+							+ 'more than one provider, so this narrows within the '
+							+ 'session; it cannot search across sessions.',
+					},
+					deviceId: {
+						type: 'string',
+						description:
+							'Keep only entries for this device id, which is the claimant '
+							+ 'id.',
+					},
+					source: {
+						type: 'string',
+						description:
+							'Keep only entries from this client build. The source string '
+							+ 'carries the SDK, platform, and version, so it is the field '
+							+ 'to compare a working run against a broken one.',
+					},
+					startTime: {
+						type: 'string',
+						description:
+							'Lower bound, as an ISO-8601 timestamp. If you set neither '
+							+ 'bound, the backend searches only the last 3 days.',
+					},
+					endTime: {
+						type: 'string',
+						description: 'Upper bound, as an ISO-8601 timestamp.',
+					},
+					limit: {
+						type: 'number',
+						description:
+							`Log entries per page. Defaults to ${DEFAULT_LIMIT} and is `
+							+ `capped at ${MAX_PAGE}. Ignored when you set saveTo.`,
+					},
+					offset: {
+						type: 'number',
+						description:
+							'Entries to skip, counting back from the newest match. '
+							+ 'Ignored when you set saveTo.',
+					},
+					saveTo: {
+						type: 'string',
+						description:
+							'Path to write every matching entry to, as NDJSON: one raw '
+							+ 'entry per line, oldest first. When you set this, the tool '
+							+ 'returns a summary instead of the entries. Relative paths '
+							+ 'resolve against the project root. Use it when a session '
+							+ 'has more entries than you want to read inline.',
+					},
+					maxEntries: {
+						type: 'number',
+						description:
+							'Maximum entries a saveTo dump collects. Defaults to '
+							+ `${DEFAULT_MAX_ENTRIES}.`,
+					},
+				},
+				required: ['sessionId'],
+			},
+		},
+		async(args) => {
+			// The backend's own default is `info`, which silently hides every
+			// FINE and CONFIG entry — the ones that say what the interceptor
+			// actually saw. Debugging is the whole point of this tool, so widen
+			// the default here.
+			const query: SessionLogsQuery = {
+				logLevel: (args.logLevel ?? 'fine'),
+				logType: args.logType,
+				eventType: args.eventType,
+				providerId: args.providerId,
+				deviceId: args.deviceId,
+				source: args.source,
+				startTime: args.startTime,
+				endTime: args.endTime,
+				logLine: args.contains,
+			}
+
+			return args.saveTo
+				? await dump(client, args, query, args.saveTo)
+				: await page(client, args, query)
+		},
+	)
+}
+
+/** One page, returned inline. */
+async function page(
+	client: ReclaimOldClient,
+	args: Args,
+	query: SessionLogsQuery,
+) {
+	const limit = clampLimit(args.limit ?? DEFAULT_LIMIT)
+	const offset = Math.max(args.offset ?? 0, 0)
+	const res = await client.getSessionLogs(args.sessionId, {
+		...query,
+		limit,
+		offset,
+		includeCount: true,
+	})
+
+	// Newest-first off the wire; a debugger reads a session forwards.
+	const chronological = [...res.data].reverse()
+	const entries = args.eventsOnly
+		? chronological.filter(hasEvent)
+		: chronological
+	const fetched = res.data.length
+	const total = res.totalCount
+
+	return {
+		...summarize(args, res.failedRegions, entries, total),
+		page: {
+			limit,
+			offset,
+			fetched,
+			...(args.eventsOnly ? { keptWithEvent: entries.length } : {}),
+			hasMore: total === undefined
+				? fetched === limit
+				: offset + fetched < total,
+			nextOffset: offset + fetched,
+		},
+		entries: compact(entries),
+	}
+}
+
+/** Every match, paged out to an NDJSON file. */
+async function dump(
+	client: ReclaimOldClient,
+	args: Args,
+	query: SessionLogsQuery,
+	saveTo: string,
+) {
+	const maxEntries = Math.max(args.maxEntries ?? DEFAULT_MAX_ENTRIES, 1)
+	const all: SessionLogRow[] = []
+	const failedRegions = new Set<string>()
+	let total: number | undefined
+	let offset = 0
+
+	while(all.length < maxEntries) {
+		const res = await client.getSessionLogs(args.sessionId, {
+			...query,
+			limit: Math.min(MAX_PAGE, maxEntries - all.length),
+			offset,
+			// Only the first page pays for the count; it does not move.
+			includeCount: offset === 0,
+		})
+		for(const region of res.failedRegions ?? []) {
+			failedRegions.add(region)
+		}
+
+		if(offset === 0) {
+			total = res.totalCount
+		}
+
+		all.push(...res.data)
+		offset += res.data.length
+		// A short page means the match set is exhausted.
+		if(!res.data.length || res.data.length < MAX_PAGE) {
+			break
+		}
+
+		if(total !== undefined && offset >= total) {
+			break
+		}
+	}
+
+	all.reverse()
+	const entries = args.eventsOnly ? all.filter(hasEvent) : all
+
+	const path = isAbsolute(saveTo)
+		? saveTo
+		: join(findProjectRoot(process.cwd()), saveTo)
+	mkdirSync(dirname(path), { recursive: true })
+	writeFileSync(path, entries.map(e => JSON.stringify(e)).join('\n') + '\n')
+
+	return {
+		...summarize(args, [...failedRegions], entries, total),
+		file: {
+			path,
+			format: 'ndjson',
+			entries: entries.length,
+			order: 'oldest first',
+			note: 'Each line holds one raw log entry with all of its columns: '
+				+ 'timestamp, log_level, event_type, log_type, log_line, '
+				+ 'session_id, app_id, provider_id, device_id, source, and '
+				+ 'metadata.',
+			truncated: entries.length >= maxEntries
+				? `Stopped at maxEntries=${maxEntries}. Narrow the filters, or `
+					+ 'raise the limit.'
+				: undefined,
+		},
+	}
+}
+
+/** The header both modes share: what was asked for, what came back, and the
+ *  event-type histogram — usually enough on its own to see where a session
+ *  died. */
+function summarize(
+	args: Args,
+	failedRegions: string[] | undefined,
+	entries: SessionLogRow[],
+	total: number | undefined,
+) {
+	const events: Record<string, number> = {}
+	for(const entry of entries) {
+		if(entry.event_type) {
+			events[entry.event_type] = (events[entry.event_type] ?? 0) + 1
+		}
+	}
+
+	return {
+		sessionId: args.sessionId,
+		context: contextOf(entries),
+		totalMatching: total,
+		span: entries.length
+			? {
+				from: entries[0].timestamp,
+				to: entries[entries.length - 1].timestamp,
+			}
+			: undefined,
+		eventTypes: Object.keys(events).length ? events : undefined,
+		...(failedRegions?.length
+			? {
+				warning: 'The log-stream query failed in region '
+					+ `${failedRegions.join(', ')}, so this result is incomplete.`,
+			}
+			: {}),
+		...(entries.length
+			? {}
+			: {
+				hint: 'No entries matched. Check these causes in order: the '
+					+ 'search window defaults to the last 3 days, so pass startTime '
+					+ 'and endTime for an older session; the backend deletes entries '
+					+ 'after 30 days; the backend picks which regions to query from '
+					+ 'the analytics table, so a session that never recorded an '
+					+ 'analytics event reads as empty here even when entries exist; '
+					+ 'or the filters are too narrow. Cross-check with '
+					+ 'session_analytics_logs.',
+			}),
+	}
+}
+
+/** Fields that are identical on every entry, hoisted out so they are not
+ *  repeated hundreds of times. */
+function contextOf(entries: SessionLogRow[]) {
+	const uniq = (pick: (entry: SessionLogRow) => string | undefined) => {
+		const set = new Set(entries.map(pick).filter(Boolean) as string[])
+		return [...set]
+	}
+
+	const one = (values: string[]) => (values.length === 1 ? values[0] : values)
+	return entries.length
+		? {
+			appId: one(uniq(e => e.app_id)),
+			providerId: one(uniq(e => e.provider_id)),
+			deviceId: one(uniq(e => e.device_id)),
+			source: one(uniq(e => e.source)),
+		}
+		: undefined
+}
+
+function compact(entries: SessionLogRow[]): CompactEntry[] {
+	const devices = new Set(entries.map(e => e.device_id))
+	const sources = new Set(entries.map(e => e.source))
+	return entries.map(e => ({
+		ts: e.timestamp,
+		level: e.log_level,
+		...(e.event_type ? { event: e.event_type } : {}),
+		logger: e.log_type,
+		line: e.log_line,
+		// Only worth repeating per entry once the page actually mixes them.
+		...(devices.size > 1 ? { device: e.device_id } : {}),
+		...(sources.size > 1 ? { source: e.source } : {}),
+		...(e.metadata && e.metadata !== '{}' ? { metadata: e.metadata } : {}),
+	}))
+}
+
+function hasEvent(entry: SessionLogRow): boolean {
+	return !!entry.event_type
+}
+
+function clampLimit(limit: number): number {
+	return Math.min(Math.max(Math.trunc(limit), 1), MAX_PAGE)
+}

package/lib/cdp/browser-proxy.d.ts

@@ -1,78 +0,0 @@
-/** The minimal CDP surface this module needs. Both the agent's `CdpTabClient`
- *  and an app-side session-scoped wrapper around `chrome-remote-interface`'s
- *  `CDP.Client` already satisfy this. */
-export interface CdpProxySender {
-    send: (method: string, params?: object) => Promise<unknown>;
-    subscribe: <T = unknown>(method: string, listener: (params: T) => void) => () => void;
-}
-export interface BrowserProxyCredentials {
-    host: string;
-    port: number;
-    username: string;
-    password: string;
-}
-export interface TemplatedProxyUsernameOptions {
-    /** Vendor's env-configured base, e.g.
-     *  `brd-customer-<id>-zone-<zone>-country-{{COUNTRY_LOCATION}}`. */
-    template: string;
-    countryCode: string;
-    /** Sticky-session key — the same value must be used for every request
-     *  that should exit through the same proxy IP. */
-    proxySessionId: string;
-}
-/** Substitute `{{COUNTRY_LOCATION}}` in the vendor's username template (or
- *  append `-country-<cc>` if the template has no placeholder), then append
- *  the sticky-session suffix. */
-export declare function buildTemplatedProxyUsername(opts: TemplatedProxyUsernameOptions): string;
-/** A short alphanumeric sticky-session id suggestion for a proxy vendor's
- *  session placeholder (e.g. Bright Data's `-session-<id>` suffix) —
- *  deliberately not `captureId`/`sessionId` (long UUIDs, wrong shape for
- *  most vendors' conventions and for the attestor's own `proxySessionId`
- *  constraint: smallcase alphanumeric, 8-14 chars). Only a suggestion — the
- *  caller's own `proxySessionId`, when given, is used instead. */
-export declare function generateProxySessionId(): string;
-/** Parse a `PROXY_SERVER`-style `host:port` string. Throws on a malformed
- *  value — a bad env var should fail loudly, not silently proxy nowhere. */
-export declare function parseProxyServer(server: string): {
-    host: string;
-    port: number;
-};
-/**
- * Route the browser's network traffic through `host:port` via the Popcorn
- * extension's page API. Never throws — a `false` return means the extension
- * couldn't be reached (e.g. this isn't a Popcorn browser); callers still get
- * proxy auth wired up by {@link setupProxyAuthViaCdp} independently, since a
- * caller-supplied proxy might already be configured another way.
- */
-export declare function configureBrowserProxyViaExtension(sender: CdpProxySender, config: BrowserProxyCredentials): Promise<boolean>;
-/** Clear the extension-configured proxy, routing the browser direct again. */
-export declare function clearBrowserProxyViaExtension(sender: CdpProxySender): Promise<boolean>;
-/**
- * Answer the proxy's Basic-auth challenge over CDP `Fetch`, since Popcorn's
- * extension only sets host/port routing (not credentials — the proxy vendor
- * still challenges the browser for them the normal way). Self-disables once
- * the first challenge is answered (or after a timeout with none), rather
- * than intercepting every request for the session's whole lifetime.
- */
-export declare function setupProxyAuthViaCdp(sender: CdpProxySender, credentials: Pick<BrowserProxyCredentials, 'username' | 'password'>): Promise<void>;
-export interface ApplyBrowserProxyOptions extends BrowserProxyCredentials {
-    /** Defaults to true — proxy routing only affects new connections, so
-     *  existing page state must reload to actually go through it. */
-    reload?: boolean;
-}
-export interface ApplyBrowserProxyResult {
-    /** False means the extension wasn't reachable (not a Popcorn browser, or
-     *  it isn't installed) — auth handling was still armed regardless, in
-     *  case the proxy is configured another way. */
-    appliedViaExtension: boolean;
-}
-/** Configure routing + auth + reload, in the right order: routing must be
- *  live before the reload navigates, and auth must be armed before that
- *  navigation's requests go out. */
-export declare function applyBrowserProxy(sender: CdpProxySender, opts: ApplyBrowserProxyOptions): Promise<ApplyBrowserProxyResult>;
-/** Clear proxy routing and reload so subsequent requests go direct again. */
-export declare function clearBrowserProxy(sender: CdpProxySender, opts?: {
-    reload?: boolean;
-}): Promise<{
-    cleared: boolean;
-}>;

package/lib/cdp/browser-proxy.js

@@ -1,186 +0,0 @@
-/**
- * Native browser-level proxy for a Popcorn remote browser session.
- *
- * Routes the browser's OWN network traffic (not the attestor's zkTLS egress —
- * that's `geoLocation`/`useProxy` on `ProviderWebSettings`) through a
- * user-supplied proxy. Applied via the Popcorn kiosk image's `window.__pcn`
- * page API rather than a Playwright/CDP launch arg or a new browser context —
- * both of those would spawn a browser outside the pod's `--kiosk` window,
- * breaking the live-view stream this session is already being watched
- * through. Proxy auth (username/password) is answered separately over CDP's
- * `Fetch` domain, since Popcorn's extension only sets host/port routing.
- *
- * Shared between the app's verification runner and the agent's MCP tools —
- * both drive a Popcorn browser over `chrome-remote-interface`, just through
- * different wrapper types, so this module only depends on the minimal
- * {@link CdpProxySender} shape rather than either package's CDP client.
- */
-import { randomInt } from 'node:crypto';
-import { setTimeout as delay } from 'node:timers/promises';
-import { LOGGER } from "../logger.js";
-/** Substitute `{{COUNTRY_LOCATION}}` in the vendor's username template (or
- *  append `-country-<cc>` if the template has no placeholder), then append
- *  the sticky-session suffix. */
-export function buildTemplatedProxyUsername(opts) {
-    const { template, countryCode, proxySessionId } = opts;
-    const cc = countryCode.toLowerCase();
-    const base = template.includes('{{COUNTRY_LOCATION}}')
-        ? template.replaceAll('{{COUNTRY_LOCATION}}', cc)
-        : `${template}-country-${cc}`;
-    return `${base}-session-${proxySessionId}`;
-}
-const PROXY_SESSION_ID_CHARS = 'abcdefghijklmnopqrstuvwxyz0123456789';
-const PROXY_SESSION_ID_LENGTH = 10;
-/** A short alphanumeric sticky-session id suggestion for a proxy vendor's
- *  session placeholder (e.g. Bright Data's `-session-<id>` suffix) —
- *  deliberately not `captureId`/`sessionId` (long UUIDs, wrong shape for
- *  most vendors' conventions and for the attestor's own `proxySessionId`
- *  constraint: smallcase alphanumeric, 8-14 chars). Only a suggestion — the
- *  caller's own `proxySessionId`, when given, is used instead. */
-export function generateProxySessionId() {
-    let out = '';
-    for (let i = 0; i < PROXY_SESSION_ID_LENGTH; i++) {
-        out += PROXY_SESSION_ID_CHARS[randomInt(PROXY_SESSION_ID_CHARS.length)];
-    }
-    return out;
-}
-/** Parse a `PROXY_SERVER`-style `host:port` string. Throws on a malformed
- *  value — a bad env var should fail loudly, not silently proxy nowhere. */
-export function parseProxyServer(server) {
-    const match = /^([^:/]+):(\d+)$/.exec(server.trim());
-    if (!match) {
-        throw new Error(`PROXY_SERVER must be "host:port", got "${server}"`);
-    }
-    return { host: match[1], port: Number(match[2]) };
-}
-const PCN_READY_TIMEOUT_MS = 5000;
-const PCN_READY_POLL_MS = 100;
-/** Chrome caches a proxy credential per host:port after the first successful
- *  challenge, so this only needs to cover the FIRST request. If no challenge
- *  ever arrives (proxy doesn't require auth), don't leave `Fetch` enabled —
- *  it would otherwise hold every request pending on this handler forever. */
-const PROXY_AUTH_SAFETY_TIMEOUT_MS = 15000;
-async function isExtensionReady(sender) {
-    const { result } = await sender.send('Runtime.evaluate', {
-        expression: 'Boolean(window.__pcn && window.__pcn.ready)',
-        returnByValue: true,
-    });
-    return result?.value === true;
-}
-async function waitForExtensionReady(sender) {
-    const deadline = Date.now() + PCN_READY_TIMEOUT_MS;
-    while (Date.now() < deadline) {
-        if (await isExtensionReady(sender)) {
-            return true;
-        }
-        await delay(PCN_READY_POLL_MS);
-    }
-    return false;
-}
-/**
- * Route the browser's network traffic through `host:port` via the Popcorn
- * extension's page API. Never throws — a `false` return means the extension
- * couldn't be reached (e.g. this isn't a Popcorn browser); callers still get
- * proxy auth wired up by {@link setupProxyAuthViaCdp} independently, since a
- * caller-supplied proxy might already be configured another way.
- */
-export async function configureBrowserProxyViaExtension(sender, config) {
-    try {
-        if (!await isExtensionReady(sender)) {
-            // Force the content script to (re-)run so `window.__pcn` appears.
-            await sender.send('Page.navigate', { url: 'about:blank' });
-            if (!await waitForExtensionReady(sender)) {
-                LOGGER.warn('popcorn proxy extension not ready; skipping __pcn.set');
-                return false;
-            }
-        }
-        const { result } = await sender.send('Runtime.evaluate', {
-            expression: `(async () => {
-				try { await window.__pcn.set(${JSON.stringify(config)}); return true }
-				catch(e) { return false }
-			})()`,
-            awaitPromise: true,
-            returnByValue: true,
-        });
-        return result?.value === true;
-    }
-    catch (err) {
-        LOGGER.warn({ err }, 'configureBrowserProxyViaExtension failed');
-        return false;
-    }
-}
-/** Clear the extension-configured proxy, routing the browser direct again. */
-export async function clearBrowserProxyViaExtension(sender) {
-    try {
-        const { result } = await sender.send('Runtime.evaluate', {
-            expression: `(async () => {
-				try { await window.__pcn.clear(); return true }
-				catch(e) { return false }
-			})()`,
-            awaitPromise: true,
-            returnByValue: true,
-        });
-        return result?.value === true;
-    }
-    catch (err) {
-        LOGGER.warn({ err }, 'clearBrowserProxyViaExtension failed');
-        return false;
-    }
-}
-/**
- * Answer the proxy's Basic-auth challenge over CDP `Fetch`, since Popcorn's
- * extension only sets host/port routing (not credentials — the proxy vendor
- * still challenges the browser for them the normal way). Self-disables once
- * the first challenge is answered (or after a timeout with none), rather
- * than intercepting every request for the session's whole lifetime.
- */
-export async function setupProxyAuthViaCdp(sender, credentials) {
-    await sender.send('Fetch.enable', { handleAuthRequests: true });
-    let settled = false;
-    const finish = () => {
-        if (settled) {
-            return;
-        }
-        settled = true;
-        unsubAuth();
-        unsubPaused();
-        sender.send('Fetch.disable').catch(() => { });
-    };
-    const unsubAuth = sender.subscribe('Fetch.authRequired', (params) => {
-        sender.send('Fetch.continueWithAuth', {
-            requestId: params.requestId,
-            authChallengeResponse: {
-                response: 'ProvideCredentials',
-                username: credentials.username,
-                password: credentials.password,
-            },
-        }).then(finish).catch(() => { });
-    });
-    // Requests still need releasing while `Fetch` is enabled, whether or not
-    // they end up challenged. Fire-and-forget: serializing behind auth
-    // negotiation would stall unrelated requests.
-    const unsubPaused = sender.subscribe('Fetch.requestPaused', (params) => {
-        sender.send('Fetch.continueRequest', { requestId: params.requestId })
-            .catch(() => { });
-    });
-    setTimeout(finish, PROXY_AUTH_SAFETY_TIMEOUT_MS);
-}
-/** Configure routing + auth + reload, in the right order: routing must be
- *  live before the reload navigates, and auth must be armed before that
- *  navigation's requests go out. */
-export async function applyBrowserProxy(sender, opts) {
-    const appliedViaExtension = await configureBrowserProxyViaExtension(sender, opts);
-    await setupProxyAuthViaCdp(sender, opts);
-    if (opts.reload !== false) {
-        await sender.send('Page.reload', {});
-    }
-    return { appliedViaExtension };
-}
-/** Clear proxy routing and reload so subsequent requests go direct again. */
-export async function clearBrowserProxy(sender, opts = {}) {
-    const cleared = await clearBrowserProxyViaExtension(sender);
-    if (opts.reload !== false) {
-        await sender.send('Page.reload', {});
-    }
-    return { cleared };
-}

package/lib/live/page.d.ts

@@ -1,20 +0,0 @@
-/**
- * The live-view page served to whoever opens the tunnel URL.
- *
- * Deliberately dependency-free and inline: it is delivered through a throwaway
- * tunnel, so it cannot rely on a CDN, a bundler, or anything cached.
- *
- * Frames arrive as base64 JPEG over Server-Sent Events rather than a
- * WebSocket. SSE is one plain GET, so it survives tunnels and proxies that
- * mishandle upgrades, and it reconnects on its own. Input goes the other way
- * as small POSTs.
- */
-export interface PageOptions {
-    /** Path prefix that carries the access token, for example `/v/<token>`. */
-    base: string;
-    /** Whether to wire up mouse and keyboard forwarding. */
-    interactive: boolean;
-    /** Shown in the header so a viewer knows which tab they are watching. */
-    title: string;
-}
-export declare function renderViewerPage(opts: PageOptions): string;