@vincentt-xr/harness 1.0.0 → 1.2.0

package/dist/client/share.js

@@ -0,0 +1,318 @@
+// The in-app Share control — the creator's desktop-to-phone handoff, rendered
+// inside the running preview. An icon-only QR-glyph chip in the shared top-right
+// cluster; clicking it drops a popover with an inline SVG QR of the preview origin,
+// a heading + instruction, and the URL as selectable text (no Copy button).
+//
+// It re-presents ONLY `window.location.origin + "/"` — the capability URL the
+// link-holder already has (B17). It makes NO network call and sends nothing to the
+// relay (B19): pure client-side rendering of a string already in the page.
+//
+// DOM-only, no React. Loaded through the dynamic import in HarnessProvider, so the
+// whole module — and `qrcode`, reached only from here — tree-shakes out of prod.
+import QRCode from "qrcode";
+import { getClusterContainer, releaseClusterContainer } from "./cluster.js";
+/**
+ * The compiled-in preview-apex allowlist. Previews sit on their own registrable
+ * domain, `vincentt.dev` (f3's `D-Preview-is-its-own-registrable-domain`); staging
+ * and dev are subdomains of it (`*.staging.vincentt.dev`, `*.local.vincentt.dev`),
+ * so a single `.vincentt.dev` suffix matches every environment. The leading dot is a
+ * real subdomain-label boundary, so `<label>.vincentt.dev` matches but a bare
+ * `vincentt.dev` or a look-alike (`evilvincentt.dev`) does not. This is a public DNS
+ * name, not a secret — the same host the viewer's address bar already shows.
+ */
+export const PREVIEW_APEXES = [".vincentt.dev"];
+/**
+ * The canonical preview URL to encode — `origin + "/"`, stable across in-app SPA
+ * navigation. Reads ONLY the origin, so a deep path, query-param secret, or hash is
+ * never encoded into the QR or the text field.
+ */
+export function deriveShareUrl(location) {
+    return location.origin + "/";
+}
+/**
+ * Is the viewer a phone? True iff BOTH `(pointer: coarse)` and `(max-width: 820px)`
+ * match — a coarse-pointer narrow viewer is the device you would hand off to, so the
+ * button is pointless there. A missing or THROWING `matchMedia`, or a viewer we cannot
+ * classify, folds to `false` ⇒ the button shows (the "unknown shows" rule: a missing
+ * handoff on a desktop is worse than a stray, send-nothing button on an odd device).
+ * `matchMedia` is injected so the predicate is pure and testable without a DOM.
+ */
+export function isPhone(matchMedia) {
+    if (typeof matchMedia !== "function")
+        return false;
+    try {
+        return (matchMedia("(pointer: coarse)").matches && matchMedia("(max-width: 820px)").matches);
+    }
+    catch {
+        // A throwing matchMedia is "unknown", never an error to propagate ⇒ show.
+        return false;
+    }
+}
+/**
+ * Is this a real, phone-reachable preview origin? `https:` AND the hostname ends with
+ * a `PREVIEW_APEXES` suffix (`.vincentt.dev`). On the creator's plain local loop
+ * (`http://localhost`) or a self-signed LAN origin (`https://192.168.1.20`, `foo.local`)
+ * there is no phone-reachable preview link to encode, so the button does not appear.
+ */
+export function isPreviewOrigin(loc) {
+    return (loc.protocol === "https:" &&
+        PREVIEW_APEXES.some((apex) => loc.hostname.endsWith(apex)));
+}
+/**
+ * Render the preview URL as an inline SVG QR. Same params as the CLI's `qrPage.ts`
+ * (`margin:2`, ECC `M`) so the on-screen QR is identical to the proven-scannable
+ * terminal one.
+ */
+export function renderQr(url) {
+    return QRCode.toString(url, {
+        type: "svg",
+        margin: 2,
+        errorCorrectionLevel: "M",
+    });
+}
+const HEADING = "Open on your phone";
+const INSTRUCTION = "Point your phone's camera at the code, or type in the link below.";
+// A single QR-code glyph (three finder squares + a scattering of modules), ~18px,
+// `currentColor` so it inherits the chip's `#f5f2ef`. Chosen over a share arrow
+// because a QR square most directly says "get this onto a phone".
+const QR_GLYPH_SVG = `<svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" focusable="false"><path d="M3 3h8v8H3V3Zm2 2v4h4V5H5Zm-2 8h8v8H3v-8Zm2 2v4h4v-4H5ZM13 3h8v8h-8V3Zm2 2v4h4V5h-4Zm-2 8h2v2h-2v-2Zm2 2h2v2h-2v-2Zm2-2h2v2h-2v-2Zm0 4h2v2h-2v-2Zm2-2h2v2h-2v-2Zm0 4h2v2h-2v-2Zm-4 0h2v2h-2v-2Z"/></svg>`;
+/**
+ * Mount the icon-only Share chip into the shared cluster and wire its popover.
+ *
+ * The show-gate is evaluated ONCE, here at mount: render iff the viewer is not a
+ * phone AND the origin is a real preview origin. If the gate fails, nothing is
+ * appended to the DOM (no disabled state) and the returned unmount is a no-op.
+ *
+ * Returns an unmount function that removes the chip + popover, tears down listeners,
+ * and releases the shared cluster.
+ */
+export function mountShareButton(opts = {}) {
+    if (typeof document === "undefined")
+        return () => undefined;
+    const matchMedia = opts.matchMedia ?? (typeof window !== "undefined" ? window.matchMedia : undefined);
+    const location = opts.location ?? (typeof window !== "undefined" ? window.location : undefined);
+    if (!location)
+        return () => undefined;
+    const show = !isPhone(matchMedia) && isPreviewOrigin(location);
+    if (!show)
+        return () => undefined;
+    const url = deriveShareUrl(location);
+    const container = getClusterContainer();
+    let released = false;
+    const btn = document.createElement("button");
+    btn.type = "button";
+    btn.setAttribute("aria-label", "Share preview");
+    btn.title = "Share preview";
+    btn.setAttribute("aria-haspopup", "dialog");
+    btn.setAttribute("aria-controls", "vt-popover");
+    btn.setAttribute("aria-expanded", "false");
+    btn.innerHTML = QR_GLYPH_SVG;
+    Object.assign(btn.style, {
+        width: "36px",
+        height: "36px",
+        padding: "0",
+        display: "inline-flex",
+        alignItems: "center",
+        justifyContent: "center",
+        borderRadius: "10px",
+        border: "1px solid rgba(255,255,255,.14)",
+        background: "rgba(28,27,26,.92)",
+        color: "#f5f2ef",
+        boxShadow: "0 1px 4px rgba(0,0,0,.5)",
+        cursor: "pointer",
+        transition: "background 100ms, border-color 100ms",
+    });
+    const IDLE_BG = "rgba(28,27,26,.92)";
+    const IDLE_BORDER = "rgba(255,255,255,.14)";
+    const HOVER_BG = "rgba(40,38,36,.95)";
+    const HOVER_BORDER = "rgba(255,255,255,.24)";
+    const ACTIVE_BG = "rgba(40,38,36,.95)";
+    const ACTIVE_BORDER = "rgba(147,184,240,.5)";
+    const applyIdle = () => {
+        btn.style.background = IDLE_BG;
+        btn.style.borderColor = IDLE_BORDER;
+    };
+    const applyActive = () => {
+        btn.style.background = ACTIVE_BG;
+        btn.style.borderColor = ACTIVE_BORDER;
+    };
+    btn.addEventListener("mouseenter", () => {
+        if (popover)
+            return; // active state wins over hover
+        btn.style.background = HOVER_BG;
+        btn.style.borderColor = HOVER_BORDER;
+    });
+    btn.addEventListener("mouseleave", () => {
+        if (popover)
+            return;
+        applyIdle();
+    });
+    // Focus ring: a brand-blue outline that reads on any background. Set inline on
+    // focus/blur since there is no stylesheet on this surface for :focus-visible.
+    btn.addEventListener("focus", () => {
+        btn.style.outline = "2px solid #93b8f0";
+        btn.style.outlineOffset = "2px";
+    });
+    btn.addEventListener("blur", () => {
+        btn.style.outline = "none";
+    });
+    let popover = null;
+    let outsideHandler = null;
+    let keyHandler = null;
+    const prefersReducedMotion = typeof matchMedia === "function"
+        ? (() => {
+            try {
+                return matchMedia("(prefers-reduced-motion: reduce)").matches;
+            }
+            catch {
+                return false;
+            }
+        })()
+        : false;
+    const closePopover = (returnFocus) => {
+        if (!popover)
+            return;
+        popover.remove();
+        popover = null;
+        if (outsideHandler) {
+            document.removeEventListener("mousedown", outsideHandler, true);
+            outsideHandler = null;
+        }
+        if (keyHandler) {
+            document.removeEventListener("keydown", keyHandler);
+            keyHandler = null;
+        }
+        btn.setAttribute("aria-expanded", "false");
+        applyIdle();
+        if (returnFocus)
+            btn.focus();
+    };
+    const buildPopover = () => {
+        const pop = document.createElement("div");
+        pop.id = "vt-popover";
+        pop.setAttribute("role", "dialog");
+        pop.setAttribute("aria-label", "Open this preview on your phone");
+        Object.assign(pop.style, {
+            position: "fixed",
+            top: "56px",
+            right: "12px",
+            zIndex: "2147483647",
+            width: "260px",
+            padding: "16px",
+            borderRadius: "12px",
+            border: "1px solid rgba(255,255,255,.14)",
+            background: "rgba(23,22,21,.86)",
+            backdropFilter: "blur(16px) saturate(1.1)",
+            // @ts-expect-error vendor-prefixed for Safari; not in the typed CSSStyleDeclaration
+            WebkitBackdropFilter: "blur(16px) saturate(1.1)",
+            boxShadow: "0 12px 32px rgba(0,0,0,.45)",
+            boxSizing: "border-box",
+            transformOrigin: "top right",
+        });
+        const qrTile = document.createElement("div");
+        qrTile.className = "vt-qr";
+        Object.assign(qrTile.style, {
+            width: "100%",
+            aspectRatio: "1 / 1",
+            background: "#fff",
+            padding: "8px",
+            borderRadius: "8px",
+            border: "1px solid rgba(0,0,0,.06)",
+            boxSizing: "border-box",
+        });
+        // Async QR render; the tile holds its space via aspect-ratio until it lands.
+        void renderQr(url).then((svg) => {
+            // Guard against a close-before-resolve race.
+            if (qrTile.isConnected)
+                qrTile.innerHTML = svg;
+        });
+        const heading = document.createElement("div");
+        heading.className = "vt-heading";
+        heading.textContent = HEADING;
+        Object.assign(heading.style, {
+            font: "600 14px/1.35 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif",
+            color: "#f5f2ef",
+            margin: "12px 0 2px",
+        });
+        const instr = document.createElement("div");
+        instr.className = "vt-instr";
+        instr.textContent = INSTRUCTION;
+        Object.assign(instr.style, {
+            font: "400 13px/1.45 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif",
+            color: "#b8b2a9",
+            margin: "0 0 10px",
+        });
+        const urlField = document.createElement("div");
+        urlField.className = "vt-url";
+        urlField.textContent = url;
+        Object.assign(urlField.style, {
+            font: "500 12px/1.5 ui-monospace,monospace",
+            color: "#93b8f0",
+            background: "rgba(255,255,255,.06)",
+            border: "1px solid rgba(255,255,255,.10)",
+            borderRadius: "8px",
+            padding: "8px 10px",
+            wordBreak: "break-all",
+            cursor: "text",
+            userSelect: "all",
+            // @ts-expect-error vendor-prefixed for Safari
+            WebkitUserSelect: "all",
+            boxSizing: "border-box",
+        });
+        pop.append(qrTile, heading, instr, urlField);
+        if (!prefersReducedMotion) {
+            pop.style.opacity = "0";
+            pop.style.transform = "translateY(-4px) scale(.98)";
+            pop.style.transition =
+                "opacity 160ms cubic-bezier(0.16,1,0.3,1), transform 160ms cubic-bezier(0.16,1,0.3,1)";
+            // Next frame: animate to the resting state.
+            requestAnimationFrame(() => {
+                pop.style.opacity = "1";
+                pop.style.transform = "translateY(0) scale(1)";
+            });
+        }
+        return pop;
+    };
+    const openPopover = () => {
+        if (popover)
+            return;
+        popover = buildPopover();
+        container.appendChild(popover);
+        btn.setAttribute("aria-expanded", "true");
+        applyActive();
+        // Click-outside: a capture-phase mousedown outside both popover and button
+        // closes it. Registered only while open, removed on close.
+        outsideHandler = (e) => {
+            const target = e.target;
+            if (!target)
+                return;
+            if (popover && (popover.contains(target) || btn.contains(target)))
+                return;
+            closePopover(false);
+        };
+        document.addEventListener("mousedown", outsideHandler, true);
+        // Escape closes and returns focus to the Share button.
+        keyHandler = (e) => {
+            if (e.key === "Escape") {
+                e.stopPropagation();
+                closePopover(true);
+            }
+        };
+        document.addEventListener("keydown", keyHandler);
+    };
+    btn.addEventListener("click", () => {
+        if (popover)
+            closePopover(false);
+        else
+            openPopover();
+    });
+    container.appendChild(btn);
+    return () => {
+        closePopover(false);
+        btn.remove();
+        if (!released) {
+            released = true;
+            releaseClusterContainer();
+        }
+    };
+}

package/dist/shared/events.d.ts

@@ -1,5 +1,30 @@
 /** Monotonic-ish wall-clock ms since epoch, stamped by the client at capture. */
 export type Timestamp = number;
+/**
+ * The grammar of the client's session id — the key the relay groups a TESTER by.
+ *
+ * It lives here, in the file all three parts import, for the same reason
+ * VIEWER_LABEL_RE lives beside the codec that produces the label: the party that
+ * mints the value and the party that validates it must not be able to disagree
+ * about its shape. The client writes this shape; the relay accepts this shape and
+ * nothing else, with no sanitize-and-keep branch.
+ *
+ * `s2_` is generation two. Generation one was `s_<base36 time>_<base36 rand>` over
+ * ~10^6 of Math.random, which grouped a RUN. Grouping a TESTER makes a collision a
+ * silent merge of two people's streams, so the space is now 128 bits and the
+ * prefix is what lets a relay tell the two generations apart on sight.
+ */
+export declare const CLIENT_SESSION_ID_RE: RegExp;
+/**
+ * A relay-assigned tester id: `t1`, `t2`, … Minted on the CREATOR'S machine and
+ * never on the wire from the device — it is a local relabeling of a key the
+ * device supplied, which is what keeps the platform free of a correlator (B22).
+ *
+ * No leading zero. Ids are counted from 1 and never zero-padded, so `t01` is a
+ * string the registry cannot have produced; accepting it at the filter boundary
+ * would admit a second spelling for a value with one canonical form.
+ */
+export declare const TESTER_ID_RE: RegExp;
 /** Kinds of thing the diagnostics limb observes. */
 export type DiagEventKind = "log" | "network" | "trace";
 interface DiagEventBase {
@@ -60,20 +85,92 @@ export interface ClientToRelay {
     sessionId: string;
     events: DiagEvent[];
 }
+/**
+ * The FIRST message on the diagnostics WS, sent at WS-open before HarnessProvider
+ * mounts and independent of the EventBuffer having pending events. It carries the
+ * same `sessionStorage` key the events batch carries, so the relay can resolve the
+ * TESTER on connect rather than waiting for a batch — which is why a SILENT app
+ * (no console/network/trace events) and an app that crashes during mount are both
+ * attributed instead of reading as an absence.
+ *
+ * It is a relay-layer message in the `{type:"events"}` family, NOT a tunnel
+ * control frame: the edge splices the tunnel as opaque bytes and never reads it.
+ * The `sessionId` is grammar-guarded by the relay against CLIENT_SESSION_ID_RE
+ * with no sanitize-and-keep branch, exactly as the batch key is — a malformed key
+ * is ingested un-keyed, never a crash.
+ */
+export interface ClientHello {
+    type: "hello";
+    /** The client's `sessionStorage` key — same value the events batch carries. */
+    sessionId: string;
+}
+/** Every message the client sends up the diagnostics WS. Discriminated on `type`. */
+export type ClientMessage = ClientToRelay | ClientHello;
 /** What the MCP server asks the relay for. `since` is an exclusive seq cursor. */
 export interface RelayQuery {
-    sessionId?: string;
     kind?: DiagEventKind;
     since?: number;
     /** Cap the returned count (newest-biased); relay clamps to its buffer size. */
     limit?: number;
+    /**
+     * Filter to one TESTER — one browser tab, recognised across refreshes. This is
+     * the filter that answers "it breaks on their phone but not mine", because it
+     * survives the reload the tester does first.
+     *
+     * A malformed id filters to NOTHING rather than being ignored: silently
+     * widening a filter shows the creator several testers' events under a heading
+     * naming one.
+     */
+    tester?: string;
+    /**
+     * Filter to one viewer — one CONNECTION (2.8), not an identity (B22). The
+     * sub-coordinate below the tester: a single tab opens several of these under
+     * HTTP/1.1, so this narrows to one of them and is for connection-level
+     * debugging rather than for "whose phone".
+     */
+    viewer?: string;
 }
 export interface RelayResult {
     events: DiagEvent[];
+    /**
+     * `eventViewers[i]` is the label that produced `events[i]`, or undefined when
+     * the relay could not attribute it.
+     *
+     * It rides ALONGSIDE the events rather than on them because a viewer label is
+     * a fact about the CONNECTION that carried an observation, not a property of
+     * the observation — putting it on the event would make it look like something
+     * the device reported about itself, which is the identity promotion B22
+     * forbids.
+     */
+    eventViewers?: (string | undefined)[];
+    /**
+     * `eventTesters[i]` is the tester that produced `events[i]`, or undefined when
+     * the relay could not attribute it (the pre-mount window, a crashed app, a
+     * non-app request, or a session past the cap).
+     *
+     * Rides alongside for the same reason as `eventViewers`: which tester an
+     * observation came from is a fact about the CONNECTION that carried it, not a
+     * property of the observation.
+     */
+    eventTesters?: (string | undefined)[];
     /** Highest seq the relay currently holds, so the caller can advance `since`. */
     latestSeq: number;
-    /** Sessions the relay has seen events for (so the agent can disambiguate). */
-    sessions: string[];
+    /**
+     * Tester ids the relay has assigned, in arrival order. Every member matches
+     * TESTER_ID_RE.
+     *
+     * This REPLACED a `sessions` array that carried the raw client-supplied key to
+     * the terminal and to MCP tool output. That was a viewer-controlled string
+     * with no validation reaching the creator's coding agent — do not reintroduce
+     * it. The raw key is an opaque map key inside the relay and nothing else.
+     */
+    testers: string[];
+    /**
+     * Viewer labels the relay has seen. Labels churn — a reconnecting device gets
+     * a NEW label and the old one is never reused — so the caller needs the live
+     * set rather than remembering one.
+     */
+    viewers: string[];
 }
 /** A freehand stroke over the frame, in normalized [0,1] frame coordinates. */
 export interface AnnotationStroke {
@@ -105,7 +202,12 @@ export interface AnnotationInput {
     /** Annotated frame as a data URL (image/png). */
     screenshot: string;
     spec?: AnnotationSpec;
-    /** Optional preview session id, to correlate with diag events. */
+    /**
+     * The client's session key, so the annotation can be correlated with the diag
+     * events from the same tab. Client-supplied and therefore hostile input: the
+     * relay REPLACES it with the tester id it resolves to, or drops it. It is
+     * never persisted or forwarded verbatim — this record reaches an agent.
+     */
     sessionId?: string;
 }
 /** A persisted annotation the agent consumes (via `vincentt feedback --wait`). */
@@ -123,6 +225,10 @@ export interface Annotation {
     /** Absolute path to the full-res annotated screenshot on disk. */
     screenshotPath: string;
     spec: AnnotationSpec;
+    /**
+     * The TESTER this annotation came from, or absent when the relay could not
+     * attribute it. Never the raw client key — see AnnotationInput.sessionId.
+     */
     sessionId?: string;
 }
 export {};

package/dist/shared/events.js

@@ -3,4 +3,28 @@
 // server (which serves them to the agent). All three import THIS file, so the
 // three can never drift on the shape of an event. Nothing here imports React,
 // node, or MCP — it is pure data.
-export {};
+/**
+ * The grammar of the client's session id — the key the relay groups a TESTER by.
+ *
+ * It lives here, in the file all three parts import, for the same reason
+ * VIEWER_LABEL_RE lives beside the codec that produces the label: the party that
+ * mints the value and the party that validates it must not be able to disagree
+ * about its shape. The client writes this shape; the relay accepts this shape and
+ * nothing else, with no sanitize-and-keep branch.
+ *
+ * `s2_` is generation two. Generation one was `s_<base36 time>_<base36 rand>` over
+ * ~10^6 of Math.random, which grouped a RUN. Grouping a TESTER makes a collision a
+ * silent merge of two people's streams, so the space is now 128 bits and the
+ * prefix is what lets a relay tell the two generations apart on sight.
+ */
+export const CLIENT_SESSION_ID_RE = /^s2_[0-9a-f]{32}$/;
+/**
+ * A relay-assigned tester id: `t1`, `t2`, … Minted on the CREATOR'S machine and
+ * never on the wire from the device — it is a local relabeling of a key the
+ * device supplied, which is what keeps the platform free of a correlator (B22).
+ *
+ * No leading zero. Ids are counted from 1 and never zero-padded, so `t01` is a
+ * string the registry cannot have produced; accepting it at the filter boundary
+ * would admit a second spelling for a value with one canonical form.
+ */
+export const TESTER_ID_RE = /^t[1-9][0-9]{0,2}$/;

package/dist/tunnel/cbor.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The CBOR SUBSET, Node half. It mirrors `api/internal/edge/cbor.go` decision
+ * for decision, because two implementations of one wire format that were
+ * written independently are two implementations that drift.
+ *
+ * It decodes CONTROL payloads only — OPEN and HEAD. It NEVER touches a DATA
+ * payload.
+ *
+ * It is hand-written rather than a library for the same reason the Go one is: a
+ * general CBOR library's allocation behavior on hostile input would be someone
+ * else's decision, and the limits below are the whole point.
+ *
+ * Everything indefinite-length, every tag, every float, every byte string and
+ * every negative integer is REFUSED — not because they are dangerous in
+ * themselves, but because the encoder we own never emits them, so accepting
+ * them would only widen the input this parser has to be correct about.
+ */
+/**
+ * VIEWER_LABEL_RE is the SAME regex the edge assigns against, and this client
+ * RE-VALIDATES rather than trusting the edge. That is closure (c) of the three
+ * that keep viewer-supplied bytes out of the creator's agent's context: the
+ * label flows viewerLabel -> the relay ring-buffer key -> CLI terminal output
+ * and MCP tool output, which is a terminal/log-injection path INTO the agent,
+ * and a Go-only check would pass on a client that trusted the edge.
+ */
+export declare const VIEWER_LABEL_RE: RegExp;
+export declare function parseViewerLabel(s: string): string | null;
+/**
+ * UA_CLASSES is the CLOSED ENUM OF SIX, mirroring the Go edge. `unknown` is the
+ * TOTAL fallback. This client validates the class it receives against this set
+ * before stamping the relay handshake, so an unmatched or forged class becomes
+ * `unknown` rather than an echo.
+ */
+export declare const UA_CLASSES: readonly ["ios_safari", "android_chrome", "desktop_chrome", "desktop_safari", "desktop_firefox", "unknown"];
+export type UAClass = (typeof UA_CLASSES)[number];
+export declare function parseUAClass(s: string): UAClass;
+export interface OpenPayload {
+    viewerLabel: string;
+    method: string;
+    path: string;
+    headers: [string, string][];
+    upgrade?: string;
+}
+export interface HeadPayload {
+    status: number;
+    headers: [string, string][];
+}
+/**
+ * `viewer_gone` is the ONE non-terminal kind: the other three mean the session
+ * is ending, this one means a viewer's connection closed while the session
+ * continues. It is also the only kind carrying a second key.
+ */
+export type ControlKind = "revoke" | "expiring" | "superseded" | "viewer_gone";
+/** A decoded CONTROL payload. `viewerLabel` is present only on `viewer_gone`. */
+export interface ControlPayload {
+    kind: ControlKind;
+    viewerLabel?: string;
+}
+export declare function decodeOpen(b: Uint8Array): OpenPayload;
+export declare function decodeHead(b: Uint8Array): HeadPayload;
+/**
+ * The map arity is asserted AGAINST THE KIND, so a payload claiming `revoke`
+ * with a trailing label is refused as malformed rather than quietly accepted
+ * with the extra key ignored.
+ */
+export declare function decodeControl(b: Uint8Array): ControlPayload;
+/** Canonical key order: viewerLabel, method, path, headers, [upgrade]. */
+export declare function encodeOpen(p: OpenPayload): Uint8Array;
+/** Canonical key order: status, headers. */
+export declare function encodeHead(p: HeadPayload): Uint8Array;
+export declare function encodeControl(kind: ControlKind, viewerLabel?: string): Uint8Array;