ai-remote 0.4.0 → 0.4.2

package/{src/index.ts → dist/index.d.ts}

@@ -5,7 +5,6 @@
  * host roster is should not pull noVNC or an RDP state machine into its
  * bundle. The engines live behind `@remotectl/core/protocols`.
  */
-
 export * from './shared/connection';
 export * from './shared/device';
 export * from './shared/hosts';

package/dist/index.js

@@ -4,4 +4,3 @@ export * from "./shared/hosts.js";
 export * from "./shared/icons.js";
 export * from "./shared/protocol.js";
 export * from "./shared/signals.js";
-//# sourceMappingURL=index.js.map

package/dist/protocols/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The protocol registry the workspace talks to.
+ *
+ * The UI owns the toolbar, the dialogs, the stats rail and the on-screen
+ * keyboard, none of which care whether a session is VNC or RDP. Everything that
+ * does differ -- the endpoint, how a client is constructed, the wording of a
+ * failure, the labels in the connect dialog -- is looked up here instead of
+ * branching at each site.
+ */
+import type { ProtocolDriver } from './types';
+import type { RemoteProtocol } from '../shared/protocol';
+export type { ProtocolDriver, RemoteSession, SessionOptions, ScreenGeometry } from './types';
+export declare const DRIVERS: Record<RemoteProtocol, ProtocolDriver>;
+/** Unknown names fall back to VNC, which is what the dialog opens on. */
+export declare function driverFor(protocol: string | undefined): ProtocolDriver;
+/** What the workspace knows about a session that has just ended. */
+export interface DisconnectDiagnostic {
+    protocol: RemoteProtocol;
+    /** The transport close, when one arrived. A 1006 means it did not. */
+    close: {
+        code: number;
+        reason: string;
+    } | null;
+    /** True once the session had reached the desktop. */
+    established: boolean;
+}
+/**
+ * Explain a disconnect in terms someone can act on. The protocol gets first
+ * say, then the close codes that mean the same thing either way.
+ */
+export declare function explainDisconnect(diagnostic: DisconnectDiagnostic, clean: boolean, protocolMessage: string): string;

package/dist/protocols/index.js

@@ -32,4 +32,3 @@ export {
   driverFor,
   explainDisconnect
 };
-//# sourceMappingURL=index.js.map

package/dist/protocols/rdp/buffer.d.ts

@@ -0,0 +1,38 @@
+export declare class Writer {
+    #private;
+    private bytes;
+    private view;
+    private offset;
+    constructor(capacity?: number);
+    u8(value: number): this;
+    u16le(value: number): this;
+    u16be(value: number): this;
+    u32le(value: number): this;
+    u32be(value: number): this;
+    raw(bytes: Uint8Array): this;
+    zeros(count: number): this;
+    /** UTF-16LE, optionally padded or truncated to a fixed byte width. */
+    utf16le(text: string, fixedBytes?: number): this;
+    /** Overwrite an earlier 16-bit slot, for length fields known only later. */
+    patchU16le(position: number, value: number): this;
+    patchU16be(position: number, value: number): this;
+    get length(): number;
+    take(): Uint8Array;
+}
+export declare class Reader {
+    #private;
+    private readonly bytes;
+    private readonly view;
+    offset: number;
+    constructor(bytes: Uint8Array, offset?: number);
+    get remaining(): number;
+    u8(): number;
+    u16le(): number;
+    u16be(): number;
+    u32le(): number;
+    u32be(): number;
+    raw(count: number): Uint8Array;
+    skip(count: number): this;
+    rest(): Uint8Array;
+}
+export declare function concatBytes(...parts: readonly Uint8Array[]): Uint8Array;

package/dist/protocols/rdp/buffer.js

@@ -167,4 +167,3 @@ export {
   Writer,
   concatBytes
 };
-//# sourceMappingURL=buffer.js.map

package/dist/protocols/rdp/caps.d.ts

@@ -0,0 +1,49 @@
+export declare const CAPSET: {
+    GENERAL: number;
+    BITMAP: number;
+    ORDER: number;
+    BITMAPCACHE: number;
+    CONTROL: number;
+    ACTIVATION: number;
+    POINTER: number;
+    SHARE: number;
+    COLORCACHE: number;
+    SOUND: number;
+    INPUT: number;
+    FONT: number;
+    BRUSH: number;
+    GLYPHCACHE: number;
+    OFFSCREENCACHE: number;
+    VIRTUALCHANNEL: number;
+    RAIL: number;
+    WINDOW: number;
+    MULTIFRAGMENTUPDATE: number;
+    LARGE_POINTER: number;
+    SURFACE_COMMANDS: number;
+    BITMAP_CODECS: number;
+};
+export declare function buildClientCapabilities({ width, height, keyboardLayout, remoteApp, remoteAppCaps }: {
+    height: any;
+    keyboardLayout: any;
+    remoteApp?: boolean;
+    remoteAppCaps?: any;
+    width: any;
+}): {
+    bytes: Uint8Array<ArrayBufferLike>;
+    count: number;
+};
+/**
+ * Read the host's Demand Active capabilities. The desktop size it reports wins
+ * over anything the client asked for.
+ */
+export declare function parseServerCapabilities(bytes: Uint8Array): {
+    desktopWidth: number;
+    desktopHeight: number;
+    preferredBitsPerPixel: number;
+    refreshRectSupport: boolean;
+    railSupportLevel: number;
+    windowSupportLevel: number;
+    numIconCaches: number;
+    numIconCacheEntries: number;
+    types: any[];
+};

package/dist/protocols/rdp/caps.js

@@ -257,4 +257,3 @@ export {
   buildClientCapabilities,
   parseServerCapabilities
 };
-//# sourceMappingURL=caps.js.map

package/dist/protocols/rdp/cert.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Pull the RSA public key out of a DER X.509 certificate, for the TLS layer.
+ *
+ * CredSSP needs the exact bytes of the certificate's subjectPublicKey BIT
+ * STRING contents -- the DER RSAPublicKey -- because that is what both ends
+ * hash to bind the authentication to this TLS channel (MS-CSSP 3.1.5).
+ */
+export declare function parseX509PublicKey(der: Uint8Array): {
+    modulus: Uint8Array<ArrayBufferLike>;
+    exponent: Uint8Array<ArrayBufferLike>;
+    subjectPublicKey: any;
+};
+/** Parse a server certificate blob into an RSA public key. */
+export declare function parseServerCertificate(certificateBytes: Uint8Array): {
+    modulus: Uint8Array<ArrayBuffer>;
+    exponent: Uint8Array<ArrayBuffer>;
+    source: string;
+};

package/dist/protocols/rdp/cert.js

@@ -132,4 +132,3 @@ export {
   parseServerCertificate,
   parseX509PublicKey
 };
-//# sourceMappingURL=cert.js.map

package/dist/protocols/rdp/client.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A single RDP connection. Emits:
+ *   'ready'    { width, height }      -- the desktop size is known
+ *   'bitmap'   { rects }              -- decoded rectangles to paint
+ *   'palette'  Uint8Array             -- 8bpp palette update
+ *   'pointer'  pointer update         -- shape, position or visibility
+ *   'error'    { message }            -- fatal, always followed by 'close'
+ *   'close'    { clean, message }
+ */
+export declare class RdpClient extends EventTarget {
+    #private;
+    constructor(url: string, options?: {});
+    disconnect(): void;
+    /**
+     * The window the session exists to show: the largest top-level application
+     * window. Menus, tooltips and drag images are RAIL windows too, and fitting
+     * one of those to the browser instead of the application would be worse than
+     * doing nothing.
+     */
+    get remoteAppPrimaryWindow(): any;
+    /**
+     * Size the remote application's window to the room the browser has for it.
+     *
+     * The RDP desktop is fixed for the life of a connection -- resizing it needs
+     * the dynamic virtual channel this client does not speak -- so the desktop is
+     * negotiated large at connect time and the application window is moved and
+     * resized inside it instead. The canvas then shows only that window.
+     */
+    fitRemoteApp(width: number, height: number): boolean;
+    /**
+     * Hand the host our clipboard text. Resolves once the host has acknowledged
+     * owning it, which is what makes it safe to send a paste keystroke next.
+     */
+    setClipboardText(text: string): any;
+    get clipboardShared(): boolean;
+    /**
+     * Deliver text into the session the way a person would: put it on the host's
+     * clipboard, wait for the host to acknowledge owning it, then press the paste
+     * shortcut. Waiting is what stops the keystroke from pasting the previous
+     * contents. A host with no clipboard channel gets the text typed instead.
+     */
+    pasteToHost(text: string): any;
+    get connected(): boolean;
+    sendKeyByCode(code: number, pressed: boolean): boolean;
+    sendUnicode(text: string): void;
+    sendCtrlAltDel(): void;
+    sendMouseMove(x: number, y: number): void;
+    sendMouseButton(button: number, pressed: boolean, x: number, y: number): void;
+    sendWheel(delta: number, x: number, y: number, horizontal?: boolean): void;
+    /** Tell the host which lock keys are already on, so they do not drift. */
+    sendKeyboardSync(toggleFlags: number): void;
+    /** Ask the host to resend a region, used after the canvas is re-created. */
+    refresh(rect: any): void;
+    /** Pause or resume host output, e.g. while the tab is hidden. */
+    setOutputEnabled(enabled: boolean): void;
+}

package/dist/protocols/rdp/client.js

@@ -1067,4 +1067,3 @@ class RdpClient extends EventTarget {
 export {
   RdpClient
 };
-//# sourceMappingURL=client.js.map

package/dist/protocols/rdp/cliprdr.d.ts

@@ -0,0 +1,27 @@
+/**
+ * One clipboard channel. Emits:
+ *   'text' { text } -- the host's clipboard now holds this text
+ */
+export declare class ClipboardChannel extends EventTarget {
+    #private;
+    private readonly send;
+    private readonly log;
+    private ready;
+    private longFormatNames;
+    private localText;
+    private pendingAck;
+    /**
+     * @param {(bytes: Uint8Array) => void} send  delivers one complete channel message
+     * @param {(step: string, detail?: unknown) => void} [log]
+     */
+    constructor({ send, log }: {
+        log: any;
+        send: any;
+    });
+    /**
+     * Announce that this side now owns the clipboard and holds `text`. Resolves
+     * once the host has acknowledged, so a paste keystroke can safely follow.
+     */
+    setLocalText(text: string): Promise<unknown>;
+    receive(bytes: Uint8Array): void;
+}

package/dist/protocols/rdp/cliprdr.js

@@ -237,4 +237,3 @@ class ClipboardChannel extends EventTarget {
 export {
   ClipboardChannel
 };
-//# sourceMappingURL=cliprdr.js.map

package/dist/protocols/rdp/credssp.d.ts

@@ -0,0 +1,34 @@
+export declare class CredSspClient {
+    #private;
+    private readonly username;
+    private readonly domain;
+    private readonly password;
+    private readonly serverPublicKey;
+    private readonly send;
+    private readonly log;
+    private inbound;
+    private waiters;
+    constructor({ username, domain, password, serverPublicKey, send, log }: {
+        domain: any;
+        log: any;
+        password: any;
+        send: any;
+        serverPublicKey: any;
+        username: any;
+    });
+    /** Feed decrypted TLS application data. */
+    receive(bytes: Uint8Array): void;
+    authenticate(): Promise<{
+        authenticated: boolean;
+        reachedChallenge: boolean;
+        hostVersion: any;
+        targetName: string;
+        note: string;
+    } | {
+        reachedChallenge?: undefined;
+        note?: undefined;
+        authenticated: boolean;
+        hostVersion: any;
+        targetName: string;
+    }>;
+}

package/dist/protocols/rdp/credssp.js

@@ -251,4 +251,3 @@ class CredSspClient {
 export {
   CredSspClient
 };
-//# sourceMappingURL=credssp.js.map

package/dist/protocols/rdp/crypto.d.ts

@@ -0,0 +1,63 @@
+export declare function md5(message: Uint8Array): Uint8Array<ArrayBuffer>;
+export declare function sha1(message: Uint8Array): Uint8Array<ArrayBuffer>;
+/** RC4 keystream position. RDP re-keys every 4096 PDUs, so this is mutable. */
+export interface Rc4State {
+    s: Uint8Array;
+    i: number;
+    j: number;
+}
+/** The five values MS-RDPBCGR 5.3.5 derives from the two randoms. */
+export interface SessionKeys {
+    macKey: Uint8Array;
+    keyLength: number;
+    is40Bit: boolean;
+    initialDecryptKey: Uint8Array;
+    initialEncryptKey: Uint8Array;
+    decryptKey: Uint8Array;
+    encryptKey: Uint8Array;
+}
+export declare function rc4Init(key: Uint8Array): Rc4State;
+/** RC4 is symmetric, so this both encrypts and decrypts. State advances. */
+export declare function rc4Crypt(state: any, data: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * Textbook RSA over little-endian buffers, which is what RDP's Security
+ * Exchange PDU carries: the client random is raised to the server's public
+ * exponent with no padding scheme (MS-RDPBCGR 5.3.4.1).
+ */
+export declare function rsaEncrypt(dataLe: Uint8Array, modulusLe: Uint8Array, exponentLe: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * RSAES-PKCS1-v1_5 encryption over big-endian buffers, which is what TLS uses
+ * for an RSA key exchange. WebCrypto only offers OAEP, so the padding is built
+ * here and the modular exponentiation reuses the same BigInt path as RDP.
+ */
+export declare function rsaEncryptPkcs1(message: Uint8Array, modulusBe: Uint8Array, exponentBe: Uint8Array): Uint8Array<ArrayBuffer>;
+export declare const ENCRYPTION_METHOD: {
+    NONE: number;
+    BIT_40: number;
+    BIT_128: number;
+    BIT_56: number;
+    FIPS: number;
+};
+export declare function keyLengthForMethod(encryptionMethod: number): 8 | 16;
+/**
+ * Derive the MAC key and both directional RC4 keys from the two random values
+ * exchanged during connection.
+ */
+export declare function deriveSessionKeys(clientRandom: Uint8Array, serverRandom: Uint8Array, encryptionMethod: number): {
+    macKey: Uint8Array<ArrayBuffer>;
+    keyLength: number;
+    is40Bit: boolean;
+    initialDecryptKey: Uint8Array<ArrayBuffer>;
+    initialEncryptKey: Uint8Array<ArrayBuffer>;
+    decryptKey: Uint8Array<ArrayBuffer>;
+    encryptKey: Uint8Array<ArrayBuffer>;
+};
+/**
+ * MACSignature = First64Bits(MD5(macKey + Pad2 + SHA1(macKey + Pad1 + len + data)))
+ */
+export declare function macSignature(macKey: any, data: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * Every 4096 PDUs the RC4 key is refreshed from the initial key
+ * (MS-RDPBCGR 5.3.7.1). The refreshed key is salted with itself.
+ */
+export declare function updateSessionKey(initialKey: any, currentKey: any, keyLength: any, is40Bit: any): Uint8Array<ArrayBuffer>;

package/dist/protocols/rdp/crypto.js

@@ -366,4 +366,3 @@ export {
   sha1,
   updateSessionKey
 };
-//# sourceMappingURL=crypto.js.map

package/dist/protocols/rdp/display.d.ts

@@ -0,0 +1,38 @@
+export declare class RdpDisplay {
+    #private;
+    constructor(container: any);
+    resize(width: number, height: number): void;
+    /**
+     * Choose the part of the desktop that is on screen. Everything else about
+     * the session -- painting, input coordinates, the remote pointer -- keeps
+     * working in desktop coordinates, so only the framing changes here.
+     */
+    setViewport({ x, y, width, height }?: {
+        x?: number;
+        y?: number;
+    }): void;
+    applyScale(): void;
+    /**
+     * Zoom about a point, keeping whatever is under it in place. `focal` is in
+     * client coordinates -- the midpoint between two fingers, usually.
+     */
+    setZoom(next: any, focal?: any): void;
+    /** Move the visible window over the desktop. Returns what it actually used. */
+    panBy(dx: any, dy: any): {
+        x: number;
+        y: number;
+    };
+    /** True when the desktop is larger than the window on either axis. */
+    canPan(): boolean;
+    setScaleViewport(enabled: boolean): void;
+    /** Back to the opening view: whole desktop fitted on screen. */
+    resetZoom(): void;
+    drawRects(rects: any, palette: any): void;
+    applyPointer(pointer: any): void;
+    attachInput(client: any): void;
+    /** A key held while focus moves away would otherwise stay down on the host. */
+    releaseAllKeys(): void;
+    focus(): void;
+    blur(): void;
+    destroy(): void;
+}

package/dist/protocols/rdp/display.js

@@ -586,4 +586,3 @@ class RdpDisplay {
 export {
   RdpDisplay
 };
-//# sourceMappingURL=display.js.map

package/dist/protocols/rdp/gcc.d.ts

@@ -0,0 +1,23 @@
+/** RDP 5.0 and later. Anything newer would oblige us to speak newer PDUs. */
+export declare const RDP_VERSION_5_PLUS = 524292;
+export declare const ENCRYPTION_LEVEL: {
+    NONE: number;
+    LOW: number;
+    CLIENT_COMPATIBLE: number;
+    HIGH: number;
+    FIPS: number;
+};
+export declare function clientData(options: any): Uint8Array<ArrayBufferLike>;
+/**
+ * Walk the host's answer. Only the security and network blocks carry anything
+ * the client must act on; the core block is kept for logging.
+ */
+export declare function parseServerData(blocks: any): {
+    version: any;
+    encryptionMethod: number;
+    encryptionLevel: number;
+    serverRandom: any;
+    publicKey: any;
+    ioChannelId: number;
+    channelIds: any[];
+};

package/dist/protocols/rdp/gcc.js

@@ -129,4 +129,3 @@ export {
   clientData,
   parseServerData
 };
-//# sourceMappingURL=gcc.js.map

package/dist/protocols/rdp/keymap.d.ts

@@ -0,0 +1,9 @@
+/** Returns { scancode, extended } or null when the key has no RDP equivalent. */
+export declare function lookupScancode(code: string): {
+    scancode: any;
+    extended: boolean;
+};
+export declare const CTRL_ALT_DEL: {
+    code: string;
+    pressed: boolean;
+}[];

package/dist/protocols/rdp/keymap.js

@@ -129,4 +129,3 @@ export {
   CTRL_ALT_DEL,
   lookupScancode
 };
-//# sourceMappingURL=keymap.js.map

package/dist/protocols/rdp/mcs.d.ts

@@ -0,0 +1,40 @@
+export declare const MCS_BASE_CHANNEL_ID = 1001;
+export declare const MCS_GLOBAL_CHANNEL_ID = 1003;
+export declare function connectInitial(clientData: Uint8Array): Uint8Array<ArrayBufferLike>;
+export declare function parseConnectResponse(frame: Uint8Array): Uint8Array<ArrayBufferLike>;
+export declare function erectDomainRequest(): Uint8Array<ArrayBufferLike>;
+export declare function attachUserRequest(): Uint8Array<ArrayBufferLike>;
+export declare function parseAttachUserConfirm(frame: Uint8Array): {
+    userId: number;
+};
+export declare function channelJoinRequest(userId: number, channelId: number): Uint8Array<ArrayBufferLike>;
+export declare function parseChannelJoinConfirm(frame: Uint8Array): {
+    channelId: number;
+};
+export declare function sendDataRequest(userId: number, channelId: number, payload: Uint8Array): Uint8Array<ArrayBufferLike>;
+/**
+ * Classify an inbound X.224 data frame. Everything the server sends after the
+ * connect sequence arrives as a send-data indication on some channel.
+ */
+export declare function parseDomainPdu(frame: Uint8Array): {
+    type: string;
+    channelId: number;
+    payload: Uint8Array<ArrayBufferLike>;
+    reason?: undefined;
+    message?: undefined;
+    mcsPduType?: undefined;
+} | {
+    channelId?: undefined;
+    payload?: undefined;
+    type: string;
+    reason: number;
+    message: any;
+    mcsPduType?: undefined;
+} | {
+    channelId?: undefined;
+    payload?: undefined;
+    reason?: undefined;
+    message?: undefined;
+    type: string;
+    mcsPduType: number;
+};

package/dist/protocols/rdp/mcs.js

@@ -220,4 +220,3 @@ export {
   parseDomainPdu,
   sendDataRequest
 };
-//# sourceMappingURL=mcs.js.map

package/dist/protocols/rdp/ntlm.d.ts

@@ -0,0 +1,61 @@
+export declare function md4(message: string): Uint8Array<ArrayBuffer>;
+/** HMAC-MD5. WebCrypto has no MD5, so it is built from the MD5 here. */
+export declare function hmacMd5(key: Uint8Array, message: string): Uint8Array<ArrayBuffer>;
+export declare const NTLM_FLAG: {
+    UNICODE: number;
+    REQUEST_TARGET: number;
+    SIGN: number;
+    SEAL: number;
+    NTLM: number;
+    ALWAYS_SIGN: number;
+    EXTENDED_SESSION_SECURITY: number;
+    TARGET_INFO: number;
+    VERSION: number;
+    KEY_128: number;
+    KEY_EXCH: number;
+    KEY_56: number;
+};
+export declare function negotiateMessage(): Uint8Array<ArrayBufferLike>;
+export declare function parseChallengeMessage(bytes: Uint8Array): {
+    flags: number;
+    serverChallenge: Uint8Array<ArrayBuffer>;
+    targetName: Uint8Array<ArrayBuffer>;
+    targetInfo: Uint8Array<ArrayBuffer>;
+};
+/**
+ * Build the AUTHENTICATE message plus every key CredSSP needs afterwards.
+ *
+ * The MIC is always sent: a current Windows host expects one, and sending it
+ * obliges the client to flag it in the AV pair list, which in turn feeds the
+ * NTProofStr -- so the modified list has to be the one that goes on the wire.
+ */
+export declare function authenticateMessage({ username, domain, password, challenge, negotiateBytes, challengeBytes }: {
+    challenge: any;
+    challengeBytes: any;
+    domain: any;
+    negotiateBytes: any;
+    password: any;
+    username: any;
+}): {
+    message: Uint8Array<ArrayBufferLike>;
+    exportedSessionKey: Uint8Array<ArrayBuffer>;
+    keys: {
+        clientSigningKey: Uint8Array<ArrayBuffer>;
+        serverSigningKey: Uint8Array<ArrayBuffer>;
+        clientSealing: import("./crypto").Rc4State;
+        serverSealing: import("./crypto").Rc4State;
+    };
+};
+/**
+ * NTLM message confidentiality (MS-NLMP 3.4.3). The signature covers the
+ * plaintext, and both the payload and the checksum draw from the same RC4
+ * stream -- payload first.
+ */
+export declare class NtlmSealer {
+    private readonly keys;
+    private sendSequence;
+    private receiveSequence;
+    constructor(keys: any);
+    seal(plaintext: Uint8Array): Uint8Array<ArrayBufferLike>;
+    unseal(bytes: Uint8Array): Uint8Array<ArrayBuffer>;
+}

package/dist/protocols/rdp/ntlm.js

@@ -302,4 +302,3 @@ export {
   negotiateMessage,
   parseChallengeMessage
 };
-//# sourceMappingURL=ntlm.js.map