ai-remote 0.4.8 → 0.4.9

package/dist/protocols/ssh/transport.d.ts

@@ -1,62 +0,0 @@
-export declare const CLIENT_VERSION = "SSH-2.0-CloudflareGateway_1.0";
-/** Pick the first client preference the host also offered (RFC 4253 7.1). */
-export declare function negotiate(clientNames: any, serverNames: any): any;
-export declare class SshTransport extends EventTarget {
-    #private;
-    url: string;
-    verifyHost: (info: any) => Promise<boolean> | boolean;
-    log: (...args: any[]) => void;
-    socket: WebSocket | null;
-    openTransport: ((url: string) => any) | null;
-    closed: boolean;
-    buffer: Uint8Array;
-    serverVersion: string;
-    greeting: string[];
-    sendSequence: number;
-    receiveSequence: number;
-    outgoing: any;
-    incoming: any;
-    sessionId: Uint8Array | null;
-    kex: any;
-    kexQueue: Uint8Array[];
-    keepaliveTimer: any;
-    bytesSent: number;
-    bytesReceived: number;
-    encryptChain?: Promise<void>;
-    newKeysBarrier?: Promise<void> | null;
-    releaseNewKeys?: (() => void) | null;
-    pendingServerKexInit?: Uint8Array | null;
-    established?: boolean;
-    /**
-     * @param {string} url gateway WebSocket URL
-     * @param {object} options
-     * @param {(info: object) => Promise<boolean>} options.verifyHost decides
-     *   whether an unknown or changed host key may be used.
-     */
-    constructor(url: string, { verifyHost, log, openTransport }?: {
-        verifyHost?: (info: any) => Promise<boolean> | boolean;
-        log?: (...args: any[]) => void;
-        /** Returns a WebSocket-shaped transport for `url`; default is a real one. */
-        openTransport?: ((url: string) => any) | null;
-    });
-    connect(): void;
-    disconnect(message?: string): void;
-    fail(error: unknown): void;
-    /** Application packets wait while a key exchange is in flight (RFC 4253 7.1). */
-    send(payload: Uint8Array): boolean;
-}
-/** Padding for a GCM packet: only the encrypted part is block aligned. */
-export declare function gcmPaddingLength(payloadLength: any): number;
-/** A packet before any keys exist: the whole thing is block aligned. */
-export declare function framePlain(payload: Uint8Array): Uint8Array<ArrayBufferLike>;
-export declare function buildKexInit(offer: any): Uint8Array<ArrayBufferLike>;
-export declare function parseKexInit(payload: Uint8Array): {
-    kex: string[];
-    hostKey: string[];
-    cipherClientToServer: string[];
-    cipherServerToClient: string[];
-    macClientToServer: string[];
-    macServerToClient: string[];
-    compressionClientToServer: string[];
-    compressionServerToClient: string[];
-};

package/dist/protocols/ssh/wire.d.ts

@@ -1,52 +0,0 @@
-export declare function encodeUtf8(text: string): Uint8Array;
-export declare function decodeUtf8(bytes: Uint8Array): string;
-export declare function concatBytes(...parts: readonly Uint8Array[]): Uint8Array;
-/** Constant-time-ish equality. Used for authentication tags and fingerprints. */
-export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
-export declare function toBase64(bytes: Uint8Array): string;
-export declare function fromBase64(text: string): Uint8Array;
-/** Base64url without padding, which is what a JSON Web Key wants. */
-export declare function toBase64Url(bytes: Uint8Array): string;
-export declare class SshWriter {
-    #private;
-    private bytes;
-    private view;
-    private offset;
-    constructor(capacity?: number);
-    u8(value: number): this;
-    boolean(value: boolean): this;
-    u32(value: number): this;
-    raw(bytes: Uint8Array): this;
-    /** A length-prefixed string. Text is encoded as UTF-8. */
-    string(value: string | Uint8Array): this;
-    nameList(names: readonly string[]): this;
-    /**
-     * An mpint: two's complement, big endian, with no leading zero bytes except
-     * the one that keeps a positive number from looking negative.
-     */
-    mpint(bytes: Uint8Array): this;
-    get length(): number;
-    take(): Uint8Array;
-}
-export declare class SshReader {
-    #private;
-    private readonly bytes;
-    private readonly view;
-    offset: number;
-    constructor(bytes: Uint8Array, offset?: number);
-    get remaining(): number;
-    u8(): number;
-    boolean(): boolean;
-    u32(): number;
-    raw(count: number): Uint8Array;
-    /** The bytes of a length-prefixed string. */
-    stringBytes(): Uint8Array;
-    string(): string;
-    nameList(): string[];
-    /** An mpint's magnitude, with the sign byte removed. */
-    mpint(): Uint8Array;
-    skip(count: number): this;
-    rest(): Uint8Array;
-}
-/** Pad a magnitude out to a fixed width, which raw curve points need. */
-export declare function padStart(bytes: Uint8Array, width: number): Uint8Array;

package/dist/protocols/types.d.ts

@@ -1,127 +0,0 @@
-/**
- * The interface every remote-desktop protocol presents to the UI.
- *
- * The workspace -- toolbar, stats rail, on-screen keyboard, reconnects -- does
- * not care whether a session is VNC or RDP. Everything that does differ is
- * reached through this interface instead of branching at each call site.
- */
-import type { ConnectionSettings, RemoteAppLaunch } from '../shared/connection';
-import type { RdpSecurity, RemoteProtocol } from '../shared/protocol';
-/** Where the pointer may go, in framebuffer pixels. */
-export interface ScreenGeometry {
-    width: number;
-    height: number;
-    viewport: {
-        x: number;
-        y: number;
-        width: number;
-        height: number;
-    };
-}
-/** Mouse buttons, as the UI names them. */
-export type PointerButton = 0 | 1 | 2;
-/** Wheel movement in discrete remote-protocol notches. Positive is right/down. */
-export interface ScrollDelta {
-    x: number;
-    y: number;
-}
-/**
- * A live session. Both drivers expose this, so the AI pane's screen tool and
- * the toolbar never have to ask which protocol they are driving.
- */
-export interface RemoteSession extends EventTarget {
-    readonly protocol: RemoteProtocol;
-    disconnect(): void;
-    /** True once the desktop has been reached. */
-    readonly connected: boolean;
-    /** Fit the remote desktop to the pane rather than scrolling it. */
-    scaleViewport: boolean;
-    /** Watch without sending keyboard or pointer input. */
-    viewOnly: boolean;
-    /** RFB quality level. RDP ignores it. */
-    qualityLevel?: number;
-    /** RFB compression level. RDP ignores it. */
-    compressionLevel?: number;
-    /** The transport the metrics rail instruments. Can appear a tick after construction. */
-    readonly socket?: WebSocket | null;
-    readonly screenGeometry: ScreenGeometry;
-    movePointer(x: number, y: number): boolean;
-    clickPointer(x: number, y: number, button?: PointerButton): boolean;
-    pointerButton(x: number, y: number, button?: PointerButton, pressed?: boolean): boolean;
-    scrollPointer(x: number, y: number, delta: ScrollDelta): boolean;
-    typeText(text: string): boolean;
-    /** Prefer the protocol clipboard for longer text when it can paste reliably. */
-    pasteText?(text: string): boolean | Promise<boolean>;
-    /** Press or release one key by keysym. */
-    sendKey(keysym: number, code: string | null, down?: boolean): void;
-    /** Send text to the host's clipboard, when the protocol carries one. */
-    sendClipboard?(text: string): void;
-    /**
-     * Stop taking keystrokes: the workspace has given the keyboard to something
-     * local, such as the terminal or the assistant's message box.
-     *
-     * Both protocols listen on the element they paint into, so a key only leaves
-     * for the host while that element holds focus. Handing focus back is the
-     * whole mechanism -- plus, for RDP, letting go of anything still held down,
-     * which would otherwise stay down on the far side.
-     */
-    releaseKeyboard?(): void;
-    /** Ask the host for a different desktop size, when the protocol allows it. */
-    requestDesktopSize?(width: number, height: number): void;
-    /** The canvas the session paints into, for screenshots and thumbnails. */
-    readonly canvas?: HTMLCanvasElement | null;
-}
-/** What the workspace hands a driver to open a session. */
-export interface SessionOptions {
-    credentials: {
-        username: string;
-        password: string;
-    };
-    domain: string;
-    security: RdpSecurity;
-    remoteApp: RemoteAppLaunch | null;
-    /** Desktop size to ask the host for. */
-    width: number;
-    height: number;
-    /** False on a phone, where resizing the host would make a portrait strip of it. */
-    allowRemoteResize: boolean;
-    scaleViewport: boolean;
-    viewOnly: boolean;
-    quality: number;
-    compression: number;
-    /** Shown in this driver's own log lines. */
-    hostLabel: string;
-}
-/** Wording for the one connect dialog, which is shared markup across protocols. */
-export interface DialogCopy {
-    usernameLabel: string;
-    usernamePlaceholder: string;
-    usernameHelp: string;
-    passwordLabel: string;
-    passwordPlaceholder: string;
-    passwordHelp: string;
-    /** A VNC session needs some secret; RDP can sign in on the host's own screen. */
-    requiresPassword: boolean;
-}
-/** Everything the UI knows about a close, before anyone tries to explain it. */
-export interface DisconnectContext {
-    code?: number;
-    reason: string;
-    /** Pre-rendered ` (WebSocket 1006: ...)` tail, so wording stays consistent. */
-    suffix: string;
-}
-/** One protocol implementation. */
-export interface ProtocolDriver {
-    readonly protocol: RemoteProtocol;
-    /** Used as the prefix of this driver's console lines. */
-    readonly label: string;
-    readonly defaultPort: number;
-    readonly dialog: DialogCopy;
-    /** The gateway endpoint for this connection, including any query it needs. */
-    buildUrl(origin: string, settings: ConnectionSettings): string;
-    createSession(container: HTMLElement, url: string, options: SessionOptions): RemoteSession;
-    /** Extra detail worth logging once the first server frame has been parsed. */
-    describeState(session: RemoteSession): Record<string, unknown>;
-    /** Protocol-specific wording for a close, or null to fall back to the shared text. */
-    describeDisconnect(context: DisconnectContext): string | null;
-}

package/dist/protocols/vnc/des.d.ts

@@ -1,25 +0,0 @@
-/**
- * DES, for the one thing VNC still needs it for.
- *
- * The classic VNC password challenge (security type 2) is a single-block DES
- * encryption, and there is no getting round it: it is what every host from
- * x11vnc to RealVNC expects. Node's own crypto cannot help -- OpenSSL 3 moved
- * DES to the legacy provider, which is off in most builds -- and Web Crypto
- * never had it. So it is here, in about a hundred lines of tables.
- *
- * Nothing else in this repository should use this. DES is broken, and the only
- * reason it is here is that a protocol from 1998 froze it into a handshake.
- * The implementation is the textbook one, bit by bit: two blocks per sign-in
- * makes speed irrelevant and clarity worth having.
- */
-/** One 8-byte block, encrypted under an 8-byte key. */
-export declare function desEncryptBlock(key: Uint8Array, block: Uint8Array): Uint8Array;
-/**
- * The key VNC makes out of a password.
- *
- * Eight bytes, padded with zeros, and every byte's bits reversed -- an accident
- * of the original implementation that every host has copied ever since.
- */
-export declare function vncKey(password: string): Uint8Array;
-/** The answer to a host's 16-byte challenge: both halves, encrypted. */
-export declare function vncChallengeResponse(password: string, challenge: Uint8Array): Uint8Array;

package/dist/protocols/vnc/input.d.ts

@@ -1,5 +0,0 @@
-/** RFB wheel buttons for a bounded two-axis scroll, in wire order. */
-export declare function vncWheelMasks(delta: {
-    x: number;
-    y: number;
-}): number[];

package/dist/protocols/vnc/keysyms.d.ts

@@ -1,16 +0,0 @@
-/**
- * DOM key codes as X11 keysyms, which is what RFB sends.
- *
- * RDP sends scancodes, so the keyboard map on that side is a hardware table.
- * VNC sends keysyms -- what the key *means* rather than where it sits -- and
- * the useful consequence is that a character needs no modifier bookkeeping:
- * asking for `A` asks for a capital A, and the host works out that its own
- * keyboard would need shift for that.
- *
- * Latin-1 characters are their own code point. Everything above that is the
- * Unicode escape from the X protocol: 0x01000000 plus the code point.
- */
-/** A character's keysym: itself in Latin-1, and escaped above it. */
-export declare function keysymForChar(character: string): number;
-/** A DOM `code`'s keysym, or 0 for a key this does not know. */
-export declare function keysymForCode(code: string): number;

package/dist/protocols/vnc/rfb.d.ts

@@ -1,64 +0,0 @@
-/**
- * An RFB client that needs no browser.
- *
- * The VNC path in this repository has always been noVNC in a tab with the
- * gateway doing the handshake, which is fine for a tab and no use at all to a
- * command line: `RFB` wants a DOM element to paint into, and the half of the
- * handshake macOS requires lives in the Worker. This is the protocol on its
- * own -- version, security, pixels and input -- speaking to an injected
- * transport, so the CLI can hold a desktop the same way it holds an RDP one.
- *
- * The handshake reads as a straight line rather than a state machine, because
- * that is what it is: each step waits for the bytes it needs. Everything after
- * it is a message loop.
- *
- * Two pieces of the protocol need primitives no runtime offers portably --
- * DES for the classic password challenge, MD5 and AES for Apple's key
- * exchange -- so they arrive as an injected `crypto`, the same seam the
- * transport uses.
- */
-export interface RfbCrypto {
-    /** Security type 2: the 16-byte answer to the host's challenge. */
-    vncChallenge(password: string, challenge: Uint8Array): Uint8Array;
-    /** Security type 30: what macOS Screen Sharing asks for instead of a challenge. */
-    appleDh(params: Uint8Array, username: string, password: string): Uint8Array;
-}
-/** One painted area. `copyFrom` is a rectangle the host says is already on screen. */
-export interface RfbRect {
-    left: number;
-    top: number;
-    width: number;
-    height: number;
-    /** RGBA, row-major. Absent for a copy. */
-    rgba?: Uint8Array;
-    copyFrom?: {
-        x: number;
-        y: number;
-    };
-}
-export interface RfbOptions {
-    username?: string;
-    password?: string;
-    /** Let other viewers stay connected. Always true here: a session is watched. */
-    shared?: boolean;
-    crypto: RfbCrypto;
-    openTransport: () => any;
-    log?: (step: string, detail?: unknown) => void;
-}
-export declare class RfbClient extends EventTarget {
-    #private;
-    readonly options: RfbOptions;
-    width: number;
-    height: number;
-    name: string;
-    connected: boolean;
-    constructor(options: RfbOptions);
-    connect(): void;
-    disconnect(): void;
-    /** `mask` is RFB's own numbering: 1 left, 2 middle, 4 right, 8/16 wheel. */
-    pointer(x: number, y: number, mask?: number): void;
-    key(keysym: number, pressed: boolean): void;
-    cutText(text: string): void;
-    /** Ask for the whole desktop again rather than what has changed. */
-    refresh(): void;
-}

package/dist/protocols/vnc/session.d.ts

@@ -1,12 +0,0 @@
-/**
- * Everything VNC-specific, behind the driver interface the RDP side also
- * implements. noVNC's RFB object does the protocol work; this module decides
- * how it is addressed, constructed, controlled and explained.
- *
- * VNC splits the handshake differently from RDP: noVNC hands authentication to
- * the Worker, because macOS Screen Sharing needs the Apple Diffie-Hellman
- * (type 30) exchange that noVNC does not implement. That is why credentials
- * travel in the URL here and never do for RDP.
- */
-import type { ProtocolDriver } from '../types';
-export declare const vncDriver: ProtocolDriver;

package/dist/shared/connection.d.ts

@@ -1,81 +0,0 @@
-/**
- * One connection, described once.
- *
- * Every way of starting a session -- a saved card on the welcome screen, an
- * address typed by hand, a RemoteApp launcher, a reconnect after a drop --
- * produces exactly this shape and hands it to exactly one dialog. That is the
- * whole point of the type: before it existed, a saved card could only ask for a
- * username and a password, so its port, security layer, domain and picture
- * quality were unreachable once the card had been made.
- */
-import { type RdpSecurity, type RemoteProtocol } from './protocol';
-/** A published Windows application launched instead of the full desktop. */
-export interface RemoteAppLaunch {
-    /** Alias (`||notepad`) or an executable path. */
-    program: string;
-    workingDir?: string;
-    arguments?: string;
-}
-/** The companion terminal offered beside a desktop. */
-export interface SshCompanion {
-    enabled: boolean;
-    port: number;
-    username: string;
-}
-/** Picture and input options. VNC negotiates them; RDP and SSH ignore what does not apply. */
-export interface DisplaySettings {
-    /** RFB quality level, 1 (smallest) to 9 (sharpest). */
-    quality: number;
-    /** RFB compression level, 0 (fastest) to 9 (smallest). */
-    compression: number;
-    /** Fit the remote desktop to the pane rather than scrolling it. */
-    scaling: boolean;
-    /** Watch without sending keyboard or pointer input. */
-    viewOnly: boolean;
-}
-/**
- * Everything a session needs. `password` is the only field never persisted
- * anywhere -- not in the device library on the gateway, not in localStorage.
- */
-export interface ConnectionSettings {
-    /** Stable identity: protocol, address, port and program. See {@link connectionId}. */
-    id: string;
-    label: string;
-    protocol: RemoteProtocol;
-    host: string;
-    port: number;
-    username: string;
-    password: string;
-    /** Windows domain or computer name. RDP only. */
-    domain: string;
-    security: RdpSecurity;
-    remoteApp: RemoteAppLaunch | null;
-    display: DisplaySettings;
-    ssh: SshCompanion;
-    /** Open the terminal panel as soon as the desktop appears. */
-    openSshOnConnect: boolean;
-}
-export declare const DEFAULT_DISPLAY_SETTINGS: DisplaySettings;
-/**
- * A connection's identity is what it points at, not when it was made. Editing
- * the address therefore makes a different connection rather than silently
- * repointing an existing card, which is the behaviour people expect from a
- * list of machines.
- */
-export declare function connectionId(input: Pick<ConnectionSettings, 'protocol' | 'host' | 'port'> & {
-    remoteApp?: RemoteAppLaunch | null;
-}): string;
-/** A blank connection, ready for the dialog to fill in. */
-export declare function emptyConnection(protocol?: RemoteProtocol): ConnectionSettings;
-export declare function normalizeDisplaySettings(value: unknown): DisplaySettings;
-/**
- * Build a complete, valid connection out of whatever a caller happens to have.
- * Partial input from a saved card, a host list entry, a URL or localStorage all
- * arrive here, so the dialog never has to reason about missing fields.
- */
-export declare function normalizeConnection(input: Partial<ConnectionSettings> & Record<string, unknown>): ConnectionSettings;
-/** What a connection is worth remembering by -- never the password. */
-export type PersistedConnection = Omit<ConnectionSettings, 'password'>;
-export declare function withoutPassword(settings: ConnectionSettings): PersistedConnection;
-/** A one-line description for the dialog's summary row and the status bar. */
-export declare function describeConnection(settings: ConnectionSettings): string;

package/dist/shared/device.d.ts

@@ -1,26 +0,0 @@
-/**
- * A machine as the gateway remembers it, shared by the Durable Object that
- * stores the record and the welcome screen that draws it.
- *
- * Passwords and account names are deliberately absent: the gateway has no need
- * of them and every reason not to hold them. They live in the browser, next to
- * the rest of the connection's settings.
- */
-import type { RdpSecurity, RemoteProtocol } from './protocol';
-export interface SavedDevice {
-    id: string;
-    label: string;
-    host: string;
-    port: number;
-    protocol: RemoteProtocol;
-    domain?: string;
-    security?: RdpSecurity;
-    /** RemoteApp alias (`||notepad`) when this card launches an app, not a desktop. */
-    program?: string;
-    favorite?: boolean;
-    /** Milliseconds since the epoch; drives the "recent" ordering. */
-    lastUsed?: number;
-    createdAt?: number;
-    /** Set when a thumbnail exists, so the client can cache-bust its <img>. */
-    thumbnailAt?: number;
-}

package/dist/shared/hosts.d.ts

@@ -1,63 +0,0 @@
-/**
- * The gateway's own roster of machines, and the networks it is allowed to dial.
- *
- * Parsing lives here, with no reference to the Worker environment, so the same
- * code shapes the list in `VNC_HOSTS`/`RDP_HOSTS` and the list the browser
- * receives from `/api/hosts`. Reading those variables is the Worker's job --
- * see `src/worker/config/hosts.ts`.
- */
-import type { RemoteAppLaunch } from './connection';
-import { type RdpSecurity, type RemoteProtocol } from './protocol';
-/** Optional SSH access to the same machine, which publishes a terminal for it. */
-export interface HostSshAccess {
-    port: number;
-    username?: string;
-}
-/** One machine as the gateway's configuration describes it. */
-export interface RemoteHostTarget {
-    id: string;
-    name: string;
-    host: string;
-    port: number;
-    protocol: RemoteProtocol;
-    /** Windows domain or computer name pre-filled in the connect dialog. */
-    domain?: string;
-    security?: RdpSecurity;
-    remoteApp?: RemoteAppLaunch;
-    ssh?: HostSshAccess;
-}
-/**
- * Build the target list offered in the connect dialog. `VNC_HOSTS` and
- * `RDP_HOSTS` are merged into one list; each entry may override its protocol,
- * so a single list can carry both kinds of target.
- */
-export declare function parseConfiguredHosts(options: {
-    vncHostsJson?: string;
-    rdpHostsJson?: string;
-    defaultHost?: string;
-    defaultPort?: string;
-    defaultRdpHost?: string;
-    defaultRdpPort?: string;
-}): RemoteHostTarget[];
-/** One allowed network, as a base address and a mask. */
-export interface Subnet {
-    base: number;
-    mask: number;
-}
-/** Dotted-quad to a 32-bit number, or null for anything that is not one. */
-export declare function ipv4ToInt(value: string): number | null;
-/**
- * The networks this gateway may dial, beyond the machines named in the host
- * lists. Written as `ALLOWED_SUBNETS`, comma-separated:
- *
- *   192.168.8.0/24    a CIDR block
- *   192.168.8.*       the same thing, written the way people say it
- *   192.168.8.67      a single address
- *
- * This is what lets a terminal open on a machine that was never listed. Keep it
- * to networks you own: anything inside one can be reached on any port by anyone
- * who gets past the gateway's login.
- */
-export declare function parseAllowedSubnets(value?: string): Subnet[];
-/** Whether a dotted-quad address falls inside one of the allowed networks. */
-export declare function hostInAllowedSubnets(host: string, value?: string): boolean;

package/dist/shared/icons.d.ts

@@ -1,46 +0,0 @@
-/**
- * Icon path data, shared by the server-rendered login page and the React app.
- *
- * Each value is the inside of a 24x24 stroked `<svg>`; the wrapper differs
- * between the two (a string on the Worker, a component in the browser) but the
- * geometry should not.
- */
-export declare const ICON_PATHS: {
-    readonly monitor: '<rect x="2" y="3" width="20" height="14" rx="2"/><path d="M8 21h8M12 17v4"/>';
-    readonly link: '<path d="M9 17H7A5 5 0 0 1 7 7h2M15 7h2a5 5 0 1 1 0 10h-2M8 12h8"/>';
-    readonly power: '<path d="M12 2v10"/><path d="M18.4 6.6a9 9 0 1 1-12.8 0"/>';
-    readonly maximize: '<path d="M8 3H5a2 2 0 0 0-2 2v3M21 8V5a2 2 0 0 0-2-2h-3M3 16v3a2 2 0 0 0 2 2h3M16 21h3a2 2 0 0 0 2-2v-3"/>';
-    readonly minimize: '<path d="M8 3v3a2 2 0 0 1-2 2H3M21 8h-3a2 2 0 0 1-2-2V3M3 16h3a2 2 0 0 1 2 2v3M16 21v-3a2 2 0 0 1 2-2h3"/>';
-    readonly keyboard: '<rect x="2" y="4" width="20" height="16" rx="2"/><path d="M6 8h.01M10 8h.01M14 8h.01M18 8h.01M8 12h.01M12 12h.01M16 12h.01M7 16h10"/>';
-    readonly clipboard: '<rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/>';
-    readonly check: '<path d="m5 13 4 4 10-10"/>';
-    readonly camera: '<path d="M14.5 4h-5L7 7H4a2 2 0 0 0-2 2v9a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-3l-2.5-3z"/><circle cx="12" cy="13" r="3"/>';
-    readonly eye: '<path d="M2 12s3.5-6 10-6 10 6 10 6-3.5 6-10 6S2 12 2 12z"/><circle cx="12" cy="12" r="3"/>';
-    readonly sliders: '<path d="M4 21v-7M4 10V3M12 21v-9M12 8V3M20 21v-5M20 12V3M2 14h4M10 8h4M18 16h4"/>';
-    readonly expand: '<path d="M15 3h6v6M9 21H3v-6M21 3l-7 7M3 21l7-7"/>';
-    readonly shield: '<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>';
-    readonly chevron: '<path d="m6 9 6 6 6-6"/>';
-    readonly back: '<path d="m15 18-6-6 6-6"/>';
-    readonly zap: '<path d="M13 2 3 14h9l-1 8 10-12h-9l1-8z"/>';
-    readonly cube: '<path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><path d="m3.3 7 8.7 5 8.7-5M12 22V12"/>';
-    readonly logout: '<path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4M16 17l5-5-5-5M21 12H9"/>';
-    readonly clock: '<circle cx="12" cy="12" r="9"/><path d="M12 7v5l3.5 2"/>';
-    readonly activity: '<path d="M22 12h-4l-3 9L9 3l-3 9H2"/>';
-    readonly transfer: '<path d="m3 16 4 4 4-4M7 20V4M21 8l-4-4-4 4M17 4v16"/>';
-    readonly screen: '<rect x="2" y="5" width="20" height="13" rx="2"/><path d="M7 21h10"/>';
-    readonly command: '<path d="M15 6a3 3 0 1 1 3 3h-3zm0 0v12m0 0a3 3 0 1 0 3-3h-3zM9 6a3 3 0 1 0-3 3h3zm0 0v12m0 0a3 3 0 1 1-3-3h3z"/>';
-    readonly apps: '<rect x="3" y="3" width="7" height="7" rx="1"/><rect x="14" y="3" width="7" height="7" rx="1"/><rect x="3" y="14" width="7" height="7" rx="1"/><rect x="14" y="14" width="7" height="7" rx="1"/>';
-    readonly terminal: '<path d="m4 17 6-6-6-6M12 19h8"/>';
-    readonly folder: '<path d="M3 7h6l2 2h10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><path d="M3 7V6a2 2 0 0 1 2-2h4l2 3"/>';
-    readonly close: '<path d="M18 6 6 18M6 6l12 12"/>';
-    readonly sparkles: '<path d="m12 3 1.9 5.1L19 10l-5.1 1.9L12 17l-1.9-5.1L5 10l5.1-1.9L12 3z"/><path d="m19 15 .8 2.2 2.2.8-2.2.8L19 21l-.8-2.2-2.2-.8 2.2-.8z"/>';
-    readonly broom: '<path d="M10 10V4a2 2 0 0 1 4 0v6"/><path d="M6 10h12a2 2 0 0 1 2 2v2H4v-2a2 2 0 0 1 2-2Z"/><path d="m5 14-2 7h18l-2-7M9 18l-1 3M15 18l1 3"/>';
-    readonly panel: '<rect x="3" y="4" width="18" height="16" rx="2"/><path d="M14 4v16"/>';
-    readonly menu: '<path d="M4 7h16M4 12h16M4 17h16"/>';
-    readonly plus: '<path d="M12 5v14M5 12h14"/>';
-    readonly star: '<path d="m12 3 2.9 5.9 6.5.9-4.7 4.6 1.1 6.5L12 17.8 6.2 20.9l1.1-6.5L2.6 9.8l6.5-.9L12 3z"/>';
-    readonly trash: '<path d="M3 6h18M8 6V4a1 1 0 0 1 1-1h6a1 1 0 0 1 1 1v2M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/>';
-};
-export type IconName = keyof typeof ICON_PATHS;
-/** The tab icon: a monitor in Cloudflare orange. */
-export declare const FAVICON_DATA_URI = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23f38020' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='2' y='3' width='20' height='14' rx='2'/%3E%3Cpath d='M8 21h8M12 17v4'/%3E%3C/svg%3E";

package/dist/shared/protocol.d.ts

@@ -1,32 +0,0 @@
-/**
- * The vocabulary both halves of the gateway share.
- *
- * The Worker and the browser have to agree on what a "protocol" is, what ports
- * they default to and how an RDP security layer is named, so those live here
- * rather than being re-declared on each side and drifting apart.
- */
-/** A remote-desktop protocol the session workspace can display. */
-export declare const REMOTE_PROTOCOLS: readonly ['vnc', 'rdp'];
-export type RemoteProtocol = (typeof REMOTE_PROTOCOLS)[number];
-/** Every protocol the gateway relays, including the terminal side panel. */
-export declare const TRANSPORT_PROTOCOLS: readonly ['vnc', 'rdp', 'ssh'];
-export type TransportProtocol = (typeof TRANSPORT_PROTOCOLS)[number];
-/**
- * The RDP security layer. `auto` negotiates with the host, which is right for
- * anything that answers honestly; the rest are for hosts that do not.
- */
-export declare const RDP_SECURITY_MODES: readonly ['auto', 'nla', 'tls', 'rdp'];
-export type RdpSecurity = (typeof RDP_SECURITY_MODES)[number];
-export declare const DEFAULT_PORTS: Record<TransportProtocol, number>;
-export declare const DEFAULT_SSH_PORT: number;
-/** Max time allowed before command start output is detected. */
-export declare const COMMAND_START_MS = 15000;
-/** Max idle silence allowed during command execution. */
-export declare const COMMAND_IDLE_MS: number;
-export declare function isRemoteProtocol(value: unknown): value is RemoteProtocol;
-export declare function isRdpSecurity(value: unknown): value is RdpSecurity;
-/** Coerce anything to a protocol, falling back to what the caller opens on. */
-export declare function toRemoteProtocol(value: unknown, fallback?: RemoteProtocol): RemoteProtocol;
-export declare function toRdpSecurity(value: unknown, fallback?: RdpSecurity): RdpSecurity;
-/** A port number, or the protocol's default when the value is not one. */
-export declare function toPort(value: unknown, fallback: number): number;

package/dist/shared/signals.d.ts

@@ -1,37 +0,0 @@
-/**
- * Control frames the browser and the gateway exchange on the WebSocket that
- * carries a remote-desktop stream.
- *
- * They are plain strings precisely so they can never be confused with the
- * binary protocol payload flowing in either direction, and both sides import
- * these same literals so the two halves cannot drift apart.
- */
-/** Browser -> gateway: "my WebSocket is open, you may start reading the host". */
-export declare const GATEWAY_READY_SIGNAL = "VNC_GATEWAY_READY_v1";
-/**
- * Browser -> gateway: keep the edge from idling out a silent session.
- * Cloudflare closes a WebSocket with no traffic in either direction for 100s,
- * and an untouched desktop transmits nothing at all.
- */
-export declare const GATEWAY_KEEPALIVE_SIGNAL = "VNC_GATEWAY_KEEPALIVE_v1";
-/**
- * How often the browser nudges the transport. Well inside the edge's 100s
- * window, so a session that is merely being looked at is never torn down
- * without a close frame -- which is what a bare WebSocket 1006 used to mean.
- */
-export declare const KEEPALIVE_INTERVAL_MS = 25000;
-export declare const MAX_CLOSE_REASON_BYTES = 123;
-/** Whether a live desktop ended for a transient transport reason worth retrying. */
-export declare function isRetryableDisconnect(diagnostic: {
-    close: {
-        code: number;
-        reason: string;
-    } | null;
-    established: boolean;
-}): boolean;
-/** WebSocket close reasons are capped at 123 bytes; trim without splitting a code point. */
-export declare function websocketCloseReason(reason: string): string;
-/** 1005/1006/1015 are reserved and cannot be transmitted in a close frame. */
-export declare function sendableCloseCode(code: number): number;
-/** Normalize any WebSocket message payload to bytes. */
-export declare function messageToBytes(data: unknown): Promise<Uint8Array | null>;