dsh-mobile 0.8.0 → 0.8.2

package/lib/index.d.mts

@@ -6,7 +6,6 @@ import { Readable } from "node:stream";
 import { Context, Service } from "@deepseek-ai/cordis";
 import "zod";
 import { WebRoute } from "@deepseek-ai/dsh-host-webserver";
-//#region src/storage.d.ts
 /** Persistent record containing only a digest of the long-lived device credential. */
 interface StoredDevice {
   readonly id: string;
@@ -51,8 +50,6 @@ export declare class MemoryDeviceStore implements DeviceStore {
   /** Return a defensive copy for assertions or administrative export. */
   inspect(): DeviceSnapshot;
 }
-//#endregion
-//#region src/access.d.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 export declare class AccessError extends Error {
   readonly status: number;
@@ -216,8 +213,6 @@ export declare class AccessController {
     rateLimitKeys: number;
   };
 }
-//#endregion
-//#region src/network.d.ts
 /** A parsed IP network used to authorize directly connected clients. */
 interface ParsedCidr {
   readonly bits: 32 | 128;
@@ -262,8 +257,6 @@ export declare class RequestTrustPolicy {
   /** Return the canonical accepted Origin, otherwise undefined. */
   canonicalOrigin(header: string | undefined): string | undefined;
 }
-//#endregion
-//#region src/extension-worker-config.d.ts
 /** Operator-owned limits for opt-in local extension worker execution. */
 interface HostExecutionConfig {
   readonly mode?: 'in-process' | 'worker';
@@ -293,8 +286,6 @@ interface ResolvedHostExecutionConfig extends Required<Omit<HostExecutionConfig,
 }
 /** Resolve configuration once; reject malformed modes, ids and incoherent stream windows. */
 export declare function resolveHostExecution(raw: unknown): ResolvedHostExecutionConfig;
-//#endregion
-//#region src/config.d.ts
 /** Optional compression for exact, already authorized WebSocket paths. */
 interface WebSocketCompressionConfig {
   paths?: string[];
@@ -445,8 +436,6 @@ export declare const Config: z<PluginConfig>;
 export declare function parseControlFile(value: unknown): string;
 /** Parse configuration and reject unsafe topology, credential, and resource combinations. */
 export declare function parseGatewayConfig(raw: unknown): ResolvedGatewayConfig;
-//#endregion
-//#region src/client-module-preferences.d.ts
 /** Installed client module metadata, without upstream URLs or host paths. */
 interface ClientModuleEntry {
   readonly id: string;
@@ -462,6 +451,8 @@ interface ClientModuleEntry {
 /** Selection returned to the computer administrator or the authenticated device. */
 interface ClientModulePreferenceView {
   readonly entries: readonly ClientModuleEntry[];
+  /** Canonical fingerprint of this catalog. A write that carries a different one is stale. */
+  readonly revision: string;
   readonly excludedClientModules: readonly string[];
   readonly defaultExcludedClientModules: readonly string[];
   readonly source: 'device' | 'computer' | 'plugin';
@@ -498,8 +489,6 @@ export declare class ClientModulePreferenceStore {
   removeDevices(deviceIds: readonly string[]): Promise<void>;
   private save;
 }
-//#endregion
-//#region src/control.d.ts
 /** Versioned durable preference for the resident mobile-access runtime. */
 interface MobileAccessControlState {
   readonly version: 1;
@@ -542,14 +531,17 @@ export declare class MobileAccessGatewayController {
   isRunning(): boolean;
   /** Start or stop the runtime and persist only a successfully committed transition. */
   setRunning(running: boolean): Promise<void>;
+  /** Change configuration with the runtime stopped, without changing its durable enabled preference. */
+  reconfigure<T>(change: () => Promise<T>, restore: () => Promise<void>): Promise<{
+    value: T;
+    running: boolean;
+  }>;
   /** Stop the runtime after earlier transitions without changing the restart preference. */
   close(): Promise<void>;
   private enable;
   private disable;
   private enqueue;
 }
-//#endregion
-//#region src/auth-failure-log.d.ts
 /** One rejected HTTP request, with presence/count fields instead of credential values. */
 interface AuthFailureEntry {
   readonly kind: 'authorize' | 'csrf';
@@ -567,21 +559,24 @@ interface AuthFailureEntry {
   /** Earlier failures of this kind suppressed since its preceding recorded request. */
   readonly suppressed?: number;
 }
-//#endregion
-//#region src/http-failure-log.d.ts
 /** Fixed parser details safe to record without Node's raw packet, message or request headers. */
-type HttpParserCode = 'ERR_HTTP_REQUEST_TIMEOUT' | 'HPE_HEADER_OVERFLOW' | 'HPE_INVALID_CHUNK_SIZE' | 'HPE_INVALID_CONTENT_LENGTH' | 'HPE_INVALID_EOF_STATE' | 'HPE_INVALID_HEADER_TOKEN' | 'HPE_INVALID_TRANSFER_ENCODING' | 'HPE_UNEXPECTED_CONTENT_LENGTH' | 'other';
+type HttpParserCode = 'ERR_HTTP_REQUEST_TIMEOUT' | 'HPE_HEADER_OVERFLOW' | 'HPE_INVALID_METHOD' | 'HPE_INVALID_CONSTANT' | 'HPE_INVALID_URL' | 'HPE_INVALID_VERSION' | 'HPE_LF_EXPECTED' | 'HPE_PAUSED_H2_UPGRADE' | 'HPE_INVALID_CHUNK_SIZE' | 'HPE_INVALID_CONTENT_LENGTH' | 'HPE_INVALID_EOF_STATE' | 'HPE_INVALID_HEADER_TOKEN' | 'HPE_INVALID_TRANSFER_ENCODING' | 'HPE_UNEXPECTED_CONTENT_LENGTH' | 'other';
 /** A rejected inbound HTTP message's public response and bounded diagnostic category. */
 interface HttpParserFailure {
   readonly status: 400 | 408 | 431;
   readonly code: 'bad_request' | 'request_timeout' | 'headers_too_large';
   readonly parserCode: HttpParserCode;
 }
+/** Socket failures do not establish that an HTTP request was rejected. */
+type HttpTransportCode = 'ECONNRESET' | 'EPIPE' | 'ETIMEDOUT' | 'ERR_STREAM_PREMATURE_CLOSE';
 /** One sampled rejection. Arbitrary paths, query strings, body data and credentials are excluded. */
 type HttpFailureEntry = ({
   readonly kind: 'parser';
   readonly status: HttpParserFailure['status'];
   readonly code: HttpParserCode;
+} | {
+  readonly kind: 'transport';
+  readonly code: HttpTransportCode;
 } | {
   readonly kind: 'target';
   readonly status: 400;
@@ -594,8 +589,6 @@ type HttpFailureEntry = ({
 }) & {
   readonly suppressed?: number;
 };
-//#endregion
-//#region src/api-latency-log.d.ts
 /** One sampled API wait; `durationMs` spans the client's request to response close. */
 type ApiLatencyEntry = {
   readonly kind: 'api';
@@ -606,8 +599,6 @@ type ApiLatencyEntry = {
 } & {
   readonly suppressed?: number;
 };
-//#endregion
-//#region src/upstream-auth-log.d.ts
 /** Fixed outcomes of the Gateway's private DSH launch-token exchange. */
 type UpstreamAuthOutcome = 'accepted' | 'invalid-target' | 'unexpected-status' | 'invalid-cookie' | 'timeout' | 'transport-error';
 /** Exchange metadata only: no URL, header, Cookie, Token or raw error is retained. */
@@ -621,8 +612,6 @@ interface UpstreamAuthEntry {
   /** Earlier exchanges with the same success/failure category omitted by sampling. */
   readonly suppressed?: number;
 }
-//#endregion
-//#region src/http-security.d.ts
 export declare const DEVICE_COOKIE = "dsh_ma_device";
 export declare const SESSION_COOKIE = "dsh_ma_session";
 export declare const CSRF_COOKIE = "dsh_ma_csrf";
@@ -636,8 +625,6 @@ declare class HttpError extends Error {
   readonly code: string;
   constructor(status: number, code: string);
 }
-//#endregion
-//#region src/websocket-paths.d.ts
 /** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
 export declare const MAX_EXTRA_WEBSOCKET_PATHS = 16;
 export declare const MAX_WEBSOCKET_PATH_LENGTH = 256;
@@ -681,8 +668,6 @@ export declare class WebSocketPathStore {
   /** Replace the whole list after validating; persists atomically. */
   replace(paths: readonly string[]): Promise<string[]>;
 }
-//#endregion
-//#region src/extension-worker-protocol.d.ts
 /** Metadata for one action, crossing the boundary without its functions. */
 interface WorkerActionMetadata {
   readonly name: string;
@@ -695,8 +680,6 @@ interface WorkerRouteMetadata {
   readonly kind?: 'exact' | 'prefix';
   readonly timeoutMs?: number;
 }
-//#endregion
-//#region src/extension-worker.d.ts
 /** JSON bytes serialized and size-checked inside the worker. */
 declare class PreparedJsonResult {
   readonly bytes: Buffer;
@@ -792,8 +775,6 @@ declare class ExtensionWorkerHost {
   private openStream;
   private cancelStream;
 }
-//#endregion
-//#region src/extension-limits.d.ts
 /** Maximum sizes enforced when reading local extension files. */
 export declare const EXTENSION_LIMITS: Readonly<{
   manifest: number;
@@ -804,8 +785,6 @@ export declare const EXTENSION_LIMITS: Readonly<{
   assetBytes: number;
   assetDepth: 8;
 }>;
-//#endregion
-//#region src/extensions.d.ts
 /** A controlled business failure returned by an extension action or route. */
 export declare class MobileExtensionError extends Error {
   readonly code: string;
@@ -1011,8 +990,6 @@ export declare class MobileAccessService extends Service {
 }
 /** Construct the service in a Cordis plugin without importing DSH internals. */
 export declare function createMobileAccessService(ctx: Context): MobileAccessService;
-//#endregion
-//#region src/mobile-push/contracts.d.ts
 type PushCategory = 'question' | 'plan' | 'approval' | 'response' | 'goal' | 'failure' | 'test';
 type PushPreferences = Readonly<Record<Exclude<PushCategory, 'test'>, boolean>>;
 type PushLocale = 'en' | 'zh-CN' | 'it';
@@ -1069,8 +1046,6 @@ interface PushConfig {
   readonly status: 'disabled' | 'enabled' | 'suspended' | 'repair-required';
   readonly preferences: PushPreferences;
 }
-//#endregion
-//#region src/mobile-push/gateway.d.ts
 /** Trusted per-Gateway binding; authorization is freshly loaded from durable device storage. */
 interface PushGatewayOriginBinding {
   readonly scopeId: string;
@@ -1096,12 +1071,10 @@ interface PushGatewayService {
   test(owner: PushOwner, installationId: string): Promise<void>;
   resolve(owner: PushOwner, reference: string): Promise<PushTarget | undefined>;
 }
-//#endregion
-//#region src/gateway.d.ts
 /** A graph-selection conflict with a bounded diagnostic safe for authenticated callers. */
 export declare class ClientModuleConflictError extends HttpError {
   readonly detail: string;
-  constructor(detail: string);
+  constructor(detail: string, code?: string);
 }
 /** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
 export declare function rewriteMobileIndex(html: string, excludedClientModules?: readonly string[]): string;
@@ -1259,9 +1232,10 @@ export declare class MobileAccessGateway {
    * @param excluded - Untrusted module IDs to validate against the current boot graph.
    * @param deviceId - Authenticated device identity; omitted for computer defaults.
    * @param callerSignal - Cancels fetching and validation, not an atomic write already started.
+   * @param revision - Catalog fingerprint the selection was computed against; a mismatch is rejected.
    * @returns The catalog and saved selection without reloading clients.
    */
-  configureClientModules(excluded: unknown, deviceId?: string, callerSignal?: AbortSignal): Promise<ClientModulePreferenceView>;
+  configureClientModules(excluded: unknown, deviceId?: string, callerSignal?: AbortSignal, revision?: string): Promise<ClientModulePreferenceView>;
   /** Reset one override without reloading connected clients.
    * @param deviceId - Authenticated device identity; omitted to reset computer defaults.
    * @param callerSignal - Cancels fetching and validation, not an atomic write already started.
@@ -1376,8 +1350,6 @@ export declare class MobileAccessGateway {
     readonly failed: number;
   };
 }
-//#endregion
-//#region src/frp-component.d.ts
 interface FrpArtifact {
   readonly platform: NodeJS.Platform;
   readonly arch: string;
@@ -1436,8 +1408,6 @@ export declare class FrpComponentManager {
   purge(): Promise<FrpComponentStatus>;
   private enqueue;
 }
-//#endregion
-//#region src/cpolar-component.d.ts
 /** Pinned cpolar components fetched only after an explicit user action. */
 interface CpolarArtifact {
   readonly version: string;
@@ -1515,8 +1485,6 @@ export declare class CpolarComponentManager {
   purge(): Promise<CpolarComponentStatus>;
   private enqueue;
 }
-//#endregion
-//#region src/frp-template.d.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 export declare const FRP_VHOST_HTTP_PORT = 7080;
 /** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
@@ -1562,8 +1530,6 @@ export declare function createCaddySite(publicHost: string, options?: CaddySiteO
  * mode publishes a raw TCP proxy instead of an HTTP vhost.
  */
 export declare function createRestrictedFrpServerTemplate(serverPort: number, token: string, publicOrigin: string, options?: CaddySiteOptions): string;
-//#endregion
-//#region src/frp-config.d.ts
 /** How the restricted FRP channel is provisioned on the VPS. */
 type FrpMode = 'deploy' | 'attach';
 /** Public entry port used by the self-signed TCP passthrough (never 443 by requirement). */
@@ -1734,8 +1700,6 @@ export declare class FrpConfigStore {
   /** Remove only configuration files owned by the FRP provider. */
   purge(): Promise<FrpConfigurationStatus>;
 }
-//#endregion
-//#region src/frp-attach.d.ts
 /** Default proof path used to confirm the public entry answered from this computer. */
 export declare const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
 /** Declaration printed above the VPS half of an attach template. */
@@ -1810,8 +1774,6 @@ export declare function frpAttachVpsParts(settings: FrpSettings, options?: FrpAt
 export declare function createFrpAttachTemplateParts(settings: FrpSettings, options?: FrpAttachOptions): FrpAttachTemplate;
 /** Combined attach artefact, ready for the clipboard. */
 export declare function createFrpAttachTemplate(settings: FrpSettings, options?: FrpAttachOptions): string;
-//#endregion
-//#region src/frp-attach-plan.d.ts
 /** Stable step identifiers; the panel maps each one to a translated title. */
 type FrpAttachStepId = 'write-snippet' | 'add-import' | 'issue-ip-cert' | 'enable-cert-timer' | 'verify-https' | 'open-public-port' | 'verify-frps' | 'verify-entry';
 /** One actionable VPS-side step; `title` is a message key, `label` the copied text. */
@@ -1849,8 +1811,6 @@ interface FrpAttachPlan {
  * configuration is written by the ordinary provider lifecycle.
  */
 export declare function createFrpAttachPlan(settings: FrpSettings, options?: FrpAttachOptions): FrpAttachPlan;
-//#endregion
-//#region src/cert-renewal.d.ts
 /** Days left below which the entry certificate is reported as expiring. */
 export declare const CERT_EXPIRING_DAYS = 2;
 /** Read-only lifetime verdict for one certificate; never mutates or renews anything. */
@@ -1880,8 +1840,6 @@ export declare function readCertificateRenewal(file: string, now?: number): Prom
  * leaf is the expected answer for the passthrough entry.
  */
 export declare function probeOriginCertificate(host: string, port: number, timeoutMs?: number): Promise<CertRenewalStatus>;
-//#endregion
-//#region src/frp-ingress.d.ts
 /** Private files owned by the self-signed FRP ingress. */
 interface FrpIngressPaths {
   readonly directory: string;
@@ -1935,8 +1893,6 @@ export declare function ensureFrpIngressCertificate(settings: FrpSettings, state
  * and the token is never read.
  */
 export declare function frpIngressSelfCheck(settings: FrpSettings, stateFile: string, ownedRoot?: string): Promise<FrpIngressSelfCheck>;
-//#endregion
-//#region src/managed-setup.d.ts
 /** One host a server leaf must be valid for: an IP literal, a DNS name, or both. */
 interface ServerCertificateTarget {
   readonly commonName: string;
@@ -1962,8 +1918,6 @@ interface ServerCertificateAuthority {
  * hosts; the Android client accepts either through its pinned CA.
  */
 export declare function issueServerCertificate(authority: ServerCertificateAuthority, target: ServerCertificateTarget, output: ServerCertificateFiles, lifetimeDays?: number): Promise<void>;
-//#endregion
-//#region src/remote.d.ts
 /** Remote transports supported by the desktop plugin and Android client. */
 type RemoteProvider = 'tailscale' | 'cpolar' | 'cloudflared' | 'frp' | 'origin' | 'iroh';
 /** Common safe status returned by every remote provider controller. */
@@ -2009,8 +1963,6 @@ export declare class JsonRemoteProviderStore {
 }
 /** Resolve the first-run provider without letting environment values bypass validation. */
 export declare function configuredRemoteProvider(environment: NodeJS.ProcessEnv): RemoteProvider;
-//#endregion
-//#region src/frp.d.ts
 /** Product-facing states for the restricted self-hosted FRP transport. */
 type FrpState = 'off' | 'unavailable' | 'starting' | 'connecting' | 'ready' | 'error';
 /** Safe FRP state returned only through the loopback DSH control route. */
@@ -2126,8 +2078,6 @@ export declare class FrpController implements RemoteProviderController {
   private stop;
   private stopProcessAndGateway;
 }
-//#endregion
-//#region src/origin-proxy-config.d.ts
 export declare const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
 /** A private HTTP listener behind a user-managed HTTPS reverse proxy. */
 interface OriginSettings {
@@ -2171,8 +2121,6 @@ export declare class OriginConfigStore {
   configure(value: unknown): Promise<OriginConfigurationStatus>;
   purge(): Promise<OriginConfigurationStatus>;
 }
-//#endregion
-//#region src/origin-proxy.d.ts
 type OriginState = 'off' | 'unavailable' | 'starting' | 'ready' | 'error';
 /** Ready means the private listener is ready, not that public ingress was tested. */
 interface OriginStatus {
@@ -2213,8 +2161,6 @@ export declare class OriginController implements RemoteProviderController {
   private start;
   private stop;
 }
-//#endregion
-//#region src/cloudflared-component.d.ts
 /**
  * Pinned cloudflared components fetched only after an explicit user action.
  *
@@ -2305,8 +2251,6 @@ export declare class CloudflaredComponentManager {
   purge(): Promise<CloudflaredComponentStatus>;
   private enqueue;
 }
-//#endregion
-//#region src/cloudflared-tunnel.d.ts
 /** Which tunnel flavour the cloudflared provider runs. */
 type CloudflaredTunnelMode = 'quick' | 'named';
 /**
@@ -2382,8 +2326,6 @@ export declare class CloudflaredTunnelStore {
   /** Forget a named tunnel and its connector token. */
   purge(): Promise<CloudflaredTunnelStatus>;
 }
-//#endregion
-//#region src/cloudflared.d.ts
 /** Product-facing states for the optional cloudflared remote transport. */
 type CloudflaredState = 'off' | 'unavailable' | 'starting' | 'connecting' | 'ready' | 'error';
 /** Safe cloudflared state returned only through the loopback DSH control route. */
@@ -2489,8 +2431,6 @@ export declare class CloudflaredController implements RemoteProviderController {
   private stop;
   private stopProcessAndGateway;
 }
-//#endregion
-//#region src/iroh-component.d.ts
 export declare const IROH_VERSION = "0.1.0-alpha.1";
 /** A size- and content-pinned sidecar release asset with independent wire and installed-byte checks. */
 interface IrohArtifact {
@@ -2578,8 +2518,6 @@ export declare class IrohComponentManager {
   purge(): Promise<IrohComponentStatus>;
   private refresh;
 }
-//#endregion
-//#region src/iroh-pairing.d.ts
 export declare const PAIRING_DESCRIPTOR_VERSION = 1;
 export declare const PAIRING_DESCRIPTOR_TYPE = "dsh-mobile-iroh-pairing";
 export declare const MAX_PAIRING_DESCRIPTOR_BYTES = 2200;
@@ -2620,8 +2558,6 @@ export declare function decodePairingDescriptor(encoded: string, options?: {
 }): IrohPairingDescriptor;
 /** Phone-side listener port advertised in QR codes minted by this computer. */
 export declare const PAIRING_DESCRIPTOR_LOCAL_PORT = 25443;
-//#endregion
-//#region src/iroh.d.ts
 /** Product-facing states for the experimental iroh transport. */
 type IrohState = 'off' | 'unavailable' | 'starting' | 'connecting' | 'ready' | 'error';
 /** Safe iroh state returned only through the loopback DSH control route. */
@@ -2700,8 +2636,6 @@ export declare class IrohController implements RemoteProviderController {
   private waitForReady;
   private waitForPairingCode;
 }
-//#endregion
-//#region src/iroh-origin.d.ts
 /** Identity-derived browser origins for the raw TLS-over-iroh carrier.
  *
  * Ported from the independent `dsh-mobile-iroh` companion's origin contract.
@@ -2715,8 +2649,6 @@ export declare function irohHostname(endpointId: string): string;
 export declare function irohOrigin(endpointId: string, localPort?: number): string;
 /** Reject an Origin that does not belong to the selected cryptographic host identity. */
 export declare function validateIrohOrigin(value: unknown, endpointId: string, localPort?: number): string;
-//#endregion
-//#region src/iroh-tls.d.ts
 /** Leaf lifetime and renewal headroom, matching the companion's native policy. */
 export declare const IROH_LEAF_VALIDITY_DAYS = 90;
 export declare const IROH_LEAF_RENEW_BEFORE_DAYS = 30;
@@ -2757,8 +2689,6 @@ export declare function ensureIrohTls(endpointId: string, stateFile: string, own
  * the public path is the iroh transport, never a direct bind.
  */
 export declare function irohGatewayConfig(template: ResolvedGatewayConfig, endpointId: string, stateFile: string, tls: Pick<FrpIngressCertificate, 'paths' | 'caFingerprint'>, listenPort?: number): ResolvedGatewayConfig;
-//#endregion
-//#region src/task-events.d.ts
 /**
  * Host-side task-completion fan-out for phone notifications.
  *
@@ -2820,8 +2750,6 @@ export declare class TaskEventHub {
   /** Visible for tests. */
   get size(): number;
 }
-//#endregion
-//#region src/plugin.d.ts
 declare module '@deepseek-ai/dsh-llm' {
   interface MessageSourceMap {
     'plugin:dsh-mobile': {
@@ -2839,6 +2767,5 @@ export declare const inject: string[];
 export declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number, legacyInstanceId?: string): ResolvedGatewayConfig;
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 export declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
-//#endregion
 export { type AccessControllerOptions, type AuthoritySpec, type BlockedUpgradePathEntry, type CaddySiteOptions, type CertRenewalStatus, type ClientModuleEntry, type ClientModulePreferenceSelection, type ClientModulePreferenceView, type CloudflaredComponentStatus, type CloudflaredControllerOptions, type CloudflaredState, type CloudflaredStatus, type CloudflaredTunnelMode, type CloudflaredTunnelSettings, type CloudflaredTunnelStatus, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, type DeviceProbeResult, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, type FrpAttachOptions, type FrpAttachPlan, type FrpAttachPlanLocal, type FrpAttachPlanStep, type FrpAttachStepId, type FrpAttachTemplate, type FrpAttachVpsParts, type FrpComponentStatus, type FrpConfigurationStatus, type FrpControllerOptions, type FrpEntryTls, type FrpIngressCertificate, type FrpIngressPaths, type FrpIngressSelfCheck, type FrpSettings, type FrpState, type FrpStatus, type HostExecutionConfig, type IrohArtifact, type IrohComponentManagerOptions, type IrohComponentStatus, type IrohControllerOptions, type IrohPairingDescriptor, type IrohState, type IrohStatus, type IrohTlsCertificate, type IrohTlsPaths, type LocalExtensionManifest, type MobileAccessControlState, type MobileAccessControlStore, type MobileAccessService as MobileAccessRegistry, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type MobileWorkerHostApi, type OriginConfigurationStatus, type OriginControllerOptions, type OriginSettings, type OriginState, type OriginStatus, type PairingDescriptorField, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, type ResolvedGatewayConfig, type ResolvedHostExecutionConfig, type ServerCertificateAuthority, type ServerCertificateFiles, type ServerCertificateTarget, type SessionAuthorization, type SessionEndReason, type StoredDevice, type TaskCompletionEvent, type TaskEventContext, type TaskEventSession, type TaskEventSink, type TaskEventWatcherOptions, type TaskTurnEvent, type TlsConfig };
 //# sourceMappingURL=index.d.mts.map