dsh-over-ssh 0.1.0 → 0.2.0

package/lib/types/src/host/infra/transport/ssh/ssh2-transport.d.ts

@@ -27,6 +27,7 @@ import type { HostKeyPolicy } from '../../../domain/roots/connection.ts';
 import { SshDevError } from '../../../domain/errors.ts';
 import { type ExecRequest, type ExecResult, type ReadFileRangeRequest, type ReadFileRequest, type RemoteFileChunk, type RemoteWriteOutcome, type RemoveRequest, type RenameRequest, type Transport, type WriteFileRangeRequest, type WriteFileRequest } from '../transport.ts';
 import { TransportBase } from '../transport-base.ts';
+import type { ForwardHandle, ForwardRequest } from '../forward.ts';
 /** Authentication material for one hop. */
 export interface Ssh2Auth {
     readonly password?: string;
@@ -227,6 +228,10 @@ export declare class Ssh2Transport extends TransportBase implements Transport {
      */
     connect(signal?: AbortSignal): Promise<void>;
     /** Close the session. Idempotent. */
+    /** {@inheritDoc Transport.forward} */
+    forward(request: ForwardRequest, signal?: AbortSignal): Promise<ForwardHandle>;
+    /** {@inheritDoc Transport.closeForwards} */
+    closeForwards(): Promise<void>;
     dispose(): Promise<void>;
     /** Run one remote command over a channel of the shared session. */
     exec(request: ExecRequest, signal?: AbortSignal): Promise<ExecResult>;
@@ -325,4 +330,3 @@ export declare function sftpError(operation: string, path: string, error?: Error
  * session.
  */
 export declare const defaultConnector: Ssh2Connector;
-//# sourceMappingURL=ssh2-transport.d.ts.map

package/lib/types/src/host/infra/transport/transport-base.d.ts

@@ -31,4 +31,3 @@ export declare abstract class TransportBase {
     /** Forget the probe (a reconnect must not keep a stale timestamp). */
     protected clearProbed(): void;
 }
-//# sourceMappingURL=transport-base.d.ts.map

package/lib/types/src/host/infra/transport/transport.d.ts

@@ -7,6 +7,7 @@
  *
  * @module dsh-over-ssh/infra/transport/transport
  */
+import type { ForwardHandle, ForwardRequest } from './forward.ts';
 import type { RemoteCapabilities } from '../../domain/capability.ts';
 /** Lifecycle of one transport instance. */
 export type TransportState = 'idle' | 'connecting' | 'ready' | 'lost';
@@ -35,6 +36,15 @@ export interface ExecRequest {
      * *encoded* payload into the file, i.e. silent corruption).
      */
     readonly stdinBase64?: string;
+    /**
+     * Landlock write fence: when non-empty, the command may only write under these roots.
+     *
+     * **Tier 2 only.** The agent builds the fence before `exec` and refuses with `REMOTE_UNSUPPORTED` when it
+     * cannot (no Landlock, missing root); a Tier 1 transport has no fence at all and must refuse the field
+     * rather than silently run unfenced — "the fence was requested but skipped" is a security lie, not a
+     * degradation. Surfaced through `limits.execWriteFence`.
+     */
+    readonly writeRoots?: readonly string[];
 }
 /** One finished remote command. */
 export interface ExecResult {
@@ -458,6 +468,22 @@ export interface Transport {
      * hunk matching rules, which is where a patch applier goes wrong.
      */
     patchFile?(request: PatchFileRequest, signal?: AbortSignal): Promise<PatchFileResult>;
+    /**
+     * 建立一条本地 → 远端的 TCP 转发（端口转发）。
+     *
+     * 可选：**系统 ssh 的两条路径（Tier 1 与默认 Tier 2）都实现了它**，`ssh2` 传输没有——那一条会诚实
+     * 地不声明这个方法，调用方据此报"该连接不支持端口转发"，而不是给一个连不上的端口。
+     *
+     * 只绑 `127.0.0.1`：转发出来的端口是给本机浏览器/客户端用的，绑 `0.0.0.0` 等于把一个远端服务暴露给
+     * 整个局域网。要给别人用请走 SSH 自己的 `GatewayPorts` 配置，而不是让插件默认放宽。
+     *
+     * @param request - 远端目标与可选本地端口。
+     * @param signal - 取消建立过程（已建立的转发不会因此关闭）。
+     * @returns 句柄，`localPort` 一定是真实端口（自动选择时也回填）。
+     */
+    forward?(request: ForwardRequest, signal?: AbortSignal): Promise<ForwardHandle>;
+    /** 关掉这条传输上的所有转发（dispose 时调用）；幂等。 */
+    closeForwards?(): Promise<void>;
     /** Native delete (`fs.remove`); absent on Tier 1, which uses its shell primitive instead. */
     removePath?(request: RemovePathRequest, signal?: AbortSignal): Promise<void>;
     /** Native rename/move (`fs.rename`); absent on Tier 1, which uses its shell primitive. */
@@ -522,6 +548,20 @@ export interface Transport {
 }
 /** Encode bytes as base64 without line wrapping. */
 export declare function encodeBase64(bytes: Uint8Array): string;
-/** Decode base64, ignoring line breaks produced by remote tooling. */
+/**
+ * Decode base64, ignoring line breaks produced by remote tooling.
+ *
+ * **两次多余的整串处理被去掉了**（审计 0112 P3-2）：
+ *
+ *  1. `text.replace(/\s+/g, '')` 先把整串扫一遍去掉空白。Node 的 base64 解码**本来就忽略空白**
+ *     （`\n` / `\r\n` / 空格 / 制表符都已实测逐字节等价，见本函数下方的测试），所以这一遍纯属浪费：
+ *     9 MiB 负载（12.7 MB base64）实测 17.3 ms → 7.1 ms。
+ *  2. `new Uint8Array(...)` 把解码结果再拷一遍。4 KiB 以上的解码本来就不走 Buffer 的共享池，
+ *     `Buffer.from(str, 'base64')` 的返回对象已经是独占、正好大小的 `Uint8Array`，直接交出去即可
+ *     （9 MiB 的一次拷贝实测 1.4 ms，而它正是这条读路径上最大的一块）。
+ *
+ * **小结果仍然拷一次，这是有意的**：`Buffer.from(string)` 在 4 KiB 以下会落进 Node 的 64 KiB 共享池，
+ * 原样返回会让一个几十字节的缓存值长期钉住 64 KiB（读缓存按 `byteLength` 记账，看不见这块）。
+ * 那次拷贝是几十字节，与热路径无关。
+ */
 export declare function decodeBase64(text: string): Uint8Array;
-//# sourceMappingURL=transport.d.ts.map

package/lib/types/src/host/integration/agent/agent-preflight.d.ts

@@ -53,4 +53,3 @@ export interface AgentPreflight {
  * @returns the preflight, an installation lookup, and a way to forget a connection.
  */
 export declare function createAgentPreflight(options: AgentPreflightOptions): AgentPreflight;
-//# sourceMappingURL=agent-preflight.d.ts.map

package/lib/types/src/host/integration/fs/file-reference-provider.d.ts

@@ -139,4 +139,3 @@ export declare class RemoteFileReferenceService extends FileReferenceService {
     list(agent: Agent, query: string, signal: AbortSignal): Promise<FileReferenceCandidate[]>;
 }
 export default RemoteFileReferenceService;
-//# sourceMappingURL=file-reference-provider.d.ts.map

package/lib/types/src/host/integration/fs/fs-provider.d.ts

@@ -101,7 +101,6 @@ export interface RoutedFsProviderOptions {
  * model's file tools follow the router (see `cordis.patch.yml`).
  */
 export declare class RoutedFsProvider extends FileSystem {
-    #private;
     static inject: string[];
     protected readonly rangeReader: BackendRangeReader | undefined;
     protected readonly rangeChunkBytes: number;
@@ -285,7 +284,24 @@ export declare class RoutedFsProvider extends FileSystem {
      */
     private syncSessionRoots;
     private routedTarget;
-    /** Enforce the per-call policy and the root's own writability. */
+    /**
+     * Enforce the per-call policy and the root's own writability.
+     *
+     * Three gates, in order:
+     *  1. `read-only` denies every mutation (the platform's own contract);
+     *  2. a root registered `writable: false` denies;
+     *  3. under **`workspace-write`**, the target must be inside the session's workspace — where "workspace"
+     *     includes the directories **this session added** (product decision 2026-11-04: 「添加到会话的目录」=
+     *     该目录临时成为 workspace 的一部分). Before that decision the plugin admitted every writable root it
+     *     could route, which made the mode wider than the platform's own `fs-sandbox` fence
+     *     (`workspace-write` = "canonicalizes under `workspaceRoot` or the platform temp area").
+     *
+     * A call without a per-call policy keeps the historical behaviour (the mode comes from
+     * {@link sandboxMode}); the area rule needs `workspaceRoot`, which only the policy carries.
+     *
+     * @param routed - the resolved target.
+     * @param policy - the per-call sandbox policy the tool layer resolved.
+     */
     private assertWritable;
     /**
      * Previous text content, when it is readable text inside the cap; `undefined` otherwise.
@@ -365,4 +381,3 @@ export declare function createBackendRangeReader(store: (backend: Backend, offse
 export declare function toFsError(error: SshDevError): FsError;
 /** Codes this provider can surface, exported for tests that assert the mapping table. */
 export declare const MAPPED_DOMAIN_CODES: readonly SshDevErrorCode[];
-//# sourceMappingURL=fs-provider.d.ts.map

package/lib/types/src/host/integration/transfer/transfer-service.d.ts

@@ -209,4 +209,3 @@ export declare const RESUME_VERIFY_BYTES: number;
  * @returns the upload/download operations; no state is kept between calls.
  */
 export declare function createTransferService(dependencies: TransferDependencies): TransferService;
-//# sourceMappingURL=transfer-service.d.ts.map

package/lib/types/src/index.d.ts

@@ -1,3 +1,18 @@
+/**
+ * The host plugin entry: configuration, services and the object graph behind this plugin.
+ *
+ * It provides two services and nothing else, deliberately:
+ *
+ *  - `sshDevConnections` — the validated connection profiles (secrets referenced by credential key).
+ *  - `sshDevRoots` — the {@link RootRegistry} the `ctx.fs` provider (`dsh-over-ssh/fs`) injects.
+ *
+ * Transports are constructed lazily and owned by a {@link TransportService}, so a client half (or a
+ * root added at runtime) simply calls into the registry and everything else follows. Nothing here
+ * reads a secret eagerly: passwords live in `ctx.credentials` and are resolved when a connection is
+ * actually opened.
+ *
+ * @module dsh-over-ssh
+ */
 import { Context } from '@deepseek-ai/cordis';
 import { TransportService } from './host/app/transport/transport-service.ts';
 import { Config } from './config.ts';
@@ -54,6 +69,14 @@ declare module '@deepseek-ai/cordis' {
         sshDevSessionAdmin: SessionAdminService;
     }
 }
+/**
+ * Read a session log's header line.
+ *
+ * The bounded reader lives in {@link createDiskSessionHeaderReader} rather than here: a composition root
+ * cannot be exercised by a test (审计 0046 记录了同款教训), and a reader whose *memory bound* is its whole
+ * contract must have one. The previous inline version read the entire log before slicing 256 KiB off it —
+ * measured at 105.3 MiB of reads for this machine's 73 sessions, worst single log 10.9 MiB (审计 0050).
+ */
 /**
  * Install the plugin.
  *
@@ -63,4 +86,3 @@ declare module '@deepseek-ai/cordis' {
  */
 export { Config };
 export declare function apply(ctx: Context, config: ResolvedConfig): void;
-//# sourceMappingURL=index.d.ts.map

package/lib/types/src/local-bridge-refs.d.ts

@@ -23,4 +23,3 @@ export default class LocalFileReferencesBridge {
     static inject: readonly ["fileReferences"];
     constructor(ctx: Context);
 }
-//# sourceMappingURL=local-bridge-refs.d.ts.map

package/lib/types/src/local-bridge.d.ts

@@ -33,4 +33,3 @@ export default class LocalFsBridge {
     static inject: readonly ["fs"];
     constructor(ctx: Context);
 }
-//# sourceMappingURL=local-bridge.d.ts.map

package/lib/types/src/shared/root-keys.d.ts

@@ -0,0 +1,120 @@
+/**
+ * 根路径与根键的**唯一拼写规则**：client 与 host 两侧都 import 这一份。
+ *
+ * 为什么在 `shared/`：这三条规则此前各有两份实现，而每一对都已经分叉过一次（审计 0112 P2-11）：
+ *
+ *  - **根键**：客户端拼 `local:<原样路径>`，宿主拼 `local:<规范化路径>`（Windows 上还折叠大小写）。
+ *    0024 §8.3 的"删除按钮发出宿主匹配不上的键"就是这个分叉的直接后果——面板把那行显示出来，
+ *    点删除却什么也没发生，而两边各自的用例都是绿的；
+ *  - **绝对本地路径**：宿主不认 `\\server\share`（它先规范化再判断，所以只认 `//server/share`），
+ *    客户端认。同一个 UNC 路径在两半得到相反的答案；
+ *  - **远端父目录**：客户端自己 `lastIndexOf('/')`，宿主的 `remoteDirname` 先规范化（`/a//b/` 与
+ *    `/a/b` 因此是不同的答案）。
+ *
+ * `shared/` 是两侧唯一都能 import 的位置：`tests/architecture.test.ts` 规定 client 只能依赖
+ * `client` 与 `shared`，而 `shared` 只能依赖自己。这也是 `routes.ts` / `format.ts` 住在这里的理由。
+ *
+ * 本模块是**纯函数**，且**不读 `process`**：它会被打进浏览器 bundle（`platform: 'browser'`），
+ * 那里没有 `process`。平台相关的决定由调用方作为参数传进来——见 {@link rootKeySpelling} 的
+ * `caseInsensitive`：宿主的 `domain/roots/root.ts` 传 `process.platform === 'win32'`，客户端不猜。
+ *
+ * 三个函数都是**全函数**（不抛错）：宿主那一侧的错误策略（`SshDevError('ROOT_INVALID')`）留在
+ * `domain/` 里，因为客户端在 reducer 里抛错等于把界面炸掉。所以这里能共享的是**规则**，不是
+ * "遇到坏输入怎么办"。
+ *
+ * @module dsh-over-ssh/shared/root-keys
+ */
+/** Where a root lives: on this machine, or behind a connection. */
+export type RootLocation = 'local' | 'remote';
+/**
+ * One option bag for every spelling rule here.
+ *
+ * Only `caseInsensitive` exists today, and only for **local** paths: a Windows host folds case in the
+ * registry, a POSIX host does not, and a browser cannot know which. So the decision travels as an argument
+ * instead of being read from `process` inside a function that both halves call.
+ */
+export interface RootKeyOptions {
+    /** Fold case in a local path/key. Defaults to `false` — "keep the caller's case". */
+    readonly caseInsensitive?: boolean;
+}
+/**
+ * Whether a host path is absolute in either the Windows or the POSIX spelling.
+ *
+ * Both UNC spellings are accepted: `\\server\share` (what a Windows operator types) and `//server/share`
+ * (what {@link normalizeLocalPath} produces). The host used to accept only the second, the client only the
+ * first — so the panel and `makeLocalRoot` disagreed about the same string.
+ *
+ * @param path - candidate host path.
+ * @returns whether it names an absolute host path.
+ */
+export declare function isAbsoluteLocalPath(path: string): boolean;
+/**
+ * Normalize a host path for comparison: separators to `/`, `.`/`..` resolved, trailing separators dropped,
+ * and (optionally) the drive letter and case folded.
+ *
+ * Total: a relative spelling comes back as a relative spelling (`src` → `src`). The caller decides whether
+ * that is an error (the host's `makeLocalRoot`/`validateRoot` check {@link isAbsoluteLocalPath} after this).
+ *
+ * @param path - host path in either separator spelling.
+ * @param options - `caseInsensitive` folds case for comparison keys.
+ * @returns the normalized path.
+ */
+export declare function normalizeLocalPath(path: string, options?: RootKeyOptions): string;
+/**
+ * Normalize an absolute POSIX path: repeated separators collapsed, `.`/`..` resolved, trailing separators
+ * dropped (except for the root).
+ *
+ * Total: `undefined` means "not an absolute POSIX spelling". The host's `normalizeRemotePath` is the same
+ * rule plus the `SshDevError('ROOT_INVALID')` policy on top.
+ *
+ * @param path - candidate absolute POSIX path.
+ * @returns the normalized path, or `undefined` when the spelling is not absolute.
+ */
+export declare function normalizePosixPath(path: string): string | undefined;
+/**
+ * The parent directory of a **normalized** absolute POSIX path; the root's parent is `/`.
+ *
+ * One rule, two policies on top: the host's `remoteDirname` answers `/` for the root (a root's parent is
+ * itself, which is what its callers assume), while the directory browser's `parentRemotePath` answers
+ * `undefined` there (the "up" button must be disabled). The separator arithmetic is not repeated.
+ *
+ * @param normalized - an absolute POSIX path already passed through {@link normalizePosixPath}.
+ * @returns the parent directory.
+ */
+export declare function posixDirname(normalized: string): string;
+/**
+ * The key one root answers to, spelled the way **both halves** must spell it:
+ * `local:<normalized local path>` or `remote:<connectionId>:<normalized POSIX path>`.
+ *
+ * This is the string a client sends back to remove a root and the string the registry stores, so the two
+ * have to be the same function — the earlier client spelling (`local:-:<path>`, then `local:<raw path>`)
+ * produced keys the host could not match (audit 0024 §8.3, §8.5).
+ *
+ * Case is **not** folded here unless the caller asks: the host passes `{ caseInsensitive: process.platform
+ * === 'win32' }` (that is where its registry folds), and the client passes nothing because it cannot know
+ * the host's platform. Case-differing keys are therefore matched by {@link rootKeyIdentity} (the client's
+ * join) and by the host's own `sameRootKey`/`liveKeyFor` comparison — never by string equality on the key.
+ *
+ * @param location - local or remote.
+ * @param path - host path (either separator spelling) or absolute POSIX path.
+ * @param connectionId - the connection for a remote root; absent spells `remote::<path>` (the client's
+ *   fallback for a malformed answer — the host rejects such a root before it ever gets here).
+ * @param options - `caseInsensitive` folds case in a local key.
+ * @returns the key.
+ */
+export declare function rootKeySpelling(location: RootLocation, path: string, connectionId?: string, options?: RootKeyOptions): string;
+/**
+ * The identity two root keys are joined by: `local:` keys compare **case-insensitively**, remote keys do not.
+ *
+ * Why unconditional for local: the host's registry folds a Windows local path to lower case while the panel's
+ * own file keeps the caller's case, so "the same root" routinely arrives with two spellings. The host has
+ * always compared this way (`sameRootKey` in `app/roots/user-roots.ts`, out of this change's write scope);
+ * this is the client's half of the same rule, and without it a live root reads as "not in the file", which
+ * silently removes its delete button (audit 0024 §8.5).
+ *
+ * Remote paths are POSIX and therefore case-sensitive, so their keys are compared verbatim.
+ *
+ * @param key - one root key (or anything shaped like one).
+ * @returns the join identity.
+ */
+export declare function rootKeyIdentity(key: string): string;

package/lib/types/src/wiring/helpers.d.ts

@@ -141,4 +141,3 @@ export interface CredentialsLike {
 }
 /** 会话日志头读取器（原先在 index.ts 底部，被 tools 段的会话管理使用）。 */
 export declare const readSessionHeader: (dir: string) => Promise<import("../host/app/session-admin/session-admin-contract.ts").SessionHeader | undefined>;
-//# sourceMappingURL=helpers.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-over-ssh",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "SSH remote development for DeepSeek Harness: connections (key/password/ProxyJump/ssh config), remote files without sync, remote terminal, remote workspaces, remote @-completion, upload/download.",
   "type": "module",
   "main": "lib/index.js",
@@ -56,12 +56,14 @@
     "typecheck:client": "tsc -p tsconfig.client.json --pretty false",
     "build:client": "node tools/build-client.mjs --check",
     "build:host": "node tools/build-host.mjs",
-    "build": "npm run build:host && npm run build:terminal-wrapper && npm run build:client && npm run build:types:client",
+    "build": "npm run build:host && npm run build:types && npm run build:terminal-wrapper && npm run build:client",
     "agents": "node tools/agent-manifest.mjs generate --from ../dsh-over-ssh-agent/dist --out agents/agent-manifest.json --copy-to agents --platforms linux-amd64,linux-arm64 --require-provenance",
     "build:types:client": "node ./node_modules/typescript/bin/tsc -p tsconfig.client.types.json --pretty false",
     "prepack": "npm run build && node tools/prepack-agents.mjs && node tools/release-note.mjs --check",
     "build:terminal-wrapper": "node tools/build-terminal-wrapper.mjs",
-    "release:note": "node tools/release-note.mjs"
+    "release:note": "node tools/release-note.mjs",
+    "build:types:host": "node ./node_modules/typescript/bin/tsc -p tsconfig.host.types.json",
+    "build:types": "node tools/clean-types.mjs && npm run build:types:host && npm run build:types:client && node tools/prune-types.mjs"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",

package/lib/types/src/client/controls.d.ts

@@ -1,131 +0,0 @@
-/**
- * The controls the three surfaces share, as plain `createElement` templates.
- *
- * **No hooks, on purpose.** `:hover`, `:active`, `:focus-visible` and `:disabled` come from the stylesheet in
- * [`styles.ts`](./styles.ts) via class names, because a component holding `useState` cannot be rendered by
- * this repository's tests: they call the section functions **directly**, outside any React render, where a
- * hook throws `Invalid hook call`. Classes keep the templates pure element trees — a test walks the returned
- * tree and reads the same `type` / `name` / `disabled` / `role` it always did — while the browser still gets
- * real interaction states.
- *
- * These are deliberately **not** the platform's `dsh-client-ui-primitives` atoms: those factories import
- * per-component CSS modules, which a third-party bundle cannot supply (the loader materialises only
- * registered factories), and the package is not a dependency of this repository. `styles.ts` carries the
- * tokens those atoms are built from.
- *
- * @module dsh-remote-workspace/client/controls
- */
-import { type ChangeEvent, type ReactNode } from 'react';
-/** The sizes a control may have. */
-export type ControlSize = 'normal' | 'compact';
-/** The visual weight of a button. */
-export type ButtonVariant = 'primary' | 'secondary' | 'ghost' | 'row' | 'chip';
-/** Props every control shares: extra classes from the caller. */
-export interface ControlClassProps {
-    /** Extra classes from the caller; appended after the vocabulary's own. */
-    readonly className?: string;
-}
-/**
- * The part of a keyboard event a card's Esc handler reads.
- *
- * Structural, so the pure templates need no DOM types and a test drives the handler with a plain object. It is
- * assignable from React's `KeyboardEvent` (which carries both members), and it is the whole reason a dialog
- * closes on Esc: the shell focuses into the card when it opens, so the event reaches the card's own handler.
- */
-export interface KeyEventLike {
-    /** The key name, e.g. `'Escape'`. */
-    readonly key?: string;
-    /** Stop the platform's own Esc handling from also firing while the dialog is up. */
-    stopPropagation?(): void;
-}
-/** True when the event is the Esc key. */
-export declare function isEscape(event: KeyEventLike): boolean;
-/**
- * One button.
- *
- * @param props - the button's own props plus the variants this plugin uses.
- * @returns the button element.
- */
-export declare function Button(props: ControlClassProps & {
-    readonly variant: ButtonVariant;
-    readonly size?: ControlSize;
-    readonly type?: 'button' | 'submit';
-    readonly disabled?: boolean;
-    readonly name?: string;
-    readonly title?: string;
-    readonly onClick?: () => void;
-    readonly children?: ReactNode;
-}): ReactNode;
-/** Props of a text input, narrowed to what the templates pass. */
-export interface TextInputProps extends ControlClassProps {
-    readonly id: string;
-    readonly name: string;
-    readonly value: string;
-    readonly disabled?: boolean;
-    readonly placeholder?: string;
-    readonly inputMode?: 'numeric';
-    /** `password` for a secret field: the browser masks it and no autofill offers to save it. */
-    readonly type?: 'text' | 'password';
-    readonly autoComplete?: 'off' | 'new-password';
-    readonly size?: ControlSize;
-    readonly onChange: (event: ChangeEvent<HTMLInputElement>) => void;
-}
-/**
- * One text input, with the platform's border, inset surface and focus ring.
- *
- * @param props - the input's own props.
- * @returns the input element.
- */
-export declare function TextInput(props: TextInputProps): ReactNode;
-/** One option of a {@link Select}. */
-export interface SelectOption {
-    readonly value: string;
-    readonly label: string;
-}
-/**
- * A `<select>` over a fixed list of options.
- *
- * @param props - id, name, the current value, the options and the change handler.
- * @returns the select element.
- */
-export declare function Select(props: ControlClassProps & {
-    readonly id: string;
-    readonly name: string;
-    readonly value: string;
-    readonly options: readonly SelectOption[];
-    readonly disabled?: boolean;
-    readonly size?: ControlSize;
-    readonly onChange: (value: string) => void;
-}): ReactNode;
-/**
- * A labelled field: the caption above its control, so the column and its label move together.
- *
- * @param props - the label text, the control's id and the control itself.
- * @returns the labelled column.
- */
-export declare function Field(props: {
-    readonly label: string;
-    readonly htmlFor: string;
-    readonly children: ReactNode;
-}): ReactNode;
-/**
- * An inline notice block: the surface for a refusal, a host warning or "no host data".
- *
- * @param props - `warn` for something the operator may need to act on, `info` for a neutral status.
- * @returns the notice element carrying the role its caller needs (`alert` / `note` / `status`).
- */
-export declare function Notice(props: {
-    readonly role: 'alert' | 'note' | 'status';
-    readonly tone?: 'warn' | 'info';
-    readonly children: ReactNode;
-}): ReactNode;
-/**
- * The status dot of a connection row, so the row's state is not carried by colour alone.
- *
- * @param props - the dot's accessible description.
- * @returns the dot element.
- */
-export declare function StatusDot(props: {
-    readonly label: string;
-}): ReactNode;
-//# sourceMappingURL=controls.d.ts.map

package/lib/types/src/client/core/card-focus-trap.d.ts

@@ -1,45 +0,0 @@
-/**
- * The **one** Tab trap every card in this plugin installs.
- *
- * Five surfaces are dialogs and every one of them has to keep Tab inside itself, for two different reasons:
- *
- *  - the settings-hosted cards sit **outside** the platform settings modal, whose own focus trap listens on
- *    `document` in the bubble phase and pulls focus back into its panel — a bubble-phase listener of ours would
- *    run after it (registration order) and could no longer tell which field Tab came from, so the trap has to
- *    be in the **capture** phase (audit 0090);
- *  - the overlay and composer cards are simply modals: Tab walking into the page behind them is a dialog the
- *    keyboard user leaves without dismissing.
- *
- * Both cases want the same mechanics, so they live here instead of being spelled out per surface (the two that
- * were first — the connection editor and the session-panel confirmation — each carried their own copy of the
- * same eight lines, and the two newer ones had none at all; audit 2026-10-31 `client.md` §2.3).
- *
- * The split is the same one the rest of `core/` uses: {@link installCardTabTrap} is pure and takes the document
- * as an argument (so an offline test drives it with a fake), and {@link useCardTabTrap} is the two-line React
- * binding.
- *
- * @module dsh-over-ssh/client/card-focus-trap
- */
-import { type PortalDocument } from './portal.ts';
-/**
- * Install the card's Tab trap on one document.
- *
- * Capture phase on purpose: see the module note. The listener is removed with the same `options` value, so a
- * runtime that keys listeners by phase cannot leak one.
- *
- * @param doc - the page's document, or `undefined` off-browser (where this is a no-op).
- * @param container - the card's body-level container; `undefined` while it is not attached.
- * @returns the remover; safe to call more than once.
- */
-export declare function installCardTabTrap(doc: PortalDocument | undefined, container: unknown): () => void;
-/**
- * Trap Tab while a card is open.
- *
- * `open` is the caller's own condition (`editingId !== undefined`, `pending !== undefined`, `request !==
- * undefined`); the container comes from that surface's portal. Nothing is installed while the card is closed, so
- * the settings panel keeps its own Tab behaviour the rest of the time.
- *
- * @param open - whether the card is up.
- * @param container - the card's container from its portal.
- */
-export declare function useCardTabTrap(open: boolean, container: unknown): void;