mindwire 0.1.38 → 0.1.41

package/README.md

@@ -23,6 +23,25 @@ npm i mindwire
 
 ## Quick start
 
+To connect this computer to the Mindwire mobile app, install globally and run
+`mindwire connect`. Run `mindwire` for the interactive status and management menu.
+On a Mac, desktop access is a separate opt-in:
+
+```sh
+mindwire desktop enable   # Guided local Screen Sharing approval
+mindwire desktop          # Check setup or update the saved Mac login
+mindwire desktop disable  # Close desktop access and forget its login
+```
+
+The phone uses its existing paired SSH tunnel and never receives the Mac password.
+If macOS rejects the login, the CLI lets you retry the password or check Screen
+Sharing permissions. Canceling or entering a wrong password keeps the existing
+desktop setup and active connections unchanged.
+Opening a workspace or checking status does not enable screen access. See the
+[desktop contract](../../daemon/DESKTOP.md#personal-mac-desktop) for platform support,
+permissions and the shared input protocol. Existing installations need a release
+advertising `health().localDesktopVersion >= 1`.
+
 ```ts
 import { Mindwire } from "mindwire";
 

package/dist/chunk-4XNTGVCI.js

@@ -0,0 +1,306 @@
+import { websocketURL, readJSON, writeJSON, acquireProcessLock, computerClient, versionAtLeast } from './chunk-T2ZIA4TK.js';
+import { join } from 'path';
+import { setTimeout } from 'timers/promises';
+
+// src/computer/provider-info.ts
+function connectionAddress(relay, host) {
+  return relay.kind === "none" ? `ssh:${host ?? "network"}` : relay.url ? websocketURL(relay.url) : `temporary:${relay.kind}`;
+}
+function connectionInfo(relay, host) {
+  if (relay.kind === "none") return { provider: "direct", address: host ? "persistent" : "network" };
+  return { provider: relay.kind, address: ["cloudflare", "ngrok"].includes(relay.kind) && !relay.url ? "temporary" : "persistent" };
+}
+function connectionDescription(info) {
+  const name = { oblien: "Oblien", cloudflare: "Cloudflare", ngrok: "ngrok", custom: "Your tunnel", direct: "Direct SSH / VPN" }[info.provider];
+  if (info.address === "temporary") return `${name} \xB7 temporary address. For reconnect after a restart, run mindwire connection to choose a persistent address.`;
+  if (info.address === "network") return `${name} \xB7 reachable network required. Use a VPN hostname for access across networks.`;
+  return `${name} \xB7 persistent address. Saved phones retry automatically when this computer is online.`;
+}
+
+// src/computer/directory-http.ts
+var DirectoryRequestError = class extends Error {
+  constructor(status, code, retryAfter = 0) {
+    super(
+      status === 0 ? "Couldn't reach the address directory securely. Check its HTTPS address and retry." : `The address directory rejected the request (${code}).`
+    );
+    this.status = status;
+    this.code = code;
+    this.retryAfter = retryAfter;
+  }
+  status;
+  code;
+  retryAfter;
+};
+async function directoryRequest(url, path, body, signal) {
+  let response;
+  try {
+    response = await fetch(url + path, {
+      method: "POST",
+      redirect: "error",
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(1e4)]) : AbortSignal.timeout(1e4),
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+  } catch {
+    signal?.throwIfAborted();
+    throw new DirectoryRequestError(0, "unreachable");
+  }
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    if (reader)
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        length += value.byteLength;
+        if (length > 64 * 1024) throw new Error("The address directory returned an oversized response.");
+        chunks.push(value);
+      }
+  } finally {
+    void reader?.cancel().catch(() => {
+    });
+  }
+  let data;
+  try {
+    data = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new DirectoryRequestError(response.status, "invalid_response");
+  }
+  if (!response.ok) {
+    const error = data?.error;
+    const code = typeof error === "string" ? error : error?.code;
+    const retryAfter = Number(response.headers.get("Retry-After"));
+    throw new DirectoryRequestError(
+      response.status,
+      typeof code === "string" && /^[a-z_]{1,64}$/.test(code) ? code : "directory_error",
+      Number.isFinite(retryAfter) ? Math.max(0, Math.min(60, retryAfter)) : 0
+    );
+  }
+  return data;
+}
+
+// src/computer/discovery.ts
+var DIRECTORY_API_PATH = "/api/computer-directory/v1";
+var DIRECTORY_URL = `https://console.mindwire.sh${DIRECTORY_API_PATH}`;
+var discoveryPreference = (directory) => readJSON(join(directory, "computer-discovery-preference.json"));
+async function saveDiscoveryPreference(directory, value) {
+  const preference = { ...value, url: value.url ? directoryURL(value.url) : void 0 };
+  await writeJSON(join(directory, "computer-discovery-preference.json"), preference);
+}
+function directoryURL(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Enter the directory's HTTPS API URL.");
+  }
+  if (value.length > 2048 || /[\s\x00]/.test(value) || url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new Error("Use an HTTPS directory URL without credentials, a query, or a fragment.");
+  }
+  if (url.pathname === "/") url.pathname = DIRECTORY_API_PATH;
+  if (url.pathname.endsWith("/") || url.pathname.includes("//") || url.pathname.includes("%")) {
+    throw new Error("Use the exact directory API URL without a trailing slash.");
+  }
+  return url.href;
+}
+async function enableAddressDiscovery(options) {
+  const lock = await acquireProcessLock(join(options.directory, "discovery-setup.lock"), { signal: options.signal });
+  try {
+    let status;
+    try {
+      status = await options.computer.computer.discovery();
+    } catch (error) {
+      if (error.status === 404)
+        throw new Error("Update the Mindwire service before enabling automatic address recovery.");
+      throw error;
+    }
+    const preference = await discoveryPreference(options.directory);
+    if (options.reconcile && preference?.enabled === false) return status;
+    const url = directoryURL(
+      options.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? preference?.url ?? DIRECTORY_URL
+    );
+    if (status.url && status.url !== url && (status.enabled || (status.sequence ?? 0) !== (status.publishedSequence ?? 0))) {
+      throw new Error(
+        "Disable the current directory with mindwire discovery disable and wait for its withdrawal before changing the directory URL."
+      );
+    }
+    await saveDiscoveryPreference(options.directory, { enabled: true, url });
+    if (!status.enabled || status.url !== url || status.error?.includes("enrollment")) {
+      options.prompt.print(`Enabling encrypted address recovery with ${new URL(url).host}\u2026`);
+      try {
+        const challenge = await directoryRequest(url, "/registrations/challenge", {
+          directoryId: status.directoryId
+        }, options.signal);
+        if (typeof challenge?.challenge !== "string" || challenge.challenge.length < 16 || challenge.challenge.length > 2048) {
+          throw new Error("The address directory returned an invalid enrollment challenge.");
+        }
+        const proof = await options.computer.computer.directoryEnrollment(url, challenge.challenge);
+        const enrolled = await directoryRequest(url, "/registrations", proof, options.signal);
+        if (enrolled?.directoryId !== status.directoryId)
+          throw new Error("The directory acknowledged a different computer.");
+      } catch (error) {
+        if (error instanceof DirectoryRequestError) {
+          if (error.status === 404 || error.status === 501)
+            throw new Error(
+              "The address directory isn't available at this URL. Your existing connection still works; retry after the backend is deployed."
+            );
+          if (error.status === 409)
+            throw new Error(
+              "This computer's directory registration is revoked or conflicts with its saved identity. Contact the directory operator."
+            );
+          if (error.code === "account_required")
+            throw new Error(
+              "This directory still requires an account. Update its Mindwire backend to enable key-based registration, or choose another directory with --directory-url."
+            );
+          if (error.status === 401 || error.status === 403)
+            throw new Error(
+              "The directory couldn't verify this computer's key or challenge. Retry enrollment."
+            );
+          if (error.status === 429)
+            throw new Error(
+              "The directory's registration limit was reached. Retry later or use another directory."
+            );
+          if (error.status === 503)
+            throw new Error(
+              "The directory is temporarily unavailable or at capacity. Your existing connection still works."
+            );
+        }
+        throw error;
+      }
+      status = await options.computer.computer.configureDiscovery(true, url);
+    }
+    if (options.waitForPublication === false) return status;
+    const deadline = Date.now() + 15e3;
+    while (Date.now() < deadline) {
+      status = await options.computer.computer.discovery();
+      if (status.enabled && status.sequence && status.publishedSequence === status.sequence) return status;
+      if (status.error?.includes("enrollment") || status.error?.includes("older revision"))
+        throw new Error(status.error);
+      await setTimeout(250, void 0, { signal: options.signal });
+    }
+    throw new Error(
+      "Address recovery is configured and will retry in the background. Run mindwire discovery status to check publication."
+    );
+  } finally {
+    await lock?.close();
+  }
+}
+async function disableAddressDiscovery(directory, computer, reconcile = false) {
+  const lock = await acquireProcessLock(join(directory, "discovery-setup.lock"));
+  try {
+    const status = await computer.computer.discovery();
+    const preference = await discoveryPreference(directory);
+    if (reconcile && preference?.enabled === true) return status;
+    await saveDiscoveryPreference(directory, { enabled: false, url: status.url ?? preference?.url });
+    if (!status.enabled) return status;
+    return await computer.computer.configureDiscovery(false);
+  } finally {
+    await lock?.close();
+  }
+}
+async function reconcileAddressDiscovery(options) {
+  const preference = await discoveryPreference(options.directory);
+  const { discovery: status } = await options.computer.computer.info();
+  const automatic = options.config.relay.kind === "cloudflare" && !options.config.relay.url;
+  const enabled = preference?.enabled ?? (status?.enabled || automatic && !status?.url);
+  if (!enabled) {
+    if (preference?.enabled === false && status?.enabled) await disableAddressDiscovery(options.directory, options.computer, true);
+    return;
+  }
+  if (!status) throw new Error("Update the Mindwire service to enable automatic reconnection.");
+  const url = directoryURL(preference?.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? DIRECTORY_URL);
+  if (status.enabled && status.url === url && !status.error?.includes("enrollment")) return;
+  await enableAddressDiscovery({
+    ...options,
+    url,
+    waitForPublication: false,
+    reconcile: true,
+    prompt: {
+      print() {
+      },
+      open() {
+      },
+      question: async () => {
+        throw new Error("Unexpected interactive setup.");
+      },
+      secret: async () => {
+        throw new Error("Unexpected interactive setup.");
+      }
+    }
+  });
+}
+function discoveryDescription(status) {
+  if (!status?.enabled) return "Automatic address recovery is off. Enable it with mindwire discovery enable.";
+  if (status.error) return status.error;
+  return status.sequence && status.publishedSequence === status.sequence ? "Encrypted address recovery is on. Saved phones can find this computer when its tunnel address changes." : "Publishing the computer's encrypted address\u2026";
+}
+function activeUpdate(update) {
+  return !!update && ["queued", "downloading", "waiting", "restarting"].includes(update.status);
+}
+async function queueServiceUpdate(client, version, force = false) {
+  for (let attempt = 0; ; attempt++) {
+    const previous = await client.computer.updateStatus();
+    if (activeUpdate(previous) && (!force || previous.force)) return previous;
+    try {
+      return await client.computer.requestUpdate(activeUpdate(previous) ? previous.version : version, { force });
+    } catch (error) {
+      if (error.status !== 409 || attempt >= 2) throw error;
+    }
+  }
+}
+async function updateComputer(options) {
+  const version = options.version.replace(/^v/, "");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) throw new Error("Enter a Mindwire release version, such as 0.1.38.");
+  const connect = options.connect ?? (() => computerClient(options.directory));
+  const deadline = Date.now() + (options.timeoutMs ?? 12e4);
+  let requested, last = "";
+  for (; ; ) {
+    options.signal?.throwIfAborted();
+    if (!requested) {
+      const client = await connect();
+      const installed = (await client.health()).version.replace(/^v/, "");
+      if (installed === version || !options.allowDowngrade && versionAtLeast(installed, version))
+        return { version: installed, complete: true };
+      requested = await queueServiceUpdate(client, version, options.force);
+    }
+    const update = await readJSON(join(options.directory, "computer-update.json")) ?? requested;
+    if (update.id !== requested.id) {
+      requested = void 0;
+    } else {
+      const key = `${update.id}:${update.status}`;
+      if (last !== key) {
+        last = key;
+        options.onProgress?.(update);
+      }
+      if (update.status === "failed") throw new Error(update.error ?? "The service update failed. Run mindwire inspect for details.");
+      if (update.status === "complete") {
+        requested = void 0;
+        if (Date.now() < deadline) continue;
+      } else if (!options.force && update.status === "waiting") {
+        return { version, complete: false, update };
+      }
+    }
+    if (Date.now() >= deadline) return { version, complete: false, update };
+    await setTimeout(500, void 0, { signal: options.signal });
+  }
+}
+function updateProgress(update) {
+  const phase = {
+    idle: "Ready",
+    queued: "Queued",
+    downloading: "Downloading verified release\u2026",
+    waiting: "Waiting for active work to finish",
+    restarting: "Restarting service\u2026",
+    complete: "Installed",
+    failed: "Update failed"
+  };
+  return `${update.version} \xB7 ${phase[update.status]}`;
+}
+
+export { activeUpdate, connectionAddress, connectionDescription, connectionInfo, disableAddressDiscovery, discoveryDescription, discoveryPreference, enableAddressDiscovery, queueServiceUpdate, reconcileAddressDiscovery, saveDiscoveryPreference, updateComputer, updateProgress };
+//# sourceMappingURL=chunk-4XNTGVCI.js.map
+//# sourceMappingURL=chunk-4XNTGVCI.js.map

package/dist/chunk-4XNTGVCI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/computer/provider-info.ts","../src/computer/directory-http.ts","../src/computer/discovery.ts","../src/computer/service-update.ts"],"names":["delay","join"],"mappings":";;;;;AAKO,SAAS,iBAAA,CAAkB,OAAqB,IAAA,EAAuB;AAC5E,EAAA,OAAO,KAAA,CAAM,IAAA,KAAS,MAAA,GAAS,CAAA,IAAA,EAAO,QAAQ,SAAS,CAAA,CAAA,GACnD,KAAA,CAAM,GAAA,GAAM,aAAa,KAAA,CAAM,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,MAAM,IAAI,CAAA,CAAA;AACnE;AAGO,SAAS,cAAA,CAAe,OAAqB,IAAA,EAAuC;AACzF,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAQ,OAAO,EAAE,UAAU,QAAA,EAAU,OAAA,EAAS,IAAA,GAAO,YAAA,GAAe,SAAA,EAAU;AACjG,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,CAAM,IAAA,EAAM,OAAA,EAAS,CAAC,YAAA,EAAc,OAAO,CAAA,CAAE,QAAA,CAAS,MAAM,IAAI,CAAA,IAAK,CAAC,KAAA,CAAM,GAAA,GAAM,cAAc,YAAA,EAAa;AAClI;AAEO,SAAS,sBAAsB,IAAA,EAAsC;AAC1E,EAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,YAAY,YAAA,EAAc,KAAA,EAAO,OAAA,EAAS,MAAA,EAAQ,aAAA,EAAe,MAAA,EAAQ,kBAAA,EAAmB,CAAE,KAAK,QAAQ,CAAA;AAC5I,EAAA,IAAI,IAAA,CAAK,OAAA,KAAY,WAAA,EAAa,OAAO,GAAG,IAAI,CAAA,+GAAA,CAAA;AAChD,EAAA,IAAI,IAAA,CAAK,OAAA,KAAY,SAAA,EAAW,OAAO,GAAG,IAAI,CAAA,gFAAA,CAAA;AAC9C,EAAA,OAAO,GAAG,IAAI,CAAA,wFAAA,CAAA;AAChB;;;ACrBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,CACW,MAAA,EACA,IAAA,EACA,UAAA,GAAa,CAAA,EACtB;AACA,IAAA,KAAA;AAAA,MACE,MAAA,KAAW,CAAA,GACP,mFAAA,GACA,CAAA,4CAAA,EAA+C,IAAI,CAAA,EAAA;AAAA,KACzD;AARS,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAOX;AAAA,EATW,MAAA;AAAA,EACA,IAAA;AAAA,EACA,UAAA;AAQb,CAAA;AAGA,eAAsB,gBAAA,CAAoB,GAAA,EAAa,IAAA,EAAc,IAAA,EAAe,MAAA,EAAkC;AACpH,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,GAAM,IAAA,EAAM;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAC,CAAC,CAAA,GAAI,WAAA,CAAY,QAAQ,GAAM,CAAA;AAAA,MACpG,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACV;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA,EAAQ,cAAA,EAAe;AACvB,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,EAAG,aAAa,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACF,MAAA,WAAS;AACP,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AACV,QAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAChB,QAAA,IAAI,SAAS,EAAA,GAAK,IAAA,EAAM,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAC/F,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MACnB;AAAA,EACJ,CAAA,SAAE;AACA,IAAA,KAAK,MAAA,EAAQ,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,qBAAA,CAAsB,QAAA,CAAS,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,QAAS,IAAA,EAAqC,KAAA;AACpD,IAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,QAAS,KAAA,EAAqC,IAAA;AACvF,IAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AAC7D,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,QAAA,CAAS,MAAA;AAAA,MACT,OAAO,IAAA,KAAS,QAAA,IAAY,iBAAiB,IAAA,CAAK,IAAI,IAAI,IAAA,GAAO,iBAAA;AAAA,MACjE,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,UAAU,CAAC,CAAA,GAAI;AAAA,KACxE;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;ACvDO,IAAM,kBAAA,GAAqB,4BAAA;AAC3B,IAAM,aAAA,GAAgB,8BAA8B,kBAAkB,CAAA,CAAA;AAGtE,IAAM,sBAAsB,CAAC,SAAA,KAClC,SAA8B,IAAA,CAAK,SAAA,EAAW,oCAAoC,CAAC;AAIrF,eAAsB,uBAAA,CAAwB,WAAmB,KAAA,EAA2C;AAC1G,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,KAAA,EAAO,GAAA,EAAK,KAAA,CAAM,GAAA,GAAM,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA,GAAI,MAAA,EAAU;AACpF,EAAA,MAAM,SAAA,CAAU,IAAA,CAAK,SAAA,EAAW,oCAAoC,GAAG,UAAU,CAAA;AACnF;AAEO,SAAS,aAAa,KAAA,EAAuB;AAClD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AACA,EAAA,IACE,KAAA,CAAM,MAAA,GAAS,IAAA,IACf,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,IACrB,GAAA,CAAI,QAAA,IACJ,GAAA,CAAI,QAAA,IACJ,GAAA,CAAI,UACJ,GAAA,CAAI,IAAA,IACH,GAAA,CAAI,QAAA,KAAa,QAAA,IAChB,EAAE,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA,CAAA,EACzF;AACA,IAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,GAAA,EAAK,GAAA,CAAI,QAAA,GAAW,kBAAA;AACzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,GAAG,KAAK,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC3F,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,GAAA,CAAI,IAAA;AACb;AAEA,eAAsB,uBAAuB,OAAA,EAQR;AACnC,EAAA,MAAM,IAAA,GAAO,MAAM,kBAAA,CAAmB,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,sBAAsB,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAA;AACjH,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AAAA,IACrD,SAAS,KAAA,EAAO;AACd,MAAA,IAAK,MAA8B,MAAA,KAAW,GAAA;AAC5C,QAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,OAAA,CAAQ,SAAS,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,UAAA,EAAY,OAAA,KAAY,OAAO,OAAO,MAAA;AAG/D,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,OAAA,CAAQ,OAAO,OAAA,CAAQ,GAAA,CAAI,0BAA0B,MAAA,CAAO,GAAA,IAAO,YAAY,GAAA,IAAO;AAAA,KACxF;AACA,IAAA,IACE,MAAA,CAAO,GAAA,IACP,MAAA,CAAO,GAAA,KAAQ,GAAA,KACd,MAAA,CAAO,OAAA,IAAA,CAAY,MAAA,CAAO,QAAA,IAAY,CAAA,OAAQ,MAAA,CAAO,iBAAA,IAAqB,CAAA,CAAA,CAAA,EAC3E;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,wBAAwB,OAAA,CAAQ,SAAA,EAAW,EAAE,OAAA,EAAS,IAAA,EAAM,KAAK,CAAA;AACvE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,GAAA,KAAQ,OAAO,MAAA,CAAO,KAAA,EAAO,QAAA,CAAS,YAAY,CAAA,EAAG;AACjF,MAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,yCAAA,EAA4C,IAAI,IAAI,GAAG,CAAA,CAAE,IAAI,CAAA,MAAA,CAAG,CAAA;AACrF,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAwC,GAAA,EAAK,0BAAA,EAA4B;AAAA,UAC/F,aAAa,MAAA,CAAO;AAAA,SACtB,EAAG,QAAQ,MAAM,CAAA;AACjB,QAAA,IACE,OAAO,SAAA,EAAW,SAAA,KAAc,QAAA,IAChC,SAAA,CAAU,SAAA,CAAU,MAAA,GAAS,EAAA,IAC7B,SAAA,CAAU,SAAA,CAAU,MAAA,GAAS,IAAA,EAC7B;AACA,UAAA,MAAM,IAAI,MAAM,iEAAiE,CAAA;AAAA,QACnF;AACA,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,mBAAA,CAAoB,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1F,QAAA,MAAM,WAAW,MAAM,gBAAA,CAA0C,KAAK,gBAAA,EAAkB,KAAA,EAAO,QAAQ,MAAM,CAAA;AAC7G,QAAA,IAAI,QAAA,EAAU,gBAAgB,MAAA,CAAO,WAAA;AACnC,UAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,MACtE,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,qBAAA,EAAuB;AAC1C,UAAA,IAAI,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA;AAC3C,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,IAAA,KAAS,kBAAA;AACjB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA;AAC3C,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,QACJ;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,kBAAA,CAAmB,MAAM,GAAG,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,OAAA,CAAQ,kBAAA,KAAuB,KAAA,EAAO,OAAO,MAAA;AACjD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AACnD,MAAA,IAAI,MAAA,CAAO,WAAW,MAAA,CAAO,QAAA,IAAY,OAAO,iBAAA,KAAsB,MAAA,CAAO,UAAU,OAAO,MAAA;AAC9F,MAAA,IAAI,MAAA,CAAO,OAAO,QAAA,CAAS,YAAY,KAAK,MAAA,CAAO,KAAA,EAAO,SAAS,gBAAgB,CAAA;AACjF,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAC9B,MAAA,MAAMA,WAAM,GAAA,EAAK,KAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxD;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AACF;AAEA,eAAsB,uBAAA,CAAwB,SAAA,EAAmB,QAAA,EAAoB,SAAA,GAAY,KAAA,EAAyC;AACxI,EAAA,MAAM,OAAO,MAAM,kBAAA,CAAmB,IAAA,CAAK,SAAA,EAAW,sBAAsB,CAAC,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AACjD,IAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,SAAS,CAAA;AACtD,IAAA,IAAI,SAAA,IAAa,UAAA,EAAY,OAAA,KAAY,IAAA,EAAM,OAAO,MAAA;AACtD,IAAA,MAAM,uBAAA,CAAwB,SAAA,EAAW,EAAE,OAAA,EAAS,KAAA,EAAO,KAAK,MAAA,CAAO,GAAA,IAAO,UAAA,EAAY,GAAA,EAAK,CAAA;AAC/F,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AAC5B,IAAA,OAAO,MAAM,QAAA,CAAS,QAAA,CAAS,kBAAA,CAAmB,KAAK,CAAA;AAAA,EACzD,CAAA,SAAE;AAAU,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EAAG;AACnC;AAKA,eAAsB,0BAA0B,OAAA,EAE9B;AAChB,EAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,OAAA,CAAQ,SAAS,CAAA;AAC9D,EAAA,MAAM,EAAE,WAAW,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,IAAA,EAAK;AACnE,EAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,YAAA,IAAgB,CAAC,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,GAAA;AACtF,EAAA,MAAM,UAAU,UAAA,EAAY,OAAA,KAAY,QAAQ,OAAA,IAAW,SAAA,IAAa,CAAC,MAAA,EAAQ,GAAA,CAAA;AACjF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,IAAI,UAAA,EAAY,OAAA,KAAY,KAAA,IAAS,MAAA,EAAQ,OAAA,EAAS,MAAM,uBAAA,CAAwB,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,QAAA,EAAU,IAAI,CAAA;AAC7H,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAC5F,EAAA,MAAM,GAAA,GAAM,aAAa,UAAA,EAAY,GAAA,IAAO,QAAQ,GAAA,CAAI,sBAAA,IAA0B,MAAA,CAAO,GAAA,IAAO,aAAa,CAAA;AAC7G,EAAA,IAAI,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,GAAA,KAAQ,GAAA,IAAO,CAAC,MAAA,CAAO,KAAA,EAAO,QAAA,CAAS,YAAY,CAAA,EAAG;AACnF,EAAA,MAAM,sBAAA,CAAuB;AAAA,IAAE,GAAG,OAAA;AAAA,IAAS,GAAA;AAAA,IAAK,kBAAA,EAAoB,KAAA;AAAA,IAAO,SAAA,EAAW,IAAA;AAAA,IACpF,MAAA,EAAQ;AAAA,MAAE,KAAA,GAAQ;AAAA,MAAC,CAAA;AAAA,MAAG,IAAA,GAAO;AAAA,MAAC,CAAA;AAAA,MAAG,UAAU,YAAY;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAG,CAAA;AAAA,MACzG,QAAQ,YAAY;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAG;AAAA;AAAE,GAAG,CAAA;AACnF;AAEO,SAAS,qBAAqB,MAAA,EAAqD;AACxF,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,8EAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,OAAO,MAAA,CAAO,KAAA;AAChC,EAAA,OAAO,OAAO,QAAA,IAAY,MAAA,CAAO,iBAAA,KAAsB,MAAA,CAAO,WAC1D,wGAAA,GACA,mDAAA;AACN;ACtLO,SAAS,aAAa,MAAA,EAA8D;AACzF,EAAA,OAAO,CAAC,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU,aAAA,EAAe,SAAA,EAAW,YAAY,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA;AAC9F;AAIA,eAAsB,kBAAA,CAAmB,MAAA,EAAsB,OAAA,EAAiB,KAAA,GAAQ,KAAA,EAAgC;AACtH,EAAA,KAAA,IAAS,OAAA,GAAU,KAAK,OAAA,EAAA,EAAW;AACjC,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,YAAA,EAAa;AACpD,IAAA,IAAI,aAAa,QAAQ,CAAA,KAAM,CAAC,KAAA,IAAS,QAAA,CAAS,QAAQ,OAAO,QAAA;AACjE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAA,CAAO,QAAA,CAAS,aAAA,CAAc,YAAA,CAAa,QAAQ,CAAA,GAAI,QAAA,CAAS,OAAA,GAAU,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AAAA,IAC3G,SAAS,KAAA,EAAO;AACd,MAAA,IAAK,KAAA,CAA8B,MAAA,KAAW,GAAA,IAAO,OAAA,IAAW,GAAG,MAAM,KAAA;AAAA,IAE3E;AAAA,EACF;AACF;AAMA,eAAsB,eAAe,OAAA,EAKR;AAC3B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,MAAM,EAAE,CAAA;AAChD,EAAA,IAAI,CAAC,sCAAsC,IAAA,CAAK,OAAO,GAAG,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAC7H,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA,KAAY,MAAM,cAAA,CAAe,QAAQ,SAAS,CAAA,CAAA;AAC1E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,IAAK,QAAQ,SAAA,IAAa,IAAA,CAAA;AACpD,EAAA,IAAI,WAAuC,IAAA,GAAO,EAAA;AAClD,EAAA,WAAS;AACP,IAAA,OAAA,CAAQ,QAAQ,cAAA,EAAe;AAC/B,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,EAAQ;AAC7B,MAAA,MAAM,SAAA,GAAA,CAAa,MAAM,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,OAAA,CAAQ,MAAM,EAAE,CAAA;AAClE,MAAA,IAAI,cAAc,OAAA,IAAW,CAAC,QAAQ,cAAA,IAAkB,cAAA,CAAe,WAAW,OAAO,CAAA;AACvF,QAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,IAAA,EAAK;AAC9C,MAAA,SAAA,GAAY,MAAM,kBAAA,CAAmB,MAAA,EAAQ,OAAA,EAAS,QAAQ,KAAK,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAyBC,IAAAA,CAAK,QAAQ,SAAA,EAAW,sBAAsB,CAAC,CAAA,IAAK,SAAA;AAClG,IAAA,IAAI,MAAA,CAAO,EAAA,KAAO,SAAA,CAAU,EAAA,EAAI;AAE9B,MAAA,SAAA,GAAY,MAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,MAAM,MAAM,CAAA,EAAG,MAAA,CAAO,EAAE,CAAA,CAAA,EAAI,OAAO,MAAM,CAAA,CAAA;AACzC,MAAA,IAAI,SAAS,GAAA,EAAK;AAAE,QAAA,IAAA,GAAO,GAAA;AAAK,QAAA,OAAA,CAAQ,aAAa,MAAM,CAAA;AAAA,MAAG;AAC9D,MAAA,IAAI,MAAA,CAAO,WAAW,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,SAAS,8DAA8D,CAAA;AAC9H,MAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,QAAA,SAAA,GAAY,MAAA;AACZ,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAAA,MAC7B,WAAW,CAAC,OAAA,CAAQ,KAAA,IAAS,MAAA,CAAO,WAAW,SAAA,EAAW;AACxD,QAAA,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,KAAA,EAAO,MAAA,EAAO;AAAA,MAC5C;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,KAAI,IAAK,QAAA,SAAiB,EAAE,OAAA,EAAS,QAAA,EAAU,KAAA,EAAO,MAAA,EAAO;AACtE,IAAA,MAAMD,WAAM,GAAA,EAAK,MAAA,EAAW,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EACxD;AACF;AAEO,SAAS,eAAe,MAAA,EAAgC;AAC7D,EAAA,MAAM,KAAA,GAAkD;AAAA,IACtD,IAAA,EAAM,OAAA;AAAA,IAAS,MAAA,EAAQ,QAAA;AAAA,IAAU,WAAA,EAAa,oCAAA;AAAA,IAC9C,OAAA,EAAS,mCAAA;AAAA,IAAqC,UAAA,EAAY,0BAAA;AAAA,IAC1D,QAAA,EAAU,WAAA;AAAA,IAAa,MAAA,EAAQ;AAAA,GACjC;AACA,EAAA,OAAO,GAAG,MAAA,CAAO,OAAO,SAAM,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAA,CAAA;AACpD","file":"chunk-4XNTGVCI.js","sourcesContent":["import type { ComputerConnectionInfo } from \"../computer.js\";\nimport type { RelayOptions } from \"./relay.js\";\nimport { websocketURL } from \"./relay.js\";\n\n/** Credential renewal does not change the address already saved by the phone. */\nexport function connectionAddress(relay: RelayOptions, host?: string): string {\n  return relay.kind === \"none\" ? `ssh:${host ?? \"network\"}`\n    : relay.url ? websocketURL(relay.url) : `temporary:${relay.kind}`;\n}\n\n/** Public, non-secret metadata. Route/SSH identity is independent of provider credentials. */\nexport function connectionInfo(relay: RelayOptions, host?: string): ComputerConnectionInfo {\n  if (relay.kind === \"none\") return { provider: \"direct\", address: host ? \"persistent\" : \"network\" };\n  return { provider: relay.kind, address: [\"cloudflare\", \"ngrok\"].includes(relay.kind) && !relay.url ? \"temporary\" : \"persistent\" };\n}\n\nexport function connectionDescription(info: ComputerConnectionInfo): string {\n  const name = { oblien: \"Oblien\", cloudflare: \"Cloudflare\", ngrok: \"ngrok\", custom: \"Your tunnel\", direct: \"Direct SSH / VPN\" }[info.provider];\n  if (info.address === \"temporary\") return `${name} · temporary address. For reconnect after a restart, run mindwire connection to choose a persistent address.`;\n  if (info.address === \"network\") return `${name} · reachable network required. Use a VPN hostname for access across networks.`;\n  return `${name} · persistent address. Saved phones retry automatically when this computer is online.`;\n}\n","export class DirectoryRequestError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    readonly retryAfter = 0,\n  ) {\n    super(\n      status === 0\n        ? \"Couldn't reach the address directory securely. Check its HTTPS address and retry.\"\n        : `The address directory rejected the request (${code}).`,\n    );\n  }\n}\n\n/** Bounded, same-origin requests. No redirects, cookie jar or retained credentials. */\nexport async function directoryRequest<T>(url: string, path: string, body: unknown, signal?: AbortSignal): Promise<T> {\n  let response: Response;\n  try {\n    response = await fetch(url + path, {\n      method: \"POST\",\n      redirect: \"error\",\n      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: JSON.stringify(body),\n    });\n  } catch {\n    signal?.throwIfAborted();\n    throw new DirectoryRequestError(0, \"unreachable\");\n  }\n  const reader = response.body?.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    if (reader)\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        length += value.byteLength;\n        if (length > 64 * 1024) throw new Error(\"The address directory returned an oversized response.\");\n        chunks.push(value);\n      }\n  } finally {\n    void reader?.cancel().catch(() => {});\n  }\n  let data: unknown;\n  try {\n    data = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n  } catch {\n    throw new DirectoryRequestError(response.status, \"invalid_response\");\n  }\n  if (!response.ok) {\n    const error = (data as { error?: unknown } | null)?.error;\n    const code = typeof error === \"string\" ? error : (error as { code?: unknown } | null)?.code;\n    const retryAfter = Number(response.headers.get(\"Retry-After\"));\n    throw new DirectoryRequestError(\n      response.status,\n      typeof code === \"string\" && /^[a-z_]{1,64}$/.test(code) ? code : \"directory_error\",\n      Number.isFinite(retryAfter) ? Math.max(0, Math.min(60, retryAfter)) : 0,\n    );\n  }\n  return data as T;\n}\n","import { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport type { Mindwire } from \"../client.js\";\nimport type { ComputerDiscoveryStatus } from \"../computer.js\";\nimport { acquireProcessLock } from \"./lock.js\";\nimport type { SetupPrompt } from \"./setup-prompt.js\";\nimport { directoryRequest, DirectoryRequestError } from \"./directory-http.js\";\nimport { readJSON, writeJSON, type ComputerConfig } from \"./lifecycle.js\";\n\nexport const DIRECTORY_API_PATH = \"/api/computer-directory/v1\";\nexport const DIRECTORY_URL = `https://console.mindwire.sh${DIRECTORY_API_PATH}`;\n\nexport interface DiscoveryPreference { enabled: boolean; url?: string }\nexport const discoveryPreference = (directory: string) =>\n  readJSON<DiscoveryPreference>(join(directory, \"computer-discovery-preference.json\"));\n\n/** Desired setup is durable even if enrollment is temporarily offline. The\n * daemon remains the authority for signed publications and phone access. */\nexport async function saveDiscoveryPreference(directory: string, value: DiscoveryPreference): Promise<void> {\n  const preference = { ...value, url: value.url ? directoryURL(value.url) : undefined };\n  await writeJSON(join(directory, \"computer-discovery-preference.json\"), preference);\n}\n\nexport function directoryURL(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Enter the directory's HTTPS API URL.\");\n  }\n  if (\n    value.length > 2048 ||\n    /[\\s\\x00]/.test(value) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    (url.protocol !== \"https:\" &&\n      !(url.protocol === \"http:\" && [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname)))\n  ) {\n    throw new Error(\"Use an HTTPS directory URL without credentials, a query, or a fragment.\");\n  }\n  if (url.pathname === \"/\") url.pathname = DIRECTORY_API_PATH;\n  if (url.pathname.endsWith(\"/\") || url.pathname.includes(\"//\") || url.pathname.includes(\"%\")) {\n    throw new Error(\"Use the exact directory API URL without a trailing slash.\");\n  }\n  return url.href;\n}\n\nexport async function enableAddressDiscovery(options: {\n  directory: string;\n  computer: Mindwire;\n  prompt: SetupPrompt;\n  url?: string;\n  waitForPublication?: boolean;\n  signal?: AbortSignal;\n  reconcile?: boolean;\n}): Promise<ComputerDiscoveryStatus> {\n  const lock = await acquireProcessLock(join(options.directory, \"discovery-setup.lock\"), { signal: options.signal });\n  try {\n    let status: ComputerDiscoveryStatus;\n    try {\n      status = await options.computer.computer.discovery();\n    } catch (error) {\n      if ((error as { status?: number }).status === 404)\n        throw new Error(\"Update the Mindwire service before enabling automatic address recovery.\");\n      throw error;\n    }\n    const preference = await discoveryPreference(options.directory);\n    if (options.reconcile && preference?.enabled === false) return status;\n    // Preserve a saved private directory across upgrades. Credentials belonging\n    // to another provider are never read by this flow.\n    const url = directoryURL(\n      options.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? preference?.url ?? DIRECTORY_URL,\n    );\n    if (\n      status.url &&\n      status.url !== url &&\n      (status.enabled || (status.sequence ?? 0) !== (status.publishedSequence ?? 0))\n    ) {\n      throw new Error(\n        \"Disable the current directory with mindwire discovery disable and wait for its withdrawal before changing the directory URL.\",\n      );\n    }\n    await saveDiscoveryPreference(options.directory, { enabled: true, url });\n    if (!status.enabled || status.url !== url || status.error?.includes(\"enrollment\")) {\n      options.prompt.print(`Enabling encrypted address recovery with ${new URL(url).host}…`);\n      try {\n        const challenge = await directoryRequest<{ challenge: string }>(url, \"/registrations/challenge\", {\n          directoryId: status.directoryId,\n        }, options.signal);\n        if (\n          typeof challenge?.challenge !== \"string\" ||\n          challenge.challenge.length < 16 ||\n          challenge.challenge.length > 2048\n        ) {\n          throw new Error(\"The address directory returned an invalid enrollment challenge.\");\n        }\n        const proof = await options.computer.computer.directoryEnrollment(url, challenge.challenge);\n        const enrolled = await directoryRequest<{ directoryId: string }>(url, \"/registrations\", proof, options.signal);\n        if (enrolled?.directoryId !== status.directoryId)\n          throw new Error(\"The directory acknowledged a different computer.\");\n      } catch (error) {\n        if (error instanceof DirectoryRequestError) {\n          if (error.status === 404 || error.status === 501)\n            throw new Error(\n              \"The address directory isn't available at this URL. Your existing connection still works; retry after the backend is deployed.\",\n            );\n          if (error.status === 409)\n            throw new Error(\n              \"This computer's directory registration is revoked or conflicts with its saved identity. Contact the directory operator.\",\n            );\n          if (error.code === \"account_required\")\n            throw new Error(\n              \"This directory still requires an account. Update its Mindwire backend to enable key-based registration, or choose another directory with --directory-url.\",\n            );\n          if (error.status === 401 || error.status === 403)\n            throw new Error(\n              \"The directory couldn't verify this computer's key or challenge. Retry enrollment.\",\n            );\n          if (error.status === 429)\n            throw new Error(\n              \"The directory's registration limit was reached. Retry later or use another directory.\",\n            );\n          if (error.status === 503)\n            throw new Error(\n              \"The directory is temporarily unavailable or at capacity. Your existing connection still works.\",\n            );\n        }\n        throw error;\n      }\n      status = await options.computer.computer.configureDiscovery(true, url);\n    }\n    if (options.waitForPublication === false) return status;\n    const deadline = Date.now() + 15_000;\n    while (Date.now() < deadline) {\n      status = await options.computer.computer.discovery();\n      if (status.enabled && status.sequence && status.publishedSequence === status.sequence) return status;\n      if (status.error?.includes(\"enrollment\") || status.error?.includes(\"older revision\"))\n        throw new Error(status.error);\n      await delay(250, undefined, { signal: options.signal });\n    }\n    throw new Error(\n      \"Address recovery is configured and will retry in the background. Run mindwire discovery status to check publication.\",\n    );\n  } finally {\n    await lock?.close();\n  }\n}\n\nexport async function disableAddressDiscovery(directory: string, computer: Mindwire, reconcile = false): Promise<ComputerDiscoveryStatus> {\n  const lock = await acquireProcessLock(join(directory, \"discovery-setup.lock\"));\n  try {\n    const status = await computer.computer.discovery();\n    const preference = await discoveryPreference(directory);\n    if (reconcile && preference?.enabled === true) return status;\n    await saveDiscoveryPreference(directory, { enabled: false, url: status.url ?? preference?.url });\n    if (!status.enabled) return status;\n    return await computer.computer.configureDiscovery(false);\n  } finally { await lock?.close(); }\n}\n\n/** Runs once after startup and retries failed enrollment in the controller. A\n * healthy setup makes only a local status read: publication/renewal stays in Go.\n * Direct/VPN/custom connections never opt into a hosted directory implicitly. */\nexport async function reconcileAddressDiscovery(options: {\n  directory: string; config: ComputerConfig; computer: Mindwire; signal?: AbortSignal;\n}): Promise<void> {\n  const preference = await discoveryPreference(options.directory);\n  const { discovery: status } = await options.computer.computer.info();\n  const automatic = options.config.relay.kind === \"cloudflare\" && !options.config.relay.url;\n  const enabled = preference?.enabled ?? (status?.enabled || automatic && !status?.url);\n  if (!enabled) {\n    if (preference?.enabled === false && status?.enabled) await disableAddressDiscovery(options.directory, options.computer, true);\n    return;\n  }\n  if (!status) throw new Error(\"Update the Mindwire service to enable automatic reconnection.\");\n  const url = directoryURL(preference?.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? DIRECTORY_URL);\n  if (status.enabled && status.url === url && !status.error?.includes(\"enrollment\")) return;\n  await enableAddressDiscovery({ ...options, url, waitForPublication: false, reconcile: true,\n    prompt: { print() {}, open() {}, question: async () => { throw new Error(\"Unexpected interactive setup.\"); },\n      secret: async () => { throw new Error(\"Unexpected interactive setup.\"); } } });\n}\n\nexport function discoveryDescription(status: ComputerDiscoveryStatus | undefined): string {\n  if (!status?.enabled) return \"Automatic address recovery is off. Enable it with mindwire discovery enable.\";\n  if (status.error) return status.error;\n  return status.sequence && status.publishedSequence === status.sequence\n    ? \"Encrypted address recovery is on. Saved phones can find this computer when its tunnel address changes.\"\n    : \"Publishing the computer's encrypted address…\";\n}\n","import { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport type { ComputerUpdate } from \"../computer.js\";\nimport type { Mindwire } from \"../client.js\";\nimport { computerClient, readJSON } from \"./lifecycle.js\";\nimport { versionAtLeast } from \"../version.js\";\n\ntype UpdateClient = Pick<Mindwire, \"health\" | \"computer\">;\nexport function activeUpdate(update: ComputerUpdate | undefined): update is ComputerUpdate {\n  return !!update && [\"queued\", \"downloading\", \"waiting\", \"restarting\"].includes(update.status);\n}\n\n/** The daemon arbitrates requests. Join an earlier version before requesting the\n * next; promoting a request never creates a second download or bypasses its lease. */\nexport async function queueServiceUpdate(client: UpdateClient, version: string, force = false): Promise<ComputerUpdate> {\n  for (let attempt = 0; ; attempt++) {\n    const previous = await client.computer.updateStatus();\n    if (activeUpdate(previous) && (!force || previous.force)) return previous;\n    try {\n      return await client.computer.requestUpdate(activeUpdate(previous) ? previous.version : version, { force });\n    } catch (error) {\n      if ((error as { status?: number }).status !== 409 || attempt >= 2) throw error;\n      // Another caller won admission. Read the authoritative request and join it.\n    }\n  }\n}\n\nexport interface ServiceUpdateResult { version: string; complete: boolean; update?: ComputerUpdate }\n\n/** A CLI may close after queuing: the controller owns download/restart. Human\n * callers get a bounded result, including the exact older request being joined. */\nexport async function updateComputer(options: {\n  directory: string; version: string; force?: boolean; allowDowngrade?: boolean;\n  onProgress?: (update: ComputerUpdate) => void; signal?: AbortSignal; timeoutMs?: number;\n  connect?: () => Promise<UpdateClient>;\n}):\nPromise<ServiceUpdateResult> {\n  const version = options.version.replace(/^v/, \"\");\n  if (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) throw new Error(\"Enter a Mindwire release version, such as 0.1.38.\");\n  const connect = options.connect ?? (() => computerClient(options.directory));\n  const deadline = Date.now() + (options.timeoutMs ?? 120_000);\n  let requested: ComputerUpdate | undefined, last = \"\";\n  for (;;) {\n    options.signal?.throwIfAborted();\n    if (!requested) {\n      const client = await connect();\n      const installed = (await client.health()).version.replace(/^v/, \"\");\n      if (installed === version || !options.allowDowngrade && versionAtLeast(installed, version))\n        return { version: installed, complete: true };\n      requested = await queueServiceUpdate(client, version, options.force);\n    }\n    // Progress survives the short API outage during restart. Only the daemon\n    // accepts new requests; this read never changes or clears its status.\n    const update = await readJSON<ComputerUpdate>(join(options.directory, \"computer-update.json\")) ?? requested;\n    if (update.id !== requested.id) {\n      // A concurrent update completed/advanced first. Recheck the live service.\n      requested = undefined;\n    } else {\n      const key = `${update.id}:${update.status}`;\n      if (last !== key) { last = key; options.onProgress?.(update); }\n      if (update.status === \"failed\") throw new Error(update.error ?? \"The service update failed. Run mindwire inspect for details.\");\n      if (update.status === \"complete\") {\n        requested = undefined;\n        if (Date.now() < deadline) continue;\n      } else if (!options.force && update.status === \"waiting\") {\n        return { version, complete: false, update };\n      }\n    }\n    if (Date.now() >= deadline) return { version, complete: false, update };\n    await delay(500, undefined, { signal: options.signal });\n  }\n}\n\nexport function updateProgress(update: ComputerUpdate): string {\n  const phase: Record<ComputerUpdate[\"status\"], string> = {\n    idle: \"Ready\", queued: \"Queued\", downloading: \"Downloading verified release…\",\n    waiting: \"Waiting for active work to finish\", restarting: \"Restarting service…\",\n    complete: \"Installed\", failed: \"Update failed\",\n  };\n  return `${update.version} · ${phase[update.status]}`;\n}\n"]}

package/dist/{chunk-CKTVMUS4.js → chunk-T2ZIA4TK.js}

@@ -88,7 +88,7 @@ function computerPairingURI(invitation) {
 }
 
 // src/version.ts
-var SDK_VERSION = "0.1.38" ;
+var SDK_VERSION = "0.1.41" ;
 function versionAtLeast(actual, desired) {
   if (actual === desired) return true;
   if (!actual || !/^\d+\.\d+\.\d+$/.test(actual) || !/^\d+\.\d+\.\d+$/.test(desired)) return false;
@@ -139,7 +139,7 @@ async function ensureDaemonBinary(opts = {}) {
   if (!request) throw new MindwireError("mindwire: fetch is unavailable; set daemonBin or MINDWIRE_DAEMON");
   const [checksums, binary] = await Promise.all([request(`${release}/checksums.txt`), request(`${release}/${asset}`)]);
   if (!checksums.ok || !binary.ok) {
-    if (!opts.releaseBaseUrl && !proc.process?.env?.MINDWIRE_RELEASE_BASE_URL) {
+    if (!opts.exactVersion && !opts.releaseBaseUrl && !proc.process?.env?.MINDWIRE_RELEASE_BASE_URL) {
       const latest = await request("https://api.github.com/repos/oblien/mindwire/releases/latest");
       if (latest.ok) {
         const tag = (await latest.json()).tag_name;
@@ -1092,6 +1092,18 @@ var ProjectSyncError = class extends MindwireError {
 };
 var active = (o) => ["queued", "exporting", "preparing", "applying"].includes(o.status);
 var prefix = "/workspace/sync";
+var selectionPaths = (paths = []) => {
+  const sorted = [...new Set(paths.map((path5) => path5.replace(/\/$/, "")))].sort();
+  const selected = new Set(sorted);
+  return sorted.filter((path5) => {
+    let parent = path5;
+    while (parent.includes("/")) {
+      parent = parent.slice(0, parent.lastIndexOf("/"));
+      if (selected.has(parent)) return false;
+    }
+    return true;
+  });
+};
 function delay4(ms, signal) {
   signal?.throwIfAborted();
   return new Promise((resolve3, reject) => {
@@ -1114,7 +1126,16 @@ var ProjectSyncApi = class {
   }
   mw;
   flights = /* @__PURE__ */ new Map();
-  export(request, options = {}) {
+  async requireSelectionSupport() {
+    if (((await this.mw.health()).projectSyncVersion ?? 0) < 2)
+      throw new MindwireError("Update Mindwire on both workspaces to review and switch selected project files.");
+  }
+  async preview(request, options = {}) {
+    await this.requireSelectionSupport();
+    return this.mw.http.request("POST", `${prefix}/preview`, { body: request, ...options });
+  }
+  async export(request, options = {}) {
+    await this.requireSelectionSupport();
     return this.mw.http.request("POST", `${prefix}/exports`, { body: request, ...options });
   }
   import(request, options = {}) {
@@ -1199,6 +1220,7 @@ var ProjectSyncApi = class {
    * throws ProjectSyncError carrying the complete conflict/recovery operation.
    */
   switchTo(target, request, options = {}) {
+    request = { ...request, includeIgnored: selectionPaths(request.includeIgnored) };
     const intent = JSON.stringify(request);
     const old = this.flights.get(request.id);
     if (old) {
@@ -1214,7 +1236,8 @@ var ProjectSyncApi = class {
         if (!(error instanceof ApiError) || error.status !== 404) throw error;
       }
       if (accepted) {
-        if ((accepted.path ?? "") !== (request.path ?? "")) throw new MindwireError("This sync ID belongs to a different destination folder.");
+        if ((accepted.path ?? "") !== (request.path ?? "") || (accepted.selectionToken ?? "") !== (request.selectionToken ?? "") || JSON.stringify(selectionPaths(accepted.includeIgnored)) !== JSON.stringify(request.includeIgnored))
+          throw new MindwireError("This sync ID belongs to a different destination folder or file selection.");
         const operation = await target.wait(accepted.id, {
           signal: options.signal,
           onUpdate: (operation2) => options.onProgress?.({ phase: "apply", transferredBytes: 0, operation: operation2 })
@@ -1223,11 +1246,11 @@ var ProjectSyncApi = class {
         return operation;
       }
       const health = await Promise.all([this.mw.health(), target.mw.health()]);
-      if (health.some((h) => (h.projectSyncVersion ?? 0) < 1)) throw new MindwireError("Update Mindwire on both workspaces to switch this project.");
+      if (health.some((h) => (h.projectSyncVersion ?? 0) < 2)) throw new MindwireError("Update Mindwire on both workspaces to review and switch selected project files.");
       let bytes = 0;
       const emit2 = (phase, operation) => options.onProgress?.({ phase, transferredBytes: bytes, operation });
       emit2("checkpoint");
-      let o = await this.export({ id: `${request.id}-export`, projectId: request.projectId }, options);
+      let o = await this.export({ id: `${request.id}-export`, projectId: request.projectId, includeIgnored: request.includeIgnored, selectionToken: request.selectionToken }, options);
       o = await this.wait(o.id, { signal: options.signal, onUpdate: (value) => emit2("checkpoint", value) });
       if (o.status !== "succeeded" || !o.resultCheckpointId) throw new ProjectSyncError(o);
       emit2("transfer");
@@ -1235,7 +1258,7 @@ var ProjectSyncApi = class {
         bytes += n;
         emit2("transfer");
       } });
-      o = await target.import({ id: `${request.id}-import`, checkpointId: o.resultCheckpointId, path: request.path }, options);
+      o = await target.import({ id: `${request.id}-import`, checkpointId: o.resultCheckpointId, path: request.path, includeIgnored: request.includeIgnored, selectionToken: request.selectionToken }, options);
       o = await target.wait(o.id, { signal: options.signal, onUpdate: (value) => emit2("apply", value) });
       if (o.status !== "succeeded") throw new ProjectSyncError(o);
       return o;
@@ -1472,6 +1495,17 @@ var SurfacesApi = class {
   bind(binding) {
     return this.mw.http.request("PUT", "/surfaces/desktop/binding", { body: binding });
   }
+  localStatus() {
+    return this.mw.http.request("GET", "/surfaces/desktop/local");
+  }
+  /** Local CLI only. The separate 0600 control credential is not part of phone pairing. */
+  configureLocal(settings, localControlToken) {
+    if (!localControlToken) throw new Error("Run mindwire desktop on your Mac to manage desktop access.");
+    return this.mw.http.request("PUT", "/surfaces/desktop/local", {
+      body: settings,
+      headers: { "X-Mindwire-Local-Control": localControlToken }
+    });
+  }
   open(request) {
     return this.mw.http.request("POST", "/surfaces/desktop/sessions", { body: request });
   }
@@ -2416,7 +2450,7 @@ var NotifyApi = class {
 };
 
 // src/computer/lifecycle.ts
-var CONTROLLER_PROTOCOL = 3;
+var CONTROLLER_PROTOCOL = 4;
 var defaultStateDirectory = () => path4.join(homedir(), ".mindwire", "computer");
 var defaultComputerConfig = () => ({ directory: homedir(), bind: "0.0.0.0", sshPort: 8791, websocketPort: 8792, relay: { kind: "cloudflare" } });
 async function readJSON(file) {
@@ -2436,13 +2470,13 @@ async function writeJSON(file, value) {
     await fs2.rm(temp, { force: true });
   }
 }
-async function computerClient(directory) {
+async function computerClient(directory, requestTimeoutMs = 3e3) {
   const runtime = await readJSON(path4.join(directory, "computer-runtime.json"));
   if (!runtime) throw new Error("Mindwire is not running. Run mindwire connect on the computer.");
   const url = new URL(`http://${runtime.apiAddress}`);
   if (!["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password) throw new Error("Invalid local Mindwire address.");
   const token = (await fs2.readFile(path4.join(directory, "daemon.token"), "utf8")).trim();
-  const client = new Mindwire({ target: remote(url.origin, { token }), requestTimeoutMs: 3e3 });
+  const client = new Mindwire({ target: remote(url.origin, { token }), requestTimeoutMs });
   const info = await client.computer.info();
   if (info.computerId !== runtime.computerId || info.pid !== runtime.pid) throw new Error("The local Mindwire process changed. Retry the command.");
   return client;
@@ -2519,7 +2553,7 @@ async function ensureComputer(directory, cliPath, patch = {}, onProgress, option
       if (!compatible(controller2) || !await processStateAlive(controller2)) {
         await ensureComputer(directory, cliPath, {}, onProgress, { ...options, waitForRoutes: false });
       }
-      const { changeComputerConnection } = await import('./connection-change-5F4WNCYV.js');
+      const { changeComputerConnection } = await import('./connection-change-RHY2OKFJ.js');
       await changeComputerConnection(directory, Object.fromEntries(changed.map((key) => [key, patch[key]])), { signal: options.signal, onProgress });
       return computerClient(directory);
     }
@@ -2560,7 +2594,7 @@ async function ensureComputer(directory, cliPath, patch = {}, onProgress, option
     let controller = await readJSON(path4.join(directory, "computer-controller.json"));
     if (existing && controller && !compatible(controller) && await processStateAlive(controller)) {
       onProgress?.("Refreshing the background connection service\u2026");
-      const { handoffController } = await import('./controller-handoff-KV7WRDAI.js');
+      const { handoffController } = await import('./controller-handoff-CDPPQ2YH.js');
       await handoffController(directory, controller, config, await existing.computer.info());
       controller = void 0;
     }
@@ -2594,7 +2628,7 @@ async function ensureComputer(directory, cliPath, patch = {}, onProgress, option
   }
 }
 async function superviseComputer(directory) {
-  const controller = await import('./controller-3SZI7TBW.js');
+  const controller = await import('./controller-G2T76QDM.js');
   await controller.superviseComputer(directory);
 }
 async function stopComputer(directory, force = false) {
@@ -2618,6 +2652,6 @@ async function stopComputer(directory, force = false) {
   throw new Error("Mindwire is still stopping. Check computer.log.");
 }
 
-export { CONTROLLER_PROTOCOL, ProviderConnectionError, RelayOutput, SDK_VERSION, acquireProcessLock, adoptProcess, adoptRelay, cloudflareCommand, computerClient, computerPairingQRData, computerPairingURI, currentProcessIdentity, defaultComputerConfig, defaultStateDirectory, directRoutes, ensureComputer, ensureDaemonBinary, hasCertificateError, ownChild, processIdentity, processStateAlive, providerFailure, providerNeedsAction, readJSON, startRelay, stopComputer, superviseComputer, websocketURL, writeJSON };
-//# sourceMappingURL=chunk-CKTVMUS4.js.map
-//# sourceMappingURL=chunk-CKTVMUS4.js.map
+export { CONTROLLER_PROTOCOL, ProviderConnectionError, RelayOutput, SDK_VERSION, acquireProcessLock, adoptProcess, adoptRelay, cloudflareCommand, computerClient, computerPairingQRData, computerPairingURI, currentProcessIdentity, defaultComputerConfig, defaultStateDirectory, directRoutes, ensureComputer, ensureDaemonBinary, hasCertificateError, ownChild, processIdentity, processStateAlive, providerFailure, providerNeedsAction, readJSON, startRelay, stopComputer, superviseComputer, versionAtLeast, websocketURL, writeJSON };
+//# sourceMappingURL=chunk-T2ZIA4TK.js.map
+//# sourceMappingURL=chunk-T2ZIA4TK.js.map