mindwire 0.1.52 → 0.1.53

package/README.md

@@ -16,6 +16,11 @@ protocol; this package is a thin, dependency-free client over its REST + SSE sur
 
 ## Install
 
+Connect saved bots to Slack, Microsoft Teams, Discord, or Telegram through
+`mw.integrations`: chat with streamed replies, run commands, trigger tasks, or send notifications.
+Connections are shared with the app and Go SDK. See the
+[messaging integrations guide](https://mindwire.sh/docs/guides/integrations) for setup and examples.
+
 ```bash
 npm i mindwire
 # or: bun add mindwire / pnpm add mindwire
@@ -38,7 +43,7 @@ If macOS rejects the login, the CLI lets you retry the password or check Screen
 Sharing permissions. Canceling or entering a wrong password keeps the existing
 desktop setup and active connections unchanged.
 Opening a workspace or checking status does not enable screen access. See the
-[desktop contract](../../daemon/DESKTOP.md#personal-mac-desktop) for platform support,
+[desktop contract](../../packages/daemon/DESKTOP.md#personal-mac-desktop) for platform support,
 permissions and the shared input protocol. Existing installations need a release
 advertising `health().localDesktopVersion >= 1`.
 
@@ -112,7 +117,7 @@ and native transcripts. Use `deleteChat()` for an explicit transcript purge.
 
 Check `health().workspaceMetadataVersion` before enabling registry features on an
 older daemon. `workspace.import()` imports legacy IDs once; existing records and
-deletion markers win. See the [registry contract](../../daemon/WORKSPACES.md) for
+deletion markers win. See the [registry contract](../../packages/daemon/WORKSPACES.md) for
 migration and recovery. The embedded Go SDK exposes the same operations through
 `client.Workspace`, using the same SQLite implementation.
 
@@ -153,6 +158,93 @@ blocks running chats/overlapping projects and recovers removal across restarts.
 Cancellation returns 409 after the `deleting` phase; cleanup then affects only the
 owned quarantine, even if someone recreates the original directory.
 
+Create a plain harness profile with `mw.bots.create({ agentId, projectId, name, raw: true })`
+(Go: `Bot.Raw`). Requires `health().botsVersion >= 7`. It keeps a named conversation
+group and the existing harness authentication, settings and native tools, without
+Mindwire bot instructions, memory, knowledge, skills or bot MCP tools. `raw` is
+creation-only; create a separate profile to change modes without carrying an old
+persona into a resumed conversation.
+
+With `botsVersion >= 8`, bots belong to a workspace and can work in any of its
+projects. `projectId` is only their optional default working folder. Start a chat
+in another project with `mw.bots.createChat(bot.id, { projectId })` (Go:
+`Bots.CreateChat(bot.ID, chatID, title, projectID)`). The profile, memory and skills
+stay shared; each chat retains its own project, native session and permissions.
+Deleting a project clears a matching default folder while preserving the bot and
+its conversations in other projects.
+
+### Bot skills
+
+Bots keep standing identity in `instructions`, durable facts in `memory`, and
+reference material in `knowledge`. Assign reusable workflows separately with
+`skills`, an array containing complete portable `SKILL.md` documents:
+
+```ts
+import { readFile } from "node:fs/promises";
+
+await mw.bots.update(bot.id, {
+  expectedRevision: bot.revision,
+  skills: [await readFile("./skills/reports/SKILL.md", "utf8")],
+});
+```
+
+Requires `health().botsVersion >= 6`. The Go equivalent is `BotEdit.Skills`.
+Each document needs YAML `name` and `description` frontmatter and a Markdown body.
+Limits are 16 skills, 32 KiB each, 128 KiB total, with unique names. The portable
+frontmatter supports `license`, `compatibility` and string-valued `metadata`;
+native permission overrides, hooks and dynamic shell substitutions are rejected. Omit `skills` when updating
+unrelated fields; an explicit empty array removes assignments.
+
+The daemon supplies a private bundle for the current turn. Codex discovers it
+through process-scoped extra roots; Claude loads it through `--plugin-dir`.
+Other harnesses load the same content through `skills_list` / `skills_read` on
+the existing scoped tool bridge. Older Codex versions without extra-root support
+also use that fallback. Only skill metadata enters standing context; bodies are
+read on demand. Assignments retain the turn's starting revision. Skills grant no
+additional permissions and never alter global harness configuration. Product
+presets and skill content belong to the client; the Go core supplies the generic
+validation, storage, delivery and permission checks.
+
+### Applications and scheduled work
+
+`mw.apps` saves application resources on their owning host. Clients can present
+these as shortcuts, launchers or other application catalogs. Consumer bot presets
+and General-mode UI are outside the Go registry; no new AI runtime is created.
+
+```ts
+const { app } = await mw.apps.register({
+  projectId, name: "Reports", icon: "chart.bar", url: "http://127.0.0.1:3000",
+  startupCommand: "./scripts/ensure-reports.sh", healthPath: "/health",
+});
+await mw.apps.open(app.id); // bounded readiness check/startup; returns the saved URL
+await mw.apps.channels(); // labels/IDs only, no provider credentials
+await mw.apps.notifications(app.id); // protected credentialFile path on the computer
+await mw.apps.saveSchedule(app.id, {
+  name: "Morning report", localTime: "09:00", timeZone: "Europe/London",
+  weekdays: [1, 2, 3, 4, 5], command: "./scripts/build-report.sh",
+  title: "Reports", body: "Your morning report is ready.",
+});
+const schedules = await mw.apps.schedules(app.id);
+```
+
+Check `health().appsVersion >= 1`. Phone delivery must already be configured.
+Schedules persist across restarts and run while the owning computer is awake;
+notifications retry without rerunning a completed command. Backend credentials
+can only send as one app through its saved destinations. See the
+[Apps contract](../../docs/apple/Apps.md) for native tools, private forwarding,
+calendar rules, removal and recovery. The Go SDK shares `client.Apps` for saved
+records, readiness, notification delivery and schedules; backend credential files
+are provisioned through the running daemon's HTTP/native tool service.
+
+The standalone daemon explicitly owns scheduling. The embedded Go SDK does not
+run scheduled commands merely because a client is constructed; opt in with
+`mindwire.Options{RunScheduledJobs: true}` when hosting a long-lived runtime.
+Native agent tools request owner approval before enabling background commands,
+using the existing interaction stream. Direct owner API/SDK requests explicitly
+authorize their work. Pausing remains available when notifications are muted or
+unconfigured. Commands use the host OS permissions; the working directory does
+not provide a sandbox.
+
 ## Targets — where the daemon runs
 
 **One `new Mindwire` = one instance = one daemon = one environment.** Every agent that instance runs
@@ -289,3 +381,6 @@ bun test               # client + SSE parser tests (mocked fetch)
 ```
 
 License: Apache-2.0.
+
+
+Public hosting adapters can check `health().appsVersion >= 2`, then call `mw.apps.preparePublication(appId)` (Go: `client.Apps.PreparePublication(ctx, appID)`). This validates a port or static build plan without deploying it. After the adapter confirms hosting, save its HTTPS link using `apps.update(..., { expectedRevision, publicUrl })`. The original private URL stays intact. Provider credentials and billing belong in the host application, outside the generic runtime.

package/dist/apps.d.ts

@@ -0,0 +1,94 @@
+import type { Mindwire } from "./client.js";
+import type { WorkspaceSnapshot } from "./workspace.js";
+/** An application resource saved on its owning host. */
+export interface AppShortcut {
+    id: string;
+    workspaceId: string;
+    projectId: string;
+    botId?: string;
+    name: string;
+    icon?: string;
+    url: string;
+    startupCommand?: string;
+    healthPath?: string;
+    archived: boolean;
+    createdAt: string;
+    revision: number;
+    channelIds?: string[];
+    notificationsMuted: boolean;
+    automation?: boolean;
+    staticDirectory?: string;
+    publicUrl?: string;
+}
+export type AppShortcutCreate = Pick<AppShortcut, "projectId" | "name" | "url"> & Partial<Pick<AppShortcut, "id" | "botId" | "icon" | "startupCommand" | "healthPath" | "automation" | "channelIds" | "notificationsMuted" | "staticDirectory" | "publicUrl">>;
+export type AppShortcutEdit = {
+    expectedRevision: number;
+} & Partial<Pick<AppShortcut, "name" | "icon" | "url" | "startupCommand" | "healthPath" | "archived" | "channelIds" | "notificationsMuted" | "staticDirectory" | "publicUrl">>;
+export interface AppShortcutMutation {
+    app: AppShortcut;
+    snapshot: WorkspaceSnapshot;
+}
+export interface AppPublication {
+    app: AppShortcut;
+    kind: "port" | "static";
+    port?: number;
+    directory?: string;
+}
+export interface AppNotificationChannel {
+    id: string;
+    name: string;
+    type: string;
+}
+export interface AppScheduleSpec {
+    id?: string;
+    expectedRevision?: number;
+    name: string;
+    runAt?: string;
+    intervalSeconds?: number;
+    localTime?: string;
+    timeZone?: string;
+    weekdays?: number[];
+    command?: string;
+    title?: string;
+    body?: string;
+    enabled?: boolean;
+}
+export interface AppSchedule extends Omit<AppScheduleSpec, "id"> {
+    id: string;
+    appId: string;
+    revision: number;
+    active: boolean;
+    state: string;
+    nextRunAt?: string;
+    retryAt?: string;
+    lastRunAt?: string;
+    lastError?: string;
+    attempts: number;
+}
+export declare class AppsApi {
+    private readonly mw;
+    constructor(mw: Mindwire);
+    list(): Promise<AppShortcut[]>;
+    get(id: string): Promise<AppShortcut>;
+    register(input: AppShortcutCreate): Promise<AppShortcutMutation>;
+    update(id: string, input: AppShortcutEdit): Promise<AppShortcutMutation>;
+    /** Ensures readiness on the owning computer; the client opens the returned URL. */
+    open(id: string): Promise<AppShortcut>;
+    /** Validates a plan for the owner's hosting adapter; does not deploy or charge. */
+    preparePublication(id: string): Promise<AppPublication>;
+    channels(): Promise<AppNotificationChannel[]>;
+    notifications(id: string, options?: {
+        channelIds?: string[];
+        rotate?: boolean;
+    }): Promise<AppShortcutMutation & {
+        credentialFile: string;
+    }>;
+    revokeNotificationAccess(id: string): Promise<{
+        revoked: boolean;
+    }>;
+    schedules(id: string): Promise<AppSchedule[]>;
+    saveSchedule(id: string, schedule: AppScheduleSpec): Promise<AppSchedule>;
+    deleteSchedule(id: string, scheduleId: string): Promise<{
+        removed: boolean;
+    }>;
+}

package/dist/bots.d.ts

@@ -0,0 +1,168 @@
+import type { Mindwire } from "./client.js";
+import type { WorkspaceRecord, WorkspaceSnapshot, WorkspaceChat, WorkspaceAgent, WorkspaceProject } from "./workspace.js";
+import type { Run } from "./types.js";
+export interface BotKnowledge {
+    id: string;
+    title: string;
+    content: string;
+}
+export interface Bot extends WorkspaceRecord {
+    agentId: string;
+    /** Default folder for new chats. The bot belongs to workspaceId and can work in its other projects. */
+    projectId: string;
+    name: string;
+    /** Saved palette-character ID; omitted/empty keeps the automatic avatar. */
+    icon?: string;
+    purpose: string;
+    instructions: string;
+    memory: string;
+    knowledge: BotKnowledge[];
+    /** Portable SKILL.md documents, loaded on demand. Requires botsVersion >= 6. */
+    skills?: string[] | null;
+    /** Creation-only plain harness: no Mindwire bot context, tools or skills. Requires botsVersion >= 7. */
+    raw?: boolean;
+    isMaster: boolean;
+    archived: boolean;
+    /** Applies to this bot's current and future chats, independent of its base engine. */
+    notificationsMuted?: boolean;
+}
+export interface BotInput {
+    icon?: string;
+    id?: string;
+    agentId: string;
+    projectId?: string;
+    name: string;
+    purpose?: string;
+    instructions?: string;
+    memory?: string;
+    knowledge?: BotKnowledge[];
+    skills?: string[];
+    /** Keep native harness behavior. Cannot be changed after creation or combined with bot context. */
+    raw?: boolean;
+}
+export interface BotEdit {
+    /** Base agent for future chats; existing chats retain their original engine. Requires botsVersion >= 5. */
+    agentId?: string;
+    icon?: string;
+    expectedRevision: number;
+    name?: string;
+    purpose?: string;
+    instructions?: string;
+    memory?: string;
+    knowledge?: BotKnowledge[];
+    archived?: boolean;
+    /** Replaces assigned SKILL.md documents; omit to preserve existing skills. */
+    skills?: string[];
+    notificationsMuted?: boolean;
+}
+export interface BotMutation {
+    bot: Bot;
+    snapshot: WorkspaceSnapshot;
+}
+export interface BotTaskInput {
+    requestId: string;
+    message: string;
+}
+export interface BotTaskRequest extends BotTaskInput {
+    chatId?: string;
+    title?: string;
+    projectId?: string;
+}
+export interface BotTask {
+    botId: string;
+    chatId: string;
+    run: Run;
+    messages?: {
+        role: string;
+        text: string;
+        createdAt: string;
+    }[];
+    output?: string;
+    historyError?: string;
+    interactions?: {
+        id: string;
+        kind: string;
+        title?: string;
+        detail?: string;
+        needsResponse: boolean;
+    }[];
+    tools?: {
+        name: string;
+        status?: string;
+    }[];
+    cancelRequested?: boolean;
+}
+export type BotPeerRoute = {
+    kind: "ssh";
+    host: string;
+    port: number;
+} | {
+    kind: "websocket";
+    url: string;
+};
+export interface BotPeerIdentity {
+    workspaceId: string;
+    publicKey: string;
+    hostKeyFingerprint: string;
+    port?: number;
+    sshPort?: number;
+    routes?: BotPeerRoute[];
+}
+export interface BotPeerInput {
+    name: string;
+    publicKey: string;
+    hostKeyFingerprint: string;
+    routes: BotPeerRoute[];
+    enabled?: boolean;
+}
+export interface BotPeer extends BotPeerInput {
+    workspaceId: string;
+}
+export interface BotPeerCheck {
+    workspaceId: string;
+    reachable: boolean;
+    error?: string;
+    addressRecovery?: boolean;
+}
+/** Saved bot identities, native tasks, and explicitly paired bot-control peers. */
+export declare class BotsApi {
+    private readonly mw;
+    constructor(mw: Mindwire);
+    list(options?: {
+        projectId?: string;
+        archived?: boolean;
+    }): Promise<Bot[]>;
+    get(id: string): Promise<Bot>;
+    ensure(agentId: string, projectId: string): Promise<BotMutation>;
+    create(input: BotInput): Promise<BotMutation>;
+    update(id: string, edit: BotEdit): Promise<BotMutation>;
+    chats(id: string): Promise<WorkspaceChat[]>;
+    createChat(id: string, input?: {
+        chatId?: string;
+        title?: string;
+        projectId?: string;
+    }): Promise<{
+        chatId: string;
+        snapshot: WorkspaceSnapshot;
+    }>;
+    agents(): Promise<{
+        agents: WorkspaceAgent[];
+        projects: WorkspaceProject[];
+    }>;
+    tasks(id: string): Promise<BotTask[]>;
+    /** Keep requestId stable when retrying a task after a lost acknowledgement. */
+    delegate(id: string, input: BotTaskRequest): Promise<BotTask>;
+    task(id: string, runId: string): Promise<BotTask>;
+    input(id: string, runId: string, input: BotTaskInput): Promise<BotTask>;
+    cancel(id: string, runId: string): Promise<BotTask>;
+    peerIdentity(): Promise<BotPeerIdentity>;
+    startPeerListener(port?: number): Promise<BotPeerIdentity>;
+    peers(): Promise<BotPeer[]>;
+    pair(workspaceId: string, input: BotPeerInput): Promise<BotPeer>;
+    revokePeer(workspaceId: string): Promise<{
+        ok: boolean;
+    }>;
+    /** Bounded peer handshake/discovery; does not start a bot task. */
+    checkPeer(workspaceId: string): Promise<BotPeerCheck>;
+    private taskPath;
+}

package/dist/{chunk-RTMQJIKW.js → chunk-MZ4OTZFH.js}

@@ -1,4 +1,4 @@
-import { websocketURL, readJSON, writeJSON, acquireProcessLock, computerClient, versionAtLeast } from './chunk-4XL565EU.js';
+import { websocketURL, readJSON, writeJSON, acquireProcessLock, computerClient, versionAtLeast } from './chunk-O5DWL7MH.js';
 import { join } from 'path';
 import { setTimeout } from 'timers/promises';
 
@@ -10,12 +10,6 @@ function connectionInfo(relay, host) {
   if (relay.kind === "none") return { provider: "direct", address: host ? "persistent" : "network" };
   return { provider: relay.kind, address: ["cloudflare", "ngrok"].includes(relay.kind) && !relay.url ? "temporary" : "persistent" };
 }
-function connectionDescription(info) {
-  const name = { oblien: "Oblien", cloudflare: "Cloudflare", ngrok: "ngrok", custom: "Your tunnel", direct: "Direct SSH / VPN" }[info.provider];
-  if (info.address === "temporary") return `${name} \xB7 temporary address. For reconnect after a restart, run mindwire connection to choose a persistent address.`;
-  if (info.address === "network") return `${name} \xB7 reachable network required. Use a VPN hostname for access across networks.`;
-  return `${name} \xB7 persistent address. Saved phones retry automatically when this computer is online.`;
-}
 
 // src/computer/directory-http.ts
 var DirectoryRequestError = class extends Error {
@@ -301,6 +295,6 @@ function updateProgress(update) {
   return `${update.version} \xB7 ${phase[update.status]}`;
 }
 
-export { activeUpdate, connectionAddress, connectionDescription, connectionInfo, disableAddressDiscovery, discoveryDescription, discoveryPreference, enableAddressDiscovery, queueServiceUpdate, reconcileAddressDiscovery, saveDiscoveryPreference, updateComputer, updateProgress };
-//# sourceMappingURL=chunk-RTMQJIKW.js.map
-//# sourceMappingURL=chunk-RTMQJIKW.js.map
+export { activeUpdate, connectionAddress, connectionInfo, disableAddressDiscovery, discoveryDescription, discoveryPreference, enableAddressDiscovery, queueServiceUpdate, reconcileAddressDiscovery, saveDiscoveryPreference, updateComputer, updateProgress };
+//# sourceMappingURL=chunk-MZ4OTZFH.js.map
+//# sourceMappingURL=chunk-MZ4OTZFH.js.map

package/dist/chunk-MZ4OTZFH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/computer/provider-info.ts","../src/computer/directory-http.ts","../src/computer/discovery.ts","../src/computer/service-update.ts"],"names":["delay","join"],"mappings":";;;;;AAKO,SAAS,iBAAA,CAAkB,OAAqB,IAAA,EAAuB;AAC5E,EAAA,OAAO,KAAA,CAAM,IAAA,KAAS,MAAA,GAAS,CAAA,IAAA,EAAO,QAAQ,SAAS,CAAA,CAAA,GACnD,KAAA,CAAM,GAAA,GAAM,aAAa,KAAA,CAAM,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,MAAM,IAAI,CAAA,CAAA;AACnE;AAGO,SAAS,cAAA,CAAe,OAAqB,IAAA,EAAuC;AACzF,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAQ,OAAO,EAAE,UAAU,QAAA,EAAU,OAAA,EAAS,IAAA,GAAO,YAAA,GAAe,SAAA,EAAU;AACjG,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,CAAM,IAAA,EAAM,OAAA,EAAS,CAAC,YAAA,EAAc,OAAO,CAAA,CAAE,QAAA,CAAS,MAAM,IAAI,CAAA,IAAK,CAAC,KAAA,CAAM,GAAA,GAAM,cAAc,YAAA,EAAa;AAClI;;;ACdO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,CACW,MAAA,EACA,IAAA,EACA,UAAA,GAAa,CAAA,EACtB;AACA,IAAA,KAAA;AAAA,MACE,MAAA,KAAW,CAAA,GACP,mFAAA,GACA,CAAA,4CAAA,EAA+C,IAAI,CAAA,EAAA;AAAA,KACzD;AARS,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAOX;AAAA,EATW,MAAA;AAAA,EACA,IAAA;AAAA,EACA,UAAA;AAQb,CAAA;AAGA,eAAsB,gBAAA,CAAoB,GAAA,EAAa,IAAA,EAAc,IAAA,EAAe,MAAA,EAAkC;AACpH,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,GAAM,IAAA,EAAM;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAC,CAAC,CAAA,GAAI,WAAA,CAAY,QAAQ,GAAM,CAAA;AAAA,MACpG,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACV;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA,EAAQ,cAAA,EAAe;AACvB,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,EAAG,aAAa,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACF,MAAA,WAAS;AACP,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AACV,QAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAChB,QAAA,IAAI,SAAS,EAAA,GAAK,IAAA,EAAM,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAC/F,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MACnB;AAAA,EACJ,CAAA,SAAE;AACA,IAAA,KAAK,MAAA,EAAQ,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACtC;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,qBAAA,CAAsB,QAAA,CAAS,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,QAAS,IAAA,EAAqC,KAAA;AACpD,IAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,QAAS,KAAA,EAAqC,IAAA;AACvF,IAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AAC7D,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,QAAA,CAAS,MAAA;AAAA,MACT,OAAO,IAAA,KAAS,QAAA,IAAY,iBAAiB,IAAA,CAAK,IAAI,IAAI,IAAA,GAAO,iBAAA;AAAA,MACjE,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,UAAU,CAAC,CAAA,GAAI;AAAA,KACxE;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;ACvDO,IAAM,kBAAA,GAAqB,4BAAA;AAC3B,IAAM,aAAA,GAAgB,8BAA8B,kBAAkB,CAAA,CAAA;AAGtE,IAAM,sBAAsB,CAAC,SAAA,KAClC,SAA8B,IAAA,CAAK,SAAA,EAAW,oCAAoC,CAAC;AAIrF,eAAsB,uBAAA,CAAwB,WAAmB,KAAA,EAA2C;AAC1G,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,KAAA,EAAO,GAAA,EAAK,KAAA,CAAM,GAAA,GAAM,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA,GAAI,MAAA,EAAU;AACpF,EAAA,MAAM,SAAA,CAAU,IAAA,CAAK,SAAA,EAAW,oCAAoC,GAAG,UAAU,CAAA;AACnF;AAEO,SAAS,aAAa,KAAA,EAAuB;AAClD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AACA,EAAA,IACE,KAAA,CAAM,MAAA,GAAS,IAAA,IACf,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,IACrB,GAAA,CAAI,QAAA,IACJ,GAAA,CAAI,QAAA,IACJ,GAAA,CAAI,UACJ,GAAA,CAAI,IAAA,IACH,GAAA,CAAI,QAAA,KAAa,QAAA,IAChB,EAAE,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA,CAAA,EACzF;AACA,IAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,GAAA,EAAK,GAAA,CAAI,QAAA,GAAW,kBAAA;AACzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,GAAG,KAAK,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC3F,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,GAAA,CAAI,IAAA;AACb;AAEA,eAAsB,uBAAuB,OAAA,EAQR;AACnC,EAAA,MAAM,IAAA,GAAO,MAAM,kBAAA,CAAmB,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,sBAAsB,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAA;AACjH,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AAAA,IACrD,SAAS,KAAA,EAAO;AACd,MAAA,IAAK,MAA8B,MAAA,KAAW,GAAA;AAC5C,QAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,OAAA,CAAQ,SAAS,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,UAAA,EAAY,OAAA,KAAY,OAAO,OAAO,MAAA;AAG/D,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,OAAA,CAAQ,OAAO,OAAA,CAAQ,GAAA,CAAI,0BAA0B,MAAA,CAAO,GAAA,IAAO,YAAY,GAAA,IAAO;AAAA,KACxF;AACA,IAAA,IACE,MAAA,CAAO,GAAA,IACP,MAAA,CAAO,GAAA,KAAQ,GAAA,KACd,MAAA,CAAO,OAAA,IAAA,CAAY,MAAA,CAAO,QAAA,IAAY,CAAA,OAAQ,MAAA,CAAO,iBAAA,IAAqB,CAAA,CAAA,CAAA,EAC3E;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,wBAAwB,OAAA,CAAQ,SAAA,EAAW,EAAE,OAAA,EAAS,IAAA,EAAM,KAAK,CAAA;AACvE,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,GAAA,KAAQ,OAAO,MAAA,CAAO,KAAA,EAAO,QAAA,CAAS,YAAY,CAAA,EAAG;AACjF,MAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,yCAAA,EAA4C,IAAI,IAAI,GAAG,CAAA,CAAE,IAAI,CAAA,MAAA,CAAG,CAAA;AACrF,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAwC,GAAA,EAAK,0BAAA,EAA4B;AAAA,UAC/F,aAAa,MAAA,CAAO;AAAA,SACtB,EAAG,QAAQ,MAAM,CAAA;AACjB,QAAA,IACE,OAAO,SAAA,EAAW,SAAA,KAAc,QAAA,IAChC,SAAA,CAAU,SAAA,CAAU,MAAA,GAAS,EAAA,IAC7B,SAAA,CAAU,SAAA,CAAU,MAAA,GAAS,IAAA,EAC7B;AACA,UAAA,MAAM,IAAI,MAAM,iEAAiE,CAAA;AAAA,QACnF;AACA,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,mBAAA,CAAoB,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1F,QAAA,MAAM,WAAW,MAAM,gBAAA,CAA0C,KAAK,gBAAA,EAAkB,KAAA,EAAO,QAAQ,MAAM,CAAA;AAC7G,QAAA,IAAI,QAAA,EAAU,gBAAgB,MAAA,CAAO,WAAA;AACnC,UAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,MACtE,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,qBAAA,EAAuB;AAC1C,UAAA,IAAI,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA;AAC3C,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,IAAA,KAAS,kBAAA;AACjB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA;AAC3C,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AACF,UAAA,IAAI,MAAM,MAAA,KAAW,GAAA;AACnB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,QACJ;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,kBAAA,CAAmB,MAAM,GAAG,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,OAAA,CAAQ,kBAAA,KAAuB,KAAA,EAAO,OAAO,MAAA;AACjD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,MAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AACnD,MAAA,IAAI,MAAA,CAAO,WAAW,MAAA,CAAO,QAAA,IAAY,OAAO,iBAAA,KAAsB,MAAA,CAAO,UAAU,OAAO,MAAA;AAC9F,MAAA,IAAI,MAAA,CAAO,OAAO,QAAA,CAAS,YAAY,KAAK,MAAA,CAAO,KAAA,EAAO,SAAS,gBAAgB,CAAA;AACjF,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAC9B,MAAA,MAAMA,WAAM,GAAA,EAAK,KAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACxD;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AACF;AAEA,eAAsB,uBAAA,CAAwB,SAAA,EAAmB,QAAA,EAAoB,SAAA,GAAY,KAAA,EAAyC;AACxI,EAAA,MAAM,OAAO,MAAM,kBAAA,CAAmB,IAAA,CAAK,SAAA,EAAW,sBAAsB,CAAC,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,QAAA,CAAS,SAAA,EAAU;AACjD,IAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,SAAS,CAAA;AACtD,IAAA,IAAI,SAAA,IAAa,UAAA,EAAY,OAAA,KAAY,IAAA,EAAM,OAAO,MAAA;AACtD,IAAA,MAAM,uBAAA,CAAwB,SAAA,EAAW,EAAE,OAAA,EAAS,KAAA,EAAO,KAAK,MAAA,CAAO,GAAA,IAAO,UAAA,EAAY,GAAA,EAAK,CAAA;AAC/F,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,MAAA;AAC5B,IAAA,OAAO,MAAM,QAAA,CAAS,QAAA,CAAS,kBAAA,CAAmB,KAAK,CAAA;AAAA,EACzD,CAAA,SAAE;AAAU,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EAAG;AACnC;AAKA,eAAsB,0BAA0B,OAAA,EAE9B;AAChB,EAAA,MAAM,UAAA,GAAa,MAAM,mBAAA,CAAoB,OAAA,CAAQ,SAAS,CAAA;AAC9D,EAAA,MAAM,EAAE,WAAW,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,IAAA,EAAK;AACnE,EAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,YAAA,IAAgB,CAAC,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,GAAA;AACtF,EAAA,MAAM,UAAU,UAAA,EAAY,OAAA,KAAY,QAAQ,OAAA,IAAW,SAAA,IAAa,CAAC,MAAA,EAAQ,GAAA,CAAA;AACjF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,IAAI,UAAA,EAAY,OAAA,KAAY,KAAA,IAAS,MAAA,EAAQ,OAAA,EAAS,MAAM,uBAAA,CAAwB,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,QAAA,EAAU,IAAI,CAAA;AAC7H,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAC5F,EAAA,MAAM,GAAA,GAAM,aAAa,UAAA,EAAY,GAAA,IAAO,QAAQ,GAAA,CAAI,sBAAA,IAA0B,MAAA,CAAO,GAAA,IAAO,aAAa,CAAA;AAC7G,EAAA,IAAI,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,GAAA,KAAQ,GAAA,IAAO,CAAC,MAAA,CAAO,KAAA,EAAO,QAAA,CAAS,YAAY,CAAA,EAAG;AACnF,EAAA,MAAM,sBAAA,CAAuB;AAAA,IAAE,GAAG,OAAA;AAAA,IAAS,GAAA;AAAA,IAAK,kBAAA,EAAoB,KAAA;AAAA,IAAO,SAAA,EAAW,IAAA;AAAA,IACpF,MAAA,EAAQ;AAAA,MAAE,KAAA,GAAQ;AAAA,MAAC,CAAA;AAAA,MAAG,IAAA,GAAO;AAAA,MAAC,CAAA;AAAA,MAAG,UAAU,YAAY;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAG,CAAA;AAAA,MACzG,QAAQ,YAAY;AAAE,QAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,MAAG;AAAA;AAAE,GAAG,CAAA;AACnF;AAEO,SAAS,qBAAqB,MAAA,EAAqD;AACxF,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,8EAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,OAAO,MAAA,CAAO,KAAA;AAChC,EAAA,OAAO,OAAO,QAAA,IAAY,MAAA,CAAO,iBAAA,KAAsB,MAAA,CAAO,WAC1D,wGAAA,GACA,mDAAA;AACN;ACtLO,SAAS,aAAa,MAAA,EAA8D;AACzF,EAAA,OAAO,CAAC,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU,aAAA,EAAe,SAAA,EAAW,YAAY,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA;AAC9F;AAIA,eAAsB,kBAAA,CAAmB,MAAA,EAAsB,OAAA,EAAiB,KAAA,GAAQ,KAAA,EAAgC;AACtH,EAAA,KAAA,IAAS,OAAA,GAAU,KAAK,OAAA,EAAA,EAAW;AACjC,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,YAAA,EAAa;AACpD,IAAA,IAAI,aAAa,QAAQ,CAAA,KAAM,CAAC,KAAA,IAAS,QAAA,CAAS,QAAQ,OAAO,QAAA;AACjE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAA,CAAO,QAAA,CAAS,aAAA,CAAc,YAAA,CAAa,QAAQ,CAAA,GAAI,QAAA,CAAS,OAAA,GAAU,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AAAA,IAC3G,SAAS,KAAA,EAAO;AACd,MAAA,IAAK,KAAA,CAA8B,MAAA,KAAW,GAAA,IAAO,OAAA,IAAW,GAAG,MAAM,KAAA;AAAA,IAE3E;AAAA,EACF;AACF;AAMA,eAAsB,eAAe,OAAA,EAKR;AAC3B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,MAAM,EAAE,CAAA;AAChD,EAAA,IAAI,CAAC,sCAAsC,IAAA,CAAK,OAAO,GAAG,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAC7H,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA,KAAY,MAAM,cAAA,CAAe,QAAQ,SAAS,CAAA,CAAA;AAC1E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,IAAK,QAAQ,SAAA,IAAa,IAAA,CAAA;AACpD,EAAA,IAAI,WAAuC,IAAA,GAAO,EAAA;AAClD,EAAA,WAAS;AACP,IAAA,OAAA,CAAQ,QAAQ,cAAA,EAAe;AAC/B,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,EAAQ;AAC7B,MAAA,MAAM,SAAA,GAAA,CAAa,MAAM,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,OAAA,CAAQ,MAAM,EAAE,CAAA;AAClE,MAAA,IAAI,cAAc,OAAA,IAAW,CAAC,QAAQ,cAAA,IAAkB,cAAA,CAAe,WAAW,OAAO,CAAA;AACvF,QAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,IAAA,EAAK;AAC9C,MAAA,SAAA,GAAY,MAAM,kBAAA,CAAmB,MAAA,EAAQ,OAAA,EAAS,QAAQ,KAAK,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAyBC,IAAAA,CAAK,QAAQ,SAAA,EAAW,sBAAsB,CAAC,CAAA,IAAK,SAAA;AAClG,IAAA,IAAI,MAAA,CAAO,EAAA,KAAO,SAAA,CAAU,EAAA,EAAI;AAE9B,MAAA,SAAA,GAAY,MAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,MAAM,MAAM,CAAA,EAAG,MAAA,CAAO,EAAE,CAAA,CAAA,EAAI,OAAO,MAAM,CAAA,CAAA;AACzC,MAAA,IAAI,SAAS,GAAA,EAAK;AAAE,QAAA,IAAA,GAAO,GAAA;AAAK,QAAA,OAAA,CAAQ,aAAa,MAAM,CAAA;AAAA,MAAG;AAC9D,MAAA,IAAI,MAAA,CAAO,WAAW,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,SAAS,8DAA8D,CAAA;AAC9H,MAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,QAAA,SAAA,GAAY,MAAA;AACZ,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAAA,MAC7B,WAAW,CAAC,OAAA,CAAQ,KAAA,IAAS,MAAA,CAAO,WAAW,SAAA,EAAW;AACxD,QAAA,OAAO,EAAE,OAAA,EAAS,QAAA,EAAU,KAAA,EAAO,MAAA,EAAO;AAAA,MAC5C;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,KAAI,IAAK,QAAA,SAAiB,EAAE,OAAA,EAAS,QAAA,EAAU,KAAA,EAAO,MAAA,EAAO;AACtE,IAAA,MAAMD,WAAM,GAAA,EAAK,MAAA,EAAW,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EACxD;AACF;AAEO,SAAS,eAAe,MAAA,EAAgC;AAC7D,EAAA,MAAM,KAAA,GAAkD;AAAA,IACtD,IAAA,EAAM,OAAA;AAAA,IAAS,MAAA,EAAQ,QAAA;AAAA,IAAU,WAAA,EAAa,oCAAA;AAAA,IAC9C,OAAA,EAAS,mCAAA;AAAA,IAAqC,UAAA,EAAY,0BAAA;AAAA,IAC1D,QAAA,EAAU,WAAA;AAAA,IAAa,MAAA,EAAQ;AAAA,GACjC;AACA,EAAA,OAAO,GAAG,MAAA,CAAO,OAAO,SAAM,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAA,CAAA;AACpD","file":"chunk-MZ4OTZFH.js","sourcesContent":["import type { ComputerConnectionInfo } from \"../computer.js\";\nimport type { RelayOptions } from \"./relay.js\";\nimport { websocketURL } from \"./relay.js\";\n\n/** Credential renewal does not change the address already saved by the phone. */\nexport function connectionAddress(relay: RelayOptions, host?: string): string {\n  return relay.kind === \"none\" ? `ssh:${host ?? \"network\"}`\n    : relay.url ? websocketURL(relay.url) : `temporary:${relay.kind}`;\n}\n\n/** Public, non-secret metadata. Route/SSH identity is independent of provider credentials. */\nexport function connectionInfo(relay: RelayOptions, host?: string): ComputerConnectionInfo {\n  if (relay.kind === \"none\") return { provider: \"direct\", address: host ? \"persistent\" : \"network\" };\n  return { provider: relay.kind, address: [\"cloudflare\", \"ngrok\"].includes(relay.kind) && !relay.url ? \"temporary\" : \"persistent\" };\n}\n\nexport function connectionDescription(info: ComputerConnectionInfo): string {\n  const name = { oblien: \"Oblien\", cloudflare: \"Cloudflare\", ngrok: \"ngrok\", custom: \"Your tunnel\", direct: \"Direct SSH / VPN\" }[info.provider];\n  if (info.address === \"temporary\") return `${name} · temporary address. For reconnect after a restart, run mindwire connection to choose a persistent address.`;\n  if (info.address === \"network\") return `${name} · reachable network required. Use a VPN hostname for access across networks.`;\n  return `${name} · persistent address. Saved phones retry automatically when this computer is online.`;\n}\n","export class DirectoryRequestError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    readonly retryAfter = 0,\n  ) {\n    super(\n      status === 0\n        ? \"Couldn't reach the address directory securely. Check its HTTPS address and retry.\"\n        : `The address directory rejected the request (${code}).`,\n    );\n  }\n}\n\n/** Bounded, same-origin requests. No redirects, cookie jar or retained credentials. */\nexport async function directoryRequest<T>(url: string, path: string, body: unknown, signal?: AbortSignal): Promise<T> {\n  let response: Response;\n  try {\n    response = await fetch(url + path, {\n      method: \"POST\",\n      redirect: \"error\",\n      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: JSON.stringify(body),\n    });\n  } catch {\n    signal?.throwIfAborted();\n    throw new DirectoryRequestError(0, \"unreachable\");\n  }\n  const reader = response.body?.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    if (reader)\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        length += value.byteLength;\n        if (length > 64 * 1024) throw new Error(\"The address directory returned an oversized response.\");\n        chunks.push(value);\n      }\n  } finally {\n    void reader?.cancel().catch(() => {});\n  }\n  let data: unknown;\n  try {\n    data = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n  } catch {\n    throw new DirectoryRequestError(response.status, \"invalid_response\");\n  }\n  if (!response.ok) {\n    const error = (data as { error?: unknown } | null)?.error;\n    const code = typeof error === \"string\" ? error : (error as { code?: unknown } | null)?.code;\n    const retryAfter = Number(response.headers.get(\"Retry-After\"));\n    throw new DirectoryRequestError(\n      response.status,\n      typeof code === \"string\" && /^[a-z_]{1,64}$/.test(code) ? code : \"directory_error\",\n      Number.isFinite(retryAfter) ? Math.max(0, Math.min(60, retryAfter)) : 0,\n    );\n  }\n  return data as T;\n}\n","import { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport type { Mindwire } from \"../client.js\";\nimport type { ComputerDiscoveryStatus } from \"../computer.js\";\nimport { acquireProcessLock } from \"./lock.js\";\nimport type { SetupPrompt } from \"./setup-prompt.js\";\nimport { directoryRequest, DirectoryRequestError } from \"./directory-http.js\";\nimport { readJSON, writeJSON, type ComputerConfig } from \"./lifecycle.js\";\n\nexport const DIRECTORY_API_PATH = \"/api/computer-directory/v1\";\nexport const DIRECTORY_URL = `https://console.mindwire.sh${DIRECTORY_API_PATH}`;\n\nexport interface DiscoveryPreference { enabled: boolean; url?: string }\nexport const discoveryPreference = (directory: string) =>\n  readJSON<DiscoveryPreference>(join(directory, \"computer-discovery-preference.json\"));\n\n/** Desired setup is durable even if enrollment is temporarily offline. The\n * daemon remains the authority for signed publications and phone access. */\nexport async function saveDiscoveryPreference(directory: string, value: DiscoveryPreference): Promise<void> {\n  const preference = { ...value, url: value.url ? directoryURL(value.url) : undefined };\n  await writeJSON(join(directory, \"computer-discovery-preference.json\"), preference);\n}\n\nexport function directoryURL(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Enter the directory's HTTPS API URL.\");\n  }\n  if (\n    value.length > 2048 ||\n    /[\\s\\x00]/.test(value) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    (url.protocol !== \"https:\" &&\n      !(url.protocol === \"http:\" && [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname)))\n  ) {\n    throw new Error(\"Use an HTTPS directory URL without credentials, a query, or a fragment.\");\n  }\n  if (url.pathname === \"/\") url.pathname = DIRECTORY_API_PATH;\n  if (url.pathname.endsWith(\"/\") || url.pathname.includes(\"//\") || url.pathname.includes(\"%\")) {\n    throw new Error(\"Use the exact directory API URL without a trailing slash.\");\n  }\n  return url.href;\n}\n\nexport async function enableAddressDiscovery(options: {\n  directory: string;\n  computer: Mindwire;\n  prompt: SetupPrompt;\n  url?: string;\n  waitForPublication?: boolean;\n  signal?: AbortSignal;\n  reconcile?: boolean;\n}): Promise<ComputerDiscoveryStatus> {\n  const lock = await acquireProcessLock(join(options.directory, \"discovery-setup.lock\"), { signal: options.signal });\n  try {\n    let status: ComputerDiscoveryStatus;\n    try {\n      status = await options.computer.computer.discovery();\n    } catch (error) {\n      if ((error as { status?: number }).status === 404)\n        throw new Error(\"Update the Mindwire service before enabling automatic address recovery.\");\n      throw error;\n    }\n    const preference = await discoveryPreference(options.directory);\n    if (options.reconcile && preference?.enabled === false) return status;\n    // Preserve a saved private directory across upgrades. Credentials belonging\n    // to another provider are never read by this flow.\n    const url = directoryURL(\n      options.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? preference?.url ?? DIRECTORY_URL,\n    );\n    if (\n      status.url &&\n      status.url !== url &&\n      (status.enabled || (status.sequence ?? 0) !== (status.publishedSequence ?? 0))\n    ) {\n      throw new Error(\n        \"Disable the current directory with mindwire discovery disable and wait for its withdrawal before changing the directory URL.\",\n      );\n    }\n    await saveDiscoveryPreference(options.directory, { enabled: true, url });\n    if (!status.enabled || status.url !== url || status.error?.includes(\"enrollment\")) {\n      options.prompt.print(`Enabling encrypted address recovery with ${new URL(url).host}…`);\n      try {\n        const challenge = await directoryRequest<{ challenge: string }>(url, \"/registrations/challenge\", {\n          directoryId: status.directoryId,\n        }, options.signal);\n        if (\n          typeof challenge?.challenge !== \"string\" ||\n          challenge.challenge.length < 16 ||\n          challenge.challenge.length > 2048\n        ) {\n          throw new Error(\"The address directory returned an invalid enrollment challenge.\");\n        }\n        const proof = await options.computer.computer.directoryEnrollment(url, challenge.challenge);\n        const enrolled = await directoryRequest<{ directoryId: string }>(url, \"/registrations\", proof, options.signal);\n        if (enrolled?.directoryId !== status.directoryId)\n          throw new Error(\"The directory acknowledged a different computer.\");\n      } catch (error) {\n        if (error instanceof DirectoryRequestError) {\n          if (error.status === 404 || error.status === 501)\n            throw new Error(\n              \"The address directory isn't available at this URL. Your existing connection still works; retry after the backend is deployed.\",\n            );\n          if (error.status === 409)\n            throw new Error(\n              \"This computer's directory registration is revoked or conflicts with its saved identity. Contact the directory operator.\",\n            );\n          if (error.code === \"account_required\")\n            throw new Error(\n              \"This directory still requires an account. Update its Mindwire backend to enable key-based registration, or choose another directory with --directory-url.\",\n            );\n          if (error.status === 401 || error.status === 403)\n            throw new Error(\n              \"The directory couldn't verify this computer's key or challenge. Retry enrollment.\",\n            );\n          if (error.status === 429)\n            throw new Error(\n              \"The directory's registration limit was reached. Retry later or use another directory.\",\n            );\n          if (error.status === 503)\n            throw new Error(\n              \"The directory is temporarily unavailable or at capacity. Your existing connection still works.\",\n            );\n        }\n        throw error;\n      }\n      status = await options.computer.computer.configureDiscovery(true, url);\n    }\n    if (options.waitForPublication === false) return status;\n    const deadline = Date.now() + 15_000;\n    while (Date.now() < deadline) {\n      status = await options.computer.computer.discovery();\n      if (status.enabled && status.sequence && status.publishedSequence === status.sequence) return status;\n      if (status.error?.includes(\"enrollment\") || status.error?.includes(\"older revision\"))\n        throw new Error(status.error);\n      await delay(250, undefined, { signal: options.signal });\n    }\n    throw new Error(\n      \"Address recovery is configured and will retry in the background. Run mindwire discovery status to check publication.\",\n    );\n  } finally {\n    await lock?.close();\n  }\n}\n\nexport async function disableAddressDiscovery(directory: string, computer: Mindwire, reconcile = false): Promise<ComputerDiscoveryStatus> {\n  const lock = await acquireProcessLock(join(directory, \"discovery-setup.lock\"));\n  try {\n    const status = await computer.computer.discovery();\n    const preference = await discoveryPreference(directory);\n    if (reconcile && preference?.enabled === true) return status;\n    await saveDiscoveryPreference(directory, { enabled: false, url: status.url ?? preference?.url });\n    if (!status.enabled) return status;\n    return await computer.computer.configureDiscovery(false);\n  } finally { await lock?.close(); }\n}\n\n/** Runs once after startup and retries failed enrollment in the controller. A\n * healthy setup makes only a local status read: publication/renewal stays in Go.\n * Direct/VPN/custom connections never opt into a hosted directory implicitly. */\nexport async function reconcileAddressDiscovery(options: {\n  directory: string; config: ComputerConfig; computer: Mindwire; signal?: AbortSignal;\n}): Promise<void> {\n  const preference = await discoveryPreference(options.directory);\n  const { discovery: status } = await options.computer.computer.info();\n  const automatic = options.config.relay.kind === \"cloudflare\" && !options.config.relay.url;\n  const enabled = preference?.enabled ?? (status?.enabled || automatic && !status?.url);\n  if (!enabled) {\n    if (preference?.enabled === false && status?.enabled) await disableAddressDiscovery(options.directory, options.computer, true);\n    return;\n  }\n  if (!status) throw new Error(\"Update the Mindwire service to enable automatic reconnection.\");\n  const url = directoryURL(preference?.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? DIRECTORY_URL);\n  if (status.enabled && status.url === url && !status.error?.includes(\"enrollment\")) return;\n  await enableAddressDiscovery({ ...options, url, waitForPublication: false, reconcile: true,\n    prompt: { print() {}, open() {}, question: async () => { throw new Error(\"Unexpected interactive setup.\"); },\n      secret: async () => { throw new Error(\"Unexpected interactive setup.\"); } } });\n}\n\nexport function discoveryDescription(status: ComputerDiscoveryStatus | undefined): string {\n  if (!status?.enabled) return \"Automatic address recovery is off. Enable it with mindwire discovery enable.\";\n  if (status.error) return status.error;\n  return status.sequence && status.publishedSequence === status.sequence\n    ? \"Encrypted address recovery is on. Saved phones can find this computer when its tunnel address changes.\"\n    : \"Publishing the computer's encrypted address…\";\n}\n","import { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport type { ComputerUpdate } from \"../computer.js\";\nimport type { Mindwire } from \"../client.js\";\nimport { computerClient, readJSON } from \"./lifecycle.js\";\nimport { versionAtLeast } from \"../version.js\";\n\ntype UpdateClient = Pick<Mindwire, \"health\" | \"computer\">;\nexport function activeUpdate(update: ComputerUpdate | undefined): update is ComputerUpdate {\n  return !!update && [\"queued\", \"downloading\", \"waiting\", \"restarting\"].includes(update.status);\n}\n\n/** The daemon arbitrates requests. Join an earlier version before requesting the\n * next; promoting a request never creates a second download or bypasses its lease. */\nexport async function queueServiceUpdate(client: UpdateClient, version: string, force = false): Promise<ComputerUpdate> {\n  for (let attempt = 0; ; attempt++) {\n    const previous = await client.computer.updateStatus();\n    if (activeUpdate(previous) && (!force || previous.force)) return previous;\n    try {\n      return await client.computer.requestUpdate(activeUpdate(previous) ? previous.version : version, { force });\n    } catch (error) {\n      if ((error as { status?: number }).status !== 409 || attempt >= 2) throw error;\n      // Another caller won admission. Read the authoritative request and join it.\n    }\n  }\n}\n\nexport interface ServiceUpdateResult { version: string; complete: boolean; update?: ComputerUpdate }\n\n/** A CLI may close after queuing: the controller owns download/restart. Human\n * callers get a bounded result, including the exact older request being joined. */\nexport async function updateComputer(options: {\n  directory: string; version: string; force?: boolean; allowDowngrade?: boolean;\n  onProgress?: (update: ComputerUpdate) => void; signal?: AbortSignal; timeoutMs?: number;\n  connect?: () => Promise<UpdateClient>;\n}):\nPromise<ServiceUpdateResult> {\n  const version = options.version.replace(/^v/, \"\");\n  if (!/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) throw new Error(\"Enter a Mindwire release version, such as 0.1.38.\");\n  const connect = options.connect ?? (() => computerClient(options.directory));\n  const deadline = Date.now() + (options.timeoutMs ?? 120_000);\n  let requested: ComputerUpdate | undefined, last = \"\";\n  for (;;) {\n    options.signal?.throwIfAborted();\n    if (!requested) {\n      const client = await connect();\n      const installed = (await client.health()).version.replace(/^v/, \"\");\n      if (installed === version || !options.allowDowngrade && versionAtLeast(installed, version))\n        return { version: installed, complete: true };\n      requested = await queueServiceUpdate(client, version, options.force);\n    }\n    // Progress survives the short API outage during restart. Only the daemon\n    // accepts new requests; this read never changes or clears its status.\n    const update = await readJSON<ComputerUpdate>(join(options.directory, \"computer-update.json\")) ?? requested;\n    if (update.id !== requested.id) {\n      // A concurrent update completed/advanced first. Recheck the live service.\n      requested = undefined;\n    } else {\n      const key = `${update.id}:${update.status}`;\n      if (last !== key) { last = key; options.onProgress?.(update); }\n      if (update.status === \"failed\") throw new Error(update.error ?? \"The service update failed. Run mindwire inspect for details.\");\n      if (update.status === \"complete\") {\n        requested = undefined;\n        if (Date.now() < deadline) continue;\n      } else if (!options.force && update.status === \"waiting\") {\n        return { version, complete: false, update };\n      }\n    }\n    if (Date.now() >= deadline) return { version, complete: false, update };\n    await delay(500, undefined, { signal: options.signal });\n  }\n}\n\nexport function updateProgress(update: ComputerUpdate): string {\n  const phase: Record<ComputerUpdate[\"status\"], string> = {\n    idle: \"Ready\", queued: \"Queued\", downloading: \"Downloading verified release…\",\n    waiting: \"Waiting for active work to finish\", restarting: \"Restarting service…\",\n    complete: \"Installed\", failed: \"Update failed\",\n  };\n  return `${update.version} · ${phase[update.status]}`;\n}\n"]}