waterplane 0.0.1 → 0.1.11

package/node_modules/@waterplane/shared/dist/pairing.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Pairing a new phone to a desktop: a short code shown as a QR on a phone that
+ * is already trusted, redeemed once by the new one.
+ *
+ * The code is 8 characters from an alphabet with no look-alikes (no 0/O, 1/I),
+ * so it can be typed off a screen as a fallback; it lives `PAIR_TTL_MS` and is
+ * spent by its first successful redeem. The QR carries the LANDING URL
+ * (`<base>/pair/<code>`, a host-rendered page that offers the web version and
+ * the APK); the installed app is reached through the DEEP LINK
+ * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
+ *
+ * The base goes through `normalizeHostBase`, so a scanned or pasted link can
+ * never aim the app at a `javascript:` or `data:` base.
+ */
+import { type RandomBytes } from "./hosts.js";
+/** 32 characters (a power of two: uniform from a byte), no 0, O, 1 or I. */
+export declare const PAIR_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+export declare const PAIR_CODE_LEN = 8;
+export declare const PAIR_TTL_MS: number;
+export declare const PAIR_SCHEME: string;
+/** Past identities' schemes, newest first: still PARSED (a QR printed by an older
+ *  host), never emitted. */
+export declare const LEGACY_PAIR_SCHEMES: readonly string[];
+export declare function newPairCode(rand?: RandomBytes): string;
+/** A code as typed: case, spaces and dashes forgiven, anything else refused.
+ *  No look-alike is "corrected" — 0/O/1/I are not in the alphabet, so a code
+ *  containing one was misread and guessing which letter was meant would spend
+ *  a rate-limited attempt on a wrong code. */
+export declare function normalizePairCode(raw: unknown): string | null;
+/** `ABCD-EFGH`, for reading aloud or off a screen. */
+export declare function formatPairCode(code: string): string;
+export interface PairTarget {
+    base: string;
+    code: string;
+}
+export declare function pairDeepLink(base: string, code: string): string;
+export declare function pairLandingUrl(base: string, code: string): string;
+/** Parse `<scheme>://pair?u=<base>&c=<code>` (current or a legacy scheme), or `null`. */
+export declare function parsePairDeepLink(raw: unknown): PairTarget | null;
+/** The code in a landing path: `/pair/<code>` (page) or `/pair/<code>/apk`. */
+export declare function pairPathCode(pathname: string): {
+    code: string;
+    apk: boolean;
+} | null;
+/** Parse `<base>/pair/<code>`, or `null`. */
+export declare function parsePairLandingUrl(raw: unknown): PairTarget | null;
+/** Whatever was scanned or pasted: a deep link or a landing URL. */
+export declare function parsePairInput(raw: unknown): PairTarget | null;
+export declare function pairExpired(expiresAt: number, now: number): boolean;
+/** One waterplane daemon found on the tailnet (`GET /api/tailnet/peers`). */
+export interface TailnetPeer {
+    /** The tailscale hostname. */
+    name: string;
+    /** `100.x.y.z:port` — what the phone saves as the host's address. */
+    addr: string;
+    os: string;
+    /** The daemon answered 401: it has a password, so a pairing code is needed. */
+    gated: boolean;
+}
+/** `GET /api/tailnet/peers` (trusted path only). `peers` is empty with a
+ *  sentence in `note` when tailscale is missing or nobody answered. */
+export interface TailnetPeersResponse {
+    ok: true;
+    peers: TailnetPeer[];
+    note?: string;
+}
+/** `POST /api/pair/mint` (trusted, authenticated caller) → */
+/** `POST /api/pair/mint` body. `passive`: the device this code pairs gets a
+ *  passive token (`passive.ts`), and redeeming it switches "gate Tailscale" on. */
+export interface PairMintRequest {
+    passive?: boolean;
+}
+export interface PairMintResponse {
+    code: string;
+    /** The code pairs a passive device. */
+    passive?: boolean;
+    expiresAt: number;
+    /** What the QR encodes. */
+    landingUrl: string;
+    deepLink: string;
+    base: string;
+    /** Plain-HTTP LAN base, when the host has a LAN interface bound. */
+    lanBase?: string;
+}
+/** `POST /api/pair/redeem` */
+export interface PairRedeemRequest {
+    code: string;
+    deviceName: string;
+}
+export interface PairRedeemHost {
+    name: string;
+    base: string;
+    httpsUrl: string | null;
+    lanBase?: string;
+    lanSsids?: string[];
+}
+/** `no-password`: the host has no password and the redeem came over the LAN —
+ *  its `message` is the host's own sentence and is shown verbatim. */
+export type PairRedeemError = "bad-request" | "unknown" | "expired" | "used" | "rate-limited" | "no-password";
+export type PairRedeemResponse = {
+    ok: true;
+    host: PairRedeemHost;
+    /** Device token (a new ledger row) — absent when no password is set. */
+    token?: string;
+    deviceId?: string;
+    /** Only to a loopback/tailscale peer. */
+    lanIdentity?: {
+        hostId: string;
+        secret: string;
+    };
+    /** A sentence for the phone when it got no token (no password set). */
+    note?: string;
+    /** The token is a passive one (`passive.ts`). */
+    scope?: "passive";
+} | {
+    ok: false;
+    error: PairRedeemError;
+    message: string;
+};
+export declare function pairRedeemErrorText(error: PairRedeemError): string;

package/node_modules/@waterplane/shared/dist/pairing.js

@@ -0,0 +1,130 @@
+/**
+ * Pairing a new phone to a desktop: a short code shown as a QR on a phone that
+ * is already trusted, redeemed once by the new one.
+ *
+ * The code is 8 characters from an alphabet with no look-alikes (no 0/O, 1/I),
+ * so it can be typed off a screen as a fallback; it lives `PAIR_TTL_MS` and is
+ * spent by its first successful redeem. The QR carries the LANDING URL
+ * (`<base>/pair/<code>`, a host-rendered page that offers the web version and
+ * the APK); the installed app is reached through the DEEP LINK
+ * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
+ *
+ * The base goes through `normalizeHostBase`, so a scanned or pasted link can
+ * never aim the app at a `javascript:` or `data:` base.
+ */
+import { normalizeHostBase } from "./hosturl.js";
+import { BRAND, LEGACY } from "./brand.js";
+import { randomFromAlphabet, defaultRandomBytes } from "./hosts.js";
+/** 32 characters (a power of two: uniform from a byte), no 0, O, 1 or I. */
+export const PAIR_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+export const PAIR_CODE_LEN = 8;
+export const PAIR_TTL_MS = 10 * 60 * 1000;
+export const PAIR_SCHEME = BRAND.pairScheme;
+/** Past identities' schemes, newest first: still PARSED (a QR printed by an older
+ *  host), never emitted. */
+export const LEGACY_PAIR_SCHEMES = LEGACY.map((l) => l.pairScheme);
+export function newPairCode(rand = defaultRandomBytes) {
+    return randomFromAlphabet(PAIR_ALPHABET, PAIR_CODE_LEN, rand);
+}
+/** A code as typed: case, spaces and dashes forgiven, anything else refused.
+ *  No look-alike is "corrected" — 0/O/1/I are not in the alphabet, so a code
+ *  containing one was misread and guessing which letter was meant would spend
+ *  a rate-limited attempt on a wrong code. */
+export function normalizePairCode(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const s = raw.replace(/[\s-]/g, "").toUpperCase();
+    if (s.length !== PAIR_CODE_LEN)
+        return null;
+    for (const ch of s)
+        if (!PAIR_ALPHABET.includes(ch))
+            return null;
+    return s;
+}
+/** `ABCD-EFGH`, for reading aloud or off a screen. */
+export function formatPairCode(code) {
+    return code.length === PAIR_CODE_LEN ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+}
+export function pairDeepLink(base, code) {
+    return `${PAIR_SCHEME}://pair?u=${encodeURIComponent(base)}&c=${encodeURIComponent(code)}`;
+}
+export function pairLandingUrl(base, code) {
+    return `${base.replace(/\/+$/, "")}/pair/${code}`;
+}
+/** Parse `<scheme>://pair?u=<base>&c=<code>` (current or a legacy scheme), or `null`. */
+export function parsePairDeepLink(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const schemes = [PAIR_SCHEME, ...LEGACY_PAIR_SCHEMES].map((x) => x.replace(/[^a-z0-9+.-]/gi, "")).join("|");
+    const m = new RegExp(`^(?:${schemes})://pair/?\\?(.*)$`, "i").exec(raw.trim());
+    if (!m)
+        return null;
+    let params;
+    try {
+        params = new URLSearchParams(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const base = normalizeHostBase(params.get("u") ?? "");
+    const code = normalizePairCode(params.get("c"));
+    return base && code ? { base, code } : null;
+}
+/** The code in a landing path: `/pair/<code>` (page) or `/pair/<code>/apk`. */
+export function pairPathCode(pathname) {
+    const m = /^\/pair\/([^/]+)(\/apk)?\/?$/.exec(pathname);
+    if (!m)
+        return null;
+    let seg;
+    try {
+        seg = decodeURIComponent(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const code = normalizePairCode(seg);
+    return code ? { code, apk: !!m[2] } : null;
+}
+/** Parse `<base>/pair/<code>`, or `null`. */
+export function parsePairLandingUrl(raw) {
+    if (typeof raw !== "string")
+        return null;
+    let u;
+    try {
+        u = new URL(raw.trim());
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+        return null;
+    const p = pairPathCode(u.pathname);
+    if (!p || p.apk)
+        return null;
+    const base = normalizeHostBase(`${u.protocol}//${u.host}`);
+    return base ? { base, code: p.code } : null;
+}
+/** Whatever was scanned or pasted: a deep link or a landing URL. */
+export function parsePairInput(raw) {
+    return parsePairDeepLink(raw) ?? parsePairLandingUrl(raw);
+}
+export function pairExpired(expiresAt, now) {
+    return now >= expiresAt;
+}
+export function pairRedeemErrorText(error) {
+    switch (error) {
+        case "bad-request":
+            return "That is not a pairing code — it is 8 letters and digits.";
+        case "unknown":
+            return "The desktop does not know that code. Check it, or show a new QR.";
+        case "expired":
+            return "That code has expired (they last 10 minutes). Show a new QR on the paired phone.";
+        case "used":
+            return "That code was already used. Show a new QR on the paired phone.";
+        case "rate-limited":
+            return "Too many attempts. Wait a minute and try again.";
+        case "no-password":
+            return "This desktop has no password set, so it refuses pairing over the Wi-Fi. Pair over Tailscale instead.";
+    }
+}
+//# sourceMappingURL=pairing.js.map

package/node_modules/@waterplane/shared/dist/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AAEtF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;AAC5C;4BAC4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CAAC,OAAoB,kBAAkB;IAChE,OAAO,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,GAAG,WAAW,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,OAAO,oBAAoB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAW;IACxD,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AA6ED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,0DAA0D,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,kEAAkE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,gEAAgE,CAAC;QAC1E,KAAK,cAAc;YACjB,OAAO,iDAAiD,CAAC;QAC3D,KAAK,aAAa;YAChB,OAAO,sGAAsG,CAAC;IAClH,CAAC;AACH,CAAC"}

package/node_modules/@waterplane/shared/dist/passive.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Passive device mode — the kids' phone (requirements R-connection-011…014).
+ *
+ * A device paired as "passive" holds a token the host lets through only to the
+ * app-update path: health, the web bundle, `GET /api/passive/state` and the
+ * artifact download of an APK the auto-pull queue holds. Everything else, the
+ * WebSocket included, is refused by the HOST (`host/src/passive.ts`); the
+ * phone's single screen is a courtesy, never the boundary.
+ *
+ * A PIN, checked and rate-limited on the host, lifts that one token to full
+ * scope for `PASSIVE_UNLOCK_MS`. The lift lives in the host's memory only, so a
+ * killed app, a reboot of the phone or a host restart all come back locked.
+ */
+import type { PullItem } from "./wire/work.js";
+/** How long a correct PIN unlocks a passive device. */
+export declare const PASSIVE_UNLOCK_MS: number;
+export declare const PIN_MIN = 4;
+export declare const PIN_MAX = 12;
+/** A PIN as typed: digits only, `PIN_MIN`–`PIN_MAX` long; `null` otherwise. */
+export declare function normalizePin(raw: unknown): string | null;
+/** `GET /api/auth/status` adds these for a caller holding a device token. */
+export interface PassiveAuthFields {
+    /** The caller's token is a passive one. Absent ⇒ full scope. */
+    scope?: "passive";
+    /** A passive token currently unlocked by the PIN: until when (epoch ms). */
+    unlockedUntil?: number;
+    /** An unlock PIN is set on this host. */
+    pinSet?: boolean;
+}
+/** `GET /api/passive/state` → what the passive screen draws. */
+export interface PassiveStateResponse {
+    /** The APKs the auto-pull queue holds — exactly the downloads a passive token may fetch. */
+    items: PullItem[];
+    /** The host's clock when it answered: the "last check" line. */
+    checkedAt: number;
+    /** Unlocked until (epoch ms), or null when locked / not passive. */
+    unlockedUntil: number | null;
+    pinSet: boolean;
+}
+/** `POST /api/auth/unlock {pin}` → */
+export type PassiveUnlockResponse = {
+    ok: true;
+    unlockedUntil: number;
+} | {
+    ok: false;
+    error: "not-passive" | "no-pin" | "wrong-pin" | "rate-limited" | "bad-request";
+    message: string;
+};
+/** The one wording of a refusal of an unlock. */
+export declare function passiveUnlockErrorText(error: Exclude<PassiveUnlockResponse, {
+    ok: true;
+}>["error"], retryAfterS?: number): string;
+/** The item a passive screen and a passive download both mean: an APK. */
+export declare function isPassiveItem(item: Pick<PullItem, "name" | "relPath">): boolean;
+/** "Unlocked until 14:35" — the clock is the phone's, at render. */
+export declare function unlockedUntilText(until: number, now?: number): string | null;
+/** The pairing sheet's one sentence about what a passive pairing switches on. */
+export declare const PASSIVE_PAIR_NOTE = "Pairing a passive device switches on \"require the password over Tailscale\", so every device needs its own token on Tailscale too \u2014 sign in again on any browser that has none.";

package/node_modules/@waterplane/shared/dist/passive.js

@@ -0,0 +1,36 @@
+/** How long a correct PIN unlocks a passive device. */
+export const PASSIVE_UNLOCK_MS = 30 * 60_000;
+export const PIN_MIN = 4;
+export const PIN_MAX = 12;
+/** A PIN as typed: digits only, `PIN_MIN`–`PIN_MAX` long; `null` otherwise. */
+export function normalizePin(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const s = raw.trim();
+    return new RegExp(`^[0-9]{${PIN_MIN},${PIN_MAX}}$`).test(s) ? s : null;
+}
+/** The one wording of a refusal of an unlock. */
+export function passiveUnlockErrorText(error, retryAfterS = 0) {
+    switch (error) {
+        case "not-passive": return "This device is not a passive device, so there is nothing to unlock.";
+        case "no-pin": return "No unlock PIN is set on the desktop. Set one from a trusted phone: Settings › Connection › Passive devices.";
+        case "wrong-pin": return "Wrong PIN.";
+        case "rate-limited": return `Too many tries. Try again in ${Math.max(1, Math.ceil(retryAfterS / 60))} min.`;
+        case "bad-request": return `A PIN is ${PIN_MIN}–${PIN_MAX} digits.`;
+    }
+}
+/** The item a passive screen and a passive download both mean: an APK. */
+export function isPassiveItem(item) {
+    return /\.apk$/i.test(item.name) || /\.apk$/i.test(item.relPath);
+}
+/** "Unlocked until 14:35" — the clock is the phone's, at render. */
+export function unlockedUntilText(until, now = Date.now()) {
+    if (!(until > now))
+        return null;
+    const d = new Date(until);
+    const p = (n) => String(n).padStart(2, "0");
+    return `Unlocked until ${p(d.getHours())}:${p(d.getMinutes())}`;
+}
+/** The pairing sheet's one sentence about what a passive pairing switches on. */
+export const PASSIVE_PAIR_NOTE = "Pairing a passive device switches on \"require the password over Tailscale\", so every device needs its own token on Tailscale too — sign in again on any browser that has none.";
+//# sourceMappingURL=passive.js.map

package/node_modules/@waterplane/shared/dist/passive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passive.js","sourceRoot":"","sources":["../src/passive.ts"],"names":[],"mappings":"AAeA,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,CAAC;AAE1B,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,IAAI,MAAM,CAAC,UAAU,OAAO,IAAI,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AA4BD,iDAAiD;AACjD,MAAM,UAAU,sBAAsB,CAAC,KAA4D,EAAE,WAAW,GAAG,CAAC;IAClH,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,aAAa,CAAC,CAAC,OAAO,qEAAqE,CAAC;QACjG,KAAK,QAAQ,CAAC,CAAC,OAAO,6GAA6G,CAAC;QACpI,KAAK,WAAW,CAAC,CAAC,OAAO,YAAY,CAAC;QACtC,KAAK,cAAc,CAAC,CAAC,OAAO,gCAAgC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;QAC5G,KAAK,aAAa,CAAC,CAAC,OAAO,YAAY,OAAO,IAAI,OAAO,UAAU,CAAC;IACtE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,IAAwC;IACpE,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/D,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kLAAkL,CAAC"}

package/node_modules/@waterplane/shared/dist/peer.d.ts

@@ -0,0 +1,311 @@
+import type { SessionInfo } from "./wire/session.js";
+export declare const PEER_API_VERSION = 1;
+/** The header every peer call carries its API version in. */
+/** Lower-case: Node hands header names over lower-cased, and HTTP compares them case-blind. */
+export declare const PEER_API_HEADER: string;
+/** Report text cap (the host reads `WATERPLANE_PEER_REPORT_MAX_CHARS` over it). */
+export declare const PEER_REPORT_MAX_CHARS = 16000;
+export declare const PEER_ARTIFACT_MAX_BYTES: number;
+export declare const PEER_ARTIFACTS_MAX = 8;
+/** The caller's at-most-once key — the same shape `agentintents.ts` accepts. */
+export declare const PEER_KEY_RE: RegExp;
+/** A peer's name as `peers.json` lists it: also a URL path segment and an id part. */
+export declare const PEER_NAME_RE: RegExp;
+export type PeerJobState = "queued" | "waiting" | "running" | "limit" | "done" | "failed" | "refused";
+/** The asker adds one state of its own: the peer could not be reached. */
+export type PeerJobLocalState = PeerJobState | "unreachable";
+/** Settled for good: nothing more will happen to this job on the peer. */
+export declare const peerJobTerminal: (s: string | undefined) => boolean;
+/** Body of `POST /api/peer/jobs` (peer-facing, token-gated). */
+export interface PeerJobRequest {
+    /** Caller's at-most-once key, `PEER_KEY_RE`. */
+    key: string;
+    /** Asking host's peer name as the PEER lists it. */
+    from: string;
+    /** The repo's remote URL as the asker sees it (matched by `remoteKey`). */
+    remote: string;
+    /** What was pushed; the peer checks out `commit` detached. */
+    branch: string;
+    commit: string;
+    prompt?: string;
+    /** At most `INTENT_MAX_STEPS`. */
+    steps?: string[];
+    label?: string;
+    closeWhenDone?: boolean;
+    /** Default true: bring back `.claude/outbox` files the answer names. */
+    reportArtifacts?: boolean;
+    /** Picks one clone when the peer has two of the remote. */
+    dir?: string;
+    /**
+     * The ASKING session's label, so the job session on the peer can say why it exists
+     * ("job from mac · <this> · <label>"). Additive: an older peer ignores it.
+     */
+    askerLabel?: string;
+}
+export interface PeerReportArtifact {
+    name: string;
+    size: number;
+}
+export interface PeerJobReport {
+    ok: boolean;
+    text: string;
+    truncated: boolean;
+    artifacts: PeerReportArtifact[];
+    pushedBranch?: string;
+}
+/** `GET /api/peer/jobs/<id>`. */
+export interface PeerJobView {
+    id: string;
+    state: PeerJobState;
+    peerApi: number;
+    /** The peer's waterplane version. */
+    version: string;
+    intentId: string;
+    sessionId?: string;
+    worktree?: string;
+    /** The row's blockDetail, or the limit's reset words. */
+    waiting?: string;
+    report?: PeerJobReport;
+    /** The sentence, when refused or failed. */
+    detail?: string;
+    /**
+     * What the job's session has spent, read off the PEER's own ledger (`ctxlog.ts`, the same pass
+     * the session's cost chip there is drawn from). Additive; every field ABSENT when nothing
+     * measured it — never 0, never a guess. While the job runs it is "so far".
+     */
+    cost?: PeerJobCost;
+}
+/** Tokens by kind — the four are never merged (`tokens.ts`). */
+export interface PeerTokenSplit {
+    in: number;
+    out: number;
+    cacheRead: number;
+    cacheWrite: number;
+}
+/**
+ * One job's spend as the peer measured it. Each field stands alone and is absent when its own
+ * reading is: a job whose model has no published rate still carries its tokens and duration.
+ * `usd` is a LIST-PRICE counterfactual (`costText`'s framing), subagents included.
+ */
+export interface PeerJobCost {
+    usd?: number;
+    tokens?: PeerTokenSplit;
+    /** The model alias (`opus-5-5`), never a raw dated id. */
+    model?: string;
+    /** From the row starting to it settling — or to the reading, while it runs. */
+    durationMs?: number;
+    /** `usd` as a share of the account's WEEKLY limit, by the peer's own calibration; absent when it has none fresh. */
+    weekPct?: number;
+    /** Tokens on a model with no published rate — in no `usd`. */
+    unpricedTok?: number;
+}
+/** `GET /api/peer/hello`. */
+export interface PeerHello {
+    peerApi: number;
+    version: string;
+    /** The name this host knows the CALLER by, when the token matched one. */
+    you?: string;
+    /** Is claude signed in on this desktop: a job sent while it is not stops at the sign-in
+     *  screen. Absent from an older peer and when its `claude auth status` could not be read. */
+    claudeSignedIn?: boolean;
+}
+/** `GET /api/peers/<name>/status` — the phone asks its own host to ask that peer, now. */
+export interface PeerStatusResponse {
+    ok: boolean;
+    /** Why the peer could not be asked (offline, not paired that way, refused), in words. */
+    error?: string;
+    version?: string;
+    claudeSignedIn?: boolean;
+}
+/** The loopback route's answer. */
+export interface PeerAgentAnswer {
+    ok: true;
+    /** `peerJobId(peer, key)`. */
+    id: string;
+    state: PeerJobLocalState;
+    peer: string;
+    fires: string;
+    existing?: boolean;
+}
+/** The asker's ledger row for one job (`.waterplane/peer-jobs.json`). */
+export interface PeerJobRecord {
+    id: string;
+    peer: string;
+    key: string;
+    state: PeerJobLocalState;
+    cwd: string;
+    /** The asking session; absent once it is gone (the report falls to the backlog). */
+    sessionId?: string;
+    branch: string;
+    commit: string;
+    createdAt: number;
+    updatedAt: number;
+    /** Since when the peer has been unreachable, when it is. */
+    unreachableSince?: number;
+    view?: PeerJobView;
+    detail?: string;
+    /** The job's own label, as the asking agent gave it. */
+    label?: string;
+    /** The asking session's label when the job was sent. */
+    askerLabel?: string;
+    /** The peer's last cost reading for the job (`cleanPeerJobCost`'d); absent = none yet. */
+    cost?: PeerJobCost;
+    /** When this side first saw the job settle (terminal), epoch ms. */
+    endedAt?: number;
+    /**
+     * The peer's own id for the job (`PeerJobView.id` from the POST answer). The peer names a job
+     * after what IT calls us, which need not be what we call it, so every later read goes by this.
+     */
+    remoteId?: string;
+}
+/**
+ * One row of `peers.json`. Outbound rows (we call them) keep the clear
+ * `token`; inbound rows (they call us) keep `tokenSha256` only.
+ */
+export interface PeerRow {
+    name: string;
+    /** `host:port` — what `peerAddressOk` vouched for. */
+    addr: string;
+    token?: string;
+    tokenSha256?: string;
+    addedAt: number;
+}
+/** The id of a job on both hosts: `peer-<name>-<key>`. */
+export declare const peerJobId: (peer: string, key: string) => string;
+/** The report row's id. */
+export declare const peerReportId: (peer: string, key: string) => string;
+/** Read one `peers.json` row; anything unreadable is dropped, never defaulted. */
+export declare function cleanPeerRow(raw: unknown): PeerRow | null;
+/**
+ * One key for "the same remote", whatever its spelling: ssh://, scp-style
+ * `git@host:o/r`, https://, with or without `.git`, a trailing slash, userinfo,
+ * a port, or capitals. `host/path` lower-cased; null when there is no host or
+ * no path (a local path or `file://` identifies nothing another machine shares).
+ */
+export declare function remoteKey(url: string): string | null;
+/**
+ * Is `addr` an address a peer may be reached on? null = fine, else why not.
+ * Accepts `100.64/10:port`, `<name>.<tailnet>.ts.net:port` and
+ * `127.0.0.1:port`. Nothing else — no `*.local`, no LAN, no public, no bare name.
+ */
+export declare function peerAddressOk(addr: string): string | null;
+/** The asker's sentence for a peer-API version mismatch; says which side is older. */
+export declare function peerVersionMismatchText(peer: string, ours: number, theirs: number): string;
+/** The peer's own side of the same sentence, when it refuses a caller (409 body). */
+export declare function peerVersionRefusalText(ours: number, theirs: number | null): string;
+/** Parse the header value; null when absent or not a whole non-negative number. */
+export declare function parsePeerApiHeader(v: string | undefined | null): number | null;
+/**
+ * The ONE wording of a peer's report, as the asking session receives it.
+ * `max` caps the report text; a cut says how much, and names the peer session
+ * to open for the rest. Starts with the peer mark.
+ */
+export declare function peerReportPrompt(peer: string, job: PeerJobView, max?: number): string;
+/**
+ * The tag's words — "waiting on pc · 4 min". The age is the PHONE's clock at
+ * render (`now`), so a host-computed string is never stale on arrival; without
+ * `now`, or with a `since` that cannot be believed, the age is left off.
+ * Empty when there is nothing true to say.
+ */
+export declare function peerWaitWords(w: SessionInfo["peerWait"], now?: number): string;
+/**
+ * A model id as a job's cost names it: the ALIAS without the `claude-` prefix
+ * (`claude-opus-5-5-20260901` → `opus-5-5`), or another backend's own short id
+ * as written. Null for anything that is not a plausible id.
+ */
+export declare function peerModelName(m: unknown): string | null;
+/**
+ * Read a `PeerJobCost` off the wire FIELD BY FIELD: each one that is not a
+ * believable reading is dropped on its own, never zeroed, never defaulted.
+ * `tokens` is all four kinds or none (a split missing a kind is not a split),
+ * and all-zero is no reading. Undefined when nothing survives.
+ */
+export declare function cleanPeerJobCost(raw: unknown): PeerJobCost | undefined;
+/** A job's length in words: `<1 min`, `6 min`, `1 h 20 min`, `2 d 3 h`. Empty when it cannot be believed. */
+export declare function peerDurationText(ms: number | undefined): string;
+/** `≈0.05% of week` — the peer's own estimate; empty without one. */
+export declare function peerWeekText(weekPct: number | undefined): string;
+/** `["$0.84", "opus-5-5", "6 min"]` — the parts that were measured, in that order; [] for none. */
+export declare function peerCostParts(c: PeerJobCost | undefined): string[];
+/** A job state in the words a line uses ("running", "queued there", …); "" for an unknown one. */
+export declare const peerJobStateWords: (s: string) => string;
+/** One delegated job as the asking session lists it (`SessionInfo.peerJobs`). */
+export interface PeerJobSummary {
+    peer: string;
+    jobId: string;
+    state: PeerJobLocalState;
+    label?: string;
+    /** When the job was sent. */
+    since: number;
+    /** When this side saw it settle. */
+    endedAt?: number;
+    peerSessionId?: string;
+    peerBase?: string;
+    cost?: PeerJobCost;
+}
+/**
+ * One row of the asker's ledger as the PHONE reads it (`GET /api/peerjobs`, trusted path):
+ * a summary plus where it came from. Never a token, never the peer's report text.
+ */
+export interface PeerJobLedgerRow extends PeerJobSummary {
+    /** The asking repo (worktree path on this desktop). */
+    cwd: string;
+    /** The asking session; absent once it is gone. */
+    sessionId?: string;
+    askerLabel?: string;
+    /** The sentence, when refused/failed/unreachable. */
+    detail?: string;
+    /** Nothing more will happen: the report settled or the job was called off. */
+    closed?: boolean;
+    /** The report reached the asking session (or its backlog). */
+    reported?: boolean;
+}
+/**
+ * "sent to pc: run the e2e suite · done · $0.84 · opus-5-5 · 6 min" — one line
+ * per job in the asking session's facts. The cost parts only where measured;
+ * a job with no label is "a job". Empty when there is nothing true to say.
+ */
+export declare function peerJobLine(j: Pick<PeerJobSummary, "peer" | "state" | "label" | "cost"> | null | undefined): string;
+/**
+ * What a session cost, SPLIT by desktop: "$22.28 here + $0.84 on pc".
+ * Never a single summed figure — the two were measured on two machines, and a
+ * total without its split hides which one spent it. `hereUsd` absent (nothing
+ * priced here) says so instead of dropping the half. Jobs with no `usd` are
+ * counted, not charged zero. Null when no job carries a cost at all.
+ */
+export declare function peerSpendSplit(hereUsd: number | null | undefined, jobs: readonly Pick<PeerJobSummary, "peer" | "cost">[] | null | undefined): {
+    text: string;
+    peerUsd: number;
+    byPeer: {
+        peer: string;
+        usd: number;
+    }[];
+    unpriced: number;
+} | null;
+/**
+ * The peer-job spend that belongs in a weekly-limit calibration over
+ * `[from, to]` (both desktops on ONE account: the peer's spend is in the
+ * percentage the account reports, and this desktop's ledger never saw it).
+ * Only jobs that started AND ended inside the window, with a measured `usd` —
+ * a job straddling either edge cannot be cut to the window, so it is left out
+ * and COUNTED (`straddling`), never prorated. Null when nothing qualifies.
+ */
+export declare function peerWeekSpend(jobs: readonly Pick<PeerJobSummary, "peer" | "cost" | "since" | "endedAt">[] | null | undefined, from: number, to: number): {
+    usd: number;
+    byPeer: {
+        peer: string;
+        usd: number;
+    }[];
+    text: string;
+    straddling: number;
+} | null;
+/** Why a session on the PEER exists (`SessionInfo.peerJob`). */
+export interface PeerJobOrigin {
+    /** The asking desktop, as this host lists it. */
+    from: string;
+    jobId: string;
+    askerLabel?: string;
+    label?: string;
+}
+/** "job from mac · <asking session label> · <job label>" — absent parts omitted; empty with no `from`. */
+export declare function peerJobOriginText(o: PeerJobOrigin | null | undefined): string;