workerdeck 0.12.0 → 0.15.0

package/README.md

@@ -30,6 +30,10 @@ The cookie is not a convenience. A browser cannot set a header on a WebSocket ha
 a cookie is the only credential a tab can present when it attaches to a session — and a cookie only
 rides requests to the origin that set it. That is why the dashboard and the API share a port.
 
+Those logins persist in `<state-dir>/auth-sessions.json` (mode 600), so a restart doesn't sign
+every open tab out. Each row is an HMAC of the cookie under the operator secret — so the file is
+worth nothing on its own, and rotating the secret invalidates every outstanding login.
+
 Neither transport authenticates *who* the person is; the secret is a door key. Put an
 identity-aware proxy in front if you need more than that.
 
@@ -105,3 +109,17 @@ a normal dependency of this package. Point `webRoot` in the config file at your
 a fork instead.
 
 MIT
+
+## Rules you cannot infer from the types
+
+- **Single origin is load-bearing.** The gateway and the dashboard share one port because a tab
+  cannot header a WebSocket handshake, so a cookie is the only credential an attach can carry —
+  and cookies are per-origin. This is why there is no "dashboard on another port" mode.
+- **Loopback runs keyless; off loopback the CLI generates a key rather than serving open.** Only an
+  explicit `--insecure` / `insecureHosts` declaration serves unauthenticated, and those entries
+  double as accepted `Host` headers.
+- **Browser logins are keyed by `HMAC(secret, token)`.** That is what makes the session file
+  worthless to a reader — and what makes rotating the auth key invalidate every cookie for free.
+- **A config file supplying its own `authenticate` turns the built-in auth off entirely**, rather
+  than layering on top of it. Two auth systems agreeing is harder to reason about than one.
+

package/build/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as ConfigError, d as parseArgs, f as resolveInstanceConfig, r as startInstance, u as loadConfigFile } from "./instance-DbIqlX-e.mjs";
+import { a as ConfigError, d as parseArgs, f as resolveInstanceConfig, r as startInstance, u as loadConfigFile } from "./instance-BiGOs_KV.mjs";
 import { dirname, join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
@@ -51,6 +51,14 @@ Options
   -c, --config <path>       config file (default: ./workerdeck.config.mjs)
       --insecure            allow no-auth on a non-loopback address. Only when
                             something in front is doing the authenticating.
+      --cors-origin <o>     browser origin allowed to call /v1 cross-origin, for a
+                            dashboard served elsewhere (repeatable, exact origin, no
+                            wildcard; config: corsOrigins). Refused without auth. The
+                            key is still required — this only permits the call.
+      --no-web              don't serve the web dashboard (config: web: false).
+                            /v1 and the auth routes are unchanged; everything else
+                            404s. For a gateway reached only from the VS Code
+                            extension, the phone, or another host's dashboard.
       --open                open the dashboard in a browser once it is up
   -h, --help                show this
   -v, --version             print the version

package/build/cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { spawn } from 'node:child_process'\nimport { readFile } from 'node:fs/promises'\nimport { dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { ConfigError, loadConfigFile, parseArgs, resolveInstanceConfig } from './config.ts'\nimport { startInstance } from './instance.ts'\n\nconst HELP = `workerdeck — run a workerdeck instance: session gateway + dashboard, one port.\n\nUsage\n  workerdeck [options]\n  workerdeck guard [options]     check whether it is safe to restart an instance\n\nOptions\n  -p, --port <n>            port to listen on (default 8787, WORKERDECK_PORT)\n      --host <addr>         interface to bind (default 127.0.0.1, WORKERDECK_HOST)\n      --auth-key <secret>   shared secret, min 12 chars; browsers log in with it,\n                            services send it as x-workerdeck-key\n                            (WORKERDECK_AUTH_KEY). Unset = no auth on loopback;\n                            on any other interface a key is generated instead,\n                            printed once, and stored in <state-dir>/auth-key for\n                            later starts to reuse.\n      --trust-proxy         trust x-forwarded-proto/-host/-for from one reverse\n                            proxy. Required behind TLS termination, or the session\n                            cookie loses its Secure flag and the origin check\n                            computes http:// where the browser says https://.\n      --allowed-origin <o>  extra origin accepted on browser requests, for when a\n                            proxy rewrites Host (repeatable)\n      --allowed-host <name> extra Host header accepted when running without auth\n                            (repeatable; loopback names are always accepted)\n      --insecure-host <name>\n                            bind host that may serve without auth — no key demanded,\n                            none generated — and, while unauthenticated, also\n                            accepted as a Host header (repeatable; config:\n                            insecureHosts). Names the host alone, no port.\n      --profile <name=dir>  Claude config dir a session may run under (repeatable)\n      --cwd-root <path>     restrict session cwds to this root (repeatable,\n                            WORKERDECK_CWD_ROOTS as a ':'-separated list)\n      --fs-root <path>      narrow which host directories /v1/fs serves\n                            (repeatable, WORKERDECK_FS_ROOTS as a ':'-separated\n                            list). Reading otherwise follows --cwd-root: a caller\n                            who may start a session in a tree can already read it\n                            through the agent. With neither, the routes 404.\n      --fs-write            also accept writes over /v1/fs. Its own switch because\n                            an agent's writes go through the permission flow and a\n                            PUT does not. Every write is still conditional on the\n                            hash the client last read.\n      --state-dir <path>    where parked sessions are persisted\n                            (default: beside the config file, else ~/.workerdeck)\n      --no-parking-store    keep parked sessions in memory only; a restart drops them\n  -c, --config <path>       config file (default: ./workerdeck.config.mjs)\n      --insecure            allow no-auth on a non-loopback address. Only when\n                            something in front is doing the authenticating.\n      --open                open the dashboard in a browser once it is up\n  -h, --help                show this\n  -v, --version             print the version\n\nConfig file\n  Options that cannot fit on a command line — \\`authenticate\\`, \\`buildRunnerConfig\\`,\n  \\`createEngineRunner\\` are functions — live in workerdeck.config.mjs, which\n  default-exports the createWorkerServer options (or a function returning them).\n  Flags and env override it. Supplying your own \\`authenticate\\` turns the built-in\n  shared-secret auth off entirely.\n\nCredentials\n  workerdeck implements no Anthropic auth of its own: the official SDK/CLI\n  resolves credentials from the environment, per profile. --auth-key protects this\n  gateway, nothing else.\n`\n\nasync function readVersion(): Promise<string> {\n  // src/cli.ts and build/cli.mjs are both one level under the package root.\n  const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json')\n  try {\n    const raw = await readFile(pkgPath, 'utf8')\n    return (JSON.parse(raw) as { version?: string }).version ?? 'unknown'\n  } catch {\n    return 'unknown'\n  }\n}\n\n/** Best-effort: a browser that won't open is a convenience missed, not a failure. */\nfunction openInBrowser(url: string): void {\n  const command =\n    process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'\n  try {\n    const child = spawn(command, [url], {\n      stdio: 'ignore',\n      detached: true,\n      shell: process.platform === 'win32',\n    })\n    child.on('error', () => {})\n    child.unref()\n  } catch {\n    // ignored\n  }\n}\n\nasync function main(argv: string[]): Promise<number> {\n  if (argv[0] === 'guard') {\n    const { runGuard } = await import('./guard.ts')\n    return await runGuard(argv.slice(1))\n  }\n\n  const flags = parseArgs(argv)\n  if (flags.help) {\n    process.stdout.write(HELP)\n    return 0\n  }\n  if (flags.version) {\n    process.stdout.write(`${await readVersion()}\\n`)\n    return 0\n  }\n\n  const loaded = await loadConfigFile(flags.config)\n  const config = resolveInstanceConfig(flags, loaded)\n  const instance = await startInstance(config)\n\n  if (config.open) openInBrowser(instance.url)\n\n  const shutdown = (signal: string): void => {\n    process.stdout.write(`\\n[workerdeck] ${signal} — shutting down\\n`)\n    // Parked sessions are already on disk; this is about letting in-flight\n    // requests finish rather than dropping sockets on the floor.\n    instance\n      .close()\n      .then(() => process.exit(0))\n      .catch(() => process.exit(1))\n  }\n  process.on('SIGINT', () => shutdown('SIGINT'))\n  process.on('SIGTERM', () => shutdown('SIGTERM'))\n\n  // Resolves only on close; the process stays up serving.\n  await instance.closed\n  return 0\n}\n\nmain(process.argv.slice(2))\n  .then((code) => {\n    if (code !== 0) process.exit(code)\n  })\n  .catch((error: unknown) => {\n    if (error instanceof ConfigError) {\n      process.stderr.write(`[workerdeck] ${error.message}\\n`)\n      process.exit(2)\n    }\n    process.stderr.write(\n      `[workerdeck] ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\\n`,\n    )\n    process.exit(1)\n  })\n"],"mappings":";;;;;;;AAQA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+Db,eAAe,cAA+B;CAE5C,MAAM,UAAU,KAAK,QAAQ,cAAc,OAAO,KAAK,IAAI,CAAC,EAAE,MAAM,eAAe;AACnF,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,SAAS,OAAO;AAC3C,SAAQ,KAAK,MAAM,IAAI,CAA0B,WAAW;SACtD;AACN,SAAO;;;;AAKX,SAAS,cAAc,KAAmB;CACxC,MAAM,UACJ,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,UAAU;AACpF,KAAI;EACF,MAAM,QAAQ,MAAM,SAAS,CAAC,IAAI,EAAE;GAClC,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,aAAa;GAC7B,CAAC;AACF,QAAM,GAAG,eAAe,GAAG;AAC3B,QAAM,OAAO;SACP;;AAKV,eAAe,KAAK,MAAiC;AACnD,KAAI,KAAK,OAAO,SAAS;EACvB,MAAM,EAAE,aAAa,MAAM,OAAO,wBAAA,MAAA,MAAA,EAAA,EAAA;AAClC,SAAO,MAAM,SAAS,KAAK,MAAM,EAAE,CAAC;;CAGtC,MAAM,QAAQ,UAAU,KAAK;AAC7B,KAAI,MAAM,MAAM;AACd,UAAQ,OAAO,MAAM,KAAK;AAC1B,SAAO;;AAET,KAAI,MAAM,SAAS;AACjB,UAAQ,OAAO,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI;AAChD,SAAO;;CAIT,MAAM,SAAS,sBAAsB,OAAO,MADvB,eAAe,MAAM,OAAO,CACE;CACnD,MAAM,WAAW,MAAM,cAAc,OAAO;AAE5C,KAAI,OAAO,KAAM,eAAc,SAAS,IAAI;CAE5C,MAAM,YAAY,WAAyB;AACzC,UAAQ,OAAO,MAAM,kBAAkB,OAAO,oBAAoB;AAGlE,WACG,OAAO,CACP,WAAW,QAAQ,KAAK,EAAE,CAAC,CAC3B,YAAY,QAAQ,KAAK,EAAE,CAAC;;AAEjC,SAAQ,GAAG,gBAAgB,SAAS,SAAS,CAAC;AAC9C,SAAQ,GAAG,iBAAiB,SAAS,UAAU,CAAC;AAGhD,OAAM,SAAS;AACf,QAAO;;AAGT,KAAK,QAAQ,KAAK,MAAM,EAAE,CAAC,CACxB,MAAM,SAAS;AACd,KAAI,SAAS,EAAG,SAAQ,KAAK,KAAK;EAClC,CACD,OAAO,UAAmB;AACzB,KAAI,iBAAiB,aAAa;AAChC,UAAQ,OAAO,MAAM,gBAAgB,MAAM,QAAQ,IAAI;AACvD,UAAQ,KAAK,EAAE;;AAEjB,SAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,MAAM,CAAC,IACzF;AACD,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { spawn } from 'node:child_process'\nimport { readFile } from 'node:fs/promises'\nimport { dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { ConfigError, loadConfigFile, parseArgs, resolveInstanceConfig } from './config.ts'\nimport { startInstance } from './instance.ts'\n\nconst HELP = `workerdeck — run a workerdeck instance: session gateway + dashboard, one port.\n\nUsage\n  workerdeck [options]\n  workerdeck guard [options]     check whether it is safe to restart an instance\n\nOptions\n  -p, --port <n>            port to listen on (default 8787, WORKERDECK_PORT)\n      --host <addr>         interface to bind (default 127.0.0.1, WORKERDECK_HOST)\n      --auth-key <secret>   shared secret, min 12 chars; browsers log in with it,\n                            services send it as x-workerdeck-key\n                            (WORKERDECK_AUTH_KEY). Unset = no auth on loopback;\n                            on any other interface a key is generated instead,\n                            printed once, and stored in <state-dir>/auth-key for\n                            later starts to reuse.\n      --trust-proxy         trust x-forwarded-proto/-host/-for from one reverse\n                            proxy. Required behind TLS termination, or the session\n                            cookie loses its Secure flag and the origin check\n                            computes http:// where the browser says https://.\n      --allowed-origin <o>  extra origin accepted on browser requests, for when a\n                            proxy rewrites Host (repeatable)\n      --allowed-host <name> extra Host header accepted when running without auth\n                            (repeatable; loopback names are always accepted)\n      --insecure-host <name>\n                            bind host that may serve without auth — no key demanded,\n                            none generated — and, while unauthenticated, also\n                            accepted as a Host header (repeatable; config:\n                            insecureHosts). Names the host alone, no port.\n      --profile <name=dir>  Claude config dir a session may run under (repeatable)\n      --cwd-root <path>     restrict session cwds to this root (repeatable,\n                            WORKERDECK_CWD_ROOTS as a ':'-separated list)\n      --fs-root <path>      narrow which host directories /v1/fs serves\n                            (repeatable, WORKERDECK_FS_ROOTS as a ':'-separated\n                            list). Reading otherwise follows --cwd-root: a caller\n                            who may start a session in a tree can already read it\n                            through the agent. With neither, the routes 404.\n      --fs-write            also accept writes over /v1/fs. Its own switch because\n                            an agent's writes go through the permission flow and a\n                            PUT does not. Every write is still conditional on the\n                            hash the client last read.\n      --state-dir <path>    where parked sessions are persisted\n                            (default: beside the config file, else ~/.workerdeck)\n      --no-parking-store    keep parked sessions in memory only; a restart drops them\n  -c, --config <path>       config file (default: ./workerdeck.config.mjs)\n      --insecure            allow no-auth on a non-loopback address. Only when\n                            something in front is doing the authenticating.\n      --cors-origin <o>     browser origin allowed to call /v1 cross-origin, for a\n                            dashboard served elsewhere (repeatable, exact origin, no\n                            wildcard; config: corsOrigins). Refused without auth. The\n                            key is still required — this only permits the call.\n      --no-web              don't serve the web dashboard (config: web: false).\n                            /v1 and the auth routes are unchanged; everything else\n                            404s. For a gateway reached only from the VS Code\n                            extension, the phone, or another host's dashboard.\n      --open                open the dashboard in a browser once it is up\n  -h, --help                show this\n  -v, --version             print the version\n\nConfig file\n  Options that cannot fit on a command line — \\`authenticate\\`, \\`buildRunnerConfig\\`,\n  \\`createEngineRunner\\` are functions — live in workerdeck.config.mjs, which\n  default-exports the createWorkerServer options (or a function returning them).\n  Flags and env override it. Supplying your own \\`authenticate\\` turns the built-in\n  shared-secret auth off entirely.\n\nCredentials\n  workerdeck implements no Anthropic auth of its own: the official SDK/CLI\n  resolves credentials from the environment, per profile. --auth-key protects this\n  gateway, nothing else.\n`\n\nasync function readVersion(): Promise<string> {\n  // src/cli.ts and build/cli.mjs are both one level under the package root.\n  const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json')\n  try {\n    const raw = await readFile(pkgPath, 'utf8')\n    return (JSON.parse(raw) as { version?: string }).version ?? 'unknown'\n  } catch {\n    return 'unknown'\n  }\n}\n\n/** Best-effort: a browser that won't open is a convenience missed, not a failure. */\nfunction openInBrowser(url: string): void {\n  const command =\n    process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'\n  try {\n    const child = spawn(command, [url], {\n      stdio: 'ignore',\n      detached: true,\n      shell: process.platform === 'win32',\n    })\n    child.on('error', () => {})\n    child.unref()\n  } catch {\n    // ignored\n  }\n}\n\nasync function main(argv: string[]): Promise<number> {\n  if (argv[0] === 'guard') {\n    const { runGuard } = await import('./guard.ts')\n    return await runGuard(argv.slice(1))\n  }\n\n  const flags = parseArgs(argv)\n  if (flags.help) {\n    process.stdout.write(HELP)\n    return 0\n  }\n  if (flags.version) {\n    process.stdout.write(`${await readVersion()}\\n`)\n    return 0\n  }\n\n  const loaded = await loadConfigFile(flags.config)\n  const config = resolveInstanceConfig(flags, loaded)\n  const instance = await startInstance(config)\n\n  if (config.open) openInBrowser(instance.url)\n\n  const shutdown = (signal: string): void => {\n    process.stdout.write(`\\n[workerdeck] ${signal} — shutting down\\n`)\n    // Parked sessions are already on disk; this is about letting in-flight\n    // requests finish rather than dropping sockets on the floor.\n    instance\n      .close()\n      .then(() => process.exit(0))\n      .catch(() => process.exit(1))\n  }\n  process.on('SIGINT', () => shutdown('SIGINT'))\n  process.on('SIGTERM', () => shutdown('SIGTERM'))\n\n  // Resolves only on close; the process stays up serving.\n  await instance.closed\n  return 0\n}\n\nmain(process.argv.slice(2))\n  .then((code) => {\n    if (code !== 0) process.exit(code)\n  })\n  .catch((error: unknown) => {\n    if (error instanceof ConfigError) {\n      process.stderr.write(`[workerdeck] ${error.message}\\n`)\n      process.exit(2)\n    }\n    process.stderr.write(\n      `[workerdeck] ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\\n`,\n    )\n    process.exit(1)\n  })\n"],"mappings":";;;;;;;AAQA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuEb,eAAe,cAA+B;CAE5C,MAAM,UAAU,KAAK,QAAQ,cAAc,OAAO,KAAK,IAAI,CAAC,EAAE,MAAM,eAAe;AACnF,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,SAAS,OAAO;AAC3C,SAAQ,KAAK,MAAM,IAAI,CAA0B,WAAW;SACtD;AACN,SAAO;;;;AAKX,SAAS,cAAc,KAAmB;CACxC,MAAM,UACJ,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,UAAU;AACpF,KAAI;EACF,MAAM,QAAQ,MAAM,SAAS,CAAC,IAAI,EAAE;GAClC,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,aAAa;GAC7B,CAAC;AACF,QAAM,GAAG,eAAe,GAAG;AAC3B,QAAM,OAAO;SACP;;AAKV,eAAe,KAAK,MAAiC;AACnD,KAAI,KAAK,OAAO,SAAS;EACvB,MAAM,EAAE,aAAa,MAAM,OAAO,wBAAA,MAAA,MAAA,EAAA,EAAA;AAClC,SAAO,MAAM,SAAS,KAAK,MAAM,EAAE,CAAC;;CAGtC,MAAM,QAAQ,UAAU,KAAK;AAC7B,KAAI,MAAM,MAAM;AACd,UAAQ,OAAO,MAAM,KAAK;AAC1B,SAAO;;AAET,KAAI,MAAM,SAAS;AACjB,UAAQ,OAAO,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI;AAChD,SAAO;;CAIT,MAAM,SAAS,sBAAsB,OAAO,MADvB,eAAe,MAAM,OAAO,CACE;CACnD,MAAM,WAAW,MAAM,cAAc,OAAO;AAE5C,KAAI,OAAO,KAAM,eAAc,SAAS,IAAI;CAE5C,MAAM,YAAY,WAAyB;AACzC,UAAQ,OAAO,MAAM,kBAAkB,OAAO,oBAAoB;AAGlE,WACG,OAAO,CACP,WAAW,QAAQ,KAAK,EAAE,CAAC,CAC3B,YAAY,QAAQ,KAAK,EAAE,CAAC;;AAEjC,SAAQ,GAAG,gBAAgB,SAAS,SAAS,CAAC;AAC9C,SAAQ,GAAG,iBAAiB,SAAS,UAAU,CAAC;AAGhD,OAAM,SAAS;AACf,QAAO;;AAGT,KAAK,QAAQ,KAAK,MAAM,EAAE,CAAC,CACxB,MAAM,SAAS;AACd,KAAI,SAAS,EAAG,SAAQ,KAAK,KAAK;EAClC,CACD,OAAO,UAAmB;AACzB,KAAI,iBAAiB,aAAa;AAChC,UAAQ,OAAO,MAAM,gBAAgB,MAAM,QAAQ,IAAI;AACvD,UAAQ,KAAK,EAAE;;AAEjB,SAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,MAAM,CAAC,IACzF;AACD,SAAQ,KAAK,EAAE;EACf"}

package/build/index.d.mts

@@ -71,11 +71,11 @@ options?: {
 //#endregion
 //#region src/auth.d.ts
 /**
- * Gateway auth for the turnkey CLI: one shared operator secret, two transports.
+ * Gateway auth for the turnkey CLI: one shared operator secret, three transports.
  *
  * Services present the secret itself on every request (`x-workerdeck-key`,
- * or `Authorization: Bearer`). The dashboard cannot: the SPA is prebuilt to
- * call `location.origin + '/v1'` with no headers, and a browser WebSocket
+ * or `Authorization: Bearer`). The dashboard *served by this gateway* cannot:
+ * it calls `location.origin + '/v1'` with no headers, and a browser WebSocket
  * handshake carries no custom headers at all. So browsers POST the secret once
  * to `/auth/login`, get an HttpOnly cookie naming a server-side session, and
  * the cookie rides same-origin REST and the WS upgrade automatically. That
@@ -83,6 +83,21 @@ options?: {
  * WS handshake is exempt from CORS, so cross-origin misuse is fenced off by an
  * explicit Origin check here — not by the browser.
  *
+ * The third transport exists for a dashboard served *elsewhere* attaching to
+ * this gateway: it holds the key (the operator typed it in) and can put it on
+ * REST as a header, but still cannot put it on the WS handshake — and the
+ * cookie is another origin's, so it does not ride either. Such a client passes
+ * the key as `?key=` on the upgrade URL, and `querySecret` below accepts it
+ * **on upgrades only**.
+ *
+ * That is a deliberate, narrow concession, and its cost should be understood
+ * rather than rediscovered: a key in a query string is a permanent, replayable
+ * credential sitting in reverse-proxy access logs, where a header would not be.
+ * It is confined to upgrades so a leaked URL buys an attach and nothing else,
+ * and the seam it arrives through (`ClientOptions.buildWsUrl`) is the same one
+ * a short-lived minted ticket would use — swapping to one later needs no client
+ * change.
+ *
  * This file guards the operator's own gateway and nothing else. It never sees
  * an Anthropic credential — those are resolved by the SDK/CLI from the
  * operator's environment (root CLAUDE.md, auth red lines).
@@ -102,9 +117,9 @@ type CliAuthOptions = {
    * Browser session lifetime, default 7 days. Fixed, not sliding: the auth
    * hooks only see the request, so a renewed cookie has nowhere to ride — and
    * for a dashboard whose whole login is retyping one secret, a periodic
-   * re-login is cheaper than a refresh endpoint. Expiry (or a process restart —
-   * sessions are in-memory by design) simply lands the operator back on the
-   * login page.
+   * re-login is cheaper than a refresh endpoint. Expiry simply lands the
+   * operator back on the login page — as does a restart, unless a `sessions`
+   * store is supplied (the CLI supplies one whenever it has a state dir).
    */
   ttlMs?: number;
   /**
@@ -131,6 +146,27 @@ type CliAuthOptions = {
     maxFailuresPerIp?: number;
     maxFailuresGlobal?: number;
   };
+  /**
+   * Makes browser logins survive a restart. Absent, the session table is
+   * in-memory and a restart signs every browser out — see the table's own note.
+   * `createAuthSessionStore` is the CLI's file-backed implementation.
+   */
+  sessions?: CliSessionStore;
+};
+/** One session-table row as it is handed to a store; the key is opaque here. */
+type StoredSession = {
+  expiresAt: number;
+};
+/**
+ * The durability seam for browser logins. Deliberately narrow and
+ * fire-and-forget: the auth paths are synchronous, so a store may not make them
+ * wait, and a store that cannot write must degrade to "logins do not survive a
+ * restart" rather than refuse a login.
+ */
+type CliSessionStore = {
+  /** Rows recovered at startup, already pruned of expired ones. */initial?: Iterable<[string, StoredSession]>; /** The whole live table after a mutation. Must not throw. */
+  save(entries: [string, StoredSession][]): void; /** Resolves once queued writes have landed — for tests and shutdown. */
+  flush?(): Promise<void>;
 };
 /** What `authenticate` hands the worker server as the request principal. */
 type CliPrincipal = {
@@ -191,6 +227,25 @@ type WorkerDeckConfig = WorkerServerOptions & {
    */
   insecureHosts?: string[]; /** Serve a dashboard build from here instead of the bundled one. */
   webRoot?: string;
+  /**
+   * Serve the web dashboard at all. Default true — being turnkey is the point
+   * of this package.
+   *
+   * `false` makes the instance a bare gateway: `/v1` and the auth routes answer
+   * exactly as before, everything else 404s, and the dashboard build is never
+   * even looked for (so a checkout with no `@workerdeck/web` build can still
+   * run one). For an operator who reaches this gateway only from the VS Code
+   * extension, the phone, or another machine's dashboard, the served copy is
+   * surface they were not using.
+   */
+  web?: boolean;
+  /**
+   * Browser origins allowed to call this gateway cross-origin — for a dashboard
+   * served somewhere else. Exact origins (`https://deck.example`), never a
+   * wildcard. Refused unless auth is on: CORS on an open gateway would let any
+   * allowlisted page drive it with no credential at all.
+   */
+  corsOrigins?: string[];
   /**
    * Forward session notifications to Apple Push Notification service, for the
    * iOS app. Absent turns the forwarder off entirely — including its
@@ -219,6 +274,8 @@ type CliFlags = {
   stateDir?: string;
   parking?: boolean;
   insecure?: boolean;
+  web?: boolean;
+  corsOrigins: string[];
   open?: boolean;
   help?: boolean;
   version?: boolean;
@@ -264,7 +321,9 @@ type ResolvedConfig = {
    * unauthenticated instance — see `resolveInstanceConfig`.
    */
   allowedHosts: Set<string> | null; /** Dashboard build to serve; resolved from the package when unset. */
-  webRoot?: string;
+  webRoot?: string; /** Whether to serve the dashboard at all. False makes this a bare gateway. */
+  web: boolean; /** Browser origins allowed to call this gateway cross-origin. Empty = off. */
+  corsOrigins: string[];
   /** APNs forwarder settings with `keyFile` made absolute, or undefined for an
    * instance that does not push. */
   apns?: ApnsConfig;
@@ -345,6 +404,14 @@ declare function materializeAuthKey(stateDir: string | null, options?: {
   warn?: (message: string) => void;
 }): Promise<MaterializedAuthKey>;
 //#endregion
+//#region src/auth-sessions.d.ts
+type AuthSessionStoreOptions = {
+  /** Where `<stateDir>/auth-sessions.json` lives. */stateDir: string; /** Defaults to a `[workerdeck]` line on stderr. */
+  warn?: (message: string) => void; /** Test seam; defaults to `Date.now`. */
+  now?: () => number;
+};
+declare function createAuthSessionStore(options: AuthSessionStoreOptions): Promise<CliSessionStore>;
+//#endregion
 //#region src/login-page.d.ts
 /**
  * The login page is the CLI's, not the dashboard's. That split is deliberate:
@@ -449,5 +516,5 @@ declare function createApnsForwarder(options: {
   warn?: (message: string) => void;
 }): Promise<ApnsForwarder>;
 //#endregion
-export { type ApnsClient, type ApnsConfig, type ApnsEnvironment, type ApnsForwarder, type ApnsRequest, type ApnsResult, type CliAuth, type CliAuthOptions, type CliFlags, type CliPrincipal, ConfigError, type DeviceRecord, type DeviceRegistry, type Instance, type LoadedConfig, type LoginPageOptions, type MaterializedAuthKey, type ResolvedConfig, type WorkerDeckConfig, buildPush, createApnsClient, createApnsForwarder, createCliAuth, createDeviceRegistry, createDeviceRoute, createHostGuard, defaultStateDir, hostnameOf, isLoopback, isLoopbackHostname, loadApnsKey, loadConfigFile, materializeAuthKey, parseArgs, renderLoginPage, resolveInstanceConfig, resolveWebRoot, runGuard, startInstance };
+export { type ApnsClient, type ApnsConfig, type ApnsEnvironment, type ApnsForwarder, type ApnsRequest, type ApnsResult, type AuthSessionStoreOptions, type CliAuth, type CliAuthOptions, type CliFlags, type CliPrincipal, type CliSessionStore, ConfigError, type DeviceRecord, type DeviceRegistry, type Instance, type LoadedConfig, type LoginPageOptions, type MaterializedAuthKey, type ResolvedConfig, type StoredSession, type WorkerDeckConfig, buildPush, createApnsClient, createApnsForwarder, createAuthSessionStore, createCliAuth, createDeviceRegistry, createDeviceRoute, createHostGuard, defaultStateDir, hostnameOf, isLoopback, isLoopbackHostname, loadApnsKey, loadConfigFile, materializeAuthKey, parseArgs, renderLoginPage, resolveInstanceConfig, resolveWebRoot, runGuard, startInstance };
 //# sourceMappingURL=index.d.mts.map

package/build/index.mjs

@@ -1,3 +1,3 @@
 import { n as runGuard } from "./guard-D3VN855w.mjs";
-import { _ as createDeviceRegistry, a as ConfigError, b as loadApnsKey, c as isLoopback, d as parseArgs, f as resolveInstanceConfig, g as createApnsForwarder, h as buildPush, i as renderLoginPage, l as isLoopbackHostname, m as materializeAuthKey, n as resolveWebRoot, o as defaultStateDir, p as createCliAuth, r as startInstance, s as hostnameOf, t as createHostGuard, u as loadConfigFile, v as createDeviceRoute, y as createApnsClient } from "./instance-DbIqlX-e.mjs";
-export { ConfigError, buildPush, createApnsClient, createApnsForwarder, createCliAuth, createDeviceRegistry, createDeviceRoute, createHostGuard, defaultStateDir, hostnameOf, isLoopback, isLoopbackHostname, loadApnsKey, loadConfigFile, materializeAuthKey, parseArgs, renderLoginPage, resolveInstanceConfig, resolveWebRoot, runGuard, startInstance };
+import { _ as createApnsForwarder, a as ConfigError, b as createApnsClient, c as isLoopback, d as parseArgs, f as resolveInstanceConfig, g as buildPush, h as materializeAuthKey, i as renderLoginPage, l as isLoopbackHostname, m as createAuthSessionStore, n as resolveWebRoot, o as defaultStateDir, p as createCliAuth, r as startInstance, s as hostnameOf, t as createHostGuard, u as loadConfigFile, v as createDeviceRegistry, x as loadApnsKey, y as createDeviceRoute } from "./instance-BiGOs_KV.mjs";
+export { ConfigError, buildPush, createApnsClient, createApnsForwarder, createAuthSessionStore, createCliAuth, createDeviceRegistry, createDeviceRoute, createHostGuard, defaultStateDir, hostnameOf, isLoopback, isLoopbackHostname, loadApnsKey, loadConfigFile, materializeAuthKey, parseArgs, renderLoginPage, resolveInstanceConfig, resolveWebRoot, runGuard, startInstance };

package/build/{instance-DbIqlX-e.mjs → instance-BiGOs_KV.mjs}

@@ -2,8 +2,8 @@ import { createReadStream, existsSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createFileSessionStore, createWorkerServer } from "@workerdeck/server";
 import { dashboardDir } from "@workerdeck/web";
-import { createHash, createPrivateKey, randomBytes, sign, timingSafeEqual } from "node:crypto";
-import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { createHash, createHmac, createPrivateKey, randomBytes, sign, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { connect } from "node:http2";
 import { homedir } from "node:os";
 import { pathToFileURL } from "node:url";
@@ -564,6 +564,95 @@ async function materializeAuthKey(stateDir, options = {}) {
 	};
 }
 //#endregion
+//#region src/auth-sessions.ts
+/**
+* Durable browser-login sessions for the turnkey CLI — the other half of
+* `materializeAuthKey`, and here for the same reason: the key survives a
+* restart so clients stay paired, and the login cookie should too. Without
+* this the cookie outlives the table it points into, so a restart signs every
+* browser out while the browser still holds a perfectly valid-looking cookie.
+*
+* What lands on disk is **not credential material**: `createCliAuth` keys its
+* table by `HMAC-SHA256(secret, token)`, so a stolen file yields neither the
+* operator secret nor any cookie value (inverting either needs a preimage of a
+* 256-bit-entropy input). That keying is also what makes key rotation
+* invalidate every outstanding cookie for free — entries written under the old
+* secret simply never match a lookup again, and age out on their own expiry.
+*
+* Writes are whole-file and serialized behind one promise chain (the table is
+* capped at `MAX_SESSIONS`, so "whole file" is a few kilobytes), and go through
+* a temp file + rename so a crash mid-write cannot leave a truncated table.
+* Every failure is a warning, never a throw: losing durability signs the
+* operator out, losing the gateway does much worse.
+*/
+const FORMAT_VERSION = 1;
+const FILE_NAME = "auth-sessions.json";
+const parseSessions = (raw, now) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return [];
+	}
+	const file = parsed;
+	if (file?.version !== FORMAT_VERSION || !Array.isArray(file.sessions)) return [];
+	const entries = [];
+	for (const entry of file.sessions) {
+		if (!Array.isArray(entry) || entry.length !== 2) continue;
+		const [key, expiresAt] = entry;
+		if (typeof key !== "string" || key === "") continue;
+		if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= now) continue;
+		entries.push([key, { expiresAt }]);
+	}
+	return entries;
+};
+async function createAuthSessionStore(options) {
+	const now = options.now ?? Date.now;
+	const warn = options.warn ?? ((message) => process.stderr.write(`[workerdeck] ${message}\n`));
+	const path = join(options.stateDir, FILE_NAME);
+	let initial = [];
+	try {
+		initial = parseSessions(await readFile(path, "utf8"), now());
+		try {
+			const { mode } = await stat(path);
+			if ((mode & 63) !== 0) warn(`session file ${path} is readable by other users (mode ${(mode & 511).toString(8)}) — run: chmod 600 ${path}`);
+		} catch {}
+	} catch {
+		initial = [];
+	}
+	let pending = Promise.resolve();
+	let warned = false;
+	const write = async (entries) => {
+		const body = {
+			version: FORMAT_VERSION,
+			sessions: entries.map(([key, s]) => [key, s.expiresAt])
+		};
+		const tmp = `${path}.${process.pid}.tmp`;
+		try {
+			await mkdir(dirname(path), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(tmp, `${JSON.stringify(body)}\n`, { mode: 384 });
+			await chmod(tmp, 384);
+			await rename(tmp, path);
+			warned = false;
+		} catch (error) {
+			if (!warned) {
+				warned = true;
+				warn(`could not persist browser logins to ${path}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+	};
+	return {
+		initial,
+		save(entries) {
+			pending = pending.then(() => write(entries));
+		},
+		flush: () => pending
+	};
+}
+//#endregion
 //#region src/auth.ts
 const MIN_SECRET_LENGTH = 12;
 const DEFAULT_COOKIE_NAME = "workerdeck_session";
@@ -609,13 +698,25 @@ function createCliAuth(options = {}) {
 	* Browser sessions are a server-side table, not signed tokens: logout must
 	* actually invalidate, and a stateless HMAC token stays valid until expiry no
 	* matter what the server thinks. This is one long-lived process (multi-node
-	* is a non-goal), so "table" means one Map — the cost is that a restart signs
-	* every browser out, which for an operator dashboard one secret away from
-	* re-login is the right trade. Keys are token digests: recovering an entry's
-	* token from lookup timing would need a SHA-256 preimage.
+	* is a non-goal), so "table" means one Map — optionally mirrored to a
+	* `CliSessionStore` so a restart does not sign every browser out while the
+	* browser still holds a cookie the ttl says is good for a week.
+	*
+	* Keys are `HMAC-SHA256(secret, token)`, which buys three things at once:
+	* recovering a token from a key (or from lookup timing) needs a preimage;
+	* what a store writes to disk is not credential material; and rotating the
+	* operator secret invalidates every outstanding cookie **for free**, since
+	* rows written under the old secret can no longer be looked up and age out on
+	* their own expiry.
 	*/
 	const sessions = /* @__PURE__ */ new Map();
-	const tokenKey = (token) => sha256(token).toString("hex");
+	const store = options.sessions;
+	const tokenKey = (token) => secret === void 0 ? sha256(token).toString("hex") : createHmac("sha256", secret).update(token).digest("hex");
+	if (store?.initial !== void 0) for (const [key, entry] of store.initial) {
+		if (sessions.size >= MAX_SESSIONS) break;
+		sessions.set(key, { expiresAt: entry.expiresAt });
+	}
+	const persist = () => store?.save([...sessions]);
 	const createSession = () => {
 		if (sessions.size >= MAX_SESSIONS) {
 			const oldest = sessions.keys().next().value;
@@ -623,6 +724,7 @@ function createCliAuth(options = {}) {
 		}
 		const token = randomBytes(32).toString("base64url");
 		sessions.set(tokenKey(token), { expiresAt: Date.now() + ttlMs });
+		persist();
 		return token;
 	};
 	const cookieToken = (req) => {
@@ -642,6 +744,7 @@ function createCliAuth(options = {}) {
 		if (entry === void 0) return false;
 		if (entry.expiresAt <= Date.now()) {
 			sessions.delete(key);
+			persist();
 			return false;
 		}
 		return true;
@@ -708,9 +811,30 @@ function createCliAuth(options = {}) {
 		via: "open",
 		canManageProfiles: true
 	};
+	const isUpgradeRequest = (req) => {
+		const upgrade = req.headers.upgrade;
+		return typeof upgrade === "string" && upgrade.toLowerCase().includes("websocket");
+	};
+	/**
+	* The secret from `?key=` — **accepted on WebSocket upgrades only**.
+	*
+	* A browser cannot put a header on a WS handshake, so a tab attaching to a
+	* gateway that is not its own origin (where the cookie would ride) has no
+	* other way to present the key. That is the whole reason this exists.
+	*
+	* Restricting it to upgrades is what keeps the blast radius at "one attach":
+	* a key in a query string is not a transport we want anywhere else, because
+	* URLs land in proxy access logs and browser history in a way headers do not.
+	* A REST call with `?key=` is therefore *not* authenticated by it.
+	*/
+	const querySecret = (req) => {
+		if (!isUpgradeRequest(req)) return void 0;
+		const key = new URL(req.url ?? "/", "http://internal").searchParams.get("key");
+		return key !== null && key !== "" ? key : void 0;
+	};
 	const authenticate = (req) => {
 		if (!enabled) return openPrincipal;
-		const provided = headerSecret(req);
+		const provided = headerSecret(req) ?? querySecret(req);
 		if (provided !== void 0) return secretMatches(provided) ? {
 			via: "header",
 			canManageProfiles: true
@@ -718,8 +842,7 @@ function createCliAuth(options = {}) {
 		if (!hasSession(req)) return null;
 		const verdict = originVerdict(req);
 		if (verdict === "foreign") return null;
-		const upgrade = req.headers.upgrade;
-		const isUpgrade = typeof upgrade === "string" && upgrade.toLowerCase().includes("websocket");
+		const isUpgrade = isUpgradeRequest(req);
 		const unsafe = !SAFE_METHODS.has((req.method ?? "GET").toUpperCase());
 		if ((isUpgrade || unsafe) && verdict !== "ok") return null;
 		return {
@@ -881,7 +1004,7 @@ function createCliAuth(options = {}) {
 				return;
 			}
 			const token = cookieToken(req);
-			if (token !== void 0 && token !== "") sessions.delete(tokenKey(token));
+			if (token !== void 0 && token !== "" && sessions.delete(tokenKey(token))) persist();
 		}
 		const cookie = clearCookieValue(req);
 		if (json) res.writeHead(204, {
@@ -978,7 +1101,8 @@ function parseArgs(argv) {
 		fsRoots: [],
 		allowedOrigins: [],
 		allowedHosts: [],
-		insecureHosts: []
+		insecureHosts: [],
+		corsOrigins: []
 	};
 	const next = (i, name) => {
 		const value = argv[i + 1];
@@ -1064,6 +1188,13 @@ function parseArgs(argv) {
 			case "--insecure":
 				flags.insecure = true;
 				break;
+			case "--no-web":
+				flags.web = false;
+				break;
+			case "--cors-origin":
+				flags.corsOrigins.push(next(i, arg));
+				i++;
+				break;
 			case "--open":
 				flags.open = true;
 				break;
@@ -1185,7 +1316,20 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 		...[...flags.allowedHosts, ...loaded.options.allowedHosts ?? []].map((name) => name.toLowerCase()),
 		...insecureHosts
 	]);
-	const { port: _p, host: _h, auth: _a, stateDir: _s, allowedHosts: _ah, insecureHosts: _ih, webRoot: _w, apns: _ap, ...serverOptions } = loaded.options;
+	const web = flags.web ?? loaded.options.web ?? true;
+	const corsOrigins = flags.corsOrigins.length ? flags.corsOrigins : loaded.options.corsOrigins ?? [];
+	for (const origin of corsOrigins) {
+		if (origin === "*") throw new ConfigError("--cors-origin does not accept \"*\"");
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new ConfigError(`--cors-origin expects a full origin, got: ${origin}`);
+		}
+		if (parsed.origin !== origin) throw new ConfigError(`--cors-origin expects scheme://host[:port] with no path, got: ${origin}`);
+	}
+	if (!web && flags.open) throw new ConfigError("--open cannot be used with --no-web: there is no dashboard to open");
+	const { port: _p, host: _h, auth: _a, stateDir: _s, allowedHosts: _ah, insecureHosts: _ih, webRoot: _w, web: _web, corsOrigins: _cors, apns: _ap, ...serverOptions } = loaded.options;
 	const options = { ...serverOptions };
 	if (cwdRoots?.length) options.allowedCwdRoots = cwdRoots;
 	if (fsRoots?.length || flags.fsWrite) options.hostFiles = {
@@ -1205,6 +1349,8 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 		generateAuthKey,
 		allowedHosts,
 		webRoot: loaded.options.webRoot,
+		web,
+		corsOrigins,
 		apns: resolveApns(loaded),
 		open: flags.open ?? false,
 		options
@@ -1466,6 +1612,11 @@ function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 		}
 		if (await auth.handleAuthRequest(req, res)) return;
 		if (apnsRoute !== void 0 && await apnsRoute(req, res)) return;
+		if (webRoot === void 0) {
+			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+			res.end("the web dashboard is disabled on this gateway\n");
+			return;
+		}
 		const pathname = new URL(req.url ?? "/", "http://internal").pathname;
 		if (looksLikeAsset(pathname)) {
 			const filePath = resolveWithinRoot(webRoot, pathname);
@@ -1501,16 +1652,22 @@ function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 	};
 }
 async function startInstance(config, options = {}) {
-	const webRoot = config.webRoot ?? resolveWebRoot();
+	const webRoot = config.web ? config.webRoot ?? resolveWebRoot() : void 0;
 	const generated = config.generateAuthKey && !config.hostAuthenticates ? await materializeAuthKey(config.stateDir) : null;
-	const auth = createCliAuth(config.hostAuthenticates ? {
+	const authOptions = config.hostAuthenticates ? {
 		...config.auth,
 		secret: void 0
 	} : generated ? {
 		...config.auth,
 		secret: generated.key
-	} : config.auth);
+	} : config.auth;
+	const sessions = authOptions.secret !== void 0 && config.stateDir ? await createAuthSessionStore({ stateDir: config.stateDir }) : void 0;
+	const auth = createCliAuth(sessions ? {
+		...authOptions,
+		sessions
+	} : authOptions);
 	if (config.allowedHosts === null && !config.hostAuthenticates && !auth.enabled) throw new Error("refusing to serve: the resolved config expects auth but no shared secret was materialized — this instance would be open while believing itself authenticated");
+	if (config.corsOrigins.length > 0 && !config.hostAuthenticates && !auth.enabled) throw new Error("refusing to serve: corsOrigins is set but this instance has no auth — a cross-origin page could drive it with no credential. Set --auth-key.");
 	const hostAllowed = createHostGuard(config.allowedHosts);
 	const apns = config.apns === void 0 ? void 0 : await createApnsForwarder({
 		config: config.apns,
@@ -1537,6 +1694,7 @@ async function startInstance(config, options = {}) {
 			}
 		},
 		fallback,
+		...config.corsOrigins.length ? { cors: { origins: config.corsOrigins } } : {},
 		authenticate: config.hostAuthenticates ? (req) => hostAllowed(req) ? config.options.authenticate(req) : null : (req) => hostAllowed(req) ? auth.authenticate(req) : null
 	});
 	const { port } = await server.listen(config.port, config.host);
@@ -1560,6 +1718,8 @@ async function startInstance(config, options = {}) {
 		} else if (generated?.source === "stored") line(`  auth: shared key from ${generated.path}`);
 		else if (auth.enabled) line("  auth: shared key — browsers sign in, services send a header");
 		else line("  NO AUTH — anyone who can reach this port gets a session");
+		if (!config.web) line("  dashboard: off — bare gateway, /v1 and /auth only");
+		if (config.corsOrigins.length) line(`  cors: ${config.corsOrigins.join(", ")} may call /v1 (still key-gated)`);
 		line(config.stateDir ? `  parked sessions persist in ${join(config.stateDir, "parked")}` : "  parked sessions are in memory only — a restart drops them");
 		if (apns) {
 			const count = apns.deviceCount();
@@ -1575,12 +1735,13 @@ async function startInstance(config, options = {}) {
 		closed,
 		close: async () => {
 			await server.close();
+			await sessions?.flush?.();
 			apns?.close();
 			resolveClosed();
 		}
 	};
 }
 //#endregion
-export { createDeviceRegistry as _, ConfigError as a, loadApnsKey as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, createApnsForwarder as g, buildPush as h, renderLoginPage as i, isLoopbackHostname as l, materializeAuthKey as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createDeviceRoute as v, createApnsClient as y };
+export { createApnsForwarder as _, ConfigError as a, createApnsClient as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, buildPush as g, materializeAuthKey as h, renderLoginPage as i, isLoopbackHostname as l, createAuthSessionStore as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createDeviceRegistry as v, loadApnsKey as x, createDeviceRoute as y };
 
-//# sourceMappingURL=instance-DbIqlX-e.mjs.map
+//# sourceMappingURL=instance-BiGOs_KV.mjs.map