server-api/io.devconsole.server.api

Package-level declarations

Types

BindingMode

enum BindingMode : Enum<BindingMode>

BrowserPrincipal

data class BrowserPrincipal(val id: String, val browserLabel: String, val sourceIp: String, val expiresAtEpochMs: Long)

Safe browser metadata for the Session view; credentials never appear here.

BrowserSession

class BrowserSession

CommandAuditEvent

data class CommandAuditEvent(val timestampEpochMs: Long, val browserSessionId: String, val commandType: String, val target: String, val result: CommandAuditResult, val parameters: Map<String, String> = emptyMap())

CommandAuditLog

interface CommandAuditLog

CommandAuditResult

enum CommandAuditResult : Enum<CommandAuditResult>

DatabaseExecResult

sealed interface DatabaseExecResult

DatabaseInspector

interface DatabaseInspector

Reads and (opt-in) edits an app's own SQLite databases. Read-only SELECT/PRAGMA statements are always allowed; any statement that can mutate data or schema is refused with DatabaseExecResult.WriteBlocked unless DatabaseInspector.execute's writeEnabled is true. Callers pass writeEnabled from EditingCapabilities.database. Declared in sdk:server-api -- a plain boundary module with no Android dependency -- so both the Android engine implementation (sdk:full) and the platform-independent Ktor routes (sdk:server-ktor) can share this one contract without a circular module dependency, the same way io.devconsole.state.SessionFeatureFlags reaches GET/POST /api/v1/flags.

DatabaseListingData

data class DatabaseListingData(val name: String, val tables: List<DatabaseTableData>, val sizeBytes: Long = 0)

DatabaseQueryData

data class DatabaseQueryData(val columns: List<String>, val rows: List<List<String>>, val truncated: Boolean, val rowIds: List<Long?> = emptyList())

DatabaseTableData

data class DatabaseTableData(val name: String, val rowCount: Long)

Endpoint

data class Endpoint(val host: String, val port: Int, val bindingMode: BindingMode)

FileEntryData

data class FileEntryData(val name: String, val relativePath: String, val isDirectory: Boolean, val sizeBytes: Long, val lastModifiedEpochMs: Long)

FileInspector

interface FileInspector

Browses an app's own file storage. Every path is resolved against a fixed set of app-owned roots and canonicalized; anything escaping a root (.., symlinks, absolute paths) is refused. Text previews are redacted. Only regular files are ever touched -- never a directory tree -- across every operation here, including create/replace/rename. Every mutation (and readBytes, since it returns raw unredacted bytes) is ungated here -- callers (the Compose adapter in sdk:full, and the browser server routes in sdk:server-ktor) enforce the EditingCapabilities.files opt-in. Declared in sdk:server-api -- a plain boundary module with no Android dependency -- so both surfaces can share this one contract without a circular module dependency, the same way io.devconsole.state.SessionFeatureFlags reaches GET/POST /api/v1/flags.

FileListingData

data class FileListingData(val root: String, val relativePath: String, val entries: List<FileEntryData>)

FilePreviewData

sealed interface FilePreviewData

InMemoryCommandAuditLog

class InMemoryCommandAuditLog(maxCapacity: Int = DEFAULT_MAX_CAPACITY) : CommandAuditLog

LocalNetworkPermissionDecision

sealed interface LocalNetworkPermissionDecision

LocalNetworkPermissionGate

object LocalNetworkPermissionGate

Keeps Android-version policy outside the transport so it can be tested without framework APIs.

LocalServerEngine

interface LocalServerEngine

PreferencesEntryData

data class PreferencesEntryData(val key: String, val value: String, val type: String, val redacted: Boolean = false)

PreferencesFileData

data class PreferencesFileData(val name: String, val entries: List<PreferencesEntryData>)

PreferencesInspector

interface PreferencesInspector

Reads and edits an app's SharedPreferences. Reads are redacted; editing is ungated here -- every caller (the Compose adapter in sdk:full, and the browser server routes in sdk:server-ktor) enforces the EditingCapabilities.preferences opt-in before calling put/remove. Declared in sdk:server-api -- a plain boundary module with no Android dependency -- so both the Android engine implementation and the platform-independent Ktor routes can share this one contract without a circular module dependency, the same way io.devconsole.state.SessionFeatureFlags reaches GET/POST /api/v1/flags.

SdkHealthSnapshot

data class SdkHealthSnapshot(val initializationCount: Long = 0, val publishedEventCount: Long = 0, val droppedEventCount: Long = 0, val state: String = "UNINITIALIZED", val activePrincipalCount: Int = 0)

Bounded, credential-free counters for the SDK Health dashboard.

ServerMetadata

data class ServerMetadata(val protocolVersion: Int = 1, val appDisplayName: String = "Unknown app", val appPackageName: String = "unknown", val appVersionName: String = "unknown", val buildVariant: String = "unknown", val capabilities: List<String> = DEFAULT_CAPABILITIES, val captureCategories: List<String> = DEFAULT_CAPTURE_CATEGORIES)

Stable, non-sensitive metadata exposed to an authenticated dashboard.

ServerStartResult

sealed interface ServerStartResult

SessionAuthority

class SessionAuthority(nowEpochMs: () -> Long = System::currentTimeMillis, sessionTtlMs: Long = DEFAULT_SESSION_TTL_MS, maxAuthenticatedSessions: Int = DEFAULT_MAX_AUTHENTICATED_SESSIONS, random: SecureRandom = SecureRandom())

In-memory authority for the browser session store: creation, TTL/refresh, CSRF tokens, listing, and revocation. One access tier -- every session is equivalent; mutating routes gate on the host's EditingCapabilities flags instead of a session-level role. SessionCodeAuthority is the sole way a session gets minted, via createSession.

SessionCodeAuthority

class SessionCodeAuthority(sessionAuthority: SessionAuthority, nowEpochMs: () -> Long = System::currentTimeMillis, codeTtlMs: Long = DEFAULT_SESSION_CODE_TTL_MS, random: SecureRandom = SecureRandom())

SESSION_CODE access flow: an 8-character, unambiguous-alphabet code with its own TTL, exchanged directly for a browser session -- no on-device Approve/Deny round trip. Possession of the code within its TTL is the authorization decision; mutating routes still separately require the relevant EditingCapabilities flag on the host.

SessionCodeExchangeResult

sealed interface SessionCodeExchangeResult

Result of SessionCodeAuthority.exchange.

SessionCodeInfo

class SessionCodeInfo

Session-code data; never persisted. Possessing code within expiresAtEpochMs is the entire trust decision -- there is no on-device approval step. See SessionCodeAuthority.exchange and docs/THREAT_MODEL.md.

SessionCreateResult

sealed interface SessionCreateResult

Result of minting a session (SessionAuthority.createSession).

SessionPolicy

data class SessionPolicy(val maxAuthenticatedSessions: Int = SessionAuthority.DEFAULT_MAX_AUTHENTICATED_SESSIONS)

Session-count policy. Every authenticated session is equivalent (no role ladder -- see SessionAuthority); maxAuthenticatedSessions is the only cap that still applies, mirroring what used to be PairingSessionPolicy.maxAuthenticatedSessions before the CONTROL/ADMIN-specific caps were removed along with the role ladder itself.

StartRequest

data class StartRequest(val bindingMode: BindingMode = BindingMode.LOOPBACK, val portRange: IntRange = 8080..8099, val sessionCodeTtlMs: Long = SessionCodeAuthority.DEFAULT_SESSION_CODE_TTL_MS)