diff --git a/.gitignore b/.gitignore
index 4056c79b9f..4be17e24d9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,7 +38,10 @@ cockpit/public/main*
 .sentryclirc
 
 # cockpit lib dir
-pkg/lib
+pkg/lib/*
+!pkg/lib/cockpit/
+!pkg/lib/cockpit.d.ts
+!pkg/lib/os-release.ts
 
 rpmbuild
 
diff --git a/Makefile b/Makefile
index 77a0cdefa3..9b252e493e 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@ VERSION := $(shell (cd "$(SRCDIR)" && grep "^Version:" cockpit/$(PACKAGE_NAME).s
 COMMIT = $(shell (cd "$(SRCDIR)" && git rev-parse HEAD))
 
 # TODO: figure out a strategy for keeping this updated
-COCKPIT_REPO_COMMIT = a70142a7a6f9c4e78e71f3c4ec738b6db2fbb04f
+COCKPIT_REPO_COMMIT = 0ee23c07488e343e04ec766a891d1fceea781d10
 COCKPIT_REPO_URL = https://github.com/cockpit-project/cockpit.git
 COCKPIT_REPO_TREE = '$(strip $(COCKPIT_REPO_COMMIT))^{tree}'
 
diff --git a/pkg/lib/cockpit.d.ts b/pkg/lib/cockpit.d.ts
new file mode 100644
index 0000000000..8979eb3c1e
--- /dev/null
+++ b/pkg/lib/cockpit.d.ts
@@ -0,0 +1,444 @@
+/* This file is part of Cockpit.
+ *
+ * Copyright (C) 2024 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import '_internal/common'; // side-effecting import (`window` augmentations)
+import type { Info } from './cockpit/_internal/info';
+
+declare module 'cockpit' {
+    type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
+    type JsonObject = Record<string, JsonValue>;
+
+    class BasicError {
+        problem: string;
+        message: string;
+        toString(): string;
+    }
+
+    type SuperuserMode = "require" | "try" | null | undefined;
+
+    function init(): Promise<void>;
+
+    function assert(predicate: unknown, message?: string): asserts predicate;
+
+    export const manifests: { [package in string]?: JsonObject };
+    export const info: Info;
+
+    export let language: string;
+    export let language_direction: string;
+
+    interface Transport {
+        csrf_token: string;
+        origin: string;
+        host: string;
+        options: JsonObject;
+        uri(suffix?: string): string;
+        wait(callback: (transport: Transport) => void): void;
+        close(problem?: string): void;
+        application(): string;
+        control(command: string, options: JsonObject): void;
+    }
+
+    export const transport: Transport;
+
+    /* === jQuery compatible promise ============== */
+
+    interface DeferredPromise<T> extends Promise<T> {
+        /* jQuery Promise compatibility */
+        done(callback: (data: T) => void): DeferredPromise<T>
+        fail(callback: (exc: Error) => void): DeferredPromise<T>
+        always(callback: () => void): DeferredPromise<T>
+        progress(callback: (message: T, cancel: () => void) => void): DeferredPromise<T>
+    }
+
+    interface Deferred<T> {
+        resolve(): Deferred<T>;
+        reject(): Deferred<T>;
+        notify(): Deferred<T>;
+        promise: DeferredPromise<T>
+    }
+
+    function defer<T>(): Deferred<T>;
+
+    /* === Events mix-in ========================= */
+
+    interface EventMap {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        [_: string]: (...args: any[]) => void;
+    }
+
+    type EventListener<E extends (...args: unknown[]) => void> =
+        (event: CustomEvent<Parameters<E>>, ...args: Parameters<E>) => void;
+
+    interface EventSource<EM extends EventMap> {
+        addEventListener<E extends keyof EM>(event: E, listener: EventListener<EM[E]>): void;
+        removeEventListener<E extends keyof EM>(event: E, listener: EventListener<EM[E]>): void;
+        dispatchEvent<E extends keyof EM>(event: E, ...args: Parameters<EM[E]>): void;
+    }
+
+    interface CockpitEvents extends EventMap {
+        locationchanged(): void;
+        visibilitychange(): void;
+    }
+
+    function addEventListener<E extends keyof CockpitEvents>(
+        event: E, listener: EventListener<CockpitEvents[E]>
+    ): void;
+    function removeEventListener<E extends keyof CockpitEvents>(
+        event: E, listener: EventListener<CockpitEvents[E]>
+    ): void;
+
+    interface ChangedEvents {
+        changed(): void;
+    }
+
+    function event_target<T, EM extends EventMap>(obj: T): T & EventSource<EM>;
+
+    /* === Channel =============================== */
+
+    interface ControlMessage extends JsonObject {
+        command: string;
+    }
+
+    interface ChannelEvents<T> extends EventMap {
+        control(options: JsonObject): void;
+        ready(options: JsonObject): void;
+        close(options: JsonObject): void;
+        message(data: T): void;
+    }
+
+    interface Channel<T> extends EventSource<ChannelEvents<T>> {
+        id: string | null;
+        binary: boolean;
+        options: JsonObject;
+        ready: boolean;
+        valid: boolean;
+        send(data: T): void;
+        control(options: ControlMessage): void;
+        wait(callback?: (data: T) => void): Promise<T>;
+        close(options?: string | JsonObject): void;
+    }
+
+    // these apply to all channels
+    interface ChannelOptions {
+        superuser?: SuperuserMode;
+        [_: string]: JsonValue | undefined;
+        binary?: boolean,
+
+        // for remote channels
+        host?: string;
+        user?: string;
+        password?: string;
+        session?: "shared" | "private";
+    }
+
+    // this applies to opening a generic channel() with explicit payload
+    interface ChannelOpenOptions extends ChannelOptions {
+        payload: string;
+    }
+
+    function channel(options: ChannelOpenOptions & { binary?: false; }): Channel<string>;
+    function channel(options: ChannelOpenOptions & { binary: true; }): Channel<Uint8Array>;
+
+    /* === cockpit.{spawn,script} ============================= */
+
+    class ProcessError {
+        problem: string | null;
+        exit_status: number | null;
+        exit_signal: number | null;
+        message: string;
+    }
+
+    interface Spawn<T> extends DeferredPromise<T> {
+        input(message?: T | null, stream?: boolean): DeferredPromise<T>;
+        stream(callback: (data: T) => void): DeferredPromise<T>;
+        close(options?: string | JsonObject): void;
+    }
+
+    interface SpawnOptions extends ChannelOptions {
+        directory?: string;
+        err?: "out" | "ignore" | "message";
+        environ?: string[];
+        pty?: boolean;
+    }
+
+    function spawn(
+        args: string[],
+        options?: SpawnOptions & { binary?: false }
+    ): Spawn<string>;
+    function spawn(
+        args: string[],
+        options: SpawnOptions & { binary: true }
+    ): Spawn<Uint8Array>;
+
+    function script(
+        script: string,
+        args?: string[],
+        options?: SpawnOptions & { binary?: false }
+    ): Spawn<string>;
+    function script(
+        script: string,
+        args?: string[],
+        options?: SpawnOptions & { binary: true }
+    ): Spawn<Uint8Array>;
+
+    /* === cockpit.location ========================== */
+
+    interface Location {
+        url_root: string;
+        options: { [name: string]: string | Array<string> };
+        path: Array<string>;
+        href: string;
+        go(path: Location | string[] | string, options?: { [key: string]: string }): void;
+        replace(path: Location | string[] | string, options?: { [key: string]: string }): void;
+
+        encode(path: string[], options?: { [key: string]: string }, with_root?: boolean): string;
+        decode(string: string, options?: { [key: string]: string }): string[];
+    }
+
+    export let location: Location;
+
+    /* === cockpit.jump ========================== */
+
+    function jump(path: string | string[], host?: string): void;
+
+    /* === cockpit page visibility =============== */
+
+    export let hidden: boolean;
+
+    /* === cockpit.dbus ========================== */
+
+    interface DBusProxyEvents extends EventMap {
+        changed(changes: { [property: string]: unknown }): void;
+    }
+
+    interface DBusProxiesEvents extends EventMap {
+        added(proxy: DBusProxy): void;
+        changed(proxy: DBusProxy): void;
+        removed(proxy: DBusProxy): void;
+    }
+
+    interface DBusProxy extends EventSource<DBusProxyEvents> {
+        valid: boolean;
+        [property: string]: unknown;
+    }
+
+    interface DBusOptions {
+        bus?: string;
+        address?: string;
+        host?: string;
+        superuser?: SuperuserMode;
+        track?: boolean;
+    }
+
+    type DBusCallOptions = {
+        flags?: "" | "i",
+        type?: string,
+        timeout?: number,
+    };
+
+    interface DBusProxies extends EventSource<DBusProxiesEvents> {
+        client: DBusClient;
+        iface: string;
+        path_namespace: string;
+        wait(callback?: () => void): Promise<void>;
+    }
+
+    interface DBusClient {
+        readonly unique_name: string;
+        readonly options: DBusOptions;
+        proxy(interface?: string, path?: string, options?: { watch?: boolean }): DBusProxy;
+        proxies(interface?: string, path_namespace?: string, options?: { watch?: boolean }): DBusProxies;
+        call(path: string, iface: string, method: string, args?: unknown[] | null, options?: DBusCallOptions): Promise<unknown[]>;
+        watch(path: string): DeferredPromise<void>,
+        subscribe: (
+            match: {
+                path?: string,
+                path_namespace?: string,
+                interface?: string,
+                member?: string,
+                arg?: string
+            },
+            callback: (path: string, iface: string, signal: string, args: unknown[]) => void,
+            rule?: boolean,
+        ) => {
+            remove: () => void;
+        },
+        close(): void;
+    }
+
+    type VariantType = string | Uint8Array | number | boolean | VariantType[];
+    interface Variant {
+        t: string;
+        v: VariantType;
+    }
+
+    function dbus(name: string | null, options?: DBusOptions): DBusClient;
+
+    function variant(type: string, value: VariantType): Variant;
+    function byte_array(string: string): string;
+
+    /* === cockpit.file ========================== */
+
+    interface FileSyntaxObject<T, B> {
+        parse(content: B): T;
+        stringify?(content: T): B;
+    }
+
+    type FileTag = string;
+
+    type FileWatchCallback<T> = (data: T | null, tag: FileTag | null, error: BasicError | null) => void;
+    interface FileWatchHandle {
+        remove(): void;
+    }
+
+    interface FileHandle<T> {
+        // BUG: This should be Promise<T, FileTag>, but this isn't representable (it's a cockpit.defer underneath)
+        read(): Promise<T>;
+        replace(new_content: T | null, expected_tag?: FileTag): Promise<FileTag>;
+        watch(callback: FileWatchCallback<T>, options?: { read?: boolean }): FileWatchHandle;
+        // BUG: same as read
+        modify(callback: (data: T | null) => T | null, initial_content?: string, initial_tag?: FileTag): Promise<T>;
+        close(): void;
+        path: string;
+    }
+
+    type FileOpenOptions = {
+        max_read_size?: number;
+        superuser?: SuperuserMode;
+    };
+
+    function file(
+        path: string,
+        options?: FileOpenOptions & { binary?: false; syntax?: never; }
+    ): FileHandle<string>;
+    function file(
+        path: string,
+        options: FileOpenOptions & { binary: true; syntax?: never; }
+    ): FileHandle<Uint8Array>;
+    function file<T>(
+        path: string,
+        options: FileOpenOptions & { binary?: false; syntax: FileSyntaxObject<T, string>; }
+    ): FileHandle<T>;
+    function file<T>(
+        path: string,
+        options: FileOpenOptions & { binary: true; syntax: FileSyntaxObject<T, Uint8Array>; }
+    ): FileHandle<T>;
+
+    /* === cockpit.user ========================== */
+
+    type UserInfo = {
+        id: number;
+        gid: number;
+        name: string;
+        full_name: string;
+        groups: Array<string>;
+        home: string;
+        shell: string;
+    };
+    /** @deprecated */ export function user(): Promise<Readonly<UserInfo>>;
+
+    /* === cockpit.http ====================== */
+
+    export interface TlsCert {
+        file?: string;
+        data?: string;
+    }
+
+    export interface HttpOptions {
+        // target address; if omitted, the endpoint string must include the host
+        address?: string;
+        port?: number;
+        tls?: {
+            authority?: TlsCert;
+            certificate?: TlsCert;
+            key?: TlsCert;
+            validate?: boolean;
+        };
+        superuser?: SuperuserMode;
+        binary?: boolean;
+        // default HTTP headers to send with every request
+        headers?: HttpHeaders;
+        // Default query parameters to include with every request
+        params?: { [key: string]: string | number };
+    }
+
+    export type HttpHeaders = { [key: string]: string };
+
+    export interface HttpRequestOptions {
+        path?: string;
+        method?: string;
+        headers?: HttpHeaders;
+        params?: { [key: string]: string | number };
+        body?: string | Uint8Array | null;
+    }
+
+    // Cockpit HTTP client instance
+    // The generic parameter TResponse controls the type returned by the request methods.
+    export interface HttpInstance<TResponse = string> {
+        request(options: HttpRequestOptions): Promise<TResponse>;
+        get(path: string, options?: Omit<HttpRequestOptions, "method" | "path" | "body">): Promise<TResponse>;
+        post(path: string,
+             // JSON stringification is only implemented in post()
+             body?: string | Uint8Array | JsonObject | null,
+             options?: Omit<HttpRequestOptions, "method" | "path" | "body">
+        ): Promise<TResponse>;
+        close(): void;
+    }
+
+    function http(endpoint: string): HttpInstance<string>;
+    function http(endpoint: string, options: HttpOptions & { binary?: false | undefined }): HttpInstance<string>;
+    function http(endpoint: string, options: HttpOptions & { binary: true }): HttpInstance<Uint8Array>;
+
+    /* === String helpers ======================== */
+
+    function message(problem: string | JsonObject): string;
+
+    function format(format_string: string, ...args: unknown[]): string;
+
+    /* === i18n ===================== */
+
+    function gettext(message: string): string;
+    function gettext(context: string, message?: string): string;
+    function ngettext(message1: string, messageN: string, n: number): string;
+    function ngettext(context: string, message1: string, messageN: string, n: number): string;
+
+    function translate(): void;
+
+    /* === Number formatting ===================== */
+
+    type FormatOptions = {
+        precision?: number;
+        base2?: boolean;
+    };
+    type MaybeNumber = number | null | undefined;
+
+    function format_number(n: MaybeNumber, precision?: number): string
+    function format_bytes(n: MaybeNumber, options?: FormatOptions): string;
+    function format_bytes_per_sec(n: MaybeNumber, options?: FormatOptions): string;
+    function format_bits_per_sec(n: MaybeNumber, options?: FormatOptions & { base2?: false }): string;
+
+    /** @deprecated */ function format_bytes(n: MaybeNumber, factor: unknown, options?: object | boolean): string | string[];
+    /** @deprecated */ function format_bytes_per_sec(n: MaybeNumber, factor: unknown, options?: object | boolean): string | string[];
+    /** @deprecated */ function format_bits_per_sec(n: MaybeNumber, factor: unknown, options?: object | boolean): string | string[];
+
+    /* === Session ====================== */
+    function logout(reload: boolean, reason?: string): void;
+
+    export let localStorage: Storage;
+    export let sessionStorage: Storage;
+}
diff --git a/pkg/lib/cockpit/_internal/base64.js b/pkg/lib/cockpit/_internal/base64.js
new file mode 100644
index 0000000000..390dfe1dd2
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/base64.js
@@ -0,0 +1,65 @@
+/*
+ * These are the polyfills from Mozilla. It's pretty nasty that
+ * these weren't in the typed array standardization.
+ *
+ * https://developer.mozilla.org/en-US/docs/Glossary/Base64
+ */
+
+function uint6_to_b64 (x) {
+    return x < 26 ? x + 65 : x < 52 ? x + 71 : x < 62 ? x - 4 : x === 62 ? 43 : x === 63 ? 47 : 65;
+}
+
+export function base64_encode(data) {
+    if (typeof data === "string")
+        return window.btoa(data);
+    /* For when the caller has chosen to use ArrayBuffer */
+    if (data instanceof window.ArrayBuffer)
+        data = new window.Uint8Array(data);
+    const length = data.length;
+    let mod3 = 2;
+    let str = "";
+    for (let uint24 = 0, i = 0; i < length; i++) {
+        mod3 = i % 3;
+        uint24 |= data[i] << (16 >>> mod3 & 24);
+        if (mod3 === 2 || length - i === 1) {
+            str += String.fromCharCode(uint6_to_b64(uint24 >>> 18 & 63),
+                                       uint6_to_b64(uint24 >>> 12 & 63),
+                                       uint6_to_b64(uint24 >>> 6 & 63),
+                                       uint6_to_b64(uint24 & 63));
+            uint24 = 0;
+        }
+    }
+
+    return str.substring(0, str.length - 2 + mod3) + (mod3 === 2 ? '' : mod3 === 1 ? '=' : '==');
+}
+
+function b64_to_uint6 (x) {
+    return x > 64 && x < 91
+        ? x - 65
+        : x > 96 && x < 123
+            ? x - 71
+            : x > 47 && x < 58 ? x + 4 : x === 43 ? 62 : x === 47 ? 63 : 0;
+}
+
+export function base64_decode(str, constructor) {
+    if (constructor === String)
+        return window.atob(str);
+    const ilen = str.length;
+    let eq;
+    for (eq = 0; eq < 3; eq++) {
+        if (str[ilen - (eq + 1)] != '=')
+            break;
+    }
+    const olen = (ilen * 3 + 1 >> 2) - eq;
+    const data = new (constructor || Array)(olen);
+    for (let mod3, mod4, uint24 = 0, oi = 0, ii = 0; ii < ilen; ii++) {
+        mod4 = ii & 3;
+        uint24 |= b64_to_uint6(str.charCodeAt(ii)) << 18 - 6 * mod4;
+        if (mod4 === 3 || ilen - ii === 1) {
+            for (mod3 = 0; mod3 < 3 && oi < olen; mod3++, oi++)
+                data[oi] = uint24 >>> (16 >>> mod3 & 24) & 255;
+            uint24 = 0;
+        }
+    }
+    return data;
+}
diff --git a/pkg/lib/cockpit/_internal/channel.js b/pkg/lib/cockpit/_internal/channel.js
new file mode 100644
index 0000000000..5a80002f23
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/channel.js
@@ -0,0 +1,245 @@
+import { join_data } from './common';
+import { Deferred } from './deferred';
+import { event_mixin } from './event-mixin';
+import { ensure_transport, transport_globals } from './transport';
+
+/* -------------------------------------------------------------------------
+ * Channels
+ *
+ * Public: https://cockpit-project.org/guide/latest/api-base1.html
+ */
+
+export function Channel(options) {
+    const self = this;
+
+    /* We can trigger events */
+    event_mixin(self, { });
+
+    let transport;
+    let ready = null;
+    let closed = null;
+    let waiting = null;
+    let received_done = false;
+    let sent_done = false;
+    let id = null;
+    const binary = (options.binary === true);
+
+    /*
+     * Queue while waiting for transport, items are tuples:
+     * [is_control ? true : false, payload]
+     */
+    const queue = [];
+
+    /* Handy for callers, but not used by us */
+    self.valid = true;
+    self.options = options;
+    self.binary = binary;
+    self.id = id;
+
+    function on_message(payload) {
+        if (received_done) {
+            console.warn("received message after done");
+            self.close("protocol-error");
+        } else {
+            self.dispatchEvent("message", payload);
+        }
+    }
+
+    function on_close(data) {
+        closed = data;
+        self.valid = false;
+        if (transport && id)
+            transport.unregister(id);
+        if (closed.message && !options.err)
+            console.warn(closed.message);
+        self.dispatchEvent("close", closed);
+        if (waiting)
+            waiting.resolve(closed);
+    }
+
+    function on_ready(data) {
+        ready = data;
+        self.dispatchEvent("ready", ready);
+    }
+
+    function on_control(data) {
+        if (data.command == "close") {
+            on_close(data);
+            return;
+        } else if (data.command == "ready") {
+            on_ready(data);
+        }
+
+        const done = data.command === "done";
+        if (done && received_done) {
+            console.warn("received two done commands on channel");
+            self.close("protocol-error");
+        } else {
+            if (done)
+                received_done = true;
+            self.dispatchEvent("control", data);
+        }
+    }
+
+    function send_payload(payload) {
+        if (!binary) {
+            if (typeof payload !== "string")
+                payload = String(payload);
+        }
+        transport.send_message(payload, id);
+    }
+
+    ensure_transport(function(trans) {
+        transport = trans;
+        if (closed)
+            return;
+
+        id = transport.next_channel();
+        self.id = id;
+
+        /* Register channel handlers */
+        transport.register(id, on_control, on_message);
+
+        /* Now open the channel */
+        const command = { };
+        for (const i in options)
+            if (i !== "binary")
+                command[i] = options[i];
+        /* handle binary specially: Our JS API has always been boolean, while the wire protocol is
+         * a string with the only valid value "raw". */
+        if (binary)
+            command.binary = "raw";
+        command.command = "open";
+        command.channel = id;
+
+        if (!command.host) {
+            if (transport_globals.default_host)
+                command.host = transport_globals.default_host;
+        }
+
+        command["flow-control"] = true;
+        transport.send_control(command);
+
+        /* Now drain the queue */
+        while (queue.length > 0) {
+            const item = queue.shift();
+            if (item[0]) {
+                item[1].channel = id;
+                transport.send_control(item[1]);
+            } else {
+                send_payload(item[1]);
+            }
+        }
+    });
+
+    self.send = function send(message) {
+        if (closed)
+            console.warn("sending message on closed channel");
+        else if (sent_done)
+            console.warn("sending message after done");
+        else if (!transport)
+            queue.push([false, message]);
+        else
+            send_payload(message);
+    };
+
+    self.control = function control(options) {
+        options = options || { };
+        if (!options.command)
+            options.command = "options";
+        if (options.command === "done")
+            sent_done = true;
+        options.channel = id;
+        if (!transport)
+            queue.push([true, options]);
+        else
+            transport.send_control(options);
+    };
+
+    self.wait = function wait(callback) {
+        if (!waiting) {
+            waiting = new Deferred();
+            if (closed) {
+                waiting.reject(closed);
+            } else if (ready) {
+                waiting.resolve(ready);
+            } else {
+                self.addEventListener("ready", function(event, data) {
+                    waiting.resolve(data);
+                });
+                self.addEventListener("close", function(event, data) {
+                    waiting.reject(data);
+                });
+            }
+        }
+        const promise = waiting.promise;
+        if (callback)
+            promise.then(callback, callback);
+        return promise;
+    };
+
+    self.close = function close(options) {
+        if (closed)
+            return;
+
+        if (!options)
+            options = { };
+        else if (typeof options == "string")
+            options = { problem: options };
+        options.command = "close";
+        options.channel = id;
+
+        if (!transport)
+            queue.push([true, options]);
+        else
+            transport.send_control(options);
+        on_close(options);
+    };
+
+    self.buffer = function buffer(callback) {
+        const buffers = [];
+        buffers.callback = callback;
+        buffers.squash = function squash() {
+            return join_data(buffers, binary);
+        };
+
+        function on_message(event, data) {
+            buffers.push(data);
+            if (buffers.callback) {
+                const block = join_data(buffers, binary);
+                if (block.length > 0) {
+                    const consumed = buffers.callback.call(self, block);
+                    if (typeof consumed !== "number" || consumed === block.length) {
+                        buffers.length = 0;
+                    } else if (consumed === 0) {
+                        buffers.length = 1;
+                        buffers[0] = block;
+                    } else if (consumed !== 0) {
+                        buffers.length = 1;
+                        if (block.subarray)
+                            buffers[0] = block.subarray(consumed);
+                        else if (block.substring)
+                            buffers[0] = block.substring(consumed);
+                        else
+                            buffers[0] = block.slice(consumed);
+                    }
+                }
+            }
+        }
+
+        function on_close() {
+            self.removeEventListener("message", on_message);
+            self.removeEventListener("close", on_close);
+        }
+
+        self.addEventListener("message", on_message);
+        self.addEventListener("close", on_close);
+
+        return buffers;
+    };
+
+    self.toString = function toString() {
+        const host = options.host || "localhost";
+        return "[Channel " + (self.valid ? id : "<invalid>") + " -> " + host + "]";
+    };
+}
diff --git a/pkg/lib/cockpit/_internal/common.ts b/pkg/lib/cockpit/_internal/common.ts
new file mode 100644
index 0000000000..77f4cc940c
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/common.ts
@@ -0,0 +1,97 @@
+export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
+export type JsonObject = Record<string, JsonValue>;
+
+export type StrOrBytes = string | Uint8Array;
+
+declare global {
+    interface CockpitMockOptions {
+        url_root?: string;
+        pathname?: string;
+        last_transport?: unknown;
+        url?: string;
+    }
+
+    interface Window {
+        mock?: CockpitMockOptions;
+        debugging?: string;
+    }
+}
+
+/*
+ * The debugging property is a global that is used
+ * by various parts of the code to show/hide debug
+ * messages in the javascript console.
+ *
+ * We support using storage to get/set that property
+ * so that it carries across the various frames or
+ * alternatively persists across refreshes.
+ */
+if (typeof window.debugging === "undefined") {
+    try {
+        // Sometimes this throws a SecurityError such as during testing
+        Object.defineProperty(window, "debugging", {
+            get: function() { return window.sessionStorage.debugging || window.localStorage.debugging },
+            set: function(x) { window.sessionStorage.debugging = x }
+        });
+    } catch { }
+}
+
+export function in_array(array: unknown[], val: unknown): boolean {
+    const length = array.length;
+    for (let i = 0; i < length; i++) {
+        if (val === array[i])
+            return true;
+    }
+    return false;
+}
+
+export function is_function(x: unknown): x is (...args: unknown[]) => unknown {
+    return typeof x === 'function';
+}
+
+export function is_object(x: unknown): x is object {
+    return x !== null && typeof x === 'object';
+}
+
+export function is_plain_object(x: unknown): boolean {
+    return is_object(x) && Object.prototype.toString.call(x) === '[object Object]';
+}
+
+export function invoke_functions<F extends (...args: never[]) => void>(functions: F[], self: ThisType<F>, args: Parameters<F>): void {
+    const length = functions?.length ?? 0;
+    for (let i = 0; i < length; i++) {
+        if (functions[i])
+            functions[i].apply(self, args);
+    }
+}
+
+export function iterate_data(data: StrOrBytes, callback: (chunk: StrOrBytes) => void, batch: number = 64 * 1024): void {
+    if (typeof data === 'string') {
+        for (let i = 0; i < data.length; i += batch) {
+            callback(data.substring(i, i + batch));
+        }
+    } else if (data) {
+        for (let i = 0; i < data.byteLength; i += batch) {
+            const n = Math.min(data.byteLength - i, batch);
+            callback(new Uint8Array(data.buffer, i, n));
+        }
+    }
+}
+
+export function join_data(buffers: StrOrBytes[], binary: boolean): StrOrBytes {
+    if (!binary)
+        return buffers.join("");
+
+    let total = 0;
+    const length = buffers.length;
+    for (let i = 0; i < length; i++)
+        total += buffers[i].length;
+
+    const data = new Uint8Array(total);
+    for (let j = 0, i = 0; i < length; i++) {
+        data.set(buffers[i] as Uint8Array, j);
+        j += buffers[i].length;
+    }
+
+    return data;
+}
diff --git a/pkg/lib/cockpit/_internal/deferred.js b/pkg/lib/cockpit/_internal/deferred.js
new file mode 100644
index 0000000000..cd816471b4
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/deferred.js
@@ -0,0 +1,237 @@
+import { is_function, is_object } from './common';
+
+/* ------------------------------------------------------------------------------------
+ * An ordered queue of functions that should be called later.
+ */
+
+let later_queue = [];
+let later_timeout = null;
+
+function later_drain() {
+    const queue = later_queue;
+    later_timeout = null;
+    later_queue = [];
+    for (;;) {
+        const func = queue.shift();
+        if (!func)
+            break;
+        func();
+    }
+}
+
+export function later_invoke(func) {
+    if (func)
+        later_queue.push(func);
+    if (later_timeout === null)
+        later_timeout = window.setTimeout(later_drain, 0);
+}
+
+/* ------------------------------------------------------------------------------------
+ * Promises.
+ * Based on Q and angular promises, with some jQuery compatibility. See the angular
+ * license in COPYING.node for license lineage. There are some key differences with
+ * both Q and jQuery.
+ *
+ *  * Exceptions thrown in handlers are not treated as rejections or failures.
+ *    Exceptions remain actual exceptions.
+ *  * Unlike jQuery callbacks added to an already completed promise don't execute
+ *    immediately. Wait until control is returned to the browser.
+ */
+
+function promise_then(state, fulfilled, rejected, updated) {
+    if (fulfilled === undefined && rejected === undefined && updated === undefined)
+        return null;
+    const result = new Deferred();
+    state.pending = state.pending || [];
+    state.pending.push([result, fulfilled, rejected, updated]);
+    if (state.status > 0)
+        schedule_process_queue(state);
+    return result.promise;
+}
+
+function create_promise(state) {
+    /* Like jQuery the promise object is callable */
+    const self = function Promise(target) {
+        if (target) {
+            Object.assign(target, self);
+            return target;
+        }
+        return self;
+    };
+
+    state.status = 0;
+
+    self.then = function then(fulfilled, rejected, updated) {
+        return promise_then(state, fulfilled, rejected, updated) || self;
+    };
+
+    self.catch = function catch_(callback) {
+        return promise_then(state, null, callback) || self;
+    };
+
+    self.finally = function finally_(callback, updated) {
+        return promise_then(state, function() {
+            return handle_callback(arguments, true, callback);
+        }, function() {
+            return handle_callback(arguments, false, callback);
+        }, updated) || self;
+    };
+
+    /* Basic jQuery Promise compatibility */
+    self.done = function done(fulfilled) {
+        promise_then(state, fulfilled);
+        return self;
+    };
+
+    self.fail = function fail(rejected) {
+        promise_then(state, null, rejected);
+        return self;
+    };
+
+    self.always = function always(callback) {
+        promise_then(state, callback, callback);
+        return self;
+    };
+
+    self.progress = function progress(updated) {
+        promise_then(state, null, null, updated);
+        return self;
+    };
+
+    self.state = function state_() {
+        if (state.status == 1)
+            return "resolved";
+        if (state.status == 2)
+            return "rejected";
+        return "pending";
+    };
+
+    /* Promises are recursive like jQuery */
+    self.promise = self;
+
+    return self;
+}
+
+function process_queue(state) {
+    const pending = state.pending;
+    state.process_scheduled = false;
+    state.pending = undefined;
+    for (let i = 0, ii = pending.length; i < ii; ++i) {
+        state.pur = true;
+        const deferred = pending[i][0];
+        const fn = pending[i][state.status];
+        if (is_function(fn)) {
+            deferred.resolve(fn.apply(state.promise, state.values));
+        } else if (state.status === 1) {
+            deferred.resolve.apply(deferred.resolve, state.values);
+        } else {
+            deferred.reject.apply(deferred.reject, state.values);
+        }
+    }
+}
+
+function schedule_process_queue(state) {
+    if (state.process_scheduled || !state.pending)
+        return;
+    state.process_scheduled = true;
+    later_invoke(function() { process_queue(state) });
+}
+
+function deferred_resolve(state, values) {
+    let then;
+    let done = false;
+    if (is_object(values[0]) || is_function(values[0]))
+        then = values[0]?.then;
+    if (is_function(then)) {
+        state.status = -1;
+        then.call(values[0], function(/* ... */) {
+            if (done)
+                return;
+            done = true;
+            deferred_resolve(state, arguments);
+        }, function(/* ... */) {
+            if (done)
+                return;
+            done = true;
+            deferred_reject(state, arguments);
+        }, function(/* ... */) {
+            deferred_notify(state, arguments);
+        });
+    } else {
+        state.values = values;
+        state.status = 1;
+        schedule_process_queue(state);
+    }
+}
+
+function deferred_reject(state, values) {
+    state.values = values;
+    state.status = 2;
+    schedule_process_queue(state);
+}
+
+function deferred_notify(state, values) {
+    const callbacks = state.pending;
+    if ((state.status <= 0) && callbacks?.length) {
+        later_invoke(function() {
+            for (let i = 0, ii = callbacks.length; i < ii; i++) {
+                const result = callbacks[i][0];
+                const callback = callbacks[i][3];
+                if (is_function(callback))
+                    result.notify(callback.apply(state.promise, values));
+                else
+                    result.notify.apply(result, values);
+            }
+        });
+    }
+}
+
+export function Deferred() {
+    const self = this;
+    const state = { };
+    self.promise = state.promise = create_promise(state);
+
+    self.resolve = function resolve(/* ... */) {
+        if (arguments[0] === state.promise)
+            throw new Error("Expected promise to be resolved with other value than itself");
+        if (!state.status)
+            deferred_resolve(state, arguments);
+        return self;
+    };
+
+    self.reject = function reject(/* ... */) {
+        if (state.status)
+            return;
+        deferred_reject(state, arguments);
+        return self;
+    };
+
+    self.notify = function notify(/* ... */) {
+        deferred_notify(state, arguments);
+        return self;
+    };
+}
+
+function prep_promise(values, resolved) {
+    const result = new Deferred();
+    if (resolved)
+        result.resolve.apply(result, values);
+    else
+        result.reject.apply(result, values);
+    return result.promise;
+}
+
+function handle_callback(values, is_resolved, callback) {
+    let callback_output = null;
+    if (is_function(callback))
+        callback_output = callback();
+    if (callback_output && is_function(callback_output.then)) {
+        return callback_output.then(function() {
+            return prep_promise(values, is_resolved);
+        }, function() {
+            return prep_promise(arguments, false);
+        });
+    } else {
+        return prep_promise(values, is_resolved);
+    }
+}
diff --git a/pkg/lib/cockpit/_internal/event-mixin.js b/pkg/lib/cockpit/_internal/event-mixin.js
new file mode 100644
index 0000000000..0366c38af9
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/event-mixin.js
@@ -0,0 +1,62 @@
+import { is_function, invoke_functions } from './common';
+
+/*
+ * Extends an object to have the standard DOM style addEventListener
+ * removeEventListener and dispatchEvent methods. The dispatchEvent
+ * method has the additional capability to create a new event from a type
+ * string and arguments.
+ */
+export function event_mixin(obj, handlers) {
+    Object.defineProperties(obj, {
+        addEventListener: {
+            enumerable: false,
+            value: function addEventListener(type, handler) {
+                if (handlers[type] === undefined)
+                    handlers[type] = [];
+                handlers[type].push(handler);
+            }
+        },
+        removeEventListener: {
+            enumerable: false,
+            value: function removeEventListener(type, handler) {
+                const length = handlers[type] ? handlers[type].length : 0;
+                for (let i = 0; i < length; i++) {
+                    if (handlers[type][i] === handler) {
+                        handlers[type][i] = null;
+                        break;
+                    }
+                }
+            }
+        },
+        dispatchEvent: {
+            enumerable: false,
+            value: function dispatchEvent(event) {
+                let type, args;
+                if (typeof event === "string") {
+                    type = event;
+                    args = Array.prototype.slice.call(arguments, 1);
+
+                    let detail = null;
+                    if (arguments.length == 2)
+                        detail = arguments[1];
+                    else if (arguments.length > 2)
+                        detail = args;
+
+                    event = new CustomEvent(type, {
+                        bubbles: false,
+                        cancelable: false,
+                        detail
+                    });
+
+                    args.unshift(event);
+                } else {
+                    type = event.type;
+                    args = arguments;
+                }
+                if (is_function(obj['on' + type]))
+                    obj['on' + type].apply(obj, args);
+                invoke_functions(handlers[type], obj, args);
+            }
+        }
+    });
+}
diff --git a/pkg/lib/cockpit/_internal/info.ts b/pkg/lib/cockpit/_internal/info.ts
new file mode 100644
index 0000000000..d7fdcb56fc
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/info.ts
@@ -0,0 +1,79 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2025 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Channel } from '../channel';
+
+/* We allow accessing arbitrary fields by a Partial<Record<>> type, but having
+ * an explicit list is useful for autocompletion. */
+export interface OsRelease {
+    NAME?: string;
+    VERSION?: string;
+    RELEASE_TYPE?: string;
+    ID?: string;
+    VERSION_ID?: string;
+    VERSION_CODENAME?: string;
+    PLATFORM_ID?: string;
+    PRETTY_NAME?: string;
+    ANSI_COLOR?: string;
+    LOGO?: string;
+    CPE_NAME?: string;
+    DEFAULT_HOSTNAME?: string;
+    HOME_URL?: string;
+    DOCUMENTATION_URL?: string;
+    SUPPORT_URL?: string;
+    BUG_REPORT_URL?: string;
+    SUPPORT_END?: string;
+    VARIANT?: string;
+    VARIANT_ID?: string;
+}
+
+export interface User {
+    fullname: string;
+    gid: number;
+    group: string;
+    groups: string[];
+    home: string;
+    name: string;
+    shell: string;
+    uid: number;
+}
+
+export interface WebserverInfo {
+    version: string;
+}
+
+export interface Info {
+    channels: Partial<Record<string, string[]>>;
+    os_release: OsRelease & Partial<Record<string, string>>;
+    user: User;
+    ws: WebserverInfo;
+}
+
+export function fetch_info(): Promise<Info> {
+    const channel = new Channel({ payload: 'info' });
+    return new Promise((resolve, reject) => {
+        channel.on('data', data => {
+            resolve(JSON.parse(data));
+            channel.close();
+        });
+        channel.on('close', msg => {
+            reject(msg);
+        });
+    });
+}
diff --git a/pkg/lib/cockpit/_internal/location-utils.ts b/pkg/lib/cockpit/_internal/location-utils.ts
new file mode 100644
index 0000000000..98cfc256ea
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/location-utils.ts
@@ -0,0 +1,62 @@
+function get_url_root(): string | null {
+    const meta_url_root = document.head.querySelector("meta[name='url-root']");
+    if (meta_url_root instanceof HTMLMetaElement) {
+        return meta_url_root.content.replace(/^\/+|\/+$/g, '');
+    } else {
+        // fallback for cockpit-ws < 272
+        try {
+            // Sometimes this throws a SecurityError such as during testing
+            return window.localStorage.getItem('url-root');
+        } catch {
+            return null;
+        }
+    }
+}
+export const url_root = get_url_root();
+
+export const transport_origin = window.location.origin;
+
+export function calculate_application(): string {
+    let path = window.location.pathname || "/";
+    let _url_root = url_root;
+    if (window.mock?.pathname)
+        path = window.mock.pathname;
+    if (window.mock?.url_root)
+        _url_root = window.mock.url_root;
+
+    if (_url_root && path.indexOf('/' + _url_root) === 0)
+        path = path.replace('/' + _url_root, '') || '/';
+
+    if (path.indexOf("/cockpit/") !== 0 && path.indexOf("/cockpit+") !== 0) {
+        if (path.indexOf("/=") === 0)
+            path = "/cockpit+" + path.split("/")[1];
+        else
+            path = "/cockpit";
+    }
+
+    return path.split("/")[1];
+}
+
+export function calculate_url(suffix?: string): string {
+    if (!suffix)
+        suffix = "socket";
+    const window_loc = window.location.toString();
+    let _url_root = url_root;
+
+    if (window.mock?.url)
+        return window.mock.url;
+    if (window.mock?.url_root)
+        _url_root = window.mock.url_root;
+
+    let prefix = calculate_application();
+    if (_url_root)
+        prefix = _url_root + "/" + prefix;
+
+    if (window_loc.indexOf('http:') === 0) {
+        return "ws://" + window.location.host + "/" + prefix + "/" + suffix;
+    } else if (window_loc.indexOf('https:') === 0) {
+        return "wss://" + window.location.host + "/" + prefix + "/" + suffix;
+    } else {
+        throw new Error("Cockpit must be used over http or https");
+    }
+}
diff --git a/pkg/lib/cockpit/_internal/location.ts b/pkg/lib/cockpit/_internal/location.ts
new file mode 100644
index 0000000000..635b158478
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/location.ts
@@ -0,0 +1,190 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2024 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * This is the "cockpit.location" API converted to TypeScript and moved out of
+ * cockpit.js. In the future a new Location API should be designed to replace
+ * the "cockpit.location" one and become importable from pkg/lib/cockpit as ESM module.
+ */
+
+import { url_root, calculate_application } from './location-utils';
+
+type Options = { [name: string]: string | Array<string> };
+type Path = string | string[] | Location;
+
+export class Location {
+    path: string[];
+    href: string;
+    url_root: string;
+    options: Options;
+    #hash_changed: boolean = false;
+
+    constructor() {
+        const application = calculate_application();
+        this.url_root = url_root || "";
+
+        if (window.mock?.url_root)
+            this.url_root = window.mock.url_root;
+
+        if (application.indexOf("cockpit+=") === 0) {
+            if (this.url_root)
+                this.url_root += '/';
+            this.url_root = this.url_root + application.replace("cockpit+", '');
+        }
+
+        this.href = window.location.hash.slice(1);
+        this.options = {};
+        this.path = this.decode(this.href, this.options);
+    }
+
+    #resolve_path_dots(parts: string[]): string[] {
+        const out = [];
+        for (let i = 0; i < parts.length; i++) {
+            const part = parts[i];
+            if (part === "" || part == ".") {
+                continue;
+            } else if (part == "..") {
+                if (out.length === 0)
+                    return [];
+                out.pop();
+            } else {
+                out.push(part);
+            }
+        }
+        return out;
+    }
+
+    #href_for_go_or_replace(path: Path, options?: Options): string {
+        options = options || {};
+        if (typeof path === "string") {
+            return this.encode(this.decode(path, options), options);
+        } else if (path instanceof Location) {
+            return path.href;
+        } else {
+            return this.encode(path, options);
+        }
+    }
+
+    #decode_path(input: string): string[] {
+        let result, i;
+        let pre_parts: string[] = [];
+        const parts = input.split('/').map(decodeURIComponent);
+
+        if (this.url_root)
+            pre_parts = this.url_root.split('/').map(decodeURIComponent);
+
+        if (input && input[0] !== "/" && this.path !== undefined) {
+            result = [...this.path];
+            result.pop();
+            result = result.concat(parts);
+        } else {
+            result = parts;
+        }
+
+        result = this.#resolve_path_dots(result);
+        for (i = 0; i < pre_parts.length; i++) {
+            if (pre_parts[i] !== result[i])
+                break;
+        }
+        if (i == pre_parts.length)
+            result.splice(0, pre_parts.length);
+
+        return result;
+    }
+
+    encode(path: string | string[], options: Options, with_root: boolean = false): string {
+        if (typeof path == "string")
+            path = this.#decode_path(path);
+
+        let href = "/" + path.map(encodeURIComponent).join("/");
+        if (with_root && this.url_root && href.indexOf("/" + this.url_root + "/") !== 0)
+            href = "/" + this.url_root + href;
+
+        /* Undo unnecessary encoding of these */
+        href = href.replaceAll("%40", "@");
+        href = href.replaceAll("%3D", "=");
+        href = href.replaceAll("%2B", "+");
+        href = href.replaceAll("%23", "#");
+
+        const query: string[] = [];
+        if (options) {
+            for (const opt in options) {
+                let value = options[opt];
+                if (!Array.isArray(value))
+                    value = [value];
+                value.forEach(function(v: string) {
+                    query.push(encodeURIComponent(opt) + "=" + encodeURIComponent(v));
+                });
+            }
+            if (query.length > 0)
+                href += "?" + query.join("&");
+        }
+        return href;
+    }
+
+    // NOTE: The options argument is modified in place
+    decode(href: string, options: Options): string[] {
+        if (href[0] == '#')
+            href = href.substring(1);
+
+        const pos = href.indexOf('?');
+        const first = (pos === -1) ? href : href.substring(0, pos);
+        const path = this.#decode_path(first);
+        if (pos !== -1 && options) {
+            href.substring(pos + 1).split("&")
+                    .forEach(function(opt) {
+                        const parts = opt.split('=');
+                        const name = decodeURIComponent(parts[0]);
+                        const value = decodeURIComponent(parts[1]);
+                        if (options[name]) {
+                            let last = options[name];
+                            if (!Array.isArray(last))
+                                last = options[name] = [last];
+                            last.push(value);
+                        } else {
+                            options[name] = value;
+                        }
+                    });
+        }
+
+        return path;
+    }
+
+    replace(path: Path, options?: Options) {
+        if (this.#hash_changed)
+            return;
+        const href = this.#href_for_go_or_replace(path, options);
+        window.location.replace(window.location.pathname + '#' + href);
+    }
+
+    go(path: Path, options?: Options) {
+        if (this.#hash_changed)
+            return;
+        const href = this.#href_for_go_or_replace(path, options);
+        window.location.hash = '#' + href;
+    }
+
+    invalidate() {
+        this.#hash_changed = true;
+    }
+
+    toString() {
+        return this.href;
+    }
+}
diff --git a/pkg/lib/cockpit/_internal/parentwebsocket.ts b/pkg/lib/cockpit/_internal/parentwebsocket.ts
new file mode 100644
index 0000000000..beb800d689
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/parentwebsocket.ts
@@ -0,0 +1,58 @@
+import { transport_origin } from './location-utils';
+
+/*
+ * A WebSocket that connects to parent frame. The mechanism
+ * for doing this will eventually be documented publicly,
+ * but for now:
+ *
+ *  * Forward raw cockpit1 string protocol messages via window.postMessage
+ *  * Listen for cockpit1 string protocol messages via window.onmessage
+ *  * Never accept or send messages to another origin
+ *  * An empty string message means "close" (not completely used yet)
+ */
+export class ParentWebSocket {
+    binaryType = 'arraybuffer' as const; // compatibility with Transport, which sets this
+    readyState = 0;
+
+    // essentially signal handlers: these are assigned to from Transport
+    onopen(): void {
+    }
+
+    onclose(): void {
+    }
+
+    onmessage(_event: MessageEvent): void {
+    }
+
+    constructor(parent: Window) {
+        window.addEventListener("message", event => {
+            if (event.origin !== transport_origin || event.source !== parent)
+                return;
+            const data = event.data;
+            if (data === undefined || (data.length === undefined && data.byteLength === undefined))
+                return;
+            if (data.length === 0) {
+                this.readyState = 3;
+                this.onclose();
+            } else {
+                this.onmessage(event);
+            }
+        }, false);
+
+        window.setTimeout(() => {
+            this.readyState = 1;
+            this.onopen();
+        }, 0);
+    }
+
+    // same types as the real WebSocket
+    send(message: string | ArrayBufferLike | Blob | ArrayBufferView): void {
+        parent.postMessage(message, transport_origin);
+    }
+
+    close(): void {
+        this.readyState = 3;
+        parent.postMessage("", transport_origin);
+        this.onclose();
+    }
+}
diff --git a/pkg/lib/cockpit/_internal/transport.ts b/pkg/lib/cockpit/_internal/transport.ts
new file mode 100644
index 0000000000..4ea0a0c93f
--- /dev/null
+++ b/pkg/lib/cockpit/_internal/transport.ts
@@ -0,0 +1,324 @@
+import { EventEmitter } from '../event';
+
+import type { JsonObject } from './common';
+import { calculate_application, calculate_url } from './location-utils';
+import { ParentWebSocket } from './parentwebsocket';
+
+type ControlCallback = (message: JsonObject) => void;
+type MessageCallback = (data: string | Uint8Array) => void;
+type FilterCallback = (message: string | ArrayBuffer, channel: string | null, control: JsonObject | null) => boolean;
+
+class TransportGlobals {
+    default_transport: Transport | null = null;
+    reload_after_disconnect = false;
+    expect_disconnect = false;
+    init_callback: ControlCallback | null = null;
+    default_host: string | null = null;
+    process_hints: ControlCallback | null = null;
+    incoming_filters: FilterCallback[] = [];
+}
+
+// the transport globals must be a *real* global, across bundles -- i.e. a <script>ed cockpit.js and bundled
+// channel.ts must share the same instance, to avoid initializing transports (and thus initing) twice
+
+declare global {
+    interface Document {
+        cockpit_transport_globals?: TransportGlobals;
+    }
+}
+
+if (!document.cockpit_transport_globals)
+    document.cockpit_transport_globals = new TransportGlobals();
+
+export const transport_globals = document.cockpit_transport_globals;
+
+window.addEventListener('beforeunload', () => {
+    transport_globals.expect_disconnect = true;
+}, false);
+
+function transport_debug(...args: unknown[]) {
+    if (window.debugging == "all" || window.debugging?.includes("channel"))
+        console.debug(...args);
+}
+
+/* Private Transport class */
+class Transport extends EventEmitter<{ ready(): void }> {
+    application: string;
+    ready: boolean;
+
+    #last_channel = 0;
+    #channel_seed = "";
+    #ws: WebSocket | ParentWebSocket | null;
+    #ignore_health_check = false;
+    #got_message = false;
+    #check_health_timer;
+    #control_cbs: Record<string, ControlCallback> = {};
+    #message_cbs: Record<string, MessageCallback> = {};
+    #waiting_for_init = true;
+
+    constructor() {
+        super();
+
+        this.application = calculate_application();
+
+        if (window.mock)
+            window.mock.last_transport = this;
+
+        /* See if we should communicate via parent */
+        if (window.parent !== window && window.name.indexOf("cockpit1:") === 0) {
+            this.#ws = new ParentWebSocket(window.parent);
+        } else {
+            const ws_loc = calculate_url();
+            transport_debug("connecting to " + ws_loc);
+            this.#ws = new WebSocket(ws_loc, "cockpit1");
+
+            this.#check_health_timer = window.setInterval(() => {
+                if (this.ready && this.#ws)
+                    this.#ws.send("\n{ \"command\": \"ping\" }");
+                if (!this.#got_message) {
+                    if (this.#ignore_health_check) {
+                        console.log("health check failure ignored");
+                    } else {
+                        console.log("health check failed");
+                        this.close({ problem: "timeout" });
+                    }
+                }
+                this.#got_message = false;
+            }, 30000);
+        }
+
+        this.ready = false;
+
+        this.#ws.onopen = () => {
+            if (this.#ws) {
+                if (typeof this.#ws.binaryType !== "undefined")
+                    this.#ws.binaryType = "arraybuffer";
+                this.#ws.send("\n{ \"command\": \"init\", \"version\": 1 }");
+            }
+        };
+
+        this.#ws.onclose = () => {
+            transport_debug("WebSocket onclose");
+            this.#ws = null;
+            if (transport_globals.reload_after_disconnect) {
+                transport_globals.expect_disconnect = true;
+                // @ts-expect-error force-reload parameter is Firefox-only
+                window.location.reload(true);
+            }
+            this.close();
+        };
+
+        this.#ws.onmessage = event => this.dispatch_data(event);
+    }
+
+    /* Called when ready for channels to interact */
+    #ready_for_channels() {
+        if (!this.ready) {
+            this.ready = true;
+            this.emit("ready");
+        }
+    }
+
+    #process_init(options: JsonObject) {
+        if (options.problem) {
+            this.close({ problem: options.problem });
+            return;
+        }
+
+        if (options.version !== 1) {
+            console.error("received unsupported version in init message: " + options.version);
+            this.close({ problem: "not-supported" });
+            return;
+        }
+
+        if (options["channel-seed"])
+            this.#channel_seed = String(options["channel-seed"]);
+        if (typeof options.host === 'string')
+            transport_globals.default_host = options.host;
+
+        if (transport_globals.init_callback)
+            transport_globals.init_callback(options);
+
+        if (this.#waiting_for_init) {
+            this.#waiting_for_init = false;
+            this.#ready_for_channels();
+        }
+    }
+
+    #process_control(data: JsonObject) {
+        const channel = data.channel;
+
+        /* Init message received */
+        if (data.command == "init") {
+            this.#process_init(data);
+        } else if (this.#waiting_for_init) {
+            this.#waiting_for_init = false;
+            if (data.command != "close" || channel) {
+                console.error("received message before init: ", data.command);
+                data = { problem: "protocol-error" };
+            }
+            this.close(data);
+
+            /* Any pings get sent back as pongs */
+        } else if (data.command == "ping") {
+            data.command = "pong";
+            this.send_control(data);
+        } else if (data.command == "pong") {
+            /* Any pong commands are ignored */
+        } else if (data.command == "hint") {
+            if (transport_globals.process_hints)
+                transport_globals.process_hints(data);
+        } else if (typeof channel === 'string') {
+            const func = this.#control_cbs[channel];
+            if (func)
+                func(data);
+        }
+    }
+
+    #process_message(channel: string, payload: string | Uint8Array) {
+        const func = this.#message_cbs[channel];
+        if (func)
+            func(payload);
+    }
+
+    dispatch_data(arg: MessageEvent<string | ArrayBuffer>): boolean {
+        this.#got_message = true;
+
+        const message = arg.data;
+        let channel;
+        let control: JsonObject | null = null;
+        let payload: string | Uint8Array | null = null;
+
+        if (message instanceof ArrayBuffer) {
+            /* Binary message */
+            const frame = new window.Uint8Array(message);
+            const nl = frame.indexOf(10);
+
+            channel = new TextDecoder().decode(frame.subarray(0, nl));
+            if (!channel) {
+                console.warn('Received invalid binary message without a channel');
+                return false;
+            }
+
+            payload = frame.subarray(nl + 1);
+            transport_debug("recv binary message:", control, payload);
+        } else {
+            const nl = message.indexOf('\n');
+            channel = message.substring(0, nl);
+            if (nl == 0) {
+                control = JSON.parse(message);
+                transport_debug("recv control:", control);
+            } else {
+                payload = message.substring(nl + 1);
+                transport_debug("recv text message:", channel, payload);
+            }
+        }
+
+        for (const filter of transport_globals.incoming_filters)
+            if (filter(message, channel, control) === false)
+                return false;
+
+        if (control)
+            this.#process_control(control);
+        else if (channel && payload)
+            this.#process_message(channel, payload);
+
+        return true;
+    }
+
+    close(options?: JsonObject): void {
+        if (!options)
+            options = { problem: "disconnected" };
+        options.command = "close";
+        window.clearInterval(this.#check_health_timer);
+        const ows = this.#ws;
+        this.#ws = null;
+        if (ows)
+            ows.close();
+        if (transport_globals.expect_disconnect)
+            return;
+        this.#ready_for_channels(); /* ready to fail */
+
+        /* Broadcast to everyone */
+        for (const chan in this.#control_cbs)
+            this.#control_cbs[chan].apply(null, [options]);
+    }
+
+    next_channel(): string {
+        this.#last_channel++;
+        return this.#channel_seed + String(this.#last_channel);
+    }
+
+    send_data(data: string | ArrayBuffer): boolean {
+        if (!this.#ws) {
+            return false;
+        }
+        this.#ws.send(data);
+        return true;
+    }
+
+    send_message(payload: string | ArrayBuffer | Uint8Array, channel: string): boolean {
+        if (channel)
+            transport_debug("send " + channel, payload);
+
+        else
+            transport_debug("send control:", payload);
+
+        if (typeof payload !== 'string') {
+            /* A binary message */
+            const body = payload instanceof ArrayBuffer ? new Uint8Array(payload) : payload;
+
+            // We want to create channel + '\n' + body in binary
+            const header = new TextEncoder().encode(`${channel}\n`);
+            const output = new Uint8Array(header.length + body.length);
+            output.set(header);
+            output.set(body, header.length);
+            return this.send_data(output.buffer);
+        } else {
+            /* A string message */
+            return this.send_data(channel.toString() + "\n" + payload);
+        }
+    }
+
+    send_control(data: JsonObject): boolean {
+        if (!this.#ws && (data.command == "close" || data.command == "kill"))
+            return false; /* don't complain if closed and closing */
+        if (this.#check_health_timer &&
+            data.command == "hint" && data.hint == "ignore_transport_health_check") {
+            /* This is for us, process it directly. */
+            this.#ignore_health_check = !!data.data;
+            return false;
+        }
+        return this.send_message(JSON.stringify(data), "");
+    }
+
+    register(channel: string, control_cb: ControlCallback, message_cb: MessageCallback): void {
+        this.#control_cbs[channel] = control_cb;
+        this.#message_cbs[channel] = message_cb;
+    }
+
+    unregister(channel: string): void {
+        delete this.#control_cbs[channel];
+        delete this.#message_cbs[channel];
+    }
+}
+export type { Transport };
+
+export function ensure_transport(callback: (transport: Transport) => void) {
+    if (!transport_globals.default_transport)
+        transport_globals.default_transport = new Transport();
+    const transport = transport_globals.default_transport;
+    if (transport.ready) {
+        callback(transport);
+    } else {
+        transport.on("ready", () => {
+            callback(transport);
+        });
+    }
+}
+
+/* Always close the transport explicitly: allows parent windows to track us */
+window.addEventListener("unload", () => {
+    if (transport_globals.default_transport)
+        transport_globals.default_transport.close();
+});
diff --git a/pkg/lib/cockpit/channel.ts b/pkg/lib/cockpit/channel.ts
new file mode 100644
index 0000000000..6f4cbb570b
--- /dev/null
+++ b/pkg/lib/cockpit/channel.ts
@@ -0,0 +1,287 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2024 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { JsonObject } from './_internal/common';
+import { Transport, ensure_transport, transport_globals } from './_internal/transport';
+import { EventEmitter } from './event';
+
+export type ChannelPayload = string | Uint8Array;
+
+export interface BaseChannelOptions extends JsonObject {
+    command?: never;
+    channel?: never;
+    binary?: boolean;
+    host?: string;
+    payload?: string;
+    superuser?: "try" | "require";
+}
+
+export interface BinaryChannelOptions extends BaseChannelOptions {
+    binary: true;
+}
+
+export interface TextChannelOptions extends BaseChannelOptions {
+    binary?: false;
+}
+
+export type ChannelOptions<P extends ChannelPayload> =
+    P extends Uint8Array ?
+        BinaryChannelOptions
+    : P extends string ?
+        TextChannelOptions | undefined | void
+    :
+        BaseChannelOptions
+    ;
+
+type ChannelOpenOptions<P extends ChannelPayload> = ChannelOptions<P> & {
+    payload: string;
+};
+
+export interface ChannelControlMessage extends JsonObject {
+    command: string;
+}
+
+interface ChannelEvents<P extends ChannelPayload = string> {
+    control(options: ChannelControlMessage): void;
+    done(options: ChannelControlMessage): void;
+    ready(options: ChannelControlMessage): void;
+    close(options: ChannelControlMessage): void;
+    data(data: P): void;
+}
+
+export class Channel<out P extends ChannelPayload = string> extends EventEmitter<ChannelEvents<P>> {
+    id: string | null = null; // can be unassigned during transport startup
+    readonly options: ChannelOpenOptions<P>;
+    readonly binary: boolean;
+
+    #transport: Transport | null = null;
+    #received: Partial<Record<"close" | "ready" | "done", ChannelControlMessage>> = {};
+    #queue: ([true, ChannelControlMessage] | [false, P])[] = [];
+    #sent_done: boolean = false;
+
+    #on_control(control: ChannelControlMessage): void {
+        const command = control.command;
+
+        if (command === 'ready' || command === 'close' || command === 'done') {
+            if (this.#received[command]) {
+                console.error('received duplicate control message', this.id, this.options, control);
+                return;
+            }
+
+            this.#received[command] = control;
+            this.emit(command, control);
+        } else {
+            this.emit('control', control);
+        }
+
+        if (command === 'close') {
+            if (this.#transport && this.id)
+                this.#transport.unregister(this.id);
+            if (control.message && !this.options?.err)
+                console.warn('channel error', control.message, this.id, this.options);
+        }
+    }
+
+    /**
+     * Open a new channel to the bridge.
+     *
+     * @options: The options for the channel.  A payload type must be specified.
+     */
+    constructor(options: ChannelOpenOptions<P>) {
+        super();
+
+        this.options = { ...options };
+        this.binary = (options?.binary === true);
+
+        ensure_transport(transport => {
+            if (this.#received.close)
+                return;
+
+            this.#transport = transport;
+            this.id = transport.next_channel();
+            transport.register(
+                this.id,
+                control => {
+                    if (typeof control.command !== 'string') {
+                        console.error('Received control message without command', this.id, this.options, control);
+                    } else {
+                        this.#on_control(control as ChannelControlMessage);
+                    }
+                },
+                data => {
+                    if (this.binary && typeof data === 'string') {
+                        console.error('Text message received on binary channel', this.id, this.options, data);
+                    } else if (!this.binary && typeof data !== 'string') {
+                        console.error('Binary message received on text channel', this.id, this.options, data);
+                    } else {
+                        this.emit('data', data as P);
+                    }
+                }
+            );
+
+            // We need to delay sending the open message until after we have
+            // the transport because we need to set the host field.
+
+            // Make a copy so we can modify some fields.
+            const command: JsonObject = { ...this.options };
+
+            if (!command.host && transport_globals.default_host) {
+                command.host = transport_globals.default_host;
+            }
+
+            if (this.binary) {
+                command.binary = "raw";
+            } else {
+                delete command.binary;
+            }
+
+            // Go direct: we need this to go before the rest of the queue
+            transport.send_control({ ...command, command: 'open', channel: this.id, 'flow-control': true });
+
+            // Now send everything else from the queue
+            for (const [is_control, message] of this.#queue) {
+                if (is_control) {
+                    transport.send_control({ ...message, channel: this.id });
+                } else {
+                    transport.send_message(message, this.id);
+                }
+            }
+            this.#queue = [];
+        });
+    }
+
+    /**
+     * Sends a payload frame.
+     *
+     * You may not call this after you've sent a 'done' control message or
+     * after the channel has been closed.  This implies that you need to
+     * register a 'close' event handler, and stop sending data after it's
+     * called.
+     *
+     * @message the payload to send, either a string or a Uint8Array.
+     */
+    send_data(message: P): void {
+        if (this.#sent_done) {
+            console.error('sending data after .done()', this.id, this.options, message);
+        } else if (this.#received.close) {
+            console.error('sending data after close', this.id, this.options, message);
+        } else if (this.#transport && this.id) {
+            this.#transport.send_message(message, this.id);
+        } else {
+            this.#queue.push([false, message]);
+        }
+    }
+
+    /**
+     * Sends a control message on the channel.
+     *
+     * You may not call this after the channel is closed.  This implies that
+     * you need to register a 'close' event handler, and stop sending data
+     * after it's called.
+     *
+     * @options: the message to send.  A command must be specified.
+     */
+    send_control(options: ChannelControlMessage): void {
+        if (this.#received.close) {
+            console.error('sending control after close', this.id, this.options, options);
+            return;
+        }
+
+        // A sent close message gets handled as if the exact same close message
+        // was received.  This allows signalling your own code for cancellation, etc.
+        if (options.command === 'close') {
+            this.#on_control(options);
+        } else if (options.command === 'done') {
+            this.#sent_done = true;
+        }
+
+        if (this.#transport && this.id) {
+            this.#transport.send_control({ ...options, channel: this.id });
+        } else {
+            this.#queue.push([true, options]);
+        }
+    }
+
+    /**
+     * Sends a done control message on the channel.  This is something like
+     * EOF: it means that you won't send any more data using `.send_data()`.
+     *
+     * @options: optional extra arguments for the message.
+     */
+    done(options?: JsonObject): void {
+        this.send_control({ ...options, command: 'done' });
+    }
+
+    /**
+     * Closes the channel.
+     *
+     * This means that you're completely finished with the channel.  Any
+     * underlying resources will be freed as soon as possible.  When you call
+     * this you'll receive a 'close' signal (synchronously) and then nothing
+     * else.
+     *
+     * @problem: a problem code.  If this is unset it implies something like a
+     * "successful" close.  Otherwise, it indicates an error.
+     * @options: the bridge will ignore this, but it will be thrown as the
+     * result of any pending wait() operations and passed to the 'close' signal
+     * handler, so you can use it to communicate with your own code.
+     */
+    close(problem?: string, options?: JsonObject): void {
+        if (!this.#received.close) {
+            this.send_control({ ...options, ...problem && { problem }, command: 'close' });
+        }
+    }
+
+    /**
+     * Waits for the result of the channel open request.
+     *
+     * @return: the content of the ready message, on success
+     * @throws: the content of the close message, on fail
+     */
+    wait(): Promise<JsonObject> {
+        return new Promise((resolve, reject) => {
+            // If we got ready and closed then it's not an error.
+            // Resolve with the ready message.
+            if (this.#received.ready) {
+                resolve(this.#received.ready);
+            } else if (this.#received.close) {
+                reject(this.#received.close);
+            } else {
+                this.on('ready', resolve);
+                this.on('close', reject);
+            }
+        });
+    }
+
+    /**
+     * Provides a text description of the channel.
+     */
+    toString(): string {
+        const state =
+            (!this.id && 'waiting for transport') ||
+            (this.#received.close?.problem && `${this.id} error ${this.#received.close.problem}`) ||
+            (this.#received.close && `${this.id} closed`) ||
+            (this.#received.ready && `${this.id} opened`) ||
+            `${this.id} waiting for open`;
+
+        const host = this.options?.host || "localhost";
+
+        return `[Channel ${state} -> ${this.options?.payload}@${host}]`;
+    }
+}
diff --git a/pkg/lib/cockpit/event.ts b/pkg/lib/cockpit/event.ts
new file mode 100644
index 0000000000..fe35aad529
--- /dev/null
+++ b/pkg/lib/cockpit/event.ts
@@ -0,0 +1,36 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2024 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export class EventEmitter<EM extends { [E in keyof EM]: (...args: never[]) => void }> {
+    #listeners: { [E in keyof EM]?: EM[E][] } = {};
+
+    public on<E extends keyof EM>(event: E, listener: EM[E]) {
+        const listeners = this.#listeners[event] ||= [];
+        listeners.push(listener);
+        return () => {
+            listeners.splice(listeners.indexOf(listener), 1);
+        };
+    }
+
+    protected emit<E extends keyof EM>(event: E, ...args: Parameters<EM[E]>) {
+        for (const listener of this.#listeners[event] || []) {
+            listener(...args);
+        }
+    }
+}
diff --git a/pkg/lib/cockpit/fsinfo.ts b/pkg/lib/cockpit/fsinfo.ts
new file mode 100644
index 0000000000..b28cc8feb9
--- /dev/null
+++ b/pkg/lib/cockpit/fsinfo.ts
@@ -0,0 +1,153 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2024 Red Hat, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+'use strict';
+
+import type { JsonObject, JsonValue } from './_internal/common';
+import { Channel } from './channel';
+import { EventEmitter } from './event';
+
+function is_json_dict(value: JsonValue): value is JsonObject {
+    return value?.constructor === Object;
+}
+
+/* RFC 7396 — JSON Merge Patch — functional */
+function json_merge(current: JsonValue, patch: JsonValue): JsonValue {
+    if (is_json_dict(patch)) {
+        const updated = is_json_dict(current) ? { ...current } : { };
+
+        for (const [key, value] of Object.entries(patch)) {
+            if (value === null) {
+                delete updated[key];
+            } else {
+                updated[key] = json_merge(updated[key], value);
+            }
+        }
+
+        return updated;
+    } else {
+        return patch;
+    }
+}
+
+export interface FileInfo {
+    type?: string;
+    tag?: string;
+    mode?: number;
+    size?: number;
+    uid?: number;
+    user?: string | number;
+    gid?: number;
+    group?: string | number;
+    mtime?: number;
+    target?: string;
+    ['r-ok']?: boolean,
+    ['w-ok']?: boolean,
+    ['x-ok']?: boolean,
+    entries?: Record<string, FileInfo>;
+    targets?: Record<string, FileInfo>;
+}
+
+export interface FsInfoError {
+    problem: string;
+    message: string;
+    errno: string;
+}
+
+export interface FsInfoState {
+    info?: FileInfo;
+    error?: FsInfoError;
+    loading?: true;
+}
+
+export interface FsInfoEvents {
+    change(state: FsInfoState): void;
+    close(message: JsonObject): void;
+}
+
+export class FsInfoClient extends EventEmitter<FsInfoEvents> {
+    state: FsInfoState = { loading: true };
+
+    private partial_state: JsonValue = null;
+    private channel: Channel<string>;
+
+    constructor(path: string, attrs: (keyof FileInfo)[], options?: JsonObject) {
+        super();
+
+        this.channel = new Channel({
+            payload: "fsinfo",
+            path,
+            attrs,
+            watch: true,
+            ...options
+        });
+
+        this.channel.on('data', payload => {
+            this.partial_state = json_merge(this.partial_state, JSON.parse(payload));
+
+            if (is_json_dict(this.partial_state) && !this.partial_state.partial) {
+                this.state = { ...this.partial_state };
+                this.emit('change', this.state);
+            }
+        });
+
+        this.channel.on('close', message => {
+            this.emit('close', message);
+        });
+    }
+
+    close() {
+        this.channel.close();
+    }
+
+    static entry(info: FileInfo, name: string): FileInfo | null {
+        return info.entries?.[name] ?? null;
+    }
+
+    static target(info: FileInfo, name: string): FileInfo | null {
+        const entries = info.entries ?? {};
+        const targets = info.targets ?? {};
+
+        let entry = entries[name] ?? null;
+        for (let i = 0; i < 40; i++) {
+            const target = entry?.target;
+            if (!target)
+                return entry;
+            if (target === '.')
+                return info;
+            entry = entries[target] ?? targets[target] ?? null;
+        }
+        return null; // ELOOP
+    }
+}
+
+export function fsinfo(path: string, attrs: (keyof FileInfo)[], options?: JsonObject): Promise<FileInfo> {
+    return new Promise((resolve, reject) => {
+        const client = new FsInfoClient(path, attrs, { ...options, watch: false });
+        client.on('close', (message) => {
+            if (message.problem) {
+                reject(message);
+            } else if (client.state.info) {
+                resolve(client.state.info);
+            } else {
+                reject(client.state.error);
+            }
+        });
+    });
+}
diff --git a/pkg/lib/os-release.ts b/pkg/lib/os-release.ts
new file mode 100644
index 0000000000..b8154c0a5c
--- /dev/null
+++ b/pkg/lib/os-release.ts
@@ -0,0 +1,38 @@
+/*
+ * This file is part of Cockpit.
+ *
+ * Copyright (C) 2022 Red Hat, Inc.
+ *
+ * Cockpit is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or
+ * (at your option) any later version.
+ *
+ * Cockpit is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import cockpit from "cockpit";
+
+function parse_simple_vars(text: string): Record<string, string> {
+    const res: Record<string, string> = { };
+    for (const l of text.split('\n')) {
+        const pos = l.indexOf('=');
+        if (pos > 0) {
+            const name = l.substring(0, pos);
+            let val = l.substring(pos + 1);
+            if (val[0] == '"' && val[val.length - 1] == '"')
+                val = val.substring(1, val.length - 1);
+            res[name] = val;
+        }
+    }
+    return res;
+}
+
+/* Return /etc/os-release as object */
+export const read_os_release = () => cockpit.file("/etc/os-release", { syntax: { parse: parse_simple_vars } }).read();
diff --git a/src/Utilities/useIsCockpitAdmin.tsx b/src/Utilities/useIsCockpitAdmin.tsx
index 7aa843e1b2..c2ba242193 100644
--- a/src/Utilities/useIsCockpitAdmin.tsx
+++ b/src/Utilities/useIsCockpitAdmin.tsx
@@ -6,6 +6,7 @@ export const useIsCockpitAdmin = () => {
   const [isAdmin, setIsAdmin] = useState(false);
 
   useEffect(() => {
+    // @ts-expect-error cockpit hasn't created a type for this upstream
     const permission = cockpit.permission({ admin: true });
 
     const onChangeListener = () => {
diff --git a/src/store/cockpit/baseQuery.ts b/src/store/cockpit/baseQuery.ts
index bac653e6db..2d063cc431 100644
--- a/src/store/cockpit/baseQuery.ts
+++ b/src/store/cockpit/baseQuery.ts
@@ -31,15 +31,23 @@ export const baseQuery =
       const cloudApi = cockpit.http('/run/cloudapi/api.socket', {
         superuser: 'try',
       });
+
+      let body: string;
+      try {
+        body = JSON.stringify(options.body);
+      } catch {
+        body = '';
+      }
+
       return cloudApi
         .request({
           path: baseUrl + options.url,
-          body: options.body ?? '',
+          body: body ?? '',
           method: options.method ?? 'GET',
-          params: options.params,
-          headers: options.headers,
+          params: options.params ?? {},
+          headers: options.headers ?? {},
         })
-        .then((result) => {
+        .then((result: string) => {
           resolve({ data: JSON.parse(result) });
         })
         .catch(
diff --git a/src/store/cockpit/cockpitApi.ts b/src/store/cockpit/cockpitApi.ts
index aafdcf1489..2d7d3b330b 100644
--- a/src/store/cockpit/cockpitApi.ts
+++ b/src/store/cockpit/cockpitApi.ts
@@ -11,7 +11,6 @@ import cockpit from 'cockpit';
 import { fsinfo } from 'cockpit/fsinfo';
 import { v4 as uuidv4 } from 'uuid';
 
-import { Blueprint } from './composerCloudApi';
 // We have to work around RTK query here, since it doesn't like splitting
 // out the same api into two separate apis. So, instead, we can just
 // inherit/import the `contentSourcesApi` and build on top of that.
@@ -19,10 +18,17 @@ import { Blueprint } from './composerCloudApi';
 // the same unix socket. This allows us to split out the code a little
 // bit so that the `cockpitApi` doesn't become a monolith.
 import { contentSourcesApi } from './contentSourcesApi';
+import {
+  getBlueprintsPath,
+  getCloudConfigs,
+  lookupDatastreamDistro,
+  mapToOnpremRequest,
+  paginate,
+  readComposes,
+} from './helpers';
 import type {
   CockpitCreateBlueprintApiArg,
   CockpitCreateBlueprintRequest,
-  CockpitImageRequest,
   CockpitUpdateBlueprintApiArg,
   UpdateWorkerConfigApiArg,
   WorkerConfigFile,
@@ -33,7 +39,6 @@ import {
   mapHostedToOnPrem,
   mapOnPremToHosted,
 } from '../../Components/Blueprints/helpers/onPremToHostedBlueprintMapper';
-import { BLUEPRINTS_DIR } from '../../constants';
 import {
   BlueprintItem,
   ComposeBlueprintApiArg,
@@ -64,104 +69,6 @@ import {
   UpdateBlueprintApiResponse,
 } from '../service/imageBuilderApi';
 
-const lookupDatastreamDistro = (distribution: string) => {
-  if (distribution.startsWith('fedora')) {
-    return 'fedora';
-  }
-
-  if (distribution === 'centos-9') {
-    return 'cs9';
-  }
-
-  if (distribution === 'centos-10') {
-    return 'cs10';
-  }
-
-  if (distribution === 'rhel-9') {
-    return 'rhel9';
-  }
-
-  if (distribution === 'rhel-10') {
-    return 'rhel10';
-  }
-
-  throw 'Unknown distribution';
-};
-
-const getBlueprintsPath = async () => {
-  const user = await cockpit.user();
-
-  // we will use the user's `.local` directory
-  // to save blueprints used for on-prem
-  return `${user.home}/${BLUEPRINTS_DIR}`;
-};
-
-const readComposes = async (bpID: string) => {
-  const blueprintsDir = await getBlueprintsPath();
-  let composes: ComposesResponseItem[] = [];
-  const bpInfo = await fsinfo(
-    path.join(blueprintsDir, bpID),
-    ['entries', 'mtime'],
-    {
-      superuser: 'try',
-    },
-  );
-  const bpEntries = Object.entries(bpInfo?.entries || {});
-  for (const entry of bpEntries) {
-    if (entry[0] === `${bpID}.json`) {
-      continue;
-    }
-    const composeReq = await cockpit
-      .file(path.join(blueprintsDir, bpID, entry[0]))
-      .read();
-    composes = [
-      ...composes,
-      {
-        id: entry[0],
-        request: JSON.parse(composeReq),
-        created_at: new Date(entry[1]!.mtime * 1000).toString(),
-        blueprint_id: bpID,
-      },
-    ];
-  }
-  return composes;
-};
-
-const getCloudConfigs = async () => {
-  try {
-    const worker_config = cockpit.file(
-      '/etc/osbuild-worker/osbuild-worker.toml',
-    );
-    const contents = await worker_config.read();
-    const parsed = TOML.parse(contents);
-    return Object.keys(parsed).filter((k) => k === 'aws');
-  } catch {
-    return [];
-  }
-};
-
-const mapToOnpremRequest = (
-  blueprint: Blueprint,
-  distribution: string,
-  image_requests: CockpitImageRequest[],
-) => {
-  return {
-    blueprint,
-    distribution,
-    image_requests: image_requests.map((ir) => ({
-      architecture: ir.architecture,
-      image_type: ir.image_type,
-      repositories: [],
-      upload_targets: [
-        {
-          type: ir.upload_request.type,
-          upload_options: ir.upload_request.options,
-        },
-      ],
-    })),
-  };
-};
-
 export const cockpitApi = contentSourcesApi.injectEndpoints({
   endpoints: (builder) => {
     return {
@@ -220,7 +127,7 @@ export const cockpitApi = contentSourcesApi.injectEndpoints({
                 ...parsed,
                 id,
                 version: version,
-                last_modified_at: new Date(bpInfo!.mtime * 1000).toString(),
+                last_modified_at: new Date(bpInfo!.mtime! * 1000).toString(),
                 // linting is not supported on prem
                 lint: {
                   errors: [],
@@ -278,31 +185,7 @@ export const cockpitApi = contentSourcesApi.injectEndpoints({
               return true;
             });
 
-            let paginatedBlueprints = blueprints;
-            if (offset !== undefined && limit !== undefined) {
-              paginatedBlueprints = blueprints.slice(offset, offset + limit);
-            }
-
-            let first = '';
-            let last = '';
-
-            if (blueprints.length > 0) {
-              first = blueprints[0].id;
-              last = blueprints[blueprints.length - 1].id;
-            }
-
-            return {
-              data: {
-                meta: { count: blueprints.length },
-                links: {
-                  // These are kind of meaningless for the on-prem
-                  // version
-                  first: first,
-                  last: last,
-                },
-                data: paginatedBlueprints,
-              },
-            };
+            return paginate(blueprints, offset, limit);
           } catch (error) {
             return { error };
           }
@@ -546,19 +429,8 @@ export const cockpitApi = contentSourcesApi.injectEndpoints({
             for (const entry of entries) {
               composes = composes.concat(await readComposes(entry[0]));
             }
-            return {
-              data: {
-                meta: {
-                  count: composes.length,
-                },
-                links: {
-                  first: composes.length > 0 ? composes[0].id : '',
-                  last:
-                    composes.length > 0 ? composes[composes.length - 1].id : '',
-                },
-                data: composes,
-              },
-            };
+
+            return paginate(composes);
           } catch (error) {
             return { error };
           }
@@ -571,19 +443,7 @@ export const cockpitApi = contentSourcesApi.injectEndpoints({
         queryFn: async (queryArgs) => {
           try {
             const composes = await readComposes(queryArgs.id);
-            return {
-              data: {
-                meta: {
-                  count: composes.length,
-                },
-                links: {
-                  first: composes.length > 0 ? composes[0].id : '',
-                  last:
-                    composes.length > 0 ? composes[composes.length - 1].id : '',
-                },
-                data: composes,
-              },
-            };
+            return paginate(composes);
           } catch (error) {
             return { error };
           }
@@ -657,37 +517,36 @@ export const cockpitApi = contentSourcesApi.injectEndpoints({
           try {
             const workerConfig = cockpit.file(
               '/etc/osbuild-worker/osbuild-worker.toml',
-              {
-                superuser: 'required',
-              },
             );
 
-            const contents = await workerConfig.modify((prev: string) => {
-              if (!updateWorkerConfigRequest) {
-                return prev;
-              }
-
-              const merged = {
-                ...TOML.parse(prev),
-                ...updateWorkerConfigRequest,
-              } as WorkerConfigFile;
-
-              const contents: WorkerConfigFile = {};
-              Object.keys(merged).forEach((key: string) => {
-                // this check helps prevent saving empty objects
-                // into the osbuild-worker.toml config file.
-                if (merged[key] !== undefined) {
-                  contents[key] = Section({
-                    ...merged[key],
-                  });
+            const contents = await workerConfig.modify(
+              (prev: string | null) => {
+                if (!updateWorkerConfigRequest) {
+                  return prev;
                 }
-              });
 
-              return TOML.stringify(contents, {
-                newline: '\n',
-                newlineAround: 'document',
-              });
-            });
+                const merged = {
+                  ...TOML.parse(prev ?? ''),
+                  ...updateWorkerConfigRequest,
+                } as WorkerConfigFile;
+
+                const contents: WorkerConfigFile = {};
+                Object.keys(merged).forEach((key: string) => {
+                  // this check helps prevent saving empty objects
+                  // into the osbuild-worker.toml config file.
+                  if (merged[key] !== undefined) {
+                    contents[key] = Section({
+                      ...merged[key],
+                    });
+                  }
+                });
+
+                return TOML.stringify(contents, {
+                  newline: '\n',
+                  newlineAround: 'document',
+                });
+              },
+            );
 
             const systemServices = [
               'osbuild-composer.socket',
diff --git a/src/store/cockpit/helpers.ts b/src/store/cockpit/helpers.ts
new file mode 100644
index 0000000000..304075fe36
--- /dev/null
+++ b/src/store/cockpit/helpers.ts
@@ -0,0 +1,129 @@
+import path from 'path';
+
+import TOML from '@ltd/j-toml';
+import cockpit from 'cockpit';
+import { fsinfo } from 'cockpit/fsinfo';
+
+import { Blueprint } from './composerCloudApi';
+import { CockpitImageRequest } from './types';
+
+import { BLUEPRINTS_DIR } from '../../constants';
+import { ComposesResponseItem } from '../imageBuilderApi';
+
+export const lookupDatastreamDistro = (distribution: string) => {
+  if (distribution.startsWith('fedora')) {
+    return 'fedora';
+  }
+
+  if (distribution === 'centos-9') {
+    return 'cs9';
+  }
+
+  if (distribution === 'centos-10') {
+    return 'cs10';
+  }
+
+  if (distribution === 'rhel-9') {
+    return 'rhel9';
+  }
+
+  if (distribution === 'rhel-10') {
+    return 'rhel10';
+  }
+
+  throw 'Unknown distribution';
+};
+
+export const getBlueprintsPath = async () => {
+  const user = await cockpit.user();
+
+  // we will use the user's `.local` directory
+  // to save blueprints used for on-prem
+  return `${user.home}/${BLUEPRINTS_DIR}`;
+};
+
+export const readComposes = async (bpID: string) => {
+  const blueprintsDir = await getBlueprintsPath();
+  let composes: ComposesResponseItem[] = [];
+  const bpInfo = await fsinfo(
+    path.join(blueprintsDir, bpID),
+    ['entries', 'mtime'],
+    {
+      superuser: 'try',
+    },
+  );
+  const bpEntries = Object.entries(bpInfo?.entries || {});
+  for (const entry of bpEntries) {
+    if (entry[0] === `${bpID}.json`) {
+      continue;
+    }
+    const composeReq = await cockpit
+      .file(path.join(blueprintsDir, bpID, entry[0]))
+      .read();
+    composes = [
+      ...composes,
+      {
+        id: entry[0],
+        request: JSON.parse(composeReq),
+        created_at: new Date(entry[1]!.mtime! * 1000).toString(),
+        blueprint_id: bpID,
+      },
+    ];
+  }
+  return composes;
+};
+
+export const getCloudConfigs = async () => {
+  try {
+    const worker_config = cockpit.file(
+      '/etc/osbuild-worker/osbuild-worker.toml',
+    );
+    const contents = await worker_config.read();
+    const parsed = TOML.parse(contents);
+    return Object.keys(parsed).filter((k) => k === 'aws');
+  } catch {
+    return [];
+  }
+};
+
+export const mapToOnpremRequest = (
+  blueprint: Blueprint,
+  distribution: string,
+  image_requests: CockpitImageRequest[],
+) => {
+  return {
+    blueprint,
+    distribution,
+    image_requests: image_requests.map((ir) => ({
+      architecture: ir.architecture,
+      image_type: ir.image_type,
+      repositories: [],
+      upload_targets: [
+        {
+          type: ir.upload_request.type,
+          upload_options: ir.upload_request.options,
+        },
+      ],
+    })),
+  };
+};
+
+export const paginate = <T extends { id: string }>(
+  items: T[],
+  offset?: number | undefined,
+  limit?: number | undefined,
+) => {
+  const first = items.length > 0 ? items[0].id : '';
+  const last = items.length > 0 ? items[items.length - 1].id : '';
+
+  return {
+    data: {
+      meta: { count: items.length },
+      links: {
+        first: first,
+        last: last,
+      },
+      data: items.slice(offset ?? 0, limit ?? 100),
+    },
+  };
+};
diff --git a/src/test/mocks/cockpit/cockpitFile.ts b/src/test/mocks/cockpit/cockpitFile.ts
index 612d9f7edc..0cfc3ce778 100644
--- a/src/test/mocks/cockpit/cockpitFile.ts
+++ b/src/test/mocks/cockpit/cockpitFile.ts
@@ -44,7 +44,7 @@ export const cockpitFile = (filepath: string, _options?: object) => {
       return readCompose(file.name);
     },
     close: () => {},
-    replace: (contents: string) => {
+    replace: async (contents: string) => {
       const file = path.parse(filepath);
       const dir = path.parse(file.dir);
       if (file.name === dir.name) {
diff --git a/tsconfig.json b/tsconfig.json
index d91d030a15..f29231eafe 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -24,7 +24,7 @@
         // Needed so we can resolve `cockpit` & `cockpit/fsinfo`
         // types. We have stubbed those functions out for the
         // as this is the tsconfig file for the service.
-        "./src/test/mocks/*"
+        "./pkg/lib/*"
       ]
     }
   },