@deepseek-ai/dsh-client-connection 0.0.1-rc.1

package/lib/types/client/api.d.ts

@@ -0,0 +1,20 @@
+export type { ApiProxy, SessionsApi, SessionSearchItem, SessionSummary, PromptContentPart, HostApi, EventsApi, MuxFrame, HostFrame, ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView, DirectoryEntry, DirectoryListing, ResponseValue, WorkspaceApi, WorkspaceId, WorkspaceView, CommandsApi, CommandDescriptor, SkillsApi, SkillEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning, ModelReasoningEffort, ModelSelection, QueueAction, QueuedInboxItem, SessionModels, GoalsApi, GoalRef, SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView, CredentialsApi, CredentialView, ConfigurableProviderView, DiscoveredModelView, LlmApi, SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt, } from '@deepseek-ai/dsh-host-apiproxy/api';
+export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation';
+export type { RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode, ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt, } from '@deepseek-ai/dsh-host-apiproxy/api';
+export { RpcId, SESSION_SEARCH_RESULT_LIMIT, transportError, } from '@deepseek-ai/dsh-host-apiproxy/api';
+export { AbstractApiClient } from '@deepseek-ai/dsh-host-apiproxy/client';
+export type { IApiClient } from '@deepseek-ai/dsh-host-apiproxy/client';
+export type { SessionId, SessionEvent } from '@deepseek-ai/dsh-session/types';
+export type { MessageId } from '@deepseek-ai/dsh-llm/brand';
+export type { ContentBlock, StreamChunk } from '@deepseek-ai/dsh-llm/types';
+/** Successful value returned by the connection-generation host handshake. */
+export type HostDescription = import('@deepseek-ai/dsh-host-apiproxy/api').ResponseValue<'host.describe'>;
+import type { RpcResponse, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api';
+/**
+ * Unwrap a unary response: RpcResponse<T> -> RpcResult<T> (business code only
+ * cares about the result slot).
+ * @param response - the unary response.
+ * @returns its result slot.
+ */
+export declare function resultOf<T>(response: RpcResponse<T>): RpcResult<T>;
+//# sourceMappingURL=api.d.ts.map

package/lib/types/client/connection.d.ts

@@ -0,0 +1,62 @@
+import type { IApiClient, HostFrame, MuxFrame, RpcRequest } from './api.ts';
+/** Reconnect/backoff tunables (deployment-varying — no hardcoded tunables; these become the
+ *  future `ctx.connection` plugin's Config). All fields optional; defaults below. */
+export interface ConnectionConfig {
+    /** First-retry backoff cap in ms (jittered: actual delay is cap/2..cap). */
+    backoffBaseMs?: number;
+    /** Exponential growth factor per consecutive failed attempt. */
+    backoffFactor?: number;
+    /** Upper bound for the backoff cap in ms. */
+    backoffMaxMs?: number;
+    /** Cap on waiting for both streams' onOpen before onConnected, in ms. The strict handshake
+     *  waits for mux+host stream establishment plus describe; a carrier that never
+     *  fires onOpen (misbehaving proxy) must not wedge the connection forever — on timeout the
+     *  generation proceeds as connected and the live-gap repair path covers stragglers. */
+    streamOpenTimeoutMs?: number;
+}
+/** Coarse connection state for the UI: 'connected' after each generation's handshake,
+ *  'reconnecting' the moment the generation fails (covers the whole backoff+retry span). */
+export type ConnectionState = 'connected' | 'reconnecting';
+/** Frame sink callbacks: the Controller owns the physical streams; business dispatch belongs to
+ *  SessionManager. */
+export interface ConnectionSinks {
+    onMuxEnvelope?: (envelope: RpcRequest<MuxFrame>) => void;
+    onHostEnvelope?: (envelope: RpcRequest<HostFrame>) => void;
+    /** After each connection generation is established (both streams open + describe succeeded), first connect included. */
+    onConnected?: () => void;
+    /** Coarse state transitions (deduplicated: fires only on change). The initial pre-connect
+     *  span reports nothing — the UI treats "no state yet" as connecting, not as an outage. */
+    onStateChange?: (state: ConnectionState) => void;
+}
+/**
+ * Opens both streams and keeps iterating (pull mode: nothing reads the socket and the tap
+ * never fires unless someone for-awaits), reconnecting with exponential backoff on loss.
+ * State (generation/attempt) is instance-private, never in the store.
+ * The pump body feeds each frame to a sink (sink exceptions must
+ * not kill the pump — a broken business layer must not drag down the connection layer).
+ */
+export declare class ConnectionController {
+    private readonly api;
+    private readonly sinks;
+    private generation;
+    private attempt;
+    private current;
+    private running;
+    private lastState;
+    private readonly config;
+    constructor(api: IApiClient, sinks?: ConnectionSinks, config?: ConnectionConfig);
+    /** Idempotent: begin the connect/pump/reconnect loop. */
+    start(): void;
+    /** Stop the loop and abort the current generation's streams. */
+    stop(): void;
+    private backoffDelay;
+    /** Read through a method: stop() flips the flag across awaits, so narrowing from the loop condition must not stick. */
+    private isRunning;
+    private loop;
+    /** Deduplicated state emission (sink isolation applies). */
+    private emitState;
+    private pumpStream;
+    /** Sink exception isolation: a business-layer throw is logged only, never affecting pump or reconnect semantics. */
+    private callSink;
+}
+//# sourceMappingURL=connection.d.ts.map

package/lib/types/client/fixture.d.ts

@@ -0,0 +1,54 @@
+import type { SessionId } from '@deepseek-ai/dsh-session/types';
+import type { ApiProxy, ClientResponse, HostFrame, MuxFrame, RpcReceipt, RpcRequest, RpcResponse } from './api.ts';
+import type { RequestPayload, ResponseValue, RpcMethodMap } from '@deepseek-ai/dsh-host-apiproxy/api';
+import { AbstractApiClient } from './api.ts';
+import type { ClientConnectionRpc } from '../rpc.ts';
+/** Deterministic fixture branches used by keyless Web assembly tests. */
+export interface FixtureOptions {
+    /** Start with no real Workspace or Session. */
+    empty?: boolean;
+    /** Reject every prompt before appending its user event. */
+    rejectPrompt?: boolean;
+    /** Publish the Session but fail its Workspace account write. */
+    failWorkspaceAttach?: boolean;
+    /** Publish and frame the Session, then throw instead of returning create. */
+    dropSessionCreateResponse?: boolean;
+    /** Order of the two successful create frames. */
+    createFrameOrder?: 'session-first' | 'workspace-first';
+}
+/**
+ * In-memory fake host: fx-alpha carries history and replay scripts; fx-beta is fx-alpha's child session (lineage indent material).
+ * @param options - fixture branches for empty state and failure timing.
+ * @returns an ApiProxy backed entirely by in-memory state — no host process, no network.
+ */
+export declare function createFixtureApi(options?: FixtureOptions): ApiProxy;
+/**
+ * Fixture platform subclass: there is no HTTP at all, so instead of a doFetch transport it
+ * overrides the protocol-level virtuals (callUnary/openMux/openHost/respond) to dispatch
+ * straight into the in-memory ApiProxy — while still minting rpcIds, fabricating the four
+ * named full forms, and feeding the same tap as a real carrier. TODO: delete when the fixture
+ * moves to the isomorphic pipeline (InProcessApiClient over toFetchHandler(fixtureImpl)).
+ */
+export declare class FixtureApiClient extends AbstractApiClient {
+    private readonly api;
+    /** Generic Remote caller backed by the same in-memory state as the legacy fixture API. */
+    readonly rpc: ClientConnectionRpc;
+    constructor();
+    protected doFetch(): Promise<Response>;
+    protected callUnary<K extends keyof RpcMethodMap>(method: K, payload: RequestPayload<K>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<K>>>;
+    /** Method-key dispatch into the in-memory contract impl (a real carrier routes by URL path instead). */
+    private dispatch;
+    protected openMux(payload: {
+        since?: Record<SessionId, number>;
+    }, signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<MuxFrame>>;
+    protected openHost(payload: Record<never, never>, signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<HostFrame>>;
+    private tapStream;
+    /**
+     * Deliver a client response to the in-memory contract impl (no HTTP POST),
+     * echoing the envelope to the observation tap like every other path.
+     * @param message - the client-response envelope answering a server request.
+     * @returns the carrier receipt from the fixture impl.
+     */
+    respond(message: ClientResponse): Promise<RpcReceipt>;
+}
+//# sourceMappingURL=fixture.d.ts.map

package/lib/types/client/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Browser wire client. The plugin selects fixture or HTTP transport, provides
+ * the shared API client, and lets the runtime object layer start the stream
+ * controller with its sinks.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { IApiClient } from './api.ts';
+import { type ConnectionConfig, type ConnectionSinks, type ConnectionState } from './connection.ts';
+import type { ClientConnectionRpc } from '../rpc.ts';
+export type { ApiProxy, SessionsApi, SessionSearchItem, SessionSummary, PromptContentPart, HostApi, EventsApi, MuxFrame, HostFrame, ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView, DirectoryEntry, DirectoryListing, ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView, CommandsApi, CommandDescriptor, SkillsApi, SkillEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning, MessageId, ModelReasoningEffort, ModelSelection, QueueAction, QueuedInboxItem, SessionModels, SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt, RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode, ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt, HostDescription, IApiClient, SessionId, SessionEvent, ContentBlock, StreamChunk, GoalsApi, GoalRef, SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView, CredentialsApi, CredentialView, ConfigurableProviderView, DiscoveredModelView, LlmApi, } from './api.ts';
+export { RpcId, AbstractApiClient, transportError, } from './api.ts';
+export type { ConnectionConfig, ConnectionSinks, ConnectionState };
+export type { ClientConnectionRpc } from '../rpc.ts';
+/** Required services (none — this is the wire root). */
+export declare const inject: string[];
+/**
+ * The ctx.connection service surface: the api client plus a one-shot
+ * controller starter (the runtime plugin supplies sinks when its object layer
+ * is ready — connection stays consumer-agnostic).
+ */
+export interface ConnectionHandle {
+    /** Shared api client (fixture or real, decided at boot from the page URL). */
+    readonly api: IApiClient;
+    /** Whether the current page authority is loopback; non-browser contexts default to true. */
+    readonly isLoopback: boolean;
+    /** Generic logical RPC channels over the same Connection transport. */
+    readonly rpc: ClientConnectionRpc;
+    /**
+     * Start the connect/pump/reconnect loop with the consumer's frame sinks.
+     * One consumer owns the streams (the runtime object layer); a second call
+     * throws.
+     * @param sinks - frame/state callbacks.
+     * @param config - reconnect/backoff tunables.
+     * @returns stop handle for the loop.
+     */
+    start(sinks: ConnectionSinks, config?: ConnectionConfig): {
+        stop(): void;
+    };
+}
+/**
+ * Client plugin body: pick the api by page mode and provide ctx.connection.
+ * @param ctx - client cordis context.
+ */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/random-uuid.d.ts

@@ -0,0 +1,7 @@
+/** Browser-safe UUID generation for client-side wire correlation. */
+/**
+ * Generate an RFC 4122 version 4 UUID without requiring a secure context.
+ * @returns a UUID backed by `crypto.getRandomValues()`, which browsers expose on insecure origins.
+ */
+export declare function randomUuid(): string;
+//# sourceMappingURL=random-uuid.d.ts.map

package/lib/types/client/rpc.d.ts

@@ -0,0 +1,8 @@
+/** Browser caller for generic Connection unary RPC channels. */
+import type { ClientConnectionRpc } from '../rpc.ts';
+/**
+ * Create the browser-backed generic RPC caller.
+ * @returns caller that owns request correlation and response-envelope validation.
+ */
+export declare function createWebConnectionRpc(): ClientConnectionRpc;
+//# sourceMappingURL=rpc.d.ts.map

package/lib/types/client/web-api-client.d.ts

@@ -0,0 +1,11 @@
+/** Browser API carrier: HTTP upstream plus one WebSocket per downstream event stream. */
+import type { ApiProxy, HostFrame, MuxFrame, RpcRequest } from './api.ts';
+import { AbstractApiClient } from './api.ts';
+/** Browser platform subclass: unary/respond use fetch; mux/host use downlink-only WebSockets. */
+export declare class WebApiClient extends AbstractApiClient {
+    protected doFetch(input: URL, init?: RequestInit): Promise<Response>;
+    protected openMux(_payload: Parameters<ApiProxy['events']['mux']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<MuxFrame>>;
+    protected openHost(_payload: Parameters<ApiProxy['events']['host']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<HostFrame>>;
+    private readWebSocket;
+}
+//# sourceMappingURL=web-api-client.d.ts.map

package/lib/types/http-bridge.d.ts

@@ -0,0 +1,24 @@
+/**
+ * node:http ↔ WHATWG fetch bridge for the /api transport (host side of the
+ * web carrier; the fetch-shaped handler itself is transport-agnostic).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Transport-independent request handler consumed by the Host HTTP bridge. */
+export interface FetchHandler {
+    /**
+     * Handle one standard Fetch request.
+     * @param request - request produced by the active transport bridge.
+     * @returns complete or streaming Fetch response.
+     */
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Bridge one node:http request to the fetch-shaped handler (client close
+ * aborts; SSE bodies stream out chunk by chunk).
+ * @param req - incoming node:http request (fully read before dispatch).
+ * @param res - node:http response the bridge writes and owns to completion.
+ * @param apiHandler - fetch-shaped API carrier the request is dispatched to.
+ * @param maxRequestBodyBytes - maximum body bytes buffered before dispatch.
+ */
+export declare function bridge(req: IncomingMessage, res: ServerResponse, apiHandler: FetchHandler, maxRequestBodyBytes?: number): Promise<void>;
+//# sourceMappingURL=http-bridge.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,36 @@
+/** Host HTTP bridge for browser-client RPC. */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export type { ConnectionRpcAuthority, ConnectionRpcEndpointMatcher, ConnectionRpcHandler, ConnectionRpcHandlerOptions, HostConnectionHandle, HostConnectionRpc, } from './rpc.ts';
+export { HostConnectionService } from './rpc-host.ts';
+export { API_PATH, HOST_EVENTS_PATH, MUX_EVENTS_PATH } from './api-path.ts';
+/** Stable Cordis plugin name. */
+export declare const name = "client-connection";
+/** Services required before providing Connection; API Proxy is an optional `/api` fallback. */
+export declare const inject: string[];
+/** Plugin config: the deployment's non-loopback serving authorities. */
+export interface ConnectionConfig {
+    /**
+     * Authorities this deployment serves beyond loopback: exact `host:port`, or
+     * port-less `host` matching any port. The /api trust fence refuses any
+     * request whose Host is neither loopback nor listed here, so a
+     * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
+     * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
+     * that is not a bare, canonical authority fails the plugin load.
+     */
+    trustedHosts?: string[];
+    /** Maximum buffered JSON body for every `/api` request. */
+    maxRequestBodyBytes?: number;
+}
+export declare const Config: z<ConnectionConfig>;
+/**
+ * Mounts the API gateway under the browser transport prefix. Every request on
+ * the prefix passes the browser-trust fence first (DNS-rebinding and
+ * cross-site defense — [api-request-trust](./api-request-trust.ts));
+ * privileged methods additionally pass it with an empty trust list, which
+ * pins them to loopback.
+ * @param ctx - Host plugin context.
+ * @param config - resolved plugin config (schema defaults applied).
+ */
+export declare function apply(ctx: Context, config?: ConnectionConfig): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-client-connection`.
+ * @module @deepseek-ai/dsh-client-connection/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "client-connection-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/loopback-hostname.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Browser-safe, zero-dependency loopback classification shared by the `/api`
+ * Host fence and the package's `ctx.connection` state. The predicate stays
+ * package-internal; client plugins consume the derived state through Cordis.
+ */
+/**
+ * Whether a normalized URL hostname names the local loopback authority.
+ * @param hostname - WHATWG URL hostname (IPv6 literals retain brackets).
+ * @returns true for localhost, IPv6 loopback, or any IPv4 address in 127/8.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+//# sourceMappingURL=loopback-hostname.d.ts.map

package/lib/types/rpc-host.d.ts

@@ -0,0 +1,33 @@
+/** Host registry and HTTP adapter for generic Connection RPC channels. */
+import { Context, Service } from '@deepseek-ai/cordis';
+import { type FetchHandler } from './http-bridge.ts';
+import type { HostConnectionHandle, HostConnectionRpc } from './rpc.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /** Host Connection transport and RPC registrations. */
+        connection: HostConnectionHandle;
+    }
+}
+/** Host Connection service whose channel registrations belong to the caller fiber. */
+export declare class HostConnectionService extends Service implements HostConnectionHandle {
+    private readonly trustedHosts;
+    private readonly interceptors;
+    /**
+     * Provide the Host half over the active HTTP server.
+     * @param ctx - owning Connection plugin context.
+     * @param trustedHosts - deployment authorities accepted by trusted-host channels.
+     */
+    constructor(ctx: Context, trustedHosts: readonly string[]);
+    /** Generic channel registry scoped to the Context reading this service. */
+    get rpc(): HostConnectionRpc;
+    /**
+     * Compose one shared-channel Fetch handler from its interceptor and fallback.
+     * @param channel - shared channel mounted by Connection.
+     * @param fallback - handler for endpoints not claimed by the interceptor.
+     * @returns Fetch handler that selects exactly one target for each request.
+     */
+    createSharedFetchHandler(channel: '/api', fallback: FetchHandler): FetchHandler;
+    private register;
+    private registerInterceptor;
+}
+//# sourceMappingURL=rpc-host.d.ts.map

package/lib/types/rpc.d.ts

@@ -0,0 +1,51 @@
+/** Generic unary RPC contracts shared by the Host and Client Connection halves. */
+import type { RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api';
+/** Trust fence applied before a Host RPC channel reaches its handler. */
+export type ConnectionRpcAuthority = 'trusted-host' | 'loopback';
+/** Registration policy for one logical RPC channel. */
+export interface ConnectionRpcHandlerOptions {
+    /** Browser authority accepted by every endpoint in this channel. */
+    readonly authority: ConnectionRpcAuthority;
+}
+/** Handler invoked after Connection has decoded the transport envelope. */
+export type ConnectionRpcHandler = (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<RpcResult<unknown>>;
+/** Synchronous ownership test for one endpoint on a shared RPC channel. */
+export type ConnectionRpcEndpointMatcher = (endpoint: string) => boolean;
+/** Host registry for logical RPC channels carried by the current transport. */
+export interface HostConnectionRpc {
+    /**
+     * Register one absolute channel prefix and its trust policy.
+     * @param channel - absolute logical channel such as `/rpc`.
+     * @param handler - decoded endpoint handler returning the existing RPC result shape.
+     * @param options - channel trust policy.
+     * @returns asynchronous disposer removing the channel and its physical route.
+     */
+    handle(channel: string, handler: ConnectionRpcHandler, options: ConnectionRpcHandlerOptions): () => Promise<void>;
+    /**
+     * Intercept owned endpoints on the shared `/api` channel before its fallback.
+     * @param channel - reserved shared channel; currently `/api`.
+     * @param matches - synchronous endpoint ownership test.
+     * @param handler - decoded endpoint handler returning the existing RPC result shape.
+     * @param options - trust policy for every endpoint claimed by this interceptor.
+     * @returns asynchronous disposer removing the interceptor.
+     */
+    intercept(channel: '/api', matches: ConnectionRpcEndpointMatcher, handler: ConnectionRpcHandler, options: ConnectionRpcHandlerOptions): () => Promise<void>;
+}
+/** Host `ctx.connection` shape consumed by transport-independent adapters. */
+export interface HostConnectionHandle {
+    /** Generic RPC channel registry. */
+    readonly rpc: HostConnectionRpc;
+}
+/** Client caller for logical RPC channels carried by the current transport. */
+export interface ClientConnectionRpc {
+    /**
+     * Call one endpoint through an already registered logical channel.
+     * @param channel - absolute logical channel such as `/api`.
+     * @param endpoint - channel-relative endpoint such as `goals/create`.
+     * @param payload - channel-owned request payload.
+     * @param signal - optional caller cancellation.
+     * @returns the existing RPC success/error result; correlation stays inside Connection.
+     */
+    call(channel: string, endpoint: string, payload: unknown, signal?: AbortSignal): Promise<RpcResult<unknown>>;
+}
+//# sourceMappingURL=rpc.d.ts.map

package/lib/types/websocket-downlink.d.ts

@@ -0,0 +1,43 @@
+/** Host-side WebSocket carrier for the two server-to-browser event streams. */
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy/api';
+/**
+ * Owns WebSocket negotiation and frame pumping for the connection plugin's
+ * two downlinks. Client messages are a protocol violation: upstream traffic
+ * remains on HTTP.
+ */
+export declare class WebSocketDownlinks {
+    private readonly api;
+    private readonly server;
+    private readonly pumps;
+    /** @param api - host API supplying the typed event streams. */
+    constructor(api: ApiProxy);
+    /**
+     * Upgrade one socket and pump the mux stream until either side closes.
+     * @param req - HTTP upgrade request.
+     * @param socket - Raw socket transferred by the HTTP server.
+     * @param head - Bytes already read after the upgrade headers.
+     */
+    handleMux(req: IncomingMessage, socket: Duplex, head: Buffer): void;
+    /**
+     * Upgrade one socket and pump the host stream until either side closes.
+     * @param req - HTTP upgrade request.
+     * @param socket - Raw socket transferred by the HTTP server.
+     * @param head - Bytes already read after the upgrade headers.
+     */
+    handleHost(req: IncomingMessage, socket: Duplex, head: Buffer): void;
+    /**
+     * Terminate owned sockets and await the no-server acceptor plus frame pumps.
+     * @returns A promise resolving after every socket and source iterator stops.
+     */
+    close(): Promise<void>;
+    private upgrade;
+    private pump;
+}
+/**
+ * Reject an untrusted upgrade before protocol negotiation.
+ * @param socket - Raw HTTP socket that remains owned by the caller.
+ */
+export declare function rejectWebSocketUpgrade(socket: Duplex): void;
+//# sourceMappingURL=websocket-downlink.d.ts.map

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@deepseek-ai/dsh-client-connection",
+  "description": "Wire consumer layer: HTTP-up/WebSocket-down client, ConnectionController dual streams with reconnect, and fixture api",
+  "version": "0.0.1-rc.1",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/connection"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "client": {
+      "inject": [],
+      "platform": "web",
+      "immediately": true
+    }
+  },
+  "license": "BSD-3-Clause",
+  "dependencies": {
+    "ws": "^8.21.0",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-attachment": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.0.1-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.0.1-rc.1"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/client.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.0.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.18.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.0.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+  }
+}