@deepseek-ai/dsh-client-connection 0.1.1-rc.2 → 0.1.2-alpha.2

package/lib/invariant.js

@@ -9,11 +9,12 @@ const name = "client-connection-invariant";
 /** Service required before the companion can reserve package ownership. */
 const inject = ["invariants"];
 /**
-* No runtime invariant: the wire layer emits no cordis events and owns no
-* mutable cross-plugin relation — stream/reconnect sequencing is exercised
-* directly by its behavior specs, rpcId round-trip discipline is owned by the
-* apiproxy contract layer, and the node half's single route registration's
-* register/dispose symmetry is audited by the webserver package's invariant.
+* No runtime invariant: browser-session verification reads the credential
+* record asynchronously at the request that authorizes work, while the
+* credentials companion owns record commit-event lifetime. Stream/reconnect
+* sequencing and rpcId round-trip discipline are exercised directly by
+* behavior specs, and route register/dispose symmetry is
+* audited by the webserver companion.
 */
 const install = () => {};
 /**

package/lib/types/api-path.d.ts

@@ -1,12 +1,7 @@
 /**
  * The /api URL prefix — single source for both halves of the web transport.
- * The node half registers this prefix on the web server; both halves share the
- * event paths below for the browser WebSocket downlinks.
+ * The node half registers this prefix on the web server.
  */
 /** Route prefix owning every api request (`/api` and `/api/<anything>`). */
 export declare const API_PATH = "/api";
-/** Browser mux-frame WebSocket pathname. */
-export declare const MUX_EVENTS_PATH = "/api/events.mux";
-/** Browser host-frame WebSocket pathname. */
-export declare const HOST_EVENTS_PATH = "/api/events.host";
 //# sourceMappingURL=api-path.d.ts.map

package/lib/types/api-request-trust.d.ts

@@ -12,11 +12,7 @@
  * Network reachability and authentication stay out of scope: binding policy
  * belongs to the webserver config, and this fence is not an auth layer.
  */
-import type { IncomingHttpHeaders } from 'node:http';
-/** The request facts the fence reads from either HTTP representation. */
-interface ApiTrustRequest {
-    headers: IncomingHttpHeaders | Headers;
-}
+import type { ConnectionTrustRequest } from './rpc.ts';
 /**
  * Assert one configured `trustedHosts` entry is a bare authority (`host` or
  * `host:port`) in canonical form: it must survive WHATWG parsing unchanged
@@ -38,6 +34,5 @@ export declare function assertTrustedAuthority(entry: string): void;
  * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
  * @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
  */
-export declare function isTrustedApiRequest(request: ApiTrustRequest, trustedHosts: readonly string[]): boolean;
-export {};
+export declare function isTrustedApiRequest(request: ConnectionTrustRequest, trustedHosts: readonly string[]): boolean;
 //# sourceMappingURL=api-request-trust.d.ts.map

package/lib/types/browser-auth.d.ts

@@ -0,0 +1,46 @@
+/** Browser-session authentication for the Host Connection carrier. */
+import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
+import type { ConnectionIndexRequest, ConnectionIndexResponse, ConnectionTrustRequest } from './rpc.ts';
+/**
+ * Process launch-token exchange and persistent signed-cookie verification.
+ * Connection loads the credential provider's signing secret during activation
+ * and retains it for synchronous request authentication.
+ */
+export declare class BrowserAuth {
+    private readonly secret;
+    private readonly launchToken;
+    private readonly maxAgeMilliseconds;
+    private constructor();
+    /**
+     * Initialize browser authentication and create its durable signing secret
+     * when this Harness home has none.
+     * @param processOwner - root application context retaining one token across Connection reloads.
+     * @param credentials - persistent credential provider for the Web profile.
+     * @param maxAgeDays - positive absolute browser-cookie lifetime in days.
+     * @returns initialized authentication owner with the process owner's launch token.
+     */
+    static create(processOwner: object, credentials: CredentialProvider, maxAgeDays: number): Promise<BrowserAuth>;
+    /**
+     * Add this process's launch token to the ordinary application root URL.
+     * @param baseUrl - canonical browser origin without credentials.
+     * @returns root URL carrying the process token as its sole authentication input.
+     */
+    authenticatedUrl(baseUrl: string): string;
+    /**
+     * Authenticate an index request. A valid root query token mints the cookie
+     * and redirects to clean `/`; a valid cookie lets the caller serve the
+     * index; every other request receives the same minimal 401 response.
+     * @param req - incoming root or configured-index request.
+     * @param res - response owned when this method returns false.
+     * @returns true only when the caller may serve index.html.
+     */
+    authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse): boolean;
+    /**
+     * Verify the authority-bound browser cookie on a Host request.
+     * @param request - request headers carrying Host and Cookie.
+     * @returns true only for an unexpired cookie signed by this activation's loaded secret.
+     */
+    isAuthenticated(request: ConnectionTrustRequest): boolean;
+    private writeUnauthorized;
+}
+//# sourceMappingURL=browser-auth.d.ts.map

package/lib/types/client/api.d.ts

@@ -1,20 +1,14 @@
-export type { ApiProxy, SessionsApi, SessionSearchItem, SessionSummary, PromptContentPart, HostApi, EventsApi, MuxFrame, HostFrame, ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView, DirectoryEntry, DirectoryListing, ResponseValue, WorkspaceApi, WorkspaceId, WorkspaceView, SkillsApi, SkillEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning, ModelReasoningEffort, ModelSelection, QueueAction, QueuedInboxItem, SessionModels, GoalsApi, GoalRef, SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView, CredentialsApi, CredentialView, ConfigurableProviderView, DiscoveredModelView, LlmApi, SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt, JobView, } from '@deepseek-ai/dsh-host-apiproxy/api';
-export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation';
-export type { RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode, ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt, } from '@deepseek-ai/dsh-host-apiproxy/api';
-export { RpcId, SESSION_SEARCH_RESULT_LIMIT, transportError, } from '@deepseek-ai/dsh-host-apiproxy/api';
-export { AbstractApiClient } from '@deepseek-ai/dsh-host-apiproxy/client';
-export type { IApiClient } from '@deepseek-ai/dsh-host-apiproxy/client';
+/** Browser-safe Connection protocol and shared application value exports. */
+export type { ClientRequest, RpcMessage, RpcRequest, RpcResponse, RpcResult, ServerResponse, } from '../rpc.ts';
+export { RpcId, transportError } from '../rpc.ts';
 export type { SessionId, SessionEvent } from '@deepseek-ai/dsh-session/types';
 export type { MessageId } from '@deepseek-ai/dsh-llm/brand';
 export type { ContentBlock, StreamChunk } from '@deepseek-ai/dsh-llm/types';
-/** Successful value returned by the connection-generation host handshake. */
-export type HostDescription = import('@deepseek-ai/dsh-host-apiproxy/api').ResponseValue<'host.describe'>;
-import type { RpcResponse, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api';
+import type { RpcResponse, RpcResult } from '../rpc.ts';
 /**
- * Unwrap a unary response: RpcResponse<T> -> RpcResult<T> (business code only
- * cares about the result slot).
- * @param response - the unary response.
- * @returns its result slot.
+ * Return the business result carried by a narrow fixture response.
+ * @param response - fixture response to unwrap.
+ * @returns the response's business result.
  */
 export declare function resultOf<T>(response: RpcResponse<T>): RpcResult<T>;
 //# sourceMappingURL=api.d.ts.map

package/lib/types/client/connection.d.ts

@@ -1,55 +1,78 @@
-import type { HostDescription, IApiClient, HostFrame, MuxFrame, RpcRequest } from './api.ts';
-/** Reconnect/backoff tunables (deployment-varying — no hardcoded tunables; these become the
- *  future `ctx.connection` plugin's Config). All fields optional; defaults below. */
+/** Stable Host facts delivered by one established Remote event generation. */
+export interface ConnectionHostInfo {
+    /** Host account home used only to abbreviate displayed filesystem paths. */
+    readonly home: string;
+}
+/** One successfully established Host generation. */
+export interface ConnectionGeneration {
+    /** Monotone generation number within this Client runtime. */
+    readonly id: number;
+    /** Host facts carried by this generation's opening frame. */
+    readonly host: ConnectionHostInfo;
+}
+/** Reconnect/backoff tunables. All fields are optional; defaults are below. */
 export interface ConnectionConfig {
     /** First-retry backoff cap in ms (jittered: actual delay is cap/2..cap). */
     backoffBaseMs?: number;
-    /** Exponential growth factor per consecutive failed attempt. */
+    /** Exponential growth factor per failed attempt; values at or below 1 make the base tier final. */
     backoffFactor?: number;
     /** Upper bound for the backoff cap in ms. */
     backoffMaxMs?: number;
-    /** Cap on waiting for both streams' onOpen before onConnected, in ms. The strict handshake
-     *  waits for mux+host stream establishment plus describe; a carrier that never
-     *  fires onOpen (misbehaving proxy) must not wedge the connection forever — on timeout the
-     *  generation proceeds as connected and the live-gap repair path covers stragglers. */
-    streamOpenTimeoutMs?: number;
+    /** Maximum wait for the registered generation source's ready signal. */
+    generationReadyTimeoutMs?: number;
 }
-/** Coarse connection state for the UI: 'connected' after each generation's handshake,
- *  'reconnecting' the moment the generation fails (covers the whole backoff+retry span). */
-export type ConnectionState = 'connected' | 'reconnecting';
-/** Frame sink callbacks: the Controller owns the physical streams; business dispatch belongs to
- *  SessionManager. */
+/** Connection lifecycle state published after the first attempt has an outcome. */
+export type ConnectionState = 'connected' | 'disconnected' | 'connecting';
+/** Connection-generation callbacks owned by API Gateway. */
 export interface ConnectionSinks {
-    onMuxEnvelope?: (envelope: RpcRequest<MuxFrame>) => void;
-    onHostEnvelope?: (envelope: RpcRequest<HostFrame>) => void;
-    /** After each connection generation is established (both streams open + describe succeeded), first connect included. */
-    onConnected?: (description: HostDescription) => void;
-    /** Coarse state transitions (deduplicated: fires only on change). The initial pre-connect
-     *  span reports nothing — the UI treats "no state yet" as connecting, not as an outage. */
+    /** After the generation source reports ready, first connect included. */
+    onConnected?: (host: ConnectionHostInfo) => void;
+    /** State transitions after the initial attempt has an outcome. Equivalent states are deduplicated. */
     onStateChange?: (state: ConnectionState) => void;
+    /** Start one fresh physical-carrier attempt before each logical retry. */
+    onReconnectRequested?: () => void;
 }
 /**
- * Opens both streams and keeps iterating (pull mode: nothing reads the socket and the tap
- * never fires unless someone for-awaits), reconnecting with exponential backoff on loss.
+ * One long-lived source defining a Connection generation. The source must
+ * attach its incremental listeners before calling `ready`, then remain pending
+ * until the generation is lost or `signal` aborts.
+ * @param signal - cancellation for the current generation.
+ * @param ready - one-shot report that incremental delivery is attached.
+ * @returns a promise settling only when this generation ends or fails.
+ */
+export type ConnectionGenerationSource = (signal: AbortSignal, ready: (host: ConnectionHostInfo) => void) => Promise<void>;
+/**
+ * Opens the registered generation source, reconnecting with exponential backoff on loss.
  * State (generation/attempt) is instance-private, never in the store.
- * The pump body feeds each frame to a sink (sink exceptions must
- * not kill the pump — a broken business layer must not drag down the connection layer).
+ * Sink exceptions do not kill the generation loop.
  */
 export declare class ConnectionController {
-    private readonly api;
+    private readonly source;
     private readonly sinks;
     private generation;
     private attempt;
     private current;
+    private retryDelay;
     private running;
+    private immediateRetry;
+    private networkAvailable;
     private lastState;
     private readonly config;
-    constructor(api: IApiClient, sinks?: ConnectionSinks, config?: ConnectionConfig);
+    constructor(source: ConnectionGenerationSource, sinks?: ConnectionSinks, config?: ConnectionConfig);
     /** Idempotent: begin the connect/pump/reconnect loop. */
     start(): void;
-    /** Stop the loop and abort the current generation's streams. */
+    /** Stop the loop and abort the current generation source. */
     stop(): void;
+    /** Reset the retry sequence and replace the current generation or retry delay immediately. */
+    reconnect(): void;
+    /**
+     * Suspend automatic retries while offline and restart backoff when the network returns.
+     * @param available - whether the browser reports network access.
+     */
+    setNetworkAvailable(available: boolean): void;
+    private backoffCap;
     private backoffDelay;
+    private isFinalBackoffTier;
     /** Read through a method: stop() flips the flag across awaits, so narrowing from the loop condition must not stick. */
     private isRunning;
     /** Re-read both mutable liveness guards after a potentially reentrant sink. */
@@ -57,7 +80,6 @@ export declare class ConnectionController {
     private loop;
     /** Deduplicated state emission (sink isolation applies). */
     private emitState;
-    private pumpStream;
     /** Sink exception isolation: a business-layer throw is logged only, never affecting pump or reconnect semantics. */
     private callSink;
 }

package/lib/types/client/fixture.d.ts

@@ -1,7 +1,3 @@
-import type { SessionId } from '@deepseek-ai/dsh-session/types';
-import type { ApiProxy, ClientResponse, HostFrame, MuxFrame, RpcReceipt, RpcRequest, RpcResponse } from './api.ts';
-import type { RequestPayload, ResponseValue, RpcMethodMap } from '@deepseek-ai/dsh-host-apiproxy/api';
-import { AbstractApiClient } from './api.ts';
 import type { ClientConnectionRpc } from '../rpc.ts';
 /** Deterministic fixture branches used by keyless Web assembly tests. */
 export interface FixtureOptions {
@@ -16,53 +12,20 @@ export interface FixtureOptions {
     /** Order of the two successful create frames. */
     createFrameOrder?: 'session-first' | 'workspace-first';
 }
-/**
- * In-memory fake host: fx-alpha carries history and replay scripts; fx-beta is fx-alpha's child session (lineage indent material).
- * @param options - fixture branches for empty state and failure timing.
- * @returns an ApiProxy backed entirely by in-memory state — no host process, no network.
- */
-export declare function createFixtureApi(options?: FixtureOptions): ApiProxy;
-/** Both fixture faces over one state graph. */
+/** Fixture RPC face over one in-memory state graph. */
 export interface FixtureWorld {
-    /** Legacy unary/stream API the fixture still answers. */
-    readonly api: ApiProxy;
     /** Generic Remote caller for the endpoints business services own. */
     readonly rpc: ClientConnectionRpc;
 }
 /**
- * Build both fixture faces so a caller can drive the Remote endpoints and the
- * legacy API against one in-memory state graph.
+ * Build the fixture RPC face over one in-memory state graph.
  * @param options - fixture branches for empty state and failure timing.
- * @returns the legacy API face and the Remote RPC face.
+ * @returns the Remote RPC face.
  */
 export declare function createFixtureFaces(options?: FixtureOptions): FixtureWorld;
 /**
- * Fixture platform subclass: there is no HTTP at all, so instead of a doFetch transport it
- * overrides the protocol-level virtuals (callUnary/openMux/openHost/respond) to dispatch
- * straight into the in-memory ApiProxy — while still minting rpcIds, fabricating the four
- * named full forms, and feeding the same tap as a real carrier. TODO: delete when the fixture
- * moves to the isomorphic pipeline (InProcessApiClient over toFetchHandler(fixtureImpl)).
+ * Build the browser fixture transport from the current page's query switches.
+ * @returns an in-memory Connection RPC transport.
  */
-export declare class FixtureApiClient extends AbstractApiClient {
-    private readonly api;
-    /** Generic Remote caller backed by the same in-memory state as the legacy fixture API. */
-    readonly rpc: ClientConnectionRpc;
-    constructor();
-    protected doFetch(): Promise<Response>;
-    protected callUnary<K extends keyof RpcMethodMap>(method: K, payload: RequestPayload<K>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<K>>>;
-    /** Method-key dispatch into the in-memory contract impl (a real carrier routes by URL path instead). */
-    private dispatch;
-    protected openMux(payload: {
-        since?: Record<SessionId, number>;
-    }, signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<MuxFrame>>;
-    protected openHost(payload: Record<never, never>, signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<HostFrame>>;
-    private tapStream;
-    /**
-     * Deliver a client response to the in-memory contract impl (no HTTP POST),
-     * echoing the envelope to the observation tap like every other path.
-     * @param message - the client-response envelope answering a server request.
-     * @returns the carrier receipt from the fixture impl.
-     */
-    respond(message: ClientResponse): Promise<RpcReceipt>;
-}
+export declare function createFixtureConnectionRpc(): ClientConnectionRpc;
 //# sourceMappingURL=fixture.d.ts.map

package/lib/types/client/index.d.ts

@@ -1,23 +1,38 @@
 /**
  * Browser wire client. The plugin selects fixture or HTTP transport, provides
- * the shared API client, and lets the runtime object layer start the stream
- * controller with its sinks.
+ * the shared API client, and lets API Gateway own the connection loop.
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { HostDescription, IApiClient } from './api.ts';
-import { type ConnectionConfig, type ConnectionSinks, type ConnectionState } from './connection.ts';
-import { type RpcFetch } from './rpc.ts';
+import { type ConnectionConfig, type ConnectionGeneration, type ConnectionGenerationSource, type ConnectionSinks, type ConnectionState } from './connection.ts';
+import { type RpcFetch, type RpcStreamOpen } from './rpc.ts';
 import type { ClientConnectionRpc } from '../rpc.ts';
-export type { ApiProxy, SessionsApi, SessionSearchItem, SessionSummary, PromptContentPart, HostApi, EventsApi, MuxFrame, HostFrame, ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView, DirectoryEntry, DirectoryListing, ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView, SkillsApi, SkillEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning, MessageId, ModelReasoningEffort, ModelSelection, QueueAction, QueuedInboxItem, SessionModels, SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt, JobView, RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode, ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt, HostDescription, IApiClient, SessionId, SessionEvent, ContentBlock, StreamChunk, GoalsApi, GoalRef, SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView, CredentialsApi, CredentialView, ConfigurableProviderView, DiscoveredModelView, LlmApi, } from './api.ts';
-export { RpcId, AbstractApiClient, transportError, } from './api.ts';
-export type { ConnectionConfig, ConnectionSinks, ConnectionState };
-export type { ClientConnectionRpc } from '../rpc.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Events {
+        /**
+         * A connection generation was established. Wire-derived caches must
+         * repull; long-lived streams own their own resume and baseline lifecycle.
+         * @mode emit
+         */
+        'connection/reset'(): void;
+    }
+}
+export type { MessageId, RpcRequest, RpcResponse, RpcResult, ClientRequest, ServerResponse, RpcMessage, SessionId, SessionEvent, ContentBlock, StreamChunk, } from './api.ts';
+export { RpcId, transportError, } from './api.ts';
+export type { ConnectionConfig, ConnectionGeneration, ConnectionGenerationSource, ConnectionHostInfo, ConnectionSinks, ConnectionState, } from './connection.ts';
+export type { ClientConnectionRpc, ConnectionRpcFailure, ConnectionRpcResult, } from '../rpc.ts';
 export type { RpcFetch } from './rpc.ts';
-/** Observable Host description published by each completed connection handshake. */
-export interface HostDescriptionSource {
-    /** Latest connected-generation description; absent before connect and while reconnecting. */
-    getSnapshot(): HostDescription | undefined;
-    /** Subscribe to description replacement and connection loss. */
+/** Observable identity and Host facts for the active connection generation. */
+export interface ConnectionGenerationState {
+    /** Active generation, or undefined before readiness and while reconnecting. */
+    getSnapshot(): ConnectionGeneration | undefined;
+    /** Subscribe to generation establishment, replacement, and loss. */
+    subscribe(listener: () => void): () => void;
+}
+/** Observable recovery lifecycle of the owned Connection loop. */
+export interface ConnectionStateSource {
+    /** Current state, or undefined before the first connection outcome. */
+    getSnapshot(): ConnectionState | undefined;
+    /** Subscribe to state changes. */
     subscribe(listener: () => void): () => void;
 }
 /** Required services (none — this is the wire root). */
@@ -29,42 +44,66 @@ export declare const inject: string[];
  * provides both halves here instead of forking this plugin.
  */
 export interface ClientTransportHooks {
-    /** Build the API carrier: unary calls plus the two downstream event streams. */
-    createApiClient(): IApiClient;
     /** Transport for generic unary RPC channels (the Typert gateway). */
     fetch: RpcFetch;
+    /** Worker-local Gateway stream carrier; absent when the page uses the Gateway WebSocket. */
+    openStream?: RpcStreamOpen;
     /**
      * Bundle transport for the module system, present when the carrier also owns
      * bundle bytes (the worker tunnel). Absent in the served web app, whose
      * bundles load over HTTP.
      */
     loadBundle?(url: string): Promise<void>;
+    /**
+     * The transport owner declares the page owns the Host outright: the Host
+     * runs inside a worker this page spawned, so no other party can reach it and
+     * the loopback stand-in for "the operator's own machine" is vacuous.
+     * `ctx.connection.isLoopback` then reports the privileged surface reachable
+     * regardless of the page authority. Only a shell that assembles its own
+     * transport can set this; served pages never carry the global at all.
+     */
+    ownsHost?: boolean;
 }
 /**
- * The ctx.connection service API: the API client plus a one-shot
- * controller starter (the runtime plugin supplies sinks when its object layer
- * is ready — connection stays consumer-agnostic).
+ * The ctx.connection service API: the API client plus a one-shot controller
+ * starter. API Gateway supplies generation readiness and reset callbacks;
+ * Connection stays independent of downstream domain state.
  */
 export interface ConnectionHandle {
-    /** Shared api client (fixture or real, decided at boot from the page URL). */
-    readonly api: IApiClient;
-    /** Whether the current page authority is loopback; non-browser contexts default to true. */
+    /**
+     * Whether the privileged surface is reachable: the page authority is
+     * loopback, the transport declares the page owns the Host
+     * ({@link ClientTransportHooks.ownsHost}), or the context is not a browser.
+     */
     readonly isLoopback: boolean;
-    /** Generation-scoped Host facts, including the account home and native path-open capability. */
-    readonly hostDescription: HostDescriptionSource;
+    /** Current Remote event generation and the Host facts carried by its opening frame. */
+    readonly generation: ConnectionGenerationState;
+    /** Current recovery lifecycle for connection-specific consumers. */
+    readonly state: ConnectionStateSource;
     /** Generic logical RPC channels over the same Connection transport. */
     readonly rpc: ClientConnectionRpc;
+    /** Reset retry progression and replace the current attempt immediately. */
+    reconnect(): void;
     /**
-     * Start the connect/pump/reconnect loop with the consumer's frame sinks.
-     * One consumer owns the streams (the runtime object layer); a second call
-     * throws.
-     * @param sinks - frame/state callbacks.
-     * @param config - reconnect/backoff tunables.
-     * @returns stop handle for the loop.
+     * Register the sole source defining Host generations. The source reports
+     * ready only after its incremental listeners are attached.
+     * @param source - long-lived generation source owned by the push carrier.
+     * @returns disposer withdrawing the source and stopping an active loop.
      */
-    start(sinks: ConnectionSinks, config?: ConnectionConfig): {
-        stop(): void;
-    };
+    registerGenerationSource(source: ConnectionGenerationSource): () => void;
+    /**
+     * Start the connect/reconnect loop with the consumer's state callbacks.
+     * API Gateway owns the loop; a second call throws.
+     * @param sinks - connection-state callbacks.
+     * @param config - reconnect timing tunables.
+     * @returns lifecycle controls for the loop.
+     */
+    start(sinks: ConnectionSinks, config?: ConnectionConfig): ConnectionLoop;
+}
+/** Controls retained by the sole owner of a running connection loop. */
+export interface ConnectionLoop {
+    /** Stop the loop and withdraw its active generation. */
+    stop(): void;
 }
 /**
  * Client plugin body: pick the api by page mode and provide ctx.connection.

package/lib/types/client/rpc.d.ts

@@ -2,10 +2,13 @@
 import type { ClientConnectionRpc } from '../rpc.ts';
 /** Transport this caller posts through; same signature as the global `fetch`. */
 export type RpcFetch = (input: URL, init: RequestInit) => Promise<Response>;
+/** Worker-local opener for decoded Gateway Remote streams. */
+export type RpcStreamOpen = (endpoint: string, payload: unknown, signal: AbortSignal) => AsyncIterable<unknown>;
 /**
  * Create the browser-backed generic RPC caller.
  * @param doFetch - transport override; defaults to the page's global fetch.
+ * @param openStream - optional worker-local Gateway stream carrier.
  * @returns caller that owns request correlation and response-envelope validation.
  */
-export declare function createWebConnectionRpc(doFetch?: RpcFetch): ClientConnectionRpc;
+export declare function createWebConnectionRpc(doFetch?: RpcFetch, openStream?: RpcStreamOpen): ClientConnectionRpc;
 //# sourceMappingURL=rpc.d.ts.map

package/lib/types/http-bridge.d.ts

@@ -19,7 +19,7 @@ export interface FetchHandler {
 }
 /**
  * Bridge one node:http request to the fetch-shaped handler (client close
- * aborts; SSE bodies stream out chunk by chunk).
+ * aborts; response bodies stream out chunk by chunk).
  * @param req - incoming node:http request (fully read before dispatch).
  * @param res - node:http response the bridge writes and owns to completion.
  * @param apiHandler - fetch-shaped API carrier the request is dispatched to.

package/lib/types/index.d.ts

@@ -1,12 +1,14 @@
 /** Host HTTP bridge for browser-client RPC. */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-export type { ConnectionRpcAuthority, ConnectionRpcEndpointMatcher, ConnectionRpcHandler, ConnectionRpcHandlerOptions, HostConnectionHandle, HostConnectionRpc, } from './rpc.ts';
+export type { ConnectionFetchMethod, ConnectionFetchHandler, ConnectionFetchRoute, ConnectionIndexRequest, ConnectionIndexResponse, ConnectionRpcEndpointMatcher, ConnectionRpcFailure, ConnectionRpcHandler, ConnectionRequestRejection, ConnectionRpcResult, ConnectionTrustRequest, ClientRequest, HostConnectionHandle, HostConnectionFetch, HostConnectionRpc, RpcMessage, ServerResponse, } from './rpc.ts';
+export { RpcId, transportError } from './rpc.ts';
+export { clientRequestSchema, rpcErrorSchema, rpcIdSchema, rpcMessageSchema, rpcResultSchema, serverResponseSchema, } from './rpc-schema.ts';
 export { HostConnectionService } from './rpc-host.ts';
-export { API_PATH, HOST_EVENTS_PATH, MUX_EVENTS_PATH } from './api-path.ts';
+export { API_PATH } from './api-path.ts';
 /** Stable Cordis plugin name. */
 export declare const name = "client-connection";
-/** Services required before providing Connection; API Proxy is an optional `/api` fallback. */
+/** Services required before providing Connection. */
 export declare const inject: string[];
 /** Plugin config: the deployment's non-loopback serving authorities. */
 export interface ConnectionConfig {
@@ -15,22 +17,22 @@ export interface ConnectionConfig {
      * port-less `host` matching any port. The /api trust fence refuses any
      * request whose Host is neither loopback nor listed here, so a
      * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
-     * by (the dsh CLI derives the machine's LAN IP literals itself). An entry
-     * that is not a bare, canonical authority fails the plugin load.
+     * by; the Web runtime derives LAN IP literals from an active all-interface
+     * bind. An entry that is not a bare, canonical authority fails plugin load.
      */
     trustedHosts?: string[];
+    /** Absolute browser-session lifetime in days. Default: 30. */
+    cookieMaxAgeDays?: number;
     /** Maximum buffered JSON body for every `/api` request. Default: 300 MiB. */
     maxRequestBodyBytes?: number;
 }
 export declare const Config: z<ConnectionConfig>;
 /**
  * Mounts the API gateway under the browser transport prefix. Every request on
- * the prefix passes the browser-trust fence first (DNS-rebinding and
- * cross-site defense — [api-request-trust](./api-request-trust.ts));
- * privileged methods additionally pass it with an empty trust list, which
- * pins them to loopback.
+ * the prefix passes the Host/Origin browser-trust fence and persistent browser
+ * authentication before dispatch.
  * @param ctx - Host plugin context.
  * @param config - resolved plugin config (schema defaults applied).
  */
-export declare function apply(ctx: Context, config?: ConnectionConfig): void;
+export declare function apply(ctx: Context, config?: ConnectionConfig): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/lib/types/rpc-host.d.ts

@@ -1,7 +1,7 @@
 /** Host registry and HTTP adapter for generic Connection RPC channels. */
 import { Context, Service } from '@deepseek-ai/cordis';
-import { type FetchHandler } from './http-bridge.ts';
-import type { HostConnectionHandle, HostConnectionRpc } from './rpc.ts';
+import type { BrowserAuth } from './browser-auth.ts';
+import type { ConnectionIndexRequest, ConnectionIndexResponse, ConnectionFetchHandler, HostConnectionFetch, ConnectionRequestRejection, ConnectionTrustRequest, HostConnectionHandle, HostConnectionRpc } from './rpc.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /** Host Connection transport and RPC registrations. */
@@ -11,22 +11,33 @@ declare module '@deepseek-ai/cordis' {
 /** Host Connection service whose channel registrations belong to the caller fiber. */
 export declare class HostConnectionService extends Service implements HostConnectionHandle {
     private readonly trustedHosts;
+    private readonly browserAuth;
     private readonly interceptors;
+    private readonly fetchRoutes;
     /**
      * Provide the Host half over the active HTTP server.
      * @param ctx - owning Connection plugin context.
-     * @param trustedHosts - deployment authorities accepted by trusted-host channels.
+     * @param trustedHosts - deployment authorities accepted by the Host/Origin fence.
+     * @param browserAuth - process token and persistent browser-session owner.
      */
-    constructor(ctx: Context, trustedHosts: readonly string[]);
+    constructor(ctx: Context, trustedHosts: readonly string[], browserAuth: BrowserAuth);
     /** Generic channel registry scoped to the Context reading this service. */
     get rpc(): HostConnectionRpc;
+    /** Exact Fetch-route registry scoped to the Context reading this service. */
+    get fetch(): HostConnectionFetch;
+    /** Apply the configured Host/Origin fence, then browser authentication. */
+    requestRejection(request: ConnectionTrustRequest): ConnectionRequestRejection;
+    /** Authenticate an index request through the process-token exchange or cookie. */
+    authorizeIndex(request: ConnectionIndexRequest, response: ConnectionIndexResponse): boolean;
+    /** Add this process's launch token to the clean application URL. */
+    authenticatedUrl(baseUrl: string): string;
     /**
-     * Compose one shared-channel Fetch handler from its interceptor and fallback.
+     * Compose one shared-channel Fetch handler from exact routes and its interceptor.
      * @param channel - shared channel mounted by Connection.
-     * @param fallback - handler for endpoints not claimed by the interceptor.
-     * @returns Fetch handler that selects exactly one target for each request.
+     * @returns Fetch handler that selects one owner or returns 404.
      */
-    createSharedFetchHandler(channel: '/api', fallback: FetchHandler): FetchHandler;
+    createSharedFetchHandler(channel: '/api'): ConnectionFetchHandler;
+    private registerFetchRoute;
     private register;
     private registerInterceptor;
 }

package/lib/types/rpc-schema.d.ts

@@ -0,0 +1,30 @@
+/** Runtime validation for Connection RPC envelopes. */
+import { z } from 'zod';
+import type { ClientRequest, RpcId, RpcMessage, ServerResponse } from './rpc.ts';
+/** Correlation id after wire validation. */
+export declare const rpcIdSchema: z.ZodType<RpcId>;
+/** Generic endpoint failure carried in a response envelope. */
+export declare const rpcErrorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+    details: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+/**
+ * Build the result parser for one endpoint value parser.
+ * @param value - endpoint-owned success-value parser.
+ * @returns parser for either a success value or generic failure.
+ */
+export declare function rpcResultSchema<T>(value: z.ZodType<T>): z.ZodType<{
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: z.infer<typeof rpcErrorSchema>;
+}>;
+/** Client request envelope; endpoint payload validation belongs to its owner. */
+export declare const clientRequestSchema: z.ZodType<ClientRequest>;
+/** Server response envelope; endpoint value validation belongs to its caller. */
+export declare const serverResponseSchema: z.ZodType<ServerResponse>;
+/** Either Connection RPC envelope direction. */
+export declare const rpcMessageSchema: z.ZodType<RpcMessage>;
+//# sourceMappingURL=rpc-schema.d.ts.map