@deepseek-ai/dsh-client-connection 0.2.0-rc.2 → 0.2.1-alpha.2

package/README.i18n.yaml

@@ -18,11 +18,11 @@
   en: 13b54969ff1d00a4
   zh: 4d2ffff0445472ed
 /deepseek-ai-dsh-client-connection/browser-authentication-and-request-trust:
-  en: ab52ef146d0b5b42
-  zh: 6314d50cfe5683e1
+  en: 44956be3cc11908a
+  zh: d518f765d58f3558
 /deepseek-ai-dsh-client-connection/connection-generation:
-  en: db8757857a15c0c1
-  zh: c8e15907461ef54e
+  en: 116f94e44c0d87e7
+  zh: 59ef48984154d858
 /deepseek-ai-dsh-client-connection/model-experience:
   en: 88bbc33fe9ae9df8
   zh: bfbab6d51b4abd40
@@ -30,8 +30,8 @@
   en: ca75c51c89c2c9b0
   zh: de54f3467ef3b9be
 /deepseek-ai-dsh-client-connection/known-limitations-and-deferred-work:
-  en: 2c964a7546604347
-  zh: c30b59fc92a01c36
+  en: ad73c3b97f348ad1
+  zh: fec950f970112182
 /deepseek-ai-dsh-client-connection/known-limitations-and-deferred-work/dev-note:
-  en: c51db1312f6a43ef
-  zh: 7193ff08f53e3230
+  en: e67f633dc6fe7773
+  zh: e88aeb617ffb74ea

package/README.md

@@ -38,9 +38,11 @@ The browser uses HTTP POST for Remote unary calls. API Gateway owns the `/api/re
 
 Every Host RPC method and WebSocket stream requires one browser session; there is no method-specific loopback tier. Each process mints a random launch token. `dsh-web-app` prints and opens its application URL with `?token=...`, preserving the caller's authority and mount; `frontend-static` delegates root and index requests to `ctx.connection.authorizeIndex`, which accepts that token only on `GET /`, writes an authority-bound signed cookie, and redirects to clean `./`, which drops the token and keeps the request's directory. A missing, expired, malformed, or wrong-authority cookie returns 401 before RPC dispatch. Static assets remain public. The HTTP carrier accepts no query token outside the root exchange and no Authorization-header token.
 
-The cookie signing secret is the owner-scoped `client-connection/browser-session` grant record in `ctx.credentials`. The local provider persists it in `$DSH_HOME/.credentials.yaml`; `BrowserAuth` loads or creates the record during Connection activation and retains the secret in memory, so request authentication is synchronous. Deleting or replacing the record takes effect on the next Connection activation. Cookies carry an absolute issue/expiry interval, defaulting to 30 days through `cookieMaxAgeDays`, and bind the normalized hostname plus port in both their deterministic name and signed payload. They are host-only, `Path=/`, `HttpOnly`, and `SameSite=Strict`; they deliberately omit `Secure` because the shipped server uses loopback HTTP.
+The cookie signing secret is the owner-scoped `client-connection/browser-session` grant record in `ctx.credentials`. The local provider persists it in `$DSH_HOME/.credentials.yaml`; `BrowserAuth` loads or creates the record during Connection activation and retains the secret in memory, so request authentication is synchronous. Deleting or replacing the record takes effect on the next Connection activation. Cookies carry an absolute issue/expiry interval, defaulting to 30 days through `cookieMaxAgeDays`, and bind the normalized hostname plus port in both their deterministic name and signed payload. They are host-only, `Path=/`, `HttpOnly`, and `SameSite=Strict`, and carry `Secure` exactly when the listener that received the index request serves TLS; only that listener's own protocol decides, never a `publicUrl` announcement or a forwarded header.
 
-Before authentication, every request still passes `src/api-request-trust.ts`. Its `Host` must be loopback or match a `trustedHosts` entry: exact on `host:port`, any port on port-less entries, both sides WHATWG-normalized. An attached `Origin` must equal that Host and `sec-fetch-site: cross-site` is refused. Malformed configured authorities fail plugin load. These checks defend DNS rebinding and cross-site browser requests; they never establish identity. A failed Host/Origin check returns 403, while a trusted but unauthenticated request returns 401. `dsh web --host 0.0.0.0` remains unsupported. Decision records: [browser request trust](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md) and [browser token authentication](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.md).
+HTTPS cookie names and signed audiences include the `https:` scheme, so HTTP cookies cannot authenticate to a TLS listener even on the same hostname and port. Default ports normalize under the listener's scheme. Existing HTTP cookie audiences remain unchanged.
+
+Before authentication, every request passes `src/api-request-trust.ts`. Its `Host` must be loopback, equal the listener's bind IP literal on any port, or match a `trustedHosts` entry: exact on `host:port`, any port on port-less entries. Host and configured entries use the listener's scheme for WHATWG default-port normalization, not a forwarded header or `Origin`. An attached HTTP(S) `Origin` must name the same authority, with Host parsed under that Origin's scheme to support HTTPS proxies over HTTP upstreams; `sec-fetch-site: cross-site` is refused. Malformed configured authorities fail plugin load. `allowsRemoteAuthorities` reports whether `trustedHosts` permits a non-loopback authority; accepting the bind IP does not change that list. These checks defend DNS rebinding and cross-site browser requests; they never establish identity. A failed Host/Origin check returns 403, while a trusted but unauthenticated request returns 401. `dsh web --host 0.0.0.0` is unsupported. Decision records: [browser request trust](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md) and [browser token authentication](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.md).
 
 Every admitted request speaks for one Peer, the operator. `ctx.connection.operator` is that `PeerScope`: its `ctx` is a Cordis scope that owns connection-lifetime registrations and is disposed with the Connection. `ctx.connection.admit(request)` runs the trust and authentication checks and answers with the rejection status or the operator; the `/api` route and the Gateway's WebSocket upgrade admit through it, and every RPC handler receives the Peer of its call. `OperatorPeer` is exported so a composition without Connection, such as the Gateway's in-process carrier, owns an operator scope with the same contract.
 
@@ -51,7 +53,7 @@ Authenticated shared HTTP requests pass through the `connection/request` waterfa
 
 API Gateway Client registers the internal `$events` logical stream as the sole generation source, independently of whether any `$on` listener exists. The Host attaches all incremental listeners in the API Remotes source factory, then sends one `{ type: 'ready', clientId, host: { home } }` item before events. `ConnectionController` publishes that generation and calls `onConnected` only after the ready item arrives, so baseline acquisition cannot race ahead of incremental observation.
 
-An ended `$events` stream, a Remote stream error, a non-ready opening item, or a malformed event item invalidates the current generation. A pending handshake logs a slow-Host warning after 3 seconds and logs the readiness timeout and aborts after 15 seconds by default, including time spent waiting for the physical socket. The source must stop delivery, release resources, and settle after cancellation before a replacement starts; late readiness from a cancelled source cannot publish a generation. While the browser reports network availability, the controller publishes `connecting` and retries with 50%–100% jitter under caps of 500ms, 1s, 2s, 4s, 8s, and 10s, continuing at the final cap until recovery. Every retry asks Gateway to replace the physical WebSocket once and reopens `$events`. The [continuous recovery decision](../../../.agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.md) owns the deadlines and retry policy.
+An ended `$events` stream, a Remote stream error, a non-ready opening item, or a malformed event item invalidates the current generation. A pending handshake logs a slow-Host warning after 3 seconds and logs the readiness timeout and aborts after 15 seconds by default, including time spent waiting for the physical socket. The source must stop delivery, release resources, and settle after cancellation before a replacement starts; late readiness from a cancelled source cannot publish a generation. While the browser reports network availability, the controller publishes `connecting` and retries with 50%–100% jitter under caps of 500ms, 1s, 2s, 4s, 8s, and 10s, continuing at the final cap until recovery. Every retry asks Gateway to replace the physical WebSocket once and reopens `$events`.
 
 `ctx.connection.reconnect()` interrupts active work, resets the sequence, and starts retry 1 immediately. Browser `offline` aborts active work, publishes `disconnected`, and suspends automatic attempts; the next `online` transition resets the sequence and starts at the 500ms tier. Only a ready item publishes `connected`. Gateway mux owns no independent retry schedule.
 
@@ -72,7 +74,7 @@ None; this package neither assembles nor sends a provider request.
 <a id="known-limitations-and-deferred-work"></a>
 
 - **Buffered `/api` routes retain each request body in memory** — `maxRequestBodyBytes` (default 300 MiB, sized for the default 200 MiB aggregate image limit after base64 expansion plus envelope headroom) bounds ordinary image and RPC envelopes. Opt-in streaming routes receive backpressured chunks and bypass the aggregate cap; route implementations own persistence, cancellation, and any storage quota.
-- **The browser cookie is not marked `Secure`** — loopback HTTP is the shipped transport, so exposing the same authority over plaintext networking can expose the bearer cookie in transit.
+- **A plain-HTTP listener exposes the bearer cookie in transit** — such a deployment cannot mark the browser cookie `Secure`, so serving the same authority over a network can leak the session cookie; configure TLS on the Web carrier ([`dsh-host-webserver`](../../host/webserver/README.md)) to have the cookie marked `Secure` and confined to TLS.
 - **There is no logout operation** — clearing the browser cookie ends one browser session; deleting the owner credential record and restarting `dsh` revokes every session.
 
 
@@ -85,5 +87,3 @@ None; this package neither assembles nor sends a provider request.
 None.
 
 </details>
-
-**Runtime invariant:** No companion is published. Browser-session verification reads the credential record asynchronously at the request that authorizes work, while the credentials companion owns record commit-event lifetime. Stream/reconnect sequencing and rpcId round-trip discipline are exercised directly by behavior specs, and route register/dispose symmetry is audited by the webserver companion.

package/README.zh.md

@@ -38,9 +38,11 @@ kind: "package-reference"
 
 每个 Host RPC 方法和 WebSocket 流都要求一个浏览器会话，不存在按方法区分的 loopback 层。每个进程生成一个随机启动令牌。`dsh-web-app` 打印并打开带 `?token=...` 的应用 URL，保留调用方的 authority 与挂载；`frontend-static` 把根路径和 index 请求交给 `ctx.connection.authorizeIndex`，后者只在 `GET /` 接受该令牌，写入绑定 authority 的签名 cookie，再重定向到干净的 `./`，移除令牌并保留请求目录。缺失、过期、畸形或 authority 不匹配的 cookie 会在 RPC 分发前得到 401。静态资源保持公开。HTTP 载体不在根路径交换之外接受 query token，也不接受 Authorization header token。
 
-cookie 签名密钥是 `ctx.credentials` 中由 `client-connection/browser-session` 拥有的 grant 记录。本地提供方把它持久化到 `$DSH_HOME/.credentials.yaml`；`BrowserAuth` 在 Connection 激活期间加载或创建该记录，并把密钥留在内存中，因此请求认证同步执行。删除或替换该记录会在下一次 Connection 激活时生效。cookie 携带绝对签发与过期区间，`cookieMaxAgeDays` 默认设为 30 天，并在确定性名称与签名 payload 中同时绑定规范化 hostname 和 port。它是 host-only、`Path=/`、`HttpOnly`、`SameSite=Strict`；随附服务器使用 loopback HTTP，因此刻意不设置 `Secure`。
+cookie 签名密钥是 `ctx.credentials` 中由 `client-connection/browser-session` 拥有的 grant 记录。本地提供方把它持久化到 `$DSH_HOME/.credentials.yaml`；`BrowserAuth` 在 Connection 激活期间加载或创建该记录，并把密钥留在内存中，因此请求认证同步执行。删除或替换该记录会在下一次 Connection 激活时生效。cookie 携带绝对签发与过期区间，`cookieMaxAgeDays` 默认设为 30 天，并在确定性名称与签名 payload 中同时绑定规范化 hostname 和 port。它是 host-only、`Path=/`、`HttpOnly`、`SameSite=Strict`；收到该 index 请求的监听器提供 TLS 时才带上 `Secure`，且只由该监听器自身的协议决定，`publicUrl` 声明与转发头都不参与判断。
 
-认证之前，每个请求仍经过 `src/api-request-trust.ts`。其 `Host` 必须是 loopback，或与 `trustedHosts` 条目匹配：带端口的 `host:port` 精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化。若附带 `Origin`，它必须等于该 Host；`sec-fetch-site: cross-site` 一律拒绝。畸形配置 authority 会让插件加载失败。这些检查防御 DNS rebinding 与跨站浏览器请求，绝不建立身份。Host/Origin 校验失败返回 403；Host 可信但未认证的请求返回 401。`dsh web --host 0.0.0.0` 仍不受支持。决策记录：[浏览器请求信任](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md)与[浏览器令牌认证](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.zh.md)。
+HTTPS cookie 名称与签名 audience 包含 `https:` scheme，因此即使 hostname 和 port 相同，HTTP cookie 也无法通过 TLS 监听器的认证。默认端口按监听器的 scheme 归一化。既有 HTTP cookie audience 保持不变。
+
+认证之前，每个请求都经过 `src/api-request-trust.ts`。其 `Host` 必须是 loopback、等于监听器的绑定 IP 字面量（端口不限），或与 `trustedHosts` 条目匹配：带端口的 `host:port` 精确匹配，不带端口的条目匹配任意端口。Host 与配置条目按监听器的 scheme 做 WHATWG 默认端口归一化，不采信转发 header 或 `Origin`。附带的 HTTP(S) `Origin` 必须指向同一 authority；此时按 Origin 的 scheme 解析 Host，以支持 HTTPS 代理转发到 HTTP 上游；`sec-fetch-site: cross-site` 一律拒绝。畸形配置 authority 会让插件加载失败。`allowsRemoteAuthorities` 报告 `trustedHosts` 是否允许非 loopback authority；接受绑定 IP 不会改变该列表。这些检查防御 DNS rebinding 与跨站浏览器请求，绝不建立身份。Host/Origin 校验失败返回 403；Host 可信但未认证的请求返回 401。`dsh web --host 0.0.0.0` 不受支持。决策记录：[浏览器请求信任](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md)与[浏览器令牌认证](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.zh.md)。
 
 每个被接纳的请求都代表同一个 Peer——操作者。`ctx.connection.operator` 就是这个 `PeerScope`：其 `ctx` 是拥有连接期注册的 Cordis scope，随 Connection 一起释放。`ctx.connection.admit(request)` 执行信任与认证检查，以拒绝状态或操作者作答；`/api` 路由与 Gateway 的 WebSocket 升级都经它接纳，每个 RPC 处理器都收到本次调用的 Peer。`OperatorPeer` 对外导出，供没有 Connection 的组合（例如 Gateway 的进程内载体）以同一约定拥有一个操作者 scope。
 
@@ -51,7 +53,7 @@ cookie 签名密钥是 `ctx.credentials` 中由 `client-connection/browser-sessi
 
 API Gateway Client 把内部 `$events` 逻辑流注册为唯一 generation source，与有无 `$on` 订阅无关。Host 在 API Remotes source factory 同步挂好所有增量 listener 后，先发送唯一 `{ type: 'ready', clientId, host: { home } }` 项，再发送事件。`ConnectionController` 仅在收到该 ready 项后发布 generation 并调用 `onConnected`，因此 baseline 不会跑在增量 listener 前面。
 
-`$events` 结束、Remote 流报错、收到非 ready 首项或畸形事件项，都会使当前 generation 失效。默认情况下，挂起的握手在 3 秒后记录 Host 响应缓慢告警，在 15 秒后记录就绪超时并中止，包含等待物理 socket 的时间。取消后，source 必须停止投递、释放资源并结束，替换 source 才能启动；已取消 source 迟到的 ready 不能发布 generation。浏览器报告网络可用时，Controller 发布 `connecting`，并在 500ms、1s、2s、4s、8s 与 10s 上限内采用 50%–100% 抖动重试，达到终档后继续尝试直到恢复。每次重试都要求 Gateway 替换一次物理 WebSocket，再重开 `$events`。[持续恢复决策](../../../.agents/notes/implemented/bug-fix/2026-09-05-continuous-client-recovery.zh.md)规定握手期限与重试策略。
+`$events` 结束、Remote 流报错、收到非 ready 首项或畸形事件项，都会使当前 generation 失效。默认情况下，挂起的握手在 3 秒后记录 Host 响应缓慢告警，在 15 秒后记录就绪超时并中止，包含等待物理 socket 的时间。取消后，source 必须停止投递、释放资源并结束，替换 source 才能启动；已取消 source 迟到的 ready 不能发布 generation。浏览器报告网络可用时，Controller 发布 `connecting`，并在 500ms、1s、2s、4s、8s 与 10s 上限内采用 50%–100% 抖动重试，达到终档后继续尝试直到恢复。每次重试都要求 Gateway 替换一次物理 WebSocket，再重开 `$events`。
 
 `ctx.connection.reconnect()` 会中断活动工作、重置序列，并立即开始 retry 1。浏览器 `offline` 会中断活动工作、发布 `disconnected` 并暂停自动尝试；下一次 `online` 转换会重置序列并从 500ms 档开始。只有 ready 项会发布 `connected`。Gateway mux 不拥有独立重试调度。
 
@@ -72,7 +74,7 @@ API Gateway Client 把内部 `$events` 逻辑流注册为唯一 generation sourc
 <a id="known-limitations-and-deferred-work"></a>
 
 - **缓冲型 `/api` 路由会把每个请求体保留在内存里**：`maxRequestBodyBytes`（默认 300 MiB，按默认 200 MiB 图片总量上限经 base64 膨胀加信封余量得出）限制普通图片与 RPC 信封。显式启用的流式路由接收带背压的分块并绕过总量上限；路由实现负责持久化、取消与存储配额。
-- **浏览器 cookie 不带 `Secure`**：当前随产品提供的传输方式是 loopback HTTP；若部署经明文网络暴露同一 authority，bearer cookie 可能在传输中泄露。
+- **明文 HTTP 监听器会在传输中暴露 bearer cookie**：此类部署无法给浏览器 cookie 加 `Secure`；若把同一 authority 暴露到网络上，会话 cookie 可能泄露；在 Web 载体（[`dsh-host-webserver`](../../host/webserver/README.zh.md)）上配置 TLS 即可让 cookie 带上 `Secure` 并只经 TLS 发送。
 - **没有 logout 操作**：清除浏览器 cookie 会结束单个浏览器会话；删除 owner 凭据记录并重启 `dsh` 会撤销全部会话。
 
 
@@ -85,5 +87,3 @@ API Gateway Client 把内部 `$events` 逻辑流注册为唯一 generation sourc
 无。
 
 </details>
-
-**运行时不变式：** 不发布伴生入口。浏览器会话验证会在请求授权工作时异步读取凭据记录，而记录的 commit-event 生命周期由 credentials 伴生入口负责；流与重连的时序及 rpcId 往返约束由行为规范直接验证，路由注册与 dispose（资源释放）的对称性由 webserver 伴生入口审计。

package/lib/index.js

@@ -131,23 +131,27 @@ function isLoopbackHostname(hostname) {
 * the attacker's domain while the socket reaches this server) and cross-site
 * requests fired from a malicious page. The Host fence binds every request,
 * browser-looking or not: over plain HTTP a browser attaches neither Origin
-* nor Fetch-Metadata to reads (images and navigations — those
-* headers go only to trustworthy destinations), so an unmarked request may
-* still be a rebound browser read and Host is the one header rebinding cannot
-* forge. Non-browser and remote clients pass the same fence via loopback,
-* deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
-* Network reachability and authentication stay out of scope: binding policy
-* belongs to the webserver config, and this fence is not an auth layer.
+* nor Fetch-Metadata to reads (images and navigations — those headers go only
+* to trustworthy destinations), so an unmarked request may still be a rebound
+* browser read and Host is the one header rebinding cannot forge. Non-browser
+* and remote clients pass the same fence via loopback, the listener's bind IP
+* literal, or a declared `trustedHosts` authority. Binding policy belongs to
+* the webserver config; this fence never establishes identity.
 */
 function header$1(headers, name) {
 	if (headers instanceof Headers) return headers.get(name) ?? void 0;
 	const value = headers[name];
 	return typeof value === "string" ? value : void 0;
 }
-/** Normalized URL of a Host-header authority (hostname lowercased, default port stripped, IPv6 bracketed), or undefined when unparsable. */
-function parseAuthority(authority) {
+/**
+* Normalized URL of a bare authority (hostname lowercased, default port
+* stripped, IPv6 bracketed), or undefined when unparsable.
+* @param authority - `host` or `host:port` text.
+* @param scheme - special scheme to parse under; its default port is the one stripped.
+*/
+function parseAuthority(authority, scheme = "http:") {
 	try {
-		return new URL(`http://${authority}`);
+		return new URL(`${scheme}//${authority}`);
 	} catch {
 		return;
 	}
@@ -179,43 +183,83 @@ function assertTrustedAuthority(entry) {
 * shapes like `host:port ` as port-less.
 */
 function canonicalAuthority(entry, entryUrl) {
-	const port = entryUrl.port !== "" ? entryUrl.port : new URL(`https://${entry}`).port;
+	const port = entryUrl.port !== "" ? entryUrl.port : new URL(`${entryUrl.protocol === "http:" ? "https:" : "http:"}//${entry}`).port;
 	return port === "" ? entryUrl.hostname : `${entryUrl.hostname}:${port}`;
 }
 /**
 * Whether the request authority matches a `trustedHosts` entry. An entry with
 * an explicit port matches that exact authority; a port-less entry matches the
-* hostname on any port (the shape the CLI derives for IP-literal LAN serving,
-* where the bound port may be OS-assigned). Both sides compare through WHATWG
-* normalization, so case and a redundant `:80` never decide trust.
+* hostname on any port. Both sides compare through WHATWG normalization,
+* so case and a redundant scheme-default port never decide trust.
 */
-function isTrustedAuthority(hostUrl, trustedHosts) {
+function isTrustedAuthority(hostUrl, trustedHosts, protocol) {
 	return trustedHosts.some((entry) => {
-		const entryUrl = parseAuthority(entry);
+		const entryUrl = parseAuthority(entry, protocol);
 		if (entryUrl === void 0) return false;
 		return canonicalAuthority(entry, entryUrl) === entryUrl.hostname ? entryUrl.hostname === hostUrl.hostname : entryUrl.host === hostUrl.host;
 	});
 }
 /**
+* Classify an authority already accepted by {@link assertTrustedAuthority}.
+* @param entry - the configured authority, verbatim.
+* @returns true unless the entry parses as a loopback hostname.
+*/
+function isRemoteAuthority(entry) {
+	const url = parseAuthority(entry);
+	return url === void 0 || !isLoopbackHostname(url.hostname);
+}
+/**
+* Whether a parsed authority names the deployment's own bind address. A browser
+* dialing that literal sends it as Host, and accepting it grants nothing
+* further: the literal is no rebinding target, the Origin and cross-site checks
+* still apply, and it stays outside `trustedHosts`. Matching ignores the port,
+* like a port-less entry, and any `%zone` id (an interface selector, not
+* address text).
+*/
+function isBindAddressAuthority(hostUrl, bindHost) {
+	if (bindHost === void 0) return false;
+	const zoneAt = bindHost.indexOf("%");
+	const address = zoneAt === -1 ? bindHost : bindHost.slice(0, zoneAt);
+	const bindUrl = parseAuthority(address.includes(":") ? `[${address}]` : address);
+	return bindUrl !== void 0 && bindUrl.hostname === hostUrl.hostname;
+}
+/**
 * Decide whether one /api request may reach the RPC bridge.
 * @param request - Node HTTP or Fetch request facts (headers).
 * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
-* @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
+* @param bindHost - the listener's own bind IP literal, accepted on any port independently of `trustedHosts`.
+* @param protocol - listener protocol for default Host ports; HTTP when no Web carrier is mounted.
+* @returns true when the Host is ours (loopback, the bind address, or trusted) and any attached browser markers are same-origin.
 */
-function isTrustedApiRequest(request, trustedHosts) {
+function isTrustedApiRequest(request, trustedHosts, bindHost, protocol = "http:") {
 	const host = header$1(request.headers, "host");
 	if (host === void 0) return false;
-	const hostUrl = parseAuthority(host);
+	const hostUrl = parseAuthority(host, protocol);
 	if (hostUrl === void 0) return false;
-	if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) return false;
+	if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts, protocol) && !isBindAddressAuthority(hostUrl, bindHost)) return false;
 	if (header$1(request.headers, "sec-fetch-site") === "cross-site") return false;
 	const origin = header$1(request.headers, "origin");
 	if (origin === void 0) return true;
+	return isSameAuthorityOrigin(origin, host);
+}
+/**
+* Compare Host under the Origin's HTTP(S) scheme so default ports normalize
+* consistently. The transport may remain HTTP behind an HTTPS proxy.
+* @param origin - verbatim Origin header value.
+* @param host - verbatim Host header value already accepted by the Host fence.
+* @returns true only when the Origin is this listener's own `http(s)` authority.
+*/
+function isSameAuthorityOrigin(origin, host) {
+	let originUrl;
 	try {
-		return new URL(origin).host === hostUrl.host;
+		originUrl = new URL(origin);
 	} catch {
 		return false;
 	}
+	const scheme = originUrl.protocol === "https:" ? "https:" : originUrl.protocol === "http:" ? "http:" : void 0;
+	if (scheme === void 0) return false;
+	const hostUrl = parseAuthority(host, scheme);
+	return hostUrl !== void 0 && originUrl.host === hostUrl.host;
 }
 //#endregion
 //#region lib/types/browser-auth.js
@@ -253,12 +297,13 @@ function header(headers, name) {
 	const value = headers[name];
 	return typeof value === "string" ? value : void 0;
 }
-/** Canonical request authority used as the cookie name and signed audience. */
-function requestAuthority(headers) {
+/** Protocol-scoped cookie audience; HTTP retains its existing authority-only spelling. */
+function requestAudience(headers, secure) {
 	const host = header(headers, "host");
 	if (host === void 0) return void 0;
 	try {
-		return new URL(`http://${host}`).host;
+		const url = new URL(`${secure ? "https:" : "http:"}//${host}`);
+		return secure ? url.origin : url.host;
 	} catch {
 		return;
 	}
@@ -293,8 +338,9 @@ function cookieValue(headerValue, name) {
 	}
 }
 /** Serialize the fixed browser-session attributes; generated names and values are cookie-safe base64url. */
-function sessionCookie(name, value, expiresAt, maxAgeSeconds) {
-	return `${name}=${value}; Max-Age=${String(maxAgeSeconds)}; Path=/; Expires=${new Date(expiresAt).toUTCString()}; HttpOnly; SameSite=Strict`;
+function sessionCookie(name, value, expiresAt, maxAgeSeconds, secure) {
+	const attributes = `${name}=${value}; Max-Age=${String(maxAgeSeconds)}; Path=/; Expires=${new Date(expiresAt).toUTCString()}; HttpOnly; SameSite=Strict`;
+	return secure ? `${attributes}; Secure` : attributes;
 }
 function signature(secret, body) {
 	return createHmac("sha256", secret).update(body).digest();
@@ -383,14 +429,18 @@ var BrowserAuth = class BrowserAuth {
 	* 401 response.
 	* @param req - incoming root or configured-index request.
 	* @param res - response owned when this method returns false.
+	* @param secure - whether the listener receiving this request serves TLS; the
+	* minted cookie carries `Secure` when it does. Only that listener's own
+	* protocol decides, never a `publicUrl` announcement or a forwarded header:
+	* those describe a hop this process does not terminate.
 	* @returns true only when the caller may serve index.html.
 	*/
-	authorizeIndex(req, res) {
+	authorizeIndex(req, res, secure = false) {
 		/* v8 ignore next -- node:http always supplies url on server requests. */
 		const url = new URL(req.url ?? "/", "http://dsh.invalid");
 		const tokens = url.searchParams.getAll(TOKEN_QUERY);
 		if (tokens.length > 0) {
-			const authority = requestAuthority(req.headers);
+			const authority = requestAudience(req.headers, secure);
 			if (req.method === "GET" && url.pathname === "/" && tokens.length === 1 && authority !== void 0 && tokenMatches(tokens.join(""), this.launchToken)) {
 				const issuedAt = Date.now();
 				const expiresAt = issuedAt + this.maxAgeMilliseconds;
@@ -404,12 +454,12 @@ var BrowserAuth = class BrowserAuth {
 					"cache-control": "no-store",
 					"location": "./",
 					"referrer-policy": "no-referrer",
-					"set-cookie": sessionCookie(cookieName(authority), value, expiresAt, Math.floor(this.maxAgeMilliseconds / 1e3))
+					"set-cookie": sessionCookie(cookieName(authority), value, expiresAt, Math.floor(this.maxAgeMilliseconds / 1e3), secure)
 				});
 				res.end();
 				return false;
 			}
-			if (req.method === "GET" && url.pathname === "/" && this.isAuthenticated(req)) {
+			if (req.method === "GET" && url.pathname === "/" && this.isAuthenticated(req, secure)) {
 				res.writeHead(303, {
 					"cache-control": "no-store",
 					"location": "./",
@@ -421,17 +471,18 @@ var BrowserAuth = class BrowserAuth {
 			this.writeUnauthorized(req, res);
 			return false;
 		}
-		if (this.isAuthenticated(req)) return true;
+		if (this.isAuthenticated(req, secure)) return true;
 		this.writeUnauthorized(req, res);
 		return false;
 	}
 	/**
 	* Verify the authority-bound browser cookie on a Host request.
 	* @param request - request headers carrying Host and Cookie.
+	* @param secure - whether the receiving listener uses TLS, including its default port.
 	* @returns true only for an unexpired cookie signed by this activation's loaded secret.
 	*/
-	isAuthenticated(request) {
-		const authority = requestAuthority(request.headers);
+	isAuthenticated(request, secure = false) {
+		const authority = requestAudience(request.headers, secure);
 		const rawCookie = header(request.headers, "cookie");
 		if (authority === void 0 || rawCookie === void 0) return false;
 		const value = cookieValue(rawCookie, cookieName(authority));
@@ -556,6 +607,7 @@ var HostConnectionService = class extends Service {
 	operator;
 	interceptors = /* @__PURE__ */ new Map();
 	fetchRoutes = /* @__PURE__ */ new Map();
+	allowsRemoteAuthorities;
 	/**
 	* Provide the Host half over the active HTTP server.
 	* @param ctx - owning Connection plugin context.
@@ -568,6 +620,7 @@ var HostConnectionService = class extends Service {
 		this.browserAuth = browserAuth;
 		this.operator = new OperatorPeer(ctx);
 		ctx.effect(() => () => this.operator.dispose(), "client-connection: operator Peer");
+		this.allowsRemoteAuthorities = trustedHosts.some(isRemoteAuthority);
 	}
 	/** Generic channel registry scoped to the Context reading this service. */
 	get rpc() {
@@ -582,19 +635,22 @@ var HostConnectionService = class extends Service {
 		const owner = this.ctx;
 		return { register: (route) => this.registerFetchRoute(owner, route) };
 	}
-	/** Apply the configured Host/Origin fence, then browser authentication. */
+	/** Apply the Host/Origin fence, then browser authentication. */
 	requestRejection(request) {
-		if (!isTrustedApiRequest(request, this.trustedHosts)) return 403;
-		return this.browserAuth.isAuthenticated(request) ? void 0 : 401;
+		const carrier = this.ctx.get("webServer");
+		if (!isTrustedApiRequest(request, this.trustedHosts, carrier?.host, carrier?.protocol ?? "http:")) return 403;
+		return this.browserAuth.isAuthenticated(request, carrier?.protocol === "https:") ? void 0 : 401;
 	}
 	/** A request that passes the fence and authentication speaks for the operator. */
 	admit(request) {
 		const rejection = this.requestRejection(request);
 		return rejection === void 0 ? { peer: this.operator } : { rejection };
 	}
-	/** Authenticate an index request through the process-token exchange or cookie. */
+	/**
+	* Authenticate an index request; native TLS listeners mint Secure cookies.
+	*/
 	authorizeIndex(request, response) {
-		return this.browserAuth.authorizeIndex(request, response);
+		return this.browserAuth.authorizeIndex(request, response, this.ctx.get("webServer")?.protocol === "https:");
 	}
 	/** Add this process's launch token to the clean application URL. */
 	authenticatedUrl(baseUrl) {

package/lib/types/api-request-trust.d.ts

@@ -4,13 +4,12 @@
  * the attacker's domain while the socket reaches this server) and cross-site
  * requests fired from a malicious page. The Host fence binds every request,
  * browser-looking or not: over plain HTTP a browser attaches neither Origin
- * nor Fetch-Metadata to reads (images and navigations — those
- * headers go only to trustworthy destinations), so an unmarked request may
- * still be a rebound browser read and Host is the one header rebinding cannot
- * forge. Non-browser and remote clients pass the same fence via loopback,
- * deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
- * Network reachability and authentication stay out of scope: binding policy
- * belongs to the webserver config, and this fence is not an auth layer.
+ * nor Fetch-Metadata to reads (images and navigations — those headers go only
+ * to trustworthy destinations), so an unmarked request may still be a rebound
+ * browser read and Host is the one header rebinding cannot forge. Non-browser
+ * and remote clients pass the same fence via loopback, the listener's bind IP
+ * literal, or a declared `trustedHosts` authority. Binding policy belongs to
+ * the webserver config; this fence never establishes identity.
  */
 import type { ConnectionTrustRequest } from './rpc.ts';
 /**
@@ -28,11 +27,19 @@ import type { ConnectionTrustRequest } from './rpc.ts';
  * @param entry - the configured value, verbatim.
  */
 export declare function assertTrustedAuthority(entry: string): void;
+/**
+ * Classify an authority already accepted by {@link assertTrustedAuthority}.
+ * @param entry - the configured authority, verbatim.
+ * @returns true unless the entry parses as a loopback hostname.
+ */
+export declare function isRemoteAuthority(entry: string): boolean;
 /**
  * Decide whether one /api request may reach the RPC bridge.
  * @param request - Node HTTP or Fetch request facts (headers).
  * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
- * @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
+ * @param bindHost - the listener's own bind IP literal, accepted on any port independently of `trustedHosts`.
+ * @param protocol - listener protocol for default Host ports; HTTP when no Web carrier is mounted.
+ * @returns true when the Host is ours (loopback, the bind address, or trusted) and any attached browser markers are same-origin.
  */
-export declare function isTrustedApiRequest(request: ConnectionTrustRequest, trustedHosts: readonly string[]): boolean;
+export declare function isTrustedApiRequest(request: ConnectionTrustRequest, trustedHosts: readonly string[], bindHost?: string, protocol?: 'http:' | 'https:'): boolean;
 //# sourceMappingURL=api-request-trust.d.ts.map

package/lib/types/browser-auth.d.ts

@@ -33,15 +33,20 @@ export declare class BrowserAuth {
      * 401 response.
      * @param req - incoming root or configured-index request.
      * @param res - response owned when this method returns false.
+     * @param secure - whether the listener receiving this request serves TLS; the
+     * minted cookie carries `Secure` when it does. Only that listener's own
+     * protocol decides, never a `publicUrl` announcement or a forwarded header:
+     * those describe a hop this process does not terminate.
      * @returns true only when the caller may serve index.html.
      */
-    authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse): boolean;
+    authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse, secure?: boolean): boolean;
     /**
      * Verify the authority-bound browser cookie on a Host request.
      * @param request - request headers carrying Host and Cookie.
+     * @param secure - whether the receiving listener uses TLS, including its default port.
      * @returns true only for an unexpired cookie signed by this activation's loaded secret.
      */
-    isAuthenticated(request: ConnectionTrustRequest): boolean;
+    isAuthenticated(request: ConnectionTrustRequest, secure?: boolean): boolean;
     private writeUnauthorized;
 }
 //# sourceMappingURL=browser-auth.d.ts.map

package/lib/types/index.d.ts

@@ -33,11 +33,9 @@ export interface ConnectionConfig {
     recovery?: ConnectionRecoveryConfig;
     /**
      * Authorities this deployment serves beyond loopback: exact `host:port`, or
-     * port-less `host` matching any port. The /api trust fence refuses any
-     * request whose Host is neither loopback nor listed here, so a
-     * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
-     * by; the Web runtime derives LAN IP literals from an active all-interface
-     * bind. An entry that is not a bare, canonical authority fails plugin load.
+     * port-less `host` matching any port. The fence accepts loopback and the
+     * listener's own bind IP independently; other remote authorities require
+     * an entry here. A non-canonical or non-bare authority fails plugin load.
      */
     trustedHosts?: string[];
     /** Absolute browser-session lifetime in days. Default: 30. */

package/lib/types/rpc-host.d.ts

@@ -17,6 +17,7 @@ export declare class HostConnectionService extends Service implements HostConnec
     readonly operator: PeerScope;
     private readonly interceptors;
     private readonly fetchRoutes;
+    readonly allowsRemoteAuthorities: boolean;
     /**
      * Provide the Host half over the active HTTP server.
      * @param ctx - owning Connection plugin context.
@@ -28,11 +29,13 @@ export declare class HostConnectionService extends Service implements HostConnec
     get rpc(): HostConnectionRpc;
     /** Exact Fetch-route registry scoped to the Context reading this service. */
     get fetch(): HostConnectionFetch;
-    /** Apply the configured Host/Origin fence, then browser authentication. */
+    /** Apply the Host/Origin fence, then browser authentication. */
     requestRejection(request: ConnectionTrustRequest): ConnectionRequestRejection;
     /** A request that passes the fence and authentication speaks for the operator. */
     admit(request: ConnectionTrustRequest): PeerAdmission;
-    /** Authenticate an index request through the process-token exchange or cookie. */
+    /**
+     * Authenticate an index request; native TLS listeners mint Secure cookies.
+     */
     authorizeIndex(request: ConnectionIndexRequest, response: ConnectionIndexResponse): boolean;
     /** Add this process's launch token to the clean application URL. */
     authenticatedUrl(baseUrl: string): string;

package/lib/types/rpc.d.ts

@@ -153,6 +153,11 @@ export interface HostConnectionHandle {
     readonly fetch: HostConnectionFetch;
     /** The operator Peer every admitted request speaks for; its scope lives as long as Connection. */
     readonly operator: PeerScope;
+    /**
+     * Whether this deployment accepts authorities beyond loopback: true only
+     * when a validated `trustedHosts` entry names a non-loopback hostname.
+     */
+    readonly allowsRemoteAuthorities: boolean;
     /**
      * Compose exact Fetch routes and the shared-channel RPC interceptor.
      * @param channel - shared channel mounted by Connection.
@@ -175,6 +180,8 @@ export interface HostConnectionHandle {
     admit(request: ConnectionTrustRequest): PeerAdmission;
     /**
      * Authenticate one frontend index request, owning a token redirect or 401.
+     * The cookie this mints is `Secure` when the mounted Web carrier serves TLS,
+     * which only that listener's protocol decides.
      * @param request - root or configured-index HTTP request.
      * @param response - response owned when the result is false.
      * @returns true only when the frontend may serve index.html.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-connection",
   "description": "Authenticated RPC transport and generation lifecycle",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -34,9 +34,9 @@
   },
   "license": "MIT",
   "dependencies": {
-    "zod": "^4.4.3",
-    "@deepseek-ai/dsh-credentials": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4"
+    "@deepseek-ai/dsh-credentials": "0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "zod": "^4.4.3"
   },
   "files": [
     "lib/index.js",
@@ -44,17 +44,17 @@
     "lib/types/**/*.d.ts"
   ],
   "peerDependencies": {
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
-    "@deepseek-ai/cordis": "~4.0.4"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2"
   }
 }