@deepseek-ai/dsh-client-connection 0.2.1-alpha.1 → 0.2.1-alpha.3

package/lib/types/browser-auth.d.ts

@@ -1,4 +1,6 @@
 /** Browser-session authentication for the Host Connection carrier. */
+import type { PeerId } from '@deepseek-ai/dsh-typert-protocol';
+import { type ConnectionInteractions } from './connect-protocol.ts';
 import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
 import type { ConnectionIndexRequest, ConnectionIndexResponse, ConnectionTrustRequest } from './rpc.ts';
 /**
@@ -33,15 +35,36 @@ export declare class BrowserAuth {
      * 401 response.
      * @param req - incoming root or configured-index request.
      * @param res - response owned when this method returns false.
+     * @param secure - whether the listener receiving this request serves TLS; the
+     * minted cookie carries `Secure` when it does. Only that listener's own
+     * protocol decides, never a `publicUrl` announcement or a forwarded header:
+     * those describe a hop this process does not terminate.
      * @returns true only when the caller may serve index.html.
      */
-    authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse): boolean;
+    authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse, secure?: boolean): boolean;
+    /**
+     * Exchange the launch token for an independent API operator; omitted interactions default to none.
+     * @param req - trusted GET request on /connect with at most one interactions declaration.
+     * @param res - response owned to completion, redirecting to the API mux on success.
+     * @param secure - whether the receiving listener serves TLS.
+     * @param publish - synchronously create the operator before exposing its signed credential.
+     */
+    authorizeConnect(req: ConnectionIndexRequest, res: ConnectionIndexResponse, secure: boolean, publish: (interactions: ConnectionInteractions) => PeerId): void;
     /**
      * Verify the authority-bound browser cookie on a Host request.
      * @param request - request headers carrying Host and Cookie.
+     * @param secure - whether the receiving listener uses TLS, including its default port.
      * @returns true only for an unexpired cookie signed by this activation's loaded secret.
      */
-    isAuthenticated(request: ConnectionTrustRequest): boolean;
+    isAuthenticated(request: ConnectionTrustRequest, secure?: boolean): boolean;
+    /**
+     * Verify an API credential without creating or reviving its operator.
+     * @param request - request headers carrying Host and Cookie.
+     * @param secure - whether the receiving listener uses TLS.
+     * @returns the signed operator id, or undefined for invalid, expired, or browser cookies.
+     */
+    authenticateApi(request: ConnectionTrustRequest, secure?: boolean): PeerId | undefined;
+    private authenticate;
     private writeUnauthorized;
 }
 //# sourceMappingURL=browser-auth.d.ts.map

package/lib/types/client/index.d.ts

@@ -3,6 +3,10 @@ import type { Context } from '@deepseek-ai/cordis';
 import { type ConnectionRecoveryConfig, type ConnectionGeneration, type ConnectionGenerationSource, type ConnectionSinks, type ConnectionState } from './connection.ts';
 import { type RpcFetch, type RpcStreamOpen } from './rpc.ts';
 import type { ClientConnectionRpc } from '../rpc.ts';
+import type { ConnectionInteractions } from '../connect-protocol.ts';
+import { type ConnectionWebSocket, type ConnectionWebSocketFactory } from './socket.ts';
+export type { ConnectionInteractions } from '../connect-protocol.ts';
+export type { ConnectionWebSocket, ConnectionWebSocketFactory } from './socket.ts';
 declare module '@deepseek-ai/cordis' {
     interface Events {
         /**
@@ -60,13 +64,15 @@ export interface ClientTransportHooks {
     /**
      * The transport owner declares the page owns the Host outright: the Host
      * runs inside a worker this page spawned, so no other party can reach it and
-     * the loopback stand-in for "the operator's own machine" is vacuous.
+     * the loopback stand-in for "the owner's own machine" is vacuous.
      * `ctx.connection.isLoopback` then reports the privileged surface reachable
      * regardless of the page authority. Only a shell that assembles its own
      * transport can set this; served pages never carry the global at all.
      */
     ownsHost?: boolean;
-    /** HTTP origin of a shell-owned Host when its WebSocket uses a different page origin. */
+    /** Authenticated WebSocket factory; omission uses the browser API and its cookie jar. */
+    createWebSocket?: ConnectionWebSocketFactory;
+    /** Host base URL for desktop or Node sockets; omission uses the document base. */
     streamBaseUrl?: string;
 }
 /** Browser location fields used to classify loopback authority. */
@@ -75,6 +81,8 @@ export interface ConnectionLocation {
 }
 /** Instance-local inputs for installing a Connection service. */
 export interface ConnectionInstallOptions {
+    /** Forwarded-event participation; omission selects answer for a page and none otherwise. */
+    readonly interactions?: ConnectionInteractions;
     /** Explicit physical carrier; omit for the browser HTTP + WebSocket carrier. */
     readonly transport?: ClientTransportHooks;
     /** Reconnect timing overrides; omitted fields use controller defaults. */
@@ -87,6 +95,8 @@ export interface ConnectionInstallOptions {
  * and reset callbacks; Connection stays independent of downstream domain state.
  */
 export interface ConnectionHandle {
+    /** Forwarded-event participation selected at installation. */
+    readonly interactions: ConnectionInteractions;
     /**
      * Whether the privileged surface is reachable: the page authority is
      * loopback, the transport declares the page owns the Host
@@ -99,6 +109,12 @@ export interface ConnectionHandle {
     readonly state: ConnectionStateSource;
     /** Generic logical RPC channels over the same Connection transport. */
     readonly rpc: ClientConnectionRpc;
+    /**
+     * Create a socket on the selected carrier; the channel owns framing and closing.
+     * @param path - absolute logical channel path, resolved beneath the Host mount.
+     * @returns a newly connecting socket using the installed authentication factory.
+     */
+    openWebSocket(path: string): ConnectionWebSocket;
     /** Reset retry progression and replace the current attempt immediately. */
     reconnect(): void;
     /**
@@ -125,7 +141,7 @@ export interface ConnectionLoop {
 /**
  * Install one Context-owned Connection service from explicit composition inputs.
  * @param ctx - client Cordis context.
- * @param options - physical carrier, reconnect timing, and page location.
+ * @param options - interaction participation, physical carrier, reconnect timing, and page location.
  */
 export declare function installConnection(ctx: Context, options?: ConnectionInstallOptions): void;
 /**

package/lib/types/client/socket.d.ts

@@ -0,0 +1,50 @@
+/** Physical socket selection for browser, desktop, and authenticated Node connections. */
+/** Socket events consumed by the Gateway on browser and Node carriers. */
+export interface ConnectionWebSocketEventMap {
+    readonly open: object;
+    readonly error: object;
+    readonly close: object;
+    readonly message: {
+        readonly data: unknown;
+    };
+}
+/** Text WebSocket operations shared by the browser API and Node carriers. */
+export interface ConnectionWebSocket {
+    /** Standard WebSocket state, from CONNECTING (0) through CLOSED (3). */
+    readonly readyState: number;
+    /** @param data - complete text frame to send. */
+    send(data: string): void;
+    /**
+     * @param code - protocol close code.
+     * @param reason - peer-facing close explanation.
+     */
+    close(code?: number, reason?: string): void;
+    /**
+     * @param event - physical socket event.
+     * @param listener - callback for that event.
+     * @param options - whether the callback is removed after its first delivery.
+     */
+    addEventListener<Event extends keyof ConnectionWebSocketEventMap>(event: Event, listener: (event: ConnectionWebSocketEventMap[Event]) => void, options?: {
+        readonly once?: boolean;
+    }): void;
+    /**
+     * @param event - physical socket event.
+     * @param listener - previously registered callback.
+     */
+    removeEventListener<Event extends keyof ConnectionWebSocketEventMap>(event: Event, listener: (event: ConnectionWebSocketEventMap[Event]) => void): void;
+}
+/**
+ * Create an authenticated socket; its consumer owns framing and closing.
+ * @param url - absolute WebSocket URL beneath the selected Host mount.
+ * @returns a newly connecting socket, before it emits open or failure.
+ */
+export type ConnectionWebSocketFactory = (url: string) => ConnectionWebSocket;
+/**
+ * Resolve a logical channel against the explicit Host or the page's document base.
+ * @param path - absolute logical channel path.
+ * @param factory - authenticated socket factory; omission uses the browser API.
+ * @param baseUrl - Host base URL, required outside a document.
+ * @returns a socket owned by the calling channel.
+ */
+export declare function openConnectionWebSocket(path: string, factory?: ConnectionWebSocketFactory, baseUrl?: string): ConnectionWebSocket;
+//# sourceMappingURL=socket.d.ts.map

package/lib/types/connect-protocol.d.ts

@@ -0,0 +1,6 @@
+/** API connection inputs shared by the Host and its clients. */
+/** Whether a Peer participates in forwarded human interactions. */
+export type ConnectionInteractions = 'answer' | 'none';
+/** Launch-token exchange route for API clients. */
+export declare const CONNECT_PATH = "/connect";
+//# sourceMappingURL=connect-protocol.d.ts.map

package/lib/types/http-bridge.d.ts

@@ -3,6 +3,7 @@
  * web carrier; the fetch-shaped handler itself is transport-agnostic).
  */
 import type { IncomingMessage } from 'node:http';
+import type { PeerScope } from '@deepseek-ai/dsh-typert-protocol';
 import type { ConnectionFetchHandler } from './rpc.ts';
 /** Default carrier cap for all HTTP RPC bodies: sized for the default
  * aggregate image limit (200 MiB) after base64 expansion plus envelope
@@ -25,8 +26,9 @@ interface BridgeServerResponse {
  * @param req - incoming node:http request.
  * @param res - node:http response the bridge writes and owns to completion.
  * @param apiHandler - fetch-shaped API carrier the request is dispatched to.
+ * @param peer - Peer the carrier admitted the request as.
  * @param maxRequestBodyBytes - maximum bytes buffered for a buffered route.
  */
-export declare function bridge(req: IncomingMessage, res: BridgeServerResponse, apiHandler: ConnectionFetchHandler, maxRequestBodyBytes?: number): Promise<void>;
+export declare function bridge(req: IncomingMessage, res: BridgeServerResponse, apiHandler: ConnectionFetchHandler, peer: PeerScope, maxRequestBodyBytes?: number): Promise<void>;
 export {};
 //# sourceMappingURL=http-bridge.d.ts.map

package/lib/types/index.d.ts

@@ -3,10 +3,12 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import z from '@deepseek-ai/schemastery';
 import { type ConnectionRecoveryConfig } from './recovery-config.ts';
-export type { PeerAdmission, ConnectionFetchMethod, ConnectionFetchHandler, ConnectionFetchRoute, ConnectionIndexRequest, ConnectionIndexResponse, ConnectionRpcEndpointMatcher, ConnectionRpcAttachment, ConnectionRpcFailure, ConnectionRpcHandler, ConnectionRpcHandlerResult, ConnectionRequestRejection, ConnectionRpcResult, ConnectionRequestBodyMode, ConnectionTrustRequest, ClientRequest, HostConnectionHandle, HostConnectionFetch, HostConnectionRpc, RpcMessage, ServerResponse, } from './rpc.ts';
-export type { PeerId, PeerScope, RemoteInvocation } from '@deepseek-ai/dsh-typert-protocol';
+export type { PeerAdmission, ConnectionAdmission, ConnectionFetchMethod, ConnectionFetchHandler, ConnectionFetchRoute, ConnectionIndexRequest, ConnectionIndexResponse, ConnectionRpcEndpointMatcher, ConnectionRpcAttachment, ConnectionRpcFailure, ConnectionRpcHandler, ConnectionRpcHandlerResult, ConnectionRequestRejection, ConnectionRpcResult, ConnectionRequestBodyMode, ConnectionTrustRequest, ClientRequest, HostConnectionHandle, HostConnectionFetch, HostConnectionRpc, RpcMessage, ServerResponse, } from './rpc.ts';
+export type { PeerId, PeerScope, Principal, RemoteInvocation } from '@deepseek-ai/dsh-typert-protocol';
 export { RpcId, transportError } from './rpc.ts';
-export { OperatorPeer } from './operator-peer.ts';
+export { Peer } from './peer.ts';
+export type { PeerOptions } from './peer.ts';
+export { CONNECT_PATH, type ConnectionInteractions } from './connect-protocol.ts';
 export { clientRequestSchema, rpcErrorSchema, rpcIdSchema, rpcMessageSchema, rpcResultSchema, serverResponseSchema, } from './rpc-schema.ts';
 export { HostConnectionService } from './rpc-host.ts';
 export { API_PATH } from './api-path.ts';
@@ -33,14 +35,12 @@ export interface ConnectionConfig {
     recovery?: ConnectionRecoveryConfig;
     /**
      * Authorities this deployment serves beyond loopback: exact `host:port`, or
-     * port-less `host` matching any port. The /api trust fence refuses any
-     * request whose Host is neither loopback nor listed here, so a
-     * non-loopback (`0.0.0.0`) deployment must declare the names it is reached
-     * by; the Web runtime derives LAN IP literals from an active all-interface
-     * bind. An entry that is not a bare, canonical authority fails plugin load.
+     * port-less `host` matching any port. The fence accepts loopback and the
+     * listener's own bind IP independently; other remote authorities require
+     * an entry here. A non-canonical or non-bare authority fails plugin load.
      */
     trustedHosts?: string[];
-    /** Absolute browser-session lifetime in days. Default: 30. */
+    /** Absolute browser and API cookie lifetime in days. Default: 30. */
     cookieMaxAgeDays?: number;
     /** Maximum buffered JSON body for every `/api` request. Default: 300 MiB. */
     maxRequestBodyBytes?: number;

package/lib/types/peer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The Peer: one party admitted to this Host. Its creator fixes the principal
+ * it speaks for and owns its lifetime; Gateway hands it to each Remote call as
+ * `invocation.peer`.
+ * @module @deepseek-ai/dsh-client-connection/src/peer
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { PeerId, PeerScope, Principal } from '@deepseek-ai/dsh-typert-protocol';
+/** Construction options for one {@link Peer}. */
+export interface PeerOptions {
+    /** Caller identity every call through this Peer speaks for. */
+    readonly principal: Principal;
+    /** Omission permits an event stream; non-owner Peers still cannot answer waterfalls. */
+    readonly interactions?: 'answer' | 'none';
+}
+/**
+ * One Peer's scope. The instance is its own scope key, so `scopeOf(peer.ctx)`
+ * returns it and events dispatched with `scopeTarget(subject, peer)` reach
+ * listeners registered through `peer.ctx` and nobody else.
+ */
+export declare class Peer implements PeerScope {
+    readonly id: PeerId;
+    readonly ctx: Context;
+    readonly principal: Principal;
+    readonly interactions: 'answer' | 'none';
+    readonly signal: AbortSignal;
+    private readonly scope;
+    /**
+     * @param owner - Context the scope fiber hangs under; disposing it disposes the Peer.
+     * @param options - the principal fixed for this Peer's lifetime.
+     */
+    constructor(owner: Context, options: PeerOptions);
+    /** Tear down every connection-lifetime registration; racing calls share one completion. */
+    dispose(): Promise<void>;
+}
+//# sourceMappingURL=peer.d.ts.map

package/lib/types/rpc-host.d.ts

@@ -1,8 +1,9 @@
 /** Host registry and HTTP adapter for generic Connection RPC channels. */
 import { Context, Service } from '@deepseek-ai/cordis';
-import type { PeerScope } from '@deepseek-ai/dsh-typert-protocol';
+import type { PeerScope, Principal } from '@deepseek-ai/dsh-typert-protocol';
+import type { ConnectionInteractions } from './connect-protocol.ts';
 import type { BrowserAuth } from './browser-auth.ts';
-import type { PeerAdmission, ConnectionIndexRequest, ConnectionIndexResponse, ConnectionFetchHandler, HostConnectionFetch, ConnectionRequestRejection, ConnectionTrustRequest, HostConnectionHandle, HostConnectionRpc } from './rpc.ts';
+import type { PeerAdmission, ConnectionAdmission, ConnectionIndexRequest, ConnectionIndexResponse, ConnectionFetchHandler, HostConnectionFetch, ConnectionRequestRejection, ConnectionTrustRequest, HostConnectionHandle, HostConnectionRpc } from './rpc.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /** Host Connection transport and RPC registrations. */
@@ -13,10 +14,14 @@ declare module '@deepseek-ai/cordis' {
 export declare class HostConnectionService extends Service implements HostConnectionHandle {
     private readonly trustedHosts;
     private readonly browserAuth;
-    /** The operator Peer every admitted request speaks for. */
-    readonly operator: PeerScope;
+    /** The Peer every authenticated browser connection shares. */
+    readonly browserPeer: PeerScope;
+    private readonly peers;
+    private readonly owner;
+    private disposed;
     private readonly interceptors;
     private readonly fetchRoutes;
+    readonly allowsRemoteAuthorities: boolean;
     /**
      * Provide the Host half over the active HTTP server.
      * @param ctx - owning Connection plugin context.
@@ -28,11 +33,28 @@ export declare class HostConnectionService extends Service implements HostConnec
     get rpc(): HostConnectionRpc;
     /** Exact Fetch-route registry scoped to the Context reading this service. */
     get fetch(): HostConnectionFetch;
-    /** Apply the configured Host/Origin fence, then browser authentication. */
+    /** Apply the Host/Origin fence and require an authenticated live Peer. */
     requestRejection(request: ConnectionTrustRequest): ConnectionRequestRejection;
-    /** A request that passes the fence and authentication speaks for the operator. */
+    /** Browser requests share an owner Peer; API HTTP does not depend on an attached socket. */
     admit(request: ConnectionTrustRequest): PeerAdmission;
-    /** Authenticate an index request through the process-token exchange or cookie. */
+    /** Create one in-process Peer owned by the Context that read this service. */
+    createPeer(options: {
+        readonly principal: Principal;
+        readonly interactions?: ConnectionInteractions;
+    }): PeerScope;
+    /** Claim API socket ownership synchronously; callers release on termination or failed upgrade. */
+    admitConnection(request: ConnectionTrustRequest): ConnectionAdmission;
+    private isTrusted;
+    private publishPeer;
+    /**
+     * Authenticate and publish a credential before sending the connect redirect.
+     * @param request - launch-token request on /connect.
+     * @param response - response owned to completion.
+     */
+    authorizeConnect(request: ConnectionIndexRequest, response: ConnectionIndexResponse): void;
+    /**
+     * Authenticate an index request; native TLS listeners mint Secure cookies.
+     */
     authorizeIndex(request: ConnectionIndexRequest, response: ConnectionIndexResponse): boolean;
     /** Add this process's launch token to the clean application URL. */
     authenticatedUrl(baseUrl: string): string;

package/lib/types/rpc.d.ts

@@ -1,6 +1,6 @@
 /** Generic unary RPC contracts shared by the Host and Client Connection halves. */
 import type { Branded } from '@deepseek-ai/dsh-brand';
-import type { PeerScope } from '@deepseek-ai/dsh-typert-protocol';
+import type { PeerScope, Principal } from '@deepseek-ai/dsh-typert-protocol';
 /** Correlation id minted by a caller and echoed by the Connection response. */
 export type RpcId = Branded<'rpc-id'>;
 /**
@@ -90,15 +90,23 @@ export interface ConnectionIndexResponse {
     writeHead(status: number, headers?: Readonly<Record<string, string>>): unknown;
     end(body?: string): unknown;
 }
-/** Outcome of admitting one request: the operator Peer it speaks for, or the status refusing it. */
+/** Outcome of admitting one request: the Peer it speaks for, or the status refusing it. */
 export type PeerAdmission = {
     readonly peer: PeerScope;
 } | {
     readonly rejection: 401 | 403;
 };
+/** Socket admission claims API ownership until its carrier calls release, including failed upgrades. */
+export type ConnectionAdmission = {
+    readonly peer: PeerScope;
+    /** Remove and dispose an API Peer; browser releases leave the shared browser Peer intact. */
+    readonly release: () => Promise<void>;
+} | {
+    readonly rejection: 401 | 403 | 409;
+};
 /**
  * Handler invoked after Connection has decoded the transport envelope.
- * `peer` is the Peer the request was admitted as: the operator.
+ * `peer` is the Peer the carrier admitted or the in-process caller supplied.
  */
 export type ConnectionRpcHandler = (endpoint: string, payload: unknown, signal: AbortSignal, peer: PeerScope) => Promise<ConnectionRpcHandlerResult>;
 /** Synchronous ownership test for one endpoint on a shared RPC channel. */
@@ -115,7 +123,11 @@ export interface ConnectionFetchRoute {
     readonly methods: readonly ConnectionFetchMethod[];
     /** Buffered requests obey the configured JSON cap; streaming requests arrive with backpressure and no aggregate cap. */
     readonly requestBody: ConnectionRequestBodyMode;
-    /** Handle one request after the physical carrier has applied its trust and authentication policy. */
+    /**
+     * Handle one request after the physical carrier has applied its trust and
+     * authentication policy. Only owner Peers reach an exact route; the shared
+     * handler answers 403 for every other principal.
+     */
     readonly fetch: (request: Request) => Promise<Response>;
 }
 /** Host registry for exact Fetch routes that cannot use JSON Remote invocation. */
@@ -151,8 +163,13 @@ export interface HostConnectionHandle {
     readonly rpc: HostConnectionRpc;
     /** Exact Fetch routes for streaming or browser-native responses. */
     readonly fetch: HostConnectionFetch;
-    /** The operator Peer every admitted request speaks for; its scope lives as long as Connection. */
-    readonly operator: PeerScope;
+    /** The owner Peer every authenticated browser connection shares. */
+    readonly browserPeer: PeerScope;
+    /**
+     * Whether this deployment accepts authorities beyond loopback: true only
+     * when a validated `trustedHosts` entry names a non-loopback hostname.
+     */
+    readonly allowsRemoteAuthorities: boolean;
     /**
      * Compose exact Fetch routes and the shared-channel RPC interceptor.
      * @param channel - shared channel mounted by Connection.
@@ -167,14 +184,32 @@ export interface HostConnectionHandle {
      */
     requestRejection(request: ConnectionTrustRequest): ConnectionRequestRejection;
     /**
-     * Admit one request: it passes {@link requestRejection} and speaks for the
-     * operator, or it is refused with that status.
+     * Admit an HTTP request against its signed browser or API credential and live Peer.
      * @param request - request headers from the HTTP or upgrade request.
-     * @returns the operator Peer, or the rejection status.
+     * @returns the credential's Peer, or the rejection status.
      */
     admit(request: ConnectionTrustRequest): PeerAdmission;
+    /**
+     * Create an independent in-process Peer, disposed with the Context that read `ctx.connection`.
+     * @param options - fixed principal and optional interaction participation (default `answer`).
+     * @returns a new Peer distinct from every other Peer.
+     */
+    createPeer(options: {
+        readonly principal: Principal;
+        readonly interactions?: 'answer' | 'none';
+    }): PeerScope;
+    /**
+     * Claim a physical socket for an API Peer; browser sockets share their owner Peer.
+     * @param request - authenticated upgrade request headers.
+     * @returns the Peer and idempotent release, or 409 for duplicate API ownership.
+     * The carrier releases on socket termination or failed upgrade; release removes
+     * API admission synchronously without cancelling independent HTTP calls.
+     */
+    admitConnection(request: ConnectionTrustRequest): ConnectionAdmission;
     /**
      * Authenticate one frontend index request, owning a token redirect or 401.
+     * The cookie this mints is `Secure` when the mounted Web carrier serves TLS,
+     * which only that listener's protocol decides.
      * @param request - root or configured-index HTTP request.
      * @param response - response owned when the result is false.
      * @returns true only when the frontend may serve index.html.
@@ -201,9 +236,10 @@ export interface ConnectionFetchHandler {
     /**
      * Dispatch one already-authenticated request.
      * @param request - Fetch request below the shared channel.
-     * @returns the registered response or a 404 response.
+     * @param peer - Peer to dispatch as; required, never defaulted.
+     * @returns the registered response, a 403 response for an exact route and a non-owner Peer, or a 404 response.
      */
-    fetch(request: Request): Promise<Response>;
+    fetch(request: Request, peer: PeerScope): Promise<Response>;
 }
 /** Client caller for logical RPC channels carried by the current transport. */
 export interface ClientConnectionRpc {

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "connection"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "客户端连接",
+    "description": "建立已认证的客户端通信，并管理连接生命周期。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-connection",
   "description": "Authenticated RPC transport and generation lifecycle",
-  "version": "0.2.1-alpha.1",
+  "version": "0.2.1-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -20,10 +20,13 @@
     },
     "./client": {
       "types": "./lib/types/client/index.d.ts",
-      "default": "./lib/client.js"
+      "node": "./lib/client.node.js",
+      "browser": "./lib/client.browser.js",
+      "default": "./lib/client.browser.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "dsh": {
     "client": {
@@ -34,27 +37,29 @@
   },
   "license": "MIT",
   "dependencies": {
-    "zod": "^4.4.3",
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
-    "@deepseek-ai/dsh-credentials": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-credentials": "0.2.1-alpha.3",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2",
+    "zod": "4.4.3"
   },
   "files": [
+    "locale/*.json",
     "lib/index.js",
-    "lib/client.js",
+    "lib/client.browser.js",
+    "lib/client.node.js",
     "lib/types/**/*.d.ts"
   ],
   "peerDependencies": {
-    "@deepseek-ai/dsh-scope": "0.2.1-alpha.1",
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.3"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-scope": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.3"
   }
 }

package/lib/types/operator-peer.d.ts

@@ -1,23 +0,0 @@
-/**
- * The operator Peer: the one party this Host answers to. Connection owns it
- * for its own lifetime, admits every request as it, and hands it to each
- * Remote call as `invocation.peer`.
- * @module @deepseek-ai/dsh-client-connection/src/operator-peer
- */
-import type { Context } from '@deepseek-ai/cordis';
-import type { PeerId, PeerScope } from '@deepseek-ai/dsh-typert-protocol';
-/**
- * The operator's scope. The instance is its own scope key, so `scopeOf(peer.ctx)`
- * returns it and events dispatched with `scopeTarget(subject, peer)` reach
- * listeners registered through `peer.ctx` and nobody else.
- */
-export declare class OperatorPeer implements PeerScope {
-    readonly id: PeerId;
-    readonly ctx: Context;
-    private readonly scope;
-    /** @param owner - Connection plugin context the scope fiber hangs under. */
-    constructor(owner: Context);
-    /** Tear down every connection-lifetime registration; racing calls share one completion. */
-    dispose(): Promise<void>;
-}
-//# sourceMappingURL=operator-peer.d.ts.map