@glasshome/sync-layer 0.1.16 → 0.2.0

package/dist/connection/bridged.d.ts

@@ -0,0 +1,16 @@
+import type { HaBridge } from "../worker/bridge-client";
+/**
+ * Wire an HA bridge (worker-backed connection) into the store. The bridge's
+ * facade rides the same load/subscribe pipeline as a direct socket; only the
+ * lifecycle signals differ — they arrive as worker messages instead of
+ * Connection events.
+ *
+ * Call after bridge.connect() resolved. Returns when initial data is loaded.
+ */
+export declare function attachBridgeToStore(bridge: HaBridge, hassUrl: string): Promise<void>;
+/** Map worker connection-state messages onto the store. */
+export declare function applyBridgeConnState(state: "connected" | "disconnected" | "reconnecting"): void;
+/** Re-sync after the worker reports a completed reconnect. */
+export declare function reloadAfterBridgeReconnect(bridge: HaBridge): Promise<void>;
+/** Detach on shutdown; the caller terminates the worker itself. */
+export declare function detachBridgeFromStore(): void;

package/dist/connection/manager.d.ts

@@ -7,6 +7,7 @@
  * @packageDocumentation
  */
 import { type Auth, type Connection, type ConnectionOptions as HAConnectionOptions } from "home-assistant-js-websocket";
+import { type HaLink } from "../core/store";
 import { type OAuthOptions } from "./auth";
 /**
  * Options for initializing a connection
@@ -29,9 +30,9 @@ export declare function initConnection(options: ConnectionOptions): Promise<Conn
  */
 export declare function disconnect(): void;
 /**
- * Get current connection
+ * Get current connection link
  */
-export declare function getConnection(): Connection | null;
+export declare function getConnection(): HaLink | null;
 /**
  * Check if currently connected
  */
@@ -43,6 +44,7 @@ export declare function isConnected(): boolean;
  * `isConnected()` which reflects the manager's internal lifecycle state.
  */
 export declare function getConnectionState(): boolean;
+export declare function loadInitialData(conn: Pick<HaLink, "sendMessagePromise">): Promise<void>;
 /**
  * Refresh all data
  */

package/dist/core/store.d.ts

@@ -1,5 +1,4 @@
 /** Central reactive state store for sync-layer using SolidJS createStore. */
-import type { Connection } from "home-assistant-js-websocket";
 import type { SetStoreFunction, Store } from "solid-js/store";
 import type { CameraStreamData } from "../camera/types";
 import type { EntityHistoryData } from "../history/types";
@@ -14,9 +13,19 @@ import type { AreaId, AreaRegistryEntry, ConnectionState, DeviceId, DeviceRegist
  * NOTE: No EntityIndices field -- indices are derived reactively in Plan 03.
  * NOTE: No _activeSubscriptions -- managed externally.
  */
+/**
+ * The structural surface every conn consumer actually uses. Satisfied by a
+ * real home-assistant-js-websocket Connection, the bridge facade (traffic
+ * tunneled through the HA worker), and mock connections.
+ */
+export interface HaLink {
+    sendMessagePromise<T>(message: unknown): Promise<T>;
+    subscribeMessage<T>(callback: (message: T) => void, message: unknown): Promise<() => Promise<void>>;
+    subscribeEvents(callback: (event: unknown) => void, eventType?: string): Promise<() => void | Promise<void>>;
+}
 export interface GlassHomeState {
-    /** WebSocket connection instance */
-    conn: Connection | null;
+    /** Live HA link (real socket, worker bridge facade, or mock) */
+    conn: HaLink | null;
     /** Current connection state */
     connectionState: ConnectionState;
     /** Connection error (if any) */

package/dist/index.d.ts

@@ -43,4 +43,8 @@ export { fetchForecast, fetchForecastData, fetchForecasts } from "./weather/fetc
 export { getForecast, getForecasts, refreshForecast, refreshForecasts } from "./weather/query";
 export type { EntityForecastQueryOptions, ForecastQueryOptions, ForecastResult, ForecastsResult, ForecastType, WeatherForecast, WeatherForecastData, WeatherForecasts, WeatherForecastsData, } from "./weather/types";
 export { applyDemoServiceCall, createDemoFixtures, isDemoMode, loadDemoData, startDemoEnergyTicker, stopDemoEnergyTicker, unloadDemoData, } from "./demo/demo-provider";
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.2.0";
+export { applyBridgeConnState, attachBridgeToStore, detachBridgeFromStore, reloadAfterBridgeReconnect, } from "./connection/bridged";
+export { BridgeNeedsAuthError, createHaBridge, type BridgeConnectOptions, type BridgeEvents, type HaBridge, } from "./worker/bridge-client";
+export type { AuthMode, ConnState, OAuthTokenData } from "./worker/protocol";
+export { runHaBridgeWorker, type WorkerScope } from "./worker/worker-main";

package/dist/index.js

@@ -1,5 +1,6 @@
 import { ENERGY_ENTITY_IDS, createDemoFixtures, demoEnergyPreferences, energyEntityValue, formatEnergyState, isEnergyEntity, isSunUp, resetStore, setState, simulateEnergy, state, sunEvents, synthesizeEnergyHistory, synthesizeEnergyStatistics } from "./demo-data-CavpxBw3.js";
-import { callService as callService$1, createConnection, createLongLivedTokenAuth, getAuth } from "home-assistant-js-websocket";
+import { runHaBridgeWorker } from "./worker-main-VfHPLX2h.js";
+import { createConnection, createLongLivedTokenAuth, getAuth } from "home-assistant-js-websocket";
 import { produce, reconcile } from "solid-js/store";
 
 //#region src/connection/adapter.ts
@@ -663,7 +664,13 @@ async function callService(domain, service, serviceData = {}, target = {}) {
 	try {
 		const mockConnection = connection;
 		if (mockConnection && typeof mockConnection.callService === "function") await mockConnection.callService(domain, service, serviceData, target);
-		else await callService$1(connection, domain, service, serviceData, target);
+		else await connection.sendMessagePromise({
+			type: "call_service",
+			domain,
+			service,
+			service_data: serviceData,
+			target
+		});
 	} catch (error) {
 		throw new Error(`Service call failed: ${error.message || String(error)}`);
 	}
@@ -1244,6 +1251,7 @@ function applyStateDiff(s, entityId, diff) {
 const HEARTBEAT_INTERVAL_MS = 3e4;
 const HEARTBEAT_TIMEOUT_MS = 15e3;
 const SUSPEND_DELAY_MS = 5 * 60 * 1e3;
+let activeConn = null;
 let heartbeatInterval = null;
 let suspendTimeout = null;
 let visiblePromiseResolve = null;
@@ -1338,6 +1346,7 @@ async function initConnection(options) {
 			...options.createSocket ? { createSocket: options.createSocket } : {}
 		});
 		const wrappedConn = wrapHAConnection(conn$1);
+		activeConn = conn$1;
 		setState(produce((s) => {
 			s.conn = conn$1;
 			s.hassUrl = options.url.replace(/\/$/, "");
@@ -1364,17 +1373,17 @@ async function initConnection(options) {
 * Disconnect from Home Assistant
 */
 function disconnect() {
-	const conn$1 = state.conn;
 	stopHeartbeat();
 	teardownLifecycleListeners();
-	if (conn$1) conn$1.close();
+	activeConn?.close();
+	activeConn = null;
 	setState(produce((s) => {
 		s.conn = null;
 		s.connectionState = "disconnected";
 	}));
 }
 /**
-* Get current connection
+* Get current connection link
 */
 function getConnection() {
 	return state.conn;
@@ -1392,8 +1401,7 @@ function isConnected() {
 * `isConnected()` which reflects the manager's internal lifecycle state.
 */
 function getConnectionState() {
-	const conn$1 = state.conn;
-	return conn$1 ? conn$1.connected : false;
+	return activeConn ? activeConn.connected : state.connectionState === "connected";
 }
 function setupEventHandlers(conn$1, options) {
 	conn$1.addEventListener("disconnected", () => {
@@ -2702,9 +2710,212 @@ async function refreshForecasts(entityId, types) {
 	return getForecasts(entityId, types);
 }
 
+//#endregion
+//#region src/connection/bridged.ts
+/**
+* Wire an HA bridge (worker-backed connection) into the store. The bridge's
+* facade rides the same load/subscribe pipeline as a direct socket; only the
+* lifecycle signals differ — they arrive as worker messages instead of
+* Connection events.
+*
+* Call after bridge.connect() resolved. Returns when initial data is loaded.
+*/
+async function attachBridgeToStore(bridge, hassUrl) {
+	setState(produce((s) => {
+		s.conn = bridge.conn;
+		s.hassUrl = hassUrl.replace(/\/$/, "");
+		s.connectionState = "connected";
+		s.connectionError = null;
+	}));
+	await loadInitialData(bridge.conn);
+	await subscribeToUpdates(bridge.conn);
+}
+/** Map worker connection-state messages onto the store. */
+function applyBridgeConnState(state$1) {
+	setState(produce((s) => {
+		s.connectionState = state$1;
+		if (state$1 === "connected") s.connectionError = null;
+	}));
+}
+/** Re-sync after the worker reports a completed reconnect. */
+async function reloadAfterBridgeReconnect(bridge) {
+	await loadInitialData(bridge.conn);
+	await forceResubscribe();
+}
+/** Detach on shutdown; the caller terminates the worker itself. */
+function detachBridgeFromStore() {
+	setState(produce((s) => {
+		s.conn = null;
+		s.connectionState = "disconnected";
+	}));
+}
+
+//#endregion
+//#region src/worker/bridge-client.ts
+var BridgeNeedsAuthError = class extends Error {
+	constructor() {
+		super("No stored Home Assistant tokens; interactive sign-in required");
+	}
+};
+function createHaBridge(worker, events = {}) {
+	let nextId = 1;
+	let connState = "disconnected";
+	const pendingSends = /* @__PURE__ */ new Map();
+	const subCallbacks = /* @__PURE__ */ new Map();
+	const rawListeners = /* @__PURE__ */ new Set();
+	let pendingConnect = null;
+	const post = (msg, transfer) => transfer ? worker.postMessage(msg, transfer) : worker.postMessage(msg);
+	const failAllPending = (reason) => {
+		const err = new Error(reason);
+		for (const { reject } of pendingSends.values()) reject(err);
+		pendingSends.clear();
+		pendingConnect?.reject(err);
+		pendingConnect = null;
+	};
+	worker.onerror = () => failAllPending("HA bridge worker crashed");
+	worker.onmessage = (ev) => {
+		const msg = ev.data;
+		switch (msg.k) {
+			case "connect_result":
+				if (msg.ok) pendingConnect?.resolve();
+				else pendingConnect?.reject(msg.needsAuth ? new BridgeNeedsAuthError() : new Error(msg.error ?? "Connect failed"));
+				pendingConnect = null;
+				break;
+			case "conn":
+				connState = msg.state;
+				events.onConnState?.(msg.state);
+				break;
+			case "ready_after_reconnect":
+				events.onReadyAfterReconnect?.();
+				break;
+			case "result": {
+				const pending = pendingSends.get(msg.id);
+				pendingSends.delete(msg.id);
+				if (!pending) break;
+				if (msg.ok) pending.resolve(msg.result);
+				else pending.reject(new Error(msg.error ?? "Request failed"));
+				break;
+			}
+			case "event": {
+				subCallbacks.get(msg.id)?.(msg.payload);
+				for (const listener of rawListeners) listener(msg.payload);
+				break;
+			}
+			case "sub_end":
+				subCallbacks.delete(msg.id);
+				break;
+			case "denial":
+				events.onDenial?.(msg);
+				break;
+		}
+	};
+	function sendMessagePromise(message) {
+		const id = nextId++;
+		return new Promise((resolve, reject) => {
+			pendingSends.set(id, {
+				resolve,
+				reject
+			});
+			post({
+				k: "send",
+				id,
+				message
+			});
+		});
+	}
+	function subscribe(kind, callback, eventType, message) {
+		const id = nextId++;
+		subCallbacks.set(id, callback);
+		post({
+			k: "sub",
+			id,
+			kind,
+			eventType,
+			message
+		});
+		return async () => {
+			subCallbacks.delete(id);
+			post({
+				k: "unsub",
+				id
+			});
+		};
+	}
+	const conn$1 = {
+		connect: () => Promise.resolve(),
+		disconnect: () => post({ k: "disconnect" }),
+		get connected$() {
+			return connState === "connected";
+		},
+		authenticate: () => Promise.resolve(),
+		get authState() {
+			return connState === "connected" ? "authenticated" : "pending";
+		},
+		subscribeEvents: (callback, eventType) => Promise.resolve(subscribe("events", callback, eventType)),
+		subscribeMessage: (callback, message) => Promise.resolve(subscribe("message", callback, void 0, message)),
+		sendMessagePromise,
+		addEventListener: (handler) => {
+			rawListeners.add(handler);
+			return () => rawListeners.delete(handler);
+		}
+	};
+	return {
+		connect(opts) {
+			return new Promise((resolve, reject) => {
+				pendingConnect = {
+					resolve,
+					reject
+				};
+				post({
+					k: "connect",
+					url: opts.url,
+					mode: opts.mode,
+					proxyWsPath: opts.proxyWsPath
+				});
+			});
+		},
+		disconnect: () => post({ k: "disconnect" }),
+		reconnect: () => post({ k: "reconnect" }),
+		clearTokens: () => post({ k: "clear_tokens" }),
+		conn: conn$1,
+		registerWidget(widgetId, caps) {
+			const channel = new MessageChannel();
+			post({
+				k: "register_widget",
+				widgetId,
+				caps
+			}, [channel.port2]);
+			return channel.port1;
+		},
+		unregisterWidget: (widgetId) => post({
+			k: "unregister_widget",
+			widgetId
+		}),
+		forwardLifecycle() {
+			const onVisibility = () => post({
+				k: "visibility",
+				hidden: document.visibilityState === "hidden"
+			});
+			const onPageshow = (event) => {
+				if (event.persisted) post({ k: "pageshow_persisted" });
+			};
+			document.addEventListener("visibilitychange", onVisibility);
+			window.addEventListener("pageshow", onPageshow);
+			return () => {
+				document.removeEventListener("visibilitychange", onVisibility);
+				window.removeEventListener("pageshow", onPageshow);
+			};
+		},
+		terminate() {
+			failAllPending("HA bridge terminated");
+			worker.terminate();
+		}
+	};
+}
+
 //#endregion
 //#region src/index.ts
-const VERSION = "0.1.0";
+const VERSION = "0.2.0";
 
 //#endregion
-export { DOMAINS_USE_LAST_UPDATED, LINE_ATTRIBUTES_TO_KEEP, MAX_HISTORY_POINTS, NEED_ATTRIBUTE_DOMAINS, VERSION, addDebugIncomingMessageListener, addDebugOutgoingMessageListener, appendHistoryPoint, applyDemoServiceCall, area, areas, authenticateWithOAuth, authenticateWithToken, batchEntityUpdates, batchServiceCalls, buildAreaView, buildDeviceView, buildEntityView, bulkAppendHistoryPoints, callService, createDemoFixtures, disconnect, entities, entitiesByAreaAndDomain, entitiesWhere, entity, entityIdHistoryNeedsAttributes, entityViewEquals, extractDomain, fetchEnergyPreferences, fetchEntityHistory, fetchForecast, fetchForecastData, fetchForecasts, fetchHistory, fetchStatisticsDuringPeriod, fetchStream, fetchStreamData, getAllEntityViews, getAreaView, getAreaViews, getConnection, getConnectionState, getEntityView, getEntityViews, getForecast, getForecasts, getStream, getWebRtcClientConfig, historyStateToTimeline, initConnection, isAuthValid, isConnected, isDemoMode, isHistoryTracked, loadDemoData, normalizeStatisticTime, refreshAuth, refreshForecast, refreshForecasts, refreshStream, registerEntity, resetStore, searchEntities, sendCommand, sendWebRtcCandidate, setState, startDemoEnergyTicker, startWebRtcSession, state, stopDemoEnergyTicker, toggle, trackEntityHistory, turnOff, turnOn, unloadDemoData, untrackEntityHistory, updateEntity };
+export { BridgeNeedsAuthError, DOMAINS_USE_LAST_UPDATED, LINE_ATTRIBUTES_TO_KEEP, MAX_HISTORY_POINTS, NEED_ATTRIBUTE_DOMAINS, VERSION, addDebugIncomingMessageListener, addDebugOutgoingMessageListener, appendHistoryPoint, applyBridgeConnState, applyDemoServiceCall, area, areas, attachBridgeToStore, authenticateWithOAuth, authenticateWithToken, batchEntityUpdates, batchServiceCalls, buildAreaView, buildDeviceView, buildEntityView, bulkAppendHistoryPoints, callService, createDemoFixtures, createHaBridge, detachBridgeFromStore, disconnect, entities, entitiesByAreaAndDomain, entitiesWhere, entity, entityIdHistoryNeedsAttributes, entityViewEquals, extractDomain, fetchEnergyPreferences, fetchEntityHistory, fetchForecast, fetchForecastData, fetchForecasts, fetchHistory, fetchStatisticsDuringPeriod, fetchStream, fetchStreamData, getAllEntityViews, getAreaView, getAreaViews, getConnection, getConnectionState, getEntityView, getEntityViews, getForecast, getForecasts, getStream, getWebRtcClientConfig, historyStateToTimeline, initConnection, isAuthValid, isConnected, isDemoMode, isHistoryTracked, loadDemoData, normalizeStatisticTime, refreshAuth, refreshForecast, refreshForecasts, refreshStream, registerEntity, reloadAfterBridgeReconnect, resetStore, runHaBridgeWorker, searchEntities, sendCommand, sendWebRtcCandidate, setState, startDemoEnergyTicker, startWebRtcSession, state, stopDemoEnergyTicker, toggle, trackEntityHistory, turnOff, turnOn, unloadDemoData, untrackEntityHistory, updateEntity };

package/dist/worker/bridge-client.d.ts

@@ -0,0 +1,46 @@
+import type { CapabilityGrant } from "@glasshome/widget-contract";
+import type { SyncLayerConnection } from "../connection/types";
+import type { AuthMode, ConnState } from "./protocol";
+/**
+ * Main-thread side of the HA bridge. Wraps the Worker and exposes:
+ * - a SyncLayerConnection facade so the existing store/subscription/command
+ *   code runs unchanged, with all HA traffic tunneled through the worker
+ * - registerWidget(), which mints the per-widget MessagePort the SDK's
+ *   service hooks call through (capability-checked in the worker)
+ *
+ * The Worker reference and its privileged channel live in this module's
+ * closures only.
+ */
+export interface BridgeConnectOptions {
+    url: string;
+    mode: AuthMode;
+    proxyWsPath?: string;
+}
+export interface BridgeEvents {
+    onConnState?: (state: ConnState) => void;
+    onReadyAfterReconnect?: () => void;
+    onDenial?: (denial: {
+        widgetId: string;
+        domain: string;
+        service: string;
+        entityIds: string[];
+        message: string;
+    }) => void;
+}
+export interface HaBridge {
+    /** Resolves on socket-up; rejects with BridgeNeedsAuthError when the worker has no stored OAuth tokens. */
+    connect(opts: BridgeConnectOptions): Promise<void>;
+    disconnect(): void;
+    reconnect(): void;
+    clearTokens(): void;
+    conn: SyncLayerConnection;
+    registerWidget(widgetId: string, caps: CapabilityGrant[]): MessagePort;
+    unregisterWidget(widgetId: string): void;
+    /** Forward visibility/pageshow so the worker can drive suspend/reconnect. Returns teardown. */
+    forwardLifecycle(): () => void;
+    terminate(): void;
+}
+export declare class BridgeNeedsAuthError extends Error {
+    constructor();
+}
+export declare function createHaBridge(worker: Worker, events?: BridgeEvents): HaBridge;

package/dist/worker/enforcement.d.ts

@@ -0,0 +1,53 @@
+import { type CapabilityGrant } from "@glasshome/widget-contract";
+/**
+ * Capability enforcement for widget service calls. Pure and registry-backed:
+ * the worker feeds it its own mirror of the HA registries, so expansion never
+ * trusts anything computed in the widget's realm.
+ */
+export interface EntityFacts {
+    deviceId: string | null;
+    areaId: string | null;
+    labels: string[];
+}
+export interface DeviceFacts {
+    areaId: string | null;
+    labels: string[];
+}
+export interface ServiceCallShape {
+    domain: string;
+    service: string;
+    data?: Record<string, unknown>;
+    target?: Record<string, unknown>;
+}
+export declare class RegistryMirror {
+    readonly entities: Map<string, EntityFacts>;
+    readonly devices: Map<string, DeviceFacts>;
+    replace(entityRegistry: {
+        entity_id: string;
+        device_id: string | null;
+        area_id: string | null;
+        labels?: string[];
+    }[], deviceRegistry: {
+        id: string;
+        area_id: string | null;
+        labels?: string[];
+    }[]): void;
+    entityAreaId(entityId: string): string | null;
+    entityLabels(entityId: string): string[];
+}
+/**
+ * Expand a service call to the concrete entity ids it can touch. Reads BOTH
+ * `target` and the legacy id fields inside `data` — HA honors entity_id (and
+ * friends) in service data, so ignoring it would let a call bypass entity
+ * narrowing.
+ */
+export declare function expandTargets(call: ServiceCallShape, registry: RegistryMirror): string[];
+export type EnforcementVerdict = {
+    allowed: true;
+    entityIds: string[];
+} | {
+    allowed: false;
+    entityIds: string[];
+    message: string;
+};
+export declare function enforceServiceCall(caps: readonly CapabilityGrant[], call: ServiceCallShape, registry: RegistryMirror): EnforcementVerdict;

package/dist/worker/protocol.d.ts

@@ -0,0 +1,120 @@
+import type { CapabilityGrant } from "@glasshome/widget-contract";
+/**
+ * Message protocol between the main thread and the HA bridge worker.
+ *
+ * Two channels with different privilege:
+ * - The worker's own message port (privileged): full tunnel to the HA socket.
+ *   Held in closure by the bridge client; never handed to widget code.
+ * - Per-widget MessagePorts: exactly one verb (call_service), validated
+ *   against the widget's granted capabilities inside the worker.
+ */
+export type AuthMode = {
+    kind: "token";
+    token: string;
+} | {
+    kind: "brokered";
+    mintUrl: string;
+} | {
+    kind: "oauth";
+    data?: OAuthTokenData;
+};
+/** Serializable subset of home-assistant-js-websocket AuthData. */
+export interface OAuthTokenData {
+    hassUrl: string;
+    clientId: string | null;
+    access_token: string;
+    refresh_token: string;
+    expires: number;
+    expires_in: number;
+}
+export type MainToWorker = {
+    k: "connect";
+    url: string;
+    mode: AuthMode;
+    /** Same-origin WS path to use instead of the HA host (tunnel proxy). */
+    proxyWsPath?: string;
+} | {
+    k: "send";
+    id: number;
+    message: unknown;
+} | {
+    k: "sub";
+    id: number;
+    kind: "events" | "message";
+    eventType?: string;
+    message?: unknown;
+} | {
+    k: "unsub";
+    id: number;
+} | {
+    k: "visibility";
+    hidden: boolean;
+} | {
+    k: "pageshow_persisted";
+} | {
+    k: "reconnect";
+} | {
+    k: "disconnect";
+} | {
+    k: "clear_tokens";
+} | {
+    k: "register_widget";
+    widgetId: string;
+    caps: CapabilityGrant[];
+} | {
+    k: "unregister_widget";
+    widgetId: string;
+};
+export type ConnState = "connected" | "disconnected" | "reconnecting";
+export type WorkerToMain = {
+    k: "connect_result";
+    ok: boolean;
+    error?: string;
+    /** OAuth mode with no stored tokens: main thread must run interactive auth. */
+    needsAuth?: boolean;
+} | {
+    k: "conn";
+    state: ConnState;
+}
+/** Fired after a reconnect completes; main thread reloads data + resubscribes. */
+ | {
+    k: "ready_after_reconnect";
+} | {
+    k: "result";
+    id: number;
+    ok: boolean;
+    result?: unknown;
+    error?: string;
+} | {
+    k: "event";
+    id: number;
+    payload: unknown;
+} | {
+    k: "sub_end";
+    id: number;
+    error?: string;
+} | {
+    k: "denial";
+    widgetId: string;
+    domain: string;
+    service: string;
+    entityIds: string[];
+    message: string;
+};
+/** Widget port: request. The only verb widget code can reach. */
+export interface WidgetServiceCall {
+    id: number;
+    domain: string;
+    service: string;
+    data?: Record<string, unknown>;
+    target?: Record<string, unknown>;
+}
+export type WidgetServiceResult = {
+    id: number;
+    ok: true;
+} | {
+    id: number;
+    ok: false;
+    code: "CAPABILITY_DENIED" | "UNAVAILABLE" | "ERROR";
+    message: string;
+};

package/dist/worker/token-store.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthTokenData } from "./protocol";
+export declare function loadTokens(): Promise<OAuthTokenData | null>;
+export declare function saveTokens(data: OAuthTokenData | null): Promise<void>;

package/dist/worker/worker-main.d.ts

@@ -0,0 +1,10 @@
+/** Structural worker-global surface; the package compiles against DOM libs. */
+export interface WorkerScope {
+    postMessage(message: unknown): void;
+    onmessage: ((ev: MessageEvent) => void) | null;
+    location: {
+        protocol: string;
+        host: string;
+    };
+}
+export declare function runHaBridgeWorker(scope: WorkerScope): void;

package/dist/worker/worker-main.js

@@ -0,0 +1,3 @@
+import { runHaBridgeWorker } from "../worker-main-VfHPLX2h.js";
+
+export { runHaBridgeWorker };

package/dist/worker-main-VfHPLX2h.js

@@ -0,0 +1,478 @@
+import { Auth, createConnection, createSocket, genExpires } from "home-assistant-js-websocket";
+import { matchesCapability } from "@glasshome/widget-contract";
+
+//#region src/worker/enforcement.ts
+var RegistryMirror = class {
+	entities = /* @__PURE__ */ new Map();
+	devices = /* @__PURE__ */ new Map();
+	replace(entityRegistry, deviceRegistry) {
+		this.entities.clear();
+		this.devices.clear();
+		for (const e of entityRegistry) this.entities.set(e.entity_id, {
+			deviceId: e.device_id,
+			areaId: e.area_id,
+			labels: e.labels ?? []
+		});
+		for (const d of deviceRegistry) this.devices.set(d.id, {
+			areaId: d.area_id,
+			labels: d.labels ?? []
+		});
+	}
+	entityAreaId(entityId) {
+		const e = this.entities.get(entityId);
+		if (!e) return null;
+		if (e.areaId) return e.areaId;
+		return e.deviceId ? this.devices.get(e.deviceId)?.areaId ?? null : null;
+	}
+	entityLabels(entityId) {
+		const e = this.entities.get(entityId);
+		if (!e) return [];
+		const fromDevice = e.deviceId ? this.devices.get(e.deviceId)?.labels ?? [] : [];
+		return [...e.labels, ...fromDevice];
+	}
+};
+const asArray = (v) => typeof v === "string" ? [v] : Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+/**
+* Expand a service call to the concrete entity ids it can touch. Reads BOTH
+* `target` and the legacy id fields inside `data` — HA honors entity_id (and
+* friends) in service data, so ignoring it would let a call bypass entity
+* narrowing.
+*/
+function expandTargets(call, registry) {
+	const sources = [call.target ?? {}, call.data ?? {}];
+	const ids = /* @__PURE__ */ new Set();
+	for (const src of sources) {
+		for (const id of asArray(src.entity_id)) ids.add(id);
+		for (const deviceId of asArray(src.device_id)) for (const [entityId, facts] of registry.entities) if (facts.deviceId === deviceId) ids.add(entityId);
+		for (const areaId of asArray(src.area_id)) for (const [entityId] of registry.entities) if (registry.entityAreaId(entityId) === areaId) ids.add(entityId);
+		for (const labelId of asArray(src.label_id)) for (const [entityId] of registry.entities) if (registry.entityLabels(entityId).includes(labelId)) ids.add(entityId);
+	}
+	return [...ids];
+}
+function enforceServiceCall(caps, call, registry) {
+	const entityIds = expandTargets(call, registry);
+	if (matchesCapability(caps, {
+		domain: call.domain,
+		service: call.service,
+		entityIds
+	})) return {
+		allowed: true,
+		entityIds
+	};
+	return {
+		allowed: false,
+		entityIds,
+		message: `Call to ${call.domain}.${call.service} is not covered by the widget's granted capabilities`
+	};
+}
+
+//#endregion
+//#region src/worker/token-store.ts
+/**
+* OAuth token persistence inside the worker. IndexedDB is the only storage
+* a worker has; keeping tokens here (and deleting the old localStorage copy
+* on the main thread) is what makes "widgets never see the token" hold.
+*/
+const DB_NAME = "glasshome-ha-bridge";
+const STORE = "auth";
+const KEY = "oauth";
+function openDb() {
+	return new Promise((resolve, reject) => {
+		const req = indexedDB.open(DB_NAME, 1);
+		req.onupgradeneeded = () => {
+			req.result.createObjectStore(STORE);
+		};
+		req.onsuccess = () => resolve(req.result);
+		req.onerror = () => reject(req.error);
+	});
+}
+function settle(req) {
+	return new Promise((resolve, reject) => {
+		req.onsuccess = () => resolve(req.result);
+		req.onerror = () => reject(req.error);
+	});
+}
+async function loadTokens() {
+	try {
+		const db = await openDb();
+		const store = db.transaction(STORE, "readonly").objectStore(STORE);
+		const data = await settle(store.get(KEY));
+		db.close();
+		return data ?? null;
+	} catch {
+		return null;
+	}
+}
+async function saveTokens(data) {
+	try {
+		const db = await openDb();
+		const store = db.transaction(STORE, "readwrite").objectStore(STORE);
+		await (data ? settle(store.put(data, KEY)) : settle(store.delete(KEY)));
+		db.close();
+	} catch {}
+}
+
+//#endregion
+//#region src/worker/worker-main.ts
+/**
+* HA bridge worker. Owns the socket and the auth tokens; neither ever
+* reaches the main thread. The privileged channel (the worker's own port)
+* tunnels arbitrary HA traffic for the host. Widget MessagePorts get exactly
+* one verb — call_service — validated against the widget's granted
+* capabilities with the worker's own registry mirror, so enforcement does
+* not trust anything computed in the widget's realm.
+*/
+const HEARTBEAT_INTERVAL_MS = 3e4;
+const HEARTBEAT_TIMEOUT_MS = 15e3;
+const SUSPEND_DELAY_MS = 5 * 60 * 1e3;
+function isHaWireMessage(value) {
+	return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var BrokeredAuth = class extends Auth {
+	constructor(mintUrl, data) {
+		super(data);
+		this.mintUrl = mintUrl;
+	}
+	async refreshAccessToken() {
+		const res = await fetch(this.mintUrl, { credentials: "same-origin" });
+		if (!res.ok) throw new Error(`Token broker responded ${res.status}`);
+		const broker = await res.json();
+		this.data = {
+			...this.data,
+			access_token: broker.accessToken,
+			expires_in: broker.expiresInSec,
+			expires: genExpires(broker.expiresInSec),
+			refresh_token: "",
+			hassUrl: broker.haUrl,
+			clientId: broker.haClientId
+		};
+	}
+};
+function runHaBridgeWorker(scope) {
+	let conn = null;
+	const widgets = /* @__PURE__ */ new Map();
+	const subs = /* @__PURE__ */ new Map();
+	const registry = new RegistryMirror();
+	let suspendTimeout = null;
+	let resumeVisible = null;
+	let heartbeat = null;
+	const post = (msg) => scope.postMessage(msg);
+	async function loadRegistryMirror(c) {
+		const [entityRegistry, deviceRegistry] = await Promise.all([c.sendMessagePromise({ type: "config/entity_registry/list" }), c.sendMessagePromise({ type: "config/device_registry/list" })]);
+		registry.replace(entityRegistry, deviceRegistry);
+	}
+	function watchRegistryMirror(c) {
+		const refresh = () => {
+			loadRegistryMirror(c).catch(() => {});
+		};
+		c.subscribeEvents(refresh, "entity_registry_updated");
+		c.subscribeEvents(refresh, "device_registry_updated");
+		c.subscribeEvents(refresh, "area_registry_updated");
+	}
+	function attachWidgetPort(widgetId, caps, port) {
+		widgets.get(widgetId)?.port.close();
+		widgets.set(widgetId, {
+			port,
+			caps
+		});
+		port.onmessage = async (ev) => {
+			const call = ev.data;
+			const reply = (msg) => port.postMessage(msg);
+			const verdict = enforceServiceCall(caps, call, registry);
+			if (!verdict.allowed) {
+				post({
+					k: "denial",
+					widgetId,
+					domain: call.domain,
+					service: call.service,
+					entityIds: verdict.entityIds,
+					message: verdict.message
+				});
+				reply({
+					id: call.id,
+					ok: false,
+					code: "CAPABILITY_DENIED",
+					message: verdict.message
+				});
+				return;
+			}
+			if (!conn) {
+				reply({
+					id: call.id,
+					ok: false,
+					code: "UNAVAILABLE",
+					message: "Not connected"
+				});
+				return;
+			}
+			try {
+				await conn.sendMessagePromise({
+					type: "call_service",
+					domain: call.domain,
+					service: call.service,
+					service_data: call.data ?? {},
+					...call.target ? { target: call.target } : {}
+				});
+				reply({
+					id: call.id,
+					ok: true
+				});
+			} catch (err) {
+				reply({
+					id: call.id,
+					ok: false,
+					code: "ERROR",
+					message: err instanceof Error ? err.message : String(err)
+				});
+			}
+		};
+		port.start?.();
+	}
+	function startHeartbeat(c) {
+		stopHeartbeat();
+		heartbeat = setInterval(() => {
+			const timer = new Promise((_, reject) => setTimeout(() => reject(new Error("ping timeout")), HEARTBEAT_TIMEOUT_MS));
+			Promise.race([c.ping(), timer]).catch(() => c.reconnect());
+		}, HEARTBEAT_INTERVAL_MS);
+	}
+	function stopHeartbeat() {
+		if (heartbeat !== null) {
+			clearInterval(heartbeat);
+			heartbeat = null;
+		}
+	}
+	function onVisibility(hidden) {
+		if (!conn) return;
+		if (hidden) {
+			conn.suspendReconnectUntil(new Promise((resolve) => {
+				resumeVisible = resolve;
+			}));
+			suspendTimeout ??= setTimeout(() => {
+				suspendTimeout = null;
+				conn?.suspend();
+			}, SUSPEND_DELAY_MS);
+		} else {
+			if (suspendTimeout !== null) {
+				clearTimeout(suspendTimeout);
+				suspendTimeout = null;
+			}
+			resumeVisible?.();
+			resumeVisible = null;
+		}
+	}
+	async function buildAuth(url, mode) {
+		switch (mode.kind) {
+			case "token": return new Auth({
+				hassUrl: url,
+				clientId: null,
+				access_token: mode.token,
+				refresh_token: "",
+				expires: Date.now() + 365 * 24 * 3600 * 1e3,
+				expires_in: 365 * 24 * 3600
+			});
+			case "brokered": return new BrokeredAuth(mode.mintUrl, {
+				hassUrl: url,
+				clientId: null,
+				access_token: "",
+				refresh_token: "",
+				expires: 0,
+				expires_in: 0
+			});
+			case "oauth": {
+				const data = mode.data ?? await loadTokens();
+				if (!data) return "needs-auth";
+				if (mode.data) await saveTokens(mode.data);
+				return new Auth(data, (updated) => {
+					saveTokens(updated);
+				});
+			}
+		}
+	}
+	async function connect(url, mode, proxyWsPath) {
+		const auth = await buildAuth(url, mode);
+		if (auth === "needs-auth") {
+			post({
+				k: "connect_result",
+				ok: false,
+				needsAuth: true
+			});
+			return;
+		}
+		if (mode.kind === "brokered") try {
+			await auth.refreshAccessToken();
+		} catch (err) {
+			post({
+				k: "connect_result",
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			return;
+		}
+		const socketFactory = proxyWsPath ? (options) => {
+			const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
+			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? `${proto}//${scope.location.host}${proxyWsPath}` : Reflect.get(target, prop) });
+			return createSocket({
+				...options,
+				auth: proxied
+			});
+		} : void 0;
+		try {
+			conn = await createConnection({
+				auth,
+				...socketFactory ? { createSocket: socketFactory } : {}
+			});
+		} catch (err) {
+			post({
+				k: "connect_result",
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			return;
+		}
+		conn.addEventListener("disconnected", () => post({
+			k: "conn",
+			state: "disconnected"
+		}));
+		conn.addEventListener("reconnect-error", () => post({
+			k: "conn",
+			state: "reconnecting"
+		}));
+		let everReady = false;
+		conn.addEventListener("ready", () => {
+			post({
+				k: "conn",
+				state: "connected"
+			});
+			loadRegistryMirror(conn).catch(() => {});
+			if (everReady) post({ k: "ready_after_reconnect" });
+			everReady = true;
+		});
+		await loadRegistryMirror(conn);
+		watchRegistryMirror(conn);
+		startHeartbeat(conn);
+		everReady = true;
+		post({
+			k: "connect_result",
+			ok: true
+		});
+		post({
+			k: "conn",
+			state: "connected"
+		});
+	}
+	scope.onmessage = async (ev) => {
+		const msg = ev.data;
+		switch (msg.k) {
+			case "connect":
+				await connect(msg.url, msg.mode, msg.proxyWsPath);
+				break;
+			case "send": {
+				if (!conn || !isHaWireMessage(msg.message)) {
+					post({
+						k: "result",
+						id: msg.id,
+						ok: false,
+						error: conn ? "Malformed message" : "Not connected"
+					});
+					return;
+				}
+				try {
+					const result = await conn.sendMessagePromise(msg.message);
+					post({
+						k: "result",
+						id: msg.id,
+						ok: true,
+						result
+					});
+				} catch (err) {
+					post({
+						k: "result",
+						id: msg.id,
+						ok: false,
+						error: err instanceof Error ? err.message : String(err)
+					});
+				}
+				break;
+			}
+			case "sub": {
+				if (!conn) {
+					post({
+						k: "sub_end",
+						id: msg.id,
+						error: "Not connected"
+					});
+					return;
+				}
+				try {
+					const forward = (payload) => post({
+						k: "event",
+						id: msg.id,
+						payload
+					});
+					let unsub;
+					if (msg.kind === "events") unsub = await conn.subscribeEvents(forward, msg.eventType);
+					else {
+						if (!isHaWireMessage(msg.message)) {
+							post({
+								k: "sub_end",
+								id: msg.id,
+								error: "Malformed message"
+							});
+							return;
+						}
+						unsub = await conn.subscribeMessage(forward, msg.message);
+					}
+					subs.set(msg.id, unsub);
+				} catch (err) {
+					post({
+						k: "sub_end",
+						id: msg.id,
+						error: err instanceof Error ? err.message : String(err)
+					});
+				}
+				break;
+			}
+			case "unsub": {
+				const unsub = subs.get(msg.id);
+				subs.delete(msg.id);
+				try {
+					await unsub?.();
+				} catch {}
+				break;
+			}
+			case "visibility":
+				onVisibility(msg.hidden);
+				break;
+			case "pageshow_persisted":
+				conn?.reconnect();
+				break;
+			case "reconnect":
+				conn?.reconnect();
+				break;
+			case "disconnect":
+				stopHeartbeat();
+				conn?.close();
+				conn = null;
+				post({
+					k: "conn",
+					state: "disconnected"
+				});
+				break;
+			case "clear_tokens":
+				await saveTokens(null);
+				break;
+			case "register_widget": {
+				const port = ev.ports[0];
+				if (port) attachWidgetPort(msg.widgetId, msg.caps, port);
+				break;
+			}
+			case "unregister_widget":
+				widgets.get(msg.widgetId)?.port.close();
+				widgets.delete(msg.widgetId);
+				break;
+		}
+	};
+}
+
+//#endregion
+export { runHaBridgeWorker };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/sync-layer",
-  "version": "0.1.16",
+  "version": "0.2.0",
   "description": "Type-safe, reactive state synchronization layer for Home Assistant",
   "repository": {
     "type": "git",
@@ -26,6 +26,11 @@
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js"
     },
+    "./worker": {
+      "@glasshome/source": "./src/worker/worker-main.ts",
+      "types": "./dist/worker/worker-main.d.ts",
+      "import": "./dist/worker/worker-main.js"
+    },
     "./package.json": "./package.json"
   },
   "peerDependencies": {
@@ -50,7 +55,8 @@
     "lint": "tsc --noEmit"
   },
   "dependencies": {
-    "home-assistant-js-websocket": "^9.6.0"
+    "home-assistant-js-websocket": "^9.6.0",
+    "@glasshome/widget-contract": "0.1.0"
   },
   "devDependencies": {
     "@glasshome/ha-types": "0.1.2",