@glasshome/sync-layer 0.2.1 → 0.2.2

package/dist/index.js

@@ -1,5 +1,5 @@
 import { ENERGY_ENTITY_IDS, createDemoFixtures, demoEnergyPreferences, energyEntityValue, formatEnergyState, isEnergyEntity, isSunUp, resetStore, setState, simulateEnergy, state, sunEvents, synthesizeEnergyHistory, synthesizeEnergyStatistics } from "./demo-data-CavpxBw3.js";
-import { runHaBridgeWorker } from "./worker-main-C93MR-AO.js";
+import { runHaBridgeWorker } from "./worker-main-BYGgbA7k.js";
 import { createConnection, createLongLivedTokenAuth, getAuth } from "home-assistant-js-websocket";
 import { produce, reconcile } from "solid-js/store";
 
@@ -2870,7 +2870,8 @@ function createHaBridge(worker, events = {}) {
 					k: "connect",
 					url: opts.url,
 					mode: opts.mode,
-					proxyWsPath: opts.proxyWsPath
+					proxyWsPath: opts.proxyWsPath,
+					proxyTicket: opts.proxyTicket
 				});
 			});
 		},

package/dist/worker/bridge-client.d.ts

@@ -15,6 +15,7 @@ export interface BridgeConnectOptions {
     url: string;
     mode: AuthMode;
     proxyWsPath?: string;
+    proxyTicket?: string;
 }
 export interface BridgeEvents {
     onConnState?: (state: ConnState) => void;

package/dist/worker/protocol.d.ts

@@ -31,8 +31,13 @@ export type MainToWorker = {
     k: "connect";
     url: string;
     mode: AuthMode;
-    /** Same-origin WS path to use instead of the HA host (tunnel proxy). */
+    /** Proxy WS endpoint to use instead of the HA host. A path (web, resolved
+     *  same-origin) or an absolute ws(s)/http(s) URL (native, where the worker
+     *  origin is localhost, not dash-server). */
     proxyWsPath?: string;
+    /** Short-lived ticket authorizing the proxy WS + broker mint when a
+     *  cross-origin cookie/bearer can't ride them (native). */
+    proxyTicket?: string;
 } | {
     k: "send";
     id: number;

package/dist/worker/worker-main.js

@@ -1,3 +1,3 @@
-import { runHaBridgeWorker } from "../worker-main-C93MR-AO.js";
+import { runHaBridgeWorker } from "../worker-main-BYGgbA7k.js";
 
 export { runHaBridgeWorker };

package/dist/{worker-main-C93MR-AO.js → worker-main-BYGgbA7k.js}

@@ -129,14 +129,18 @@ function isHaWireMessage(value) {
 	return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 var BrokeredAuth = class extends Auth {
-	constructor(mintUrl, data) {
+	constructor(mintUrl, data, ticket) {
 		super(data);
 		this.mintUrl = mintUrl;
+		this.ticket = ticket;
 	}
 	async refreshAccessToken() {
 		const res = await fetch(this.mintUrl, {
-			credentials: "same-origin",
-			headers: { accept: "application/json" }
+			credentials: "include",
+			headers: {
+				accept: "application/json",
+				...this.ticket ? { "x-proxy-ticket": this.ticket } : {}
+			}
 		});
 		if (!res.ok) throw new Error(`Token broker responded ${res.status}`);
 		if (!res.headers.get("content-type")?.includes("application/json")) throw new Error(`Token broker did not return JSON (is ${this.mintUrl} reachable?)`);
@@ -152,6 +156,19 @@ var BrokeredAuth = class extends Auth {
 		};
 	}
 };
+/** Resolve the proxy WS endpoint. Accepts a same-origin path (web) or an
+*  absolute ws(s)/http(s) URL (native), and appends the auth ticket if given. */
+function buildProxyWsUrl(scope, proxyWsPath, ticket) {
+	let base;
+	if (/^wss?:\/\//i.test(proxyWsPath)) base = proxyWsPath;
+	else if (/^https?:\/\//i.test(proxyWsPath)) base = proxyWsPath.replace(/^http/i, "ws");
+	else {
+		const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
+		base = `${proto}//${scope.location.host}${proxyWsPath}`;
+	}
+	if (ticket) base += `${base.includes("?") ? "&" : "?"}ticket=${encodeURIComponent(ticket)}`;
+	return base;
+}
 function runHaBridgeWorker(scope) {
 	let conn = null;
 	const widgets = /* @__PURE__ */ new Map();
@@ -264,7 +281,7 @@ function runHaBridgeWorker(scope) {
 			resumeVisible = null;
 		}
 	}
-	async function buildAuth(url, mode) {
+	async function buildAuth(url, mode, ticket) {
 		switch (mode.kind) {
 			case "token": return new Auth({
 				hassUrl: url,
@@ -281,7 +298,7 @@ function runHaBridgeWorker(scope) {
 				refresh_token: "",
 				expires: 0,
 				expires_in: 0
-			});
+			}, ticket);
 			case "oauth": {
 				const data = mode.data ?? await loadTokens();
 				if (!data) return "needs-auth";
@@ -292,8 +309,8 @@ function runHaBridgeWorker(scope) {
 			}
 		}
 	}
-	async function connect(url, mode, proxyWsPath) {
-		const auth = await buildAuth(url, mode);
+	async function connect(url, mode, proxyWsPath, proxyTicket) {
+		const auth = await buildAuth(url, mode, proxyTicket);
 		if (auth === "needs-auth") {
 			post({
 				k: "connect_result",
@@ -312,9 +329,9 @@ function runHaBridgeWorker(scope) {
 			});
 			return;
 		}
-		const socketFactory = proxyWsPath ? (options) => {
-			const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
-			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? `${proto}//${scope.location.host}${proxyWsPath}` : Reflect.get(target, prop) });
+		const proxyWsUrl = proxyWsPath ? buildProxyWsUrl(scope, proxyWsPath, proxyTicket) : null;
+		const socketFactory = proxyWsUrl ? (options) => {
+			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? proxyWsUrl : Reflect.get(target, prop) });
 			return createSocket({
 				...options,
 				auth: proxied
@@ -368,7 +385,7 @@ function runHaBridgeWorker(scope) {
 		const msg = ev.data;
 		switch (msg.k) {
 			case "connect":
-				await connect(msg.url, msg.mode, msg.proxyWsPath);
+				await connect(msg.url, msg.mode, msg.proxyWsPath, msg.proxyTicket);
 				break;
 			case "send": {
 				if (!conn || !isHaWireMessage(msg.message)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/sync-layer",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Type-safe, reactive state synchronization layer for Home Assistant",
   "repository": {
     "type": "git",