@glasshome/sync-layer 0.2.1 → 0.3.0

package/dist/connection/bridged.d.ts

@@ -7,7 +7,7 @@ import type { HaBridge } from "../worker/bridge-client";
  *
  * Call after bridge.connect() resolved. Returns when initial data is loaded.
  */
-export declare function attachBridgeToStore(bridge: HaBridge, hassUrl: string): Promise<void>;
+export declare function attachBridgeToStore(bridge: HaBridge, hassUrl: string, mediaProxyBase?: string): Promise<void>;
 /** Map worker connection-state messages onto the store. */
 export declare function applyBridgeConnState(state: "connected" | "disconnected" | "reconnecting"): void;
 /** Re-sync after the worker reports a completed reconnect. */

package/dist/core/store.d.ts

@@ -32,6 +32,9 @@ export interface GlassHomeState {
     connectionError: Error | null;
     /** Home Assistant base URL */
     hassUrl: string | null;
+    /** Same-origin prefix for the HA media proxy (e.g. "/ha-proxy/media"), or null
+     *  to resolve media directly against hassUrl. Set by the host at connect. */
+    mediaProxyBase: string | null;
     /** Home Assistant core config (unit system, locale, currency); null until loaded */
     config: import("@glasshome/ha-types").HassConfig | null;
     /** Live entity state (keyed by entity_id) */

package/dist/{demo-data-CavpxBw3.js → demo-data-DiGSP4EH.js}

@@ -6,6 +6,7 @@ const initialState = {
 	connectionState: "disconnected",
 	connectionError: null,
 	hassUrl: null,
+	mediaProxyBase: null,
 	config: null,
 	entities: {},
 	entityRegistry: {},

package/dist/index.d.ts

@@ -27,6 +27,7 @@ export type { CallServiceRequest, CoreEventType, Domain, EntityCategory, EntityR
 export { fetchStream, fetchStreamData } from "./camera/fetch";
 export { getStream, refreshStream } from "./camera/query";
 export { fetchEnergyPreferences } from "./energy/prefs";
+export { hassMediaUrl } from "./media/url";
 export type { EnergyDeviceConsumption, EnergyPreferences, EnergySource, } from "./energy/prefs";
 export type { CameraStream, CameraStreamData, CameraStreams, EntityStreamQueryOptions, StreamFormat, StreamQueryOptions, StreamResult, } from "./camera/types";
 export { getWebRtcClientConfig, sendWebRtcCandidate, startWebRtcSession, } from "./camera/webrtc";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { ENERGY_ENTITY_IDS, createDemoFixtures, demoEnergyPreferences, energyEntityValue, formatEnergyState, isEnergyEntity, isSunUp, resetStore, setState, simulateEnergy, state, sunEvents, synthesizeEnergyHistory, synthesizeEnergyStatistics } from "./demo-data-CavpxBw3.js";
-import { runHaBridgeWorker } from "./worker-main-C93MR-AO.js";
+import { ENERGY_ENTITY_IDS, createDemoFixtures, demoEnergyPreferences, energyEntityValue, formatEnergyState, isEnergyEntity, isSunUp, resetStore, setState, simulateEnergy, state, sunEvents, synthesizeEnergyHistory, synthesizeEnergyStatistics } from "./demo-data-DiGSP4EH.js";
+import { runHaBridgeWorker } from "./worker-main-BYGgbA7k.js";
 import { createConnection, createLongLivedTokenAuth, getAuth } from "home-assistant-js-websocket";
 import { produce, reconcile } from "solid-js/store";
 
@@ -2298,6 +2298,30 @@ async function fetchEnergyPreferences(connection) {
 	};
 }
 
+//#endregion
+//#region src/media/url.ts
+/**
+* Resolve an HA media reference (e.g. an entity's `entity_picture`, a camera
+* proxy path) to a URL the page can actually load.
+*
+* HA gives these as origin-relative paths (`/api/media_player_proxy/...?token=`)
+* carrying their own signed token. A bare `<img src>` would resolve them against
+* the dash origin and 404. When the host set `mediaProxyBase`, route through the
+* same-origin media proxy so the page CSP (`img-src 'self'`) covers it in every
+* mode, LAN and remote. Otherwise fall back to prefixing `hassUrl` directly
+* (the LAN-only path, used until a transport sets the proxy base).
+*
+* Absolute URLs and non-path values pass through untouched.
+*/
+function hassMediaUrl(path) {
+	if (!path) return void 0;
+	if (/^https?:\/\//i.test(path)) return path;
+	if (!path.startsWith("/")) return path;
+	const base = state.mediaProxyBase;
+	if (base) return `${base}?path=${encodeURIComponent(path)}`;
+	return state.hassUrl ? `${state.hassUrl}${path}` : path;
+}
+
 //#endregion
 //#region src/camera/webrtc.ts
 /**
@@ -2720,10 +2744,11 @@ async function refreshForecasts(entityId, types) {
 *
 * Call after bridge.connect() resolved. Returns when initial data is loaded.
 */
-async function attachBridgeToStore(bridge, hassUrl) {
+async function attachBridgeToStore(bridge, hassUrl, mediaProxyBase) {
 	setState(produce((s) => {
 		s.conn = bridge.conn;
 		s.hassUrl = hassUrl.replace(/\/$/, "");
+		s.mediaProxyBase = mediaProxyBase ?? null;
 		s.connectionState = "connected";
 		s.connectionError = null;
 	}));
@@ -2870,7 +2895,8 @@ function createHaBridge(worker, events = {}) {
 					k: "connect",
 					url: opts.url,
 					mode: opts.mode,
-					proxyWsPath: opts.proxyWsPath
+					proxyWsPath: opts.proxyWsPath,
+					proxyTicket: opts.proxyTicket
 				});
 			});
 		},
@@ -2918,4 +2944,4 @@ function createHaBridge(worker, events = {}) {
 const VERSION = "0.2.1";
 
 //#endregion
-export { BridgeNeedsAuthError, DOMAINS_USE_LAST_UPDATED, LINE_ATTRIBUTES_TO_KEEP, MAX_HISTORY_POINTS, NEED_ATTRIBUTE_DOMAINS, VERSION, addDebugIncomingMessageListener, addDebugOutgoingMessageListener, appendHistoryPoint, applyBridgeConnState, applyDemoServiceCall, area, areas, attachBridgeToStore, authenticateWithOAuth, authenticateWithToken, batchEntityUpdates, batchServiceCalls, buildAreaView, buildDeviceView, buildEntityView, bulkAppendHistoryPoints, callService, createDemoFixtures, createHaBridge, detachBridgeFromStore, disconnect, entities, entitiesByAreaAndDomain, entitiesWhere, entity, entityIdHistoryNeedsAttributes, entityViewEquals, extractDomain, fetchEnergyPreferences, fetchEntityHistory, fetchForecast, fetchForecastData, fetchForecasts, fetchHistory, fetchStatisticsDuringPeriod, fetchStream, fetchStreamData, getAllEntityViews, getAreaView, getAreaViews, getConnection, getConnectionState, getEntityView, getEntityViews, getForecast, getForecasts, getStream, getWebRtcClientConfig, historyStateToTimeline, initConnection, isAuthValid, isConnected, isDemoMode, isHistoryTracked, loadDemoData, normalizeStatisticTime, refreshAuth, refreshForecast, refreshForecasts, refreshStream, registerEntity, reloadAfterBridgeReconnect, resetStore, runHaBridgeWorker, searchEntities, sendCommand, sendWebRtcCandidate, setState, startDemoEnergyTicker, startWebRtcSession, state, stopDemoEnergyTicker, toggle, trackEntityHistory, turnOff, turnOn, unloadDemoData, untrackEntityHistory, updateEntity };
+export { BridgeNeedsAuthError, DOMAINS_USE_LAST_UPDATED, LINE_ATTRIBUTES_TO_KEEP, MAX_HISTORY_POINTS, NEED_ATTRIBUTE_DOMAINS, VERSION, addDebugIncomingMessageListener, addDebugOutgoingMessageListener, appendHistoryPoint, applyBridgeConnState, applyDemoServiceCall, area, areas, attachBridgeToStore, authenticateWithOAuth, authenticateWithToken, batchEntityUpdates, batchServiceCalls, buildAreaView, buildDeviceView, buildEntityView, bulkAppendHistoryPoints, callService, createDemoFixtures, createHaBridge, detachBridgeFromStore, disconnect, entities, entitiesByAreaAndDomain, entitiesWhere, entity, entityIdHistoryNeedsAttributes, entityViewEquals, extractDomain, fetchEnergyPreferences, fetchEntityHistory, fetchForecast, fetchForecastData, fetchForecasts, fetchHistory, fetchStatisticsDuringPeriod, fetchStream, fetchStreamData, getAllEntityViews, getAreaView, getAreaViews, getConnection, getConnectionState, getEntityView, getEntityViews, getForecast, getForecasts, getStream, getWebRtcClientConfig, hassMediaUrl, historyStateToTimeline, initConnection, isAuthValid, isConnected, isDemoMode, isHistoryTracked, loadDemoData, normalizeStatisticTime, refreshAuth, refreshForecast, refreshForecasts, refreshStream, registerEntity, reloadAfterBridgeReconnect, resetStore, runHaBridgeWorker, searchEntities, sendCommand, sendWebRtcCandidate, setState, startDemoEnergyTicker, startWebRtcSession, state, stopDemoEnergyTicker, toggle, trackEntityHistory, turnOff, turnOn, unloadDemoData, untrackEntityHistory, updateEntity };

package/dist/media/url.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve an HA media reference (e.g. an entity's `entity_picture`, a camera
+ * proxy path) to a URL the page can actually load.
+ *
+ * HA gives these as origin-relative paths (`/api/media_player_proxy/...?token=`)
+ * carrying their own signed token. A bare `<img src>` would resolve them against
+ * the dash origin and 404. When the host set `mediaProxyBase`, route through the
+ * same-origin media proxy so the page CSP (`img-src 'self'`) covers it in every
+ * mode, LAN and remote. Otherwise fall back to prefixing `hassUrl` directly
+ * (the LAN-only path, used until a transport sets the proxy base).
+ *
+ * Absolute URLs and non-path values pass through untouched.
+ */
+export declare function hassMediaUrl(path: string | null | undefined): string | undefined;

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { createDemoFixtures, state } from "../demo-data-CavpxBw3.js";
+import { createDemoFixtures, state } from "../demo-data-DiGSP4EH.js";
 
 //#region src/testing/mock-behaviors/base.ts
 /**

package/dist/worker/bridge-client.d.ts

@@ -15,6 +15,7 @@ export interface BridgeConnectOptions {
     url: string;
     mode: AuthMode;
     proxyWsPath?: string;
+    proxyTicket?: string;
 }
 export interface BridgeEvents {
     onConnState?: (state: ConnState) => void;

package/dist/worker/protocol.d.ts

@@ -31,8 +31,13 @@ export type MainToWorker = {
     k: "connect";
     url: string;
     mode: AuthMode;
-    /** Same-origin WS path to use instead of the HA host (tunnel proxy). */
+    /** Proxy WS endpoint to use instead of the HA host. A path (web, resolved
+     *  same-origin) or an absolute ws(s)/http(s) URL (native, where the worker
+     *  origin is localhost, not dash-server). */
     proxyWsPath?: string;
+    /** Short-lived ticket authorizing the proxy WS + broker mint when a
+     *  cross-origin cookie/bearer can't ride them (native). */
+    proxyTicket?: string;
 } | {
     k: "send";
     id: number;

package/dist/worker/worker-main.js

@@ -1,3 +1,3 @@
-import { runHaBridgeWorker } from "../worker-main-C93MR-AO.js";
+import { runHaBridgeWorker } from "../worker-main-BYGgbA7k.js";
 
 export { runHaBridgeWorker };

package/dist/{worker-main-C93MR-AO.js → worker-main-BYGgbA7k.js}

@@ -129,14 +129,18 @@ function isHaWireMessage(value) {
 	return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 var BrokeredAuth = class extends Auth {
-	constructor(mintUrl, data) {
+	constructor(mintUrl, data, ticket) {
 		super(data);
 		this.mintUrl = mintUrl;
+		this.ticket = ticket;
 	}
 	async refreshAccessToken() {
 		const res = await fetch(this.mintUrl, {
-			credentials: "same-origin",
-			headers: { accept: "application/json" }
+			credentials: "include",
+			headers: {
+				accept: "application/json",
+				...this.ticket ? { "x-proxy-ticket": this.ticket } : {}
+			}
 		});
 		if (!res.ok) throw new Error(`Token broker responded ${res.status}`);
 		if (!res.headers.get("content-type")?.includes("application/json")) throw new Error(`Token broker did not return JSON (is ${this.mintUrl} reachable?)`);
@@ -152,6 +156,19 @@ var BrokeredAuth = class extends Auth {
 		};
 	}
 };
+/** Resolve the proxy WS endpoint. Accepts a same-origin path (web) or an
+*  absolute ws(s)/http(s) URL (native), and appends the auth ticket if given. */
+function buildProxyWsUrl(scope, proxyWsPath, ticket) {
+	let base;
+	if (/^wss?:\/\//i.test(proxyWsPath)) base = proxyWsPath;
+	else if (/^https?:\/\//i.test(proxyWsPath)) base = proxyWsPath.replace(/^http/i, "ws");
+	else {
+		const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
+		base = `${proto}//${scope.location.host}${proxyWsPath}`;
+	}
+	if (ticket) base += `${base.includes("?") ? "&" : "?"}ticket=${encodeURIComponent(ticket)}`;
+	return base;
+}
 function runHaBridgeWorker(scope) {
 	let conn = null;
 	const widgets = /* @__PURE__ */ new Map();
@@ -264,7 +281,7 @@ function runHaBridgeWorker(scope) {
 			resumeVisible = null;
 		}
 	}
-	async function buildAuth(url, mode) {
+	async function buildAuth(url, mode, ticket) {
 		switch (mode.kind) {
 			case "token": return new Auth({
 				hassUrl: url,
@@ -281,7 +298,7 @@ function runHaBridgeWorker(scope) {
 				refresh_token: "",
 				expires: 0,
 				expires_in: 0
-			});
+			}, ticket);
 			case "oauth": {
 				const data = mode.data ?? await loadTokens();
 				if (!data) return "needs-auth";
@@ -292,8 +309,8 @@ function runHaBridgeWorker(scope) {
 			}
 		}
 	}
-	async function connect(url, mode, proxyWsPath) {
-		const auth = await buildAuth(url, mode);
+	async function connect(url, mode, proxyWsPath, proxyTicket) {
+		const auth = await buildAuth(url, mode, proxyTicket);
 		if (auth === "needs-auth") {
 			post({
 				k: "connect_result",
@@ -312,9 +329,9 @@ function runHaBridgeWorker(scope) {
 			});
 			return;
 		}
-		const socketFactory = proxyWsPath ? (options) => {
-			const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
-			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? `${proto}//${scope.location.host}${proxyWsPath}` : Reflect.get(target, prop) });
+		const proxyWsUrl = proxyWsPath ? buildProxyWsUrl(scope, proxyWsPath, proxyTicket) : null;
+		const socketFactory = proxyWsUrl ? (options) => {
+			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? proxyWsUrl : Reflect.get(target, prop) });
 			return createSocket({
 				...options,
 				auth: proxied
@@ -368,7 +385,7 @@ function runHaBridgeWorker(scope) {
 		const msg = ev.data;
 		switch (msg.k) {
 			case "connect":
-				await connect(msg.url, msg.mode, msg.proxyWsPath);
+				await connect(msg.url, msg.mode, msg.proxyWsPath, msg.proxyTicket);
 				break;
 			case "send": {
 				if (!conn || !isHaWireMessage(msg.message)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/sync-layer",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Type-safe, reactive state synchronization layer for Home Assistant",
   "repository": {
     "type": "git",