@glasshome/sync-layer 0.7.1 → 0.8.0

package/dist/{worker-main-C-3QM4di.js → worker-main-D_wyGAIG.js}

@@ -1,6 +1,5 @@
-import { Auth, createConnection, createSocket, genExpires } from "home-assistant-js-websocket";
+import { Auth, ERR_INVALID_AUTH, createConnection, createSocket } from "home-assistant-js-websocket";
 import { matchesCapability } from "@glasshome/widget-contract";
-
 //#region src/worker/enforcement.ts
 var RegistryMirror = class {
 	entities = /* @__PURE__ */ new Map();
@@ -65,66 +64,45 @@ function enforceServiceCall(caps, call, registry) {
 		message: `Call to ${call.domain}.${call.service} is not covered by the widget's granted capabilities`
 	};
 }
-
 //#endregion
-//#region src/worker/token-store.ts
-/**
-* OAuth token persistence inside the worker. IndexedDB is the only storage
-* a worker has; keeping tokens here (and deleting the old localStorage copy
-* on the main thread) is what makes "widgets never see the token" hold.
-*/
-const DB_NAME = "glasshome-ha-bridge";
-const STORE = "auth";
-const KEY = "oauth";
-function openDb() {
-	return new Promise((resolve, reject) => {
-		const req = indexedDB.open(DB_NAME, 1);
-		req.onupgradeneeded = () => {
-			req.result.createObjectStore(STORE);
-		};
-		req.onsuccess = () => resolve(req.result);
-		req.onerror = () => reject(req.error);
+//#region src/worker/proxy-auth.ts
+/** The relay authenticates upstream; this Auth carries no token and never expires. */
+function proxyAuth(hassUrl) {
+	return new Auth({
+		hassUrl,
+		clientId: null,
+		access_token: "",
+		refresh_token: "",
+		expires: Number.MAX_SAFE_INTEGER,
+		expires_in: Number.MAX_SAFE_INTEGER
 	});
 }
-function settle(req) {
-	return new Promise((resolve, reject) => {
-		req.onsuccess = () => resolve(req.result);
-		req.onerror = () => reject(req.error);
-	});
-}
-async function loadTokens() {
-	try {
-		const db = await openDb();
-		const store = db.transaction(STORE, "readonly").objectStore(STORE);
-		const data = await settle(store.get(KEY));
-		db.close();
-		return data ?? null;
-	} catch {
-		return null;
-	}
+function invalidAuthReason(err) {
+	return err === ERR_INVALID_AUTH ? { reason: "invalid_auth" } : {};
 }
-async function saveTokens(data) {
-	try {
-		const db = await openDb();
-		const store = db.transaction(STORE, "readwrite").objectStore(STORE);
-		await (data ? settle(store.put(data, KEY)) : settle(store.delete(KEY)));
-		db.close();
-	} catch {}
+/** The lib fires reconnect-error only for ERR_INVALID_AUTH and then stops
+*  retrying, so that case is terminal, not a reconnect in progress. */
+function reconnectErrorMessage(err) {
+	const reason = invalidAuthReason(err);
+	return {
+		k: "conn",
+		state: "reason" in reason ? "disconnected" : "reconnecting",
+		...reason
+	};
 }
-
 //#endregion
 //#region src/worker/worker-main.ts
 /**
-* HA bridge worker. Owns the socket and the auth tokens; neither ever
-* reaches the main thread. The privileged channel (the worker's own port)
-* tunnels arbitrary HA traffic for the host. Widget MessagePorts get exactly
-* one verb — call_service — validated against the widget's granted
-* capabilities with the worker's own registry mirror, so enforcement does
-* not trust anything computed in the widget's realm.
+* HA bridge worker. Owns the socket, which never reaches the main thread, and
+* holds no HA token: the relay authenticates upstream. The privileged channel
+* (the worker's own port) tunnels arbitrary HA traffic for the host. Widget
+* MessagePorts get exactly one verb, call_service, validated against the
+* widget's granted capabilities with the worker's own registry mirror, so
+* enforcement does not trust anything computed in the widget's realm.
 */
 const HEARTBEAT_INTERVAL_MS = 3e4;
 const HEARTBEAT_TIMEOUT_MS = 15e3;
-const SUSPEND_DELAY_MS = 5 * 60 * 1e3;
+const SUSPEND_DELAY_MS = 3e5;
 function isHaWireMessage(value) {
 	return typeof value === "object" && value !== null && typeof value.type === "string";
 }
@@ -140,44 +118,13 @@ function errText(err) {
 	}
 	return String(err);
 }
-var BrokeredAuth = class extends Auth {
-	constructor(mintUrl, data, ticket) {
-		super(data);
-		this.mintUrl = mintUrl;
-		this.ticket = ticket;
-	}
-	async refreshAccessToken() {
-		const res = await fetch(this.mintUrl, {
-			credentials: "include",
-			headers: {
-				accept: "application/json",
-				...this.ticket ? { "x-proxy-ticket": this.ticket } : {}
-			}
-		});
-		if (!res.ok) throw new Error(`Token broker responded ${res.status}`);
-		if (!res.headers.get("content-type")?.includes("application/json")) throw new Error(`Token broker did not return JSON (is ${this.mintUrl} reachable?)`);
-		const broker = await res.json();
-		this.data = {
-			...this.data,
-			access_token: broker.accessToken,
-			expires_in: broker.expiresInSec,
-			expires: genExpires(broker.expiresInSec),
-			refresh_token: "",
-			hassUrl: broker.haUrl,
-			clientId: broker.haClientId
-		};
-	}
-};
 /** Resolve the proxy WS endpoint. Accepts a same-origin path (web) or an
 *  absolute ws(s)/http(s) URL (native), and appends the auth ticket if given. */
 function buildProxyWsUrl(scope, proxyWsPath, ticket) {
 	let base;
 	if (/^wss?:\/\//i.test(proxyWsPath)) base = proxyWsPath;
 	else if (/^https?:\/\//i.test(proxyWsPath)) base = proxyWsPath.replace(/^http/i, "ws");
-	else {
-		const proto = scope.location.protocol === "https:" ? "wss:" : "ws:";
-		base = `${proto}//${scope.location.host}${proxyWsPath}`;
-	}
+	else base = `${scope.location.protocol === "https:" ? "wss:" : "ws:"}//${scope.location.host}${proxyWsPath}`;
 	if (ticket) base += `${base.includes("?") ? "&" : "?"}ticket=${encodeURIComponent(ticket)}`;
 	return base;
 }
@@ -266,7 +213,7 @@ function runHaBridgeWorker(scope) {
 	function startHeartbeat(c) {
 		stopHeartbeat();
 		heartbeat = setInterval(() => {
-			const timer = new Promise((_, reject) => setTimeout(() => reject(new Error("ping timeout")), HEARTBEAT_TIMEOUT_MS));
+			const timer = new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("ping timeout")), HEARTBEAT_TIMEOUT_MS));
 			Promise.race([c.ping(), timer]).catch(() => c.reconnect());
 		}, HEARTBEAT_INTERVAL_MS);
 	}
@@ -295,72 +242,25 @@ function runHaBridgeWorker(scope) {
 			resumeVisible = null;
 		}
 	}
-	async function buildAuth(url, mode, ticket) {
-		switch (mode.kind) {
-			case "token": return new Auth({
-				hassUrl: url,
-				clientId: null,
-				access_token: mode.token,
-				refresh_token: "",
-				expires: Date.now() + 365 * 24 * 3600 * 1e3,
-				expires_in: 365 * 24 * 3600
-			});
-			case "brokered": return new BrokeredAuth(mode.mintUrl, {
-				hassUrl: url,
-				clientId: null,
-				access_token: "",
-				refresh_token: "",
-				expires: 0,
-				expires_in: 0
-			}, ticket);
-			case "oauth": {
-				const data = mode.data ?? await loadTokens();
-				if (!data) return "needs-auth";
-				if (mode.data) await saveTokens(mode.data);
-				return new Auth(data, (updated) => {
-					saveTokens(updated);
-				});
-			}
-		}
-	}
-	async function connect(url, mode, proxyWsPath, proxyTicket) {
-		const auth = await buildAuth(url, mode, proxyTicket);
-		if (auth === "needs-auth") {
-			post({
-				k: "connect_result",
-				ok: false,
-				needsAuth: true
-			});
-			return;
-		}
-		if (mode.kind === "brokered") try {
-			await auth.refreshAccessToken();
-		} catch (err) {
-			post({
-				k: "connect_result",
-				ok: false,
-				error: errText(err)
-			});
-			return;
-		}
-		const proxyWsUrl = proxyWsPath ? buildProxyWsUrl(scope, proxyWsPath, proxyTicket) : null;
-		const socketFactory = proxyWsUrl ? (options) => {
-			const proxied = new Proxy(options.auth, { get: (target, prop) => prop === "wsUrl" ? proxyWsUrl : Reflect.get(target, prop) });
-			return createSocket({
-				...options,
-				auth: proxied
-			});
-		} : void 0;
+	async function connect(url, proxyWsPath, proxyTicket) {
+		const auth = proxyAuth(url);
+		const proxyWsUrl = buildProxyWsUrl(scope, proxyWsPath, proxyTicket);
+		const proxiedAuth = new Proxy(auth, { get: (target, prop) => prop === "wsUrl" ? proxyWsUrl : Reflect.get(target, prop) });
+		const socketFactory = (options) => createSocket({
+			...options,
+			auth: proxiedAuth
+		});
 		try {
 			conn = await createConnection({
 				auth,
-				...socketFactory ? { createSocket: socketFactory } : {}
+				createSocket: socketFactory
 			});
 		} catch (err) {
 			post({
 				k: "connect_result",
 				ok: false,
-				error: errText(err)
+				error: errText(err),
+				...invalidAuthReason(err)
 			});
 			return;
 		}
@@ -368,10 +268,7 @@ function runHaBridgeWorker(scope) {
 			k: "conn",
 			state: "disconnected"
 		}));
-		conn.addEventListener("reconnect-error", () => post({
-			k: "conn",
-			state: "reconnecting"
-		}));
+		conn.addEventListener("reconnect-error", (_c, err) => post(reconnectErrorMessage(err)));
 		let everReady = false;
 		conn.addEventListener("ready", () => {
 			post({
@@ -399,9 +296,9 @@ function runHaBridgeWorker(scope) {
 		const msg = ev.data;
 		switch (msg.k) {
 			case "connect":
-				await connect(msg.url, msg.mode, msg.proxyWsPath, msg.proxyTicket);
+				await connect(msg.url, msg.proxyWsPath, msg.proxyTicket);
 				break;
-			case "send": {
+			case "send":
 				if (!conn || !isHaWireMessage(msg.message)) {
 					post({
 						k: "result",
@@ -428,8 +325,7 @@ function runHaBridgeWorker(scope) {
 					});
 				}
 				break;
-			}
-			case "sub": {
+			case "sub":
 				if (!conn) {
 					post({
 						k: "sub_end",
@@ -466,7 +362,6 @@ function runHaBridgeWorker(scope) {
 					});
 				}
 				break;
-			}
 			case "unsub": {
 				const unsub = subs.get(msg.id);
 				subs.delete(msg.id);
@@ -493,9 +388,6 @@ function runHaBridgeWorker(scope) {
 					state: "disconnected"
 				});
 				break;
-			case "clear_tokens":
-				await saveTokens(null);
-				break;
 			case "register_widget": {
 				const port = ev.ports[0];
 				if (port) attachWidgetPort(msg.widgetId, msg.caps, port);
@@ -504,10 +396,8 @@ function runHaBridgeWorker(scope) {
 			case "unregister_widget":
 				widgets.get(msg.widgetId)?.port.close();
 				widgets.delete(msg.widgetId);
-				break;
 		}
 	};
 }
-
 //#endregion
-export { runHaBridgeWorker };
+export { runHaBridgeWorker as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/sync-layer",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Type-safe, reactive state synchronization layer for Home Assistant",
   "repository": {
     "type": "git",
@@ -57,8 +57,8 @@
     "@glasshome/ha-types": "0.1.2",
     "@types/bun": "latest",
     "solid-js": "^1.9.0",
-    "tsdown": "^0.2.0",
-    "typescript": "^5"
+    "tsdown": "^0.22.14",
+    "typescript": "^7.0.2"
   },
   "homepage": "https://github.com/glasshome/sync-layer#readme",
   "bugs": {

package/dist/calendar/track.d.ts

@@ -1,19 +0,0 @@
-import type { EntityId } from "../core/types";
-import type { CalendarWindowOptions } from "./types";
-/**
- * Start tracking live events for a calendar entity. Returns the untrack
- * function. Safe while disconnected: the subscription activates on the next
- * `forceResubscribeCalendars()` (called by the connection layer on connect
- * and reconnect).
- */
-export declare function trackCalendarEvents(entityId: EntityId, options?: CalendarWindowOptions): () => void;
-/**
- * Reconcile every tracked calendar, dropping current subscription handles
- * first. The connection layer calls this on connect and after reconnect:
- * an unchanged window is no proof the old subscription is alive, so each
- * tracked entity resubscribes (HA re-pushes the snapshot, refreshing the
- * store through any missed changes).
- */
-export declare function forceResubscribeCalendars(): Promise<void>;
-/** Test-only: drop all tracking state and timers. */
-export declare function resetCalendarTracking(): void;

package/dist/calendar/types.d.ts

@@ -1,32 +0,0 @@
-import type { EntityId } from "../core/types";
-/**
- * One calendar event as HA serializes it over `calendar/event/subscribe`:
- * dates/datetimes are ISO strings (date-only for all-day events), and
- * None-valued fields are omitted.
- */
-export interface CalendarEvent {
-    start: string;
-    end: string;
-    summary: string;
-    description?: string;
-    location?: string;
-    uid?: string;
-    recurrence_id?: string;
-    rrule?: string;
-}
-/** Live event window for one calendar entity, held in the store. */
-export interface CalendarEventsData {
-    entityId: EntityId;
-    events: CalendarEvent[];
-    /** True until the first snapshot for the current subscription arrives. */
-    loading: boolean;
-    error: Error | null;
-    /** Subscribed window bounds (ISO). */
-    start: string;
-    end: string;
-}
-/** Per-tracker window request, in whole days relative to now. */
-export interface CalendarWindowOptions {
-    daysBehind?: number;
-    daysAhead?: number;
-}

package/dist/camera/fetch.d.ts

@@ -1,16 +0,0 @@
-/**
- * Camera Stream Fetching
- *
- * @packageDocumentation
- */
-import type { EntityId } from "../core/types";
-import type { CameraStreamData, StreamFormat, StreamQueryOptions } from "./types";
-/**
- * Fetch stream for a camera entity.
- * Returns a public demo HLS stream when not connected.
- */
-export declare function fetchStream(entityId: EntityId, format?: StreamFormat): Promise<string | null>;
-/**
- * Fetch stream data for a camera entity
- */
-export declare function fetchStreamData(entityId: EntityId, options?: StreamQueryOptions): Promise<CameraStreamData>;

package/dist/camera/query.d.ts

@@ -1,15 +0,0 @@
-/**
- * Camera Stream Query Builder
- *
- * @packageDocumentation
- */
-import type { EntityId } from "../core/types";
-import type { CameraStreamData, EntityStreamQueryOptions, StreamFormat } from "./types";
-/**
- * Get stream for a camera entity
- */
-export declare function getStream(entityId: EntityId, options?: EntityStreamQueryOptions): Promise<CameraStreamData>;
-/**
- * Refresh stream for a camera entity
- */
-export declare function refreshStream(entityId: EntityId, format?: StreamFormat): Promise<CameraStreamData>;

package/dist/camera/types.d.ts

@@ -1,85 +0,0 @@
-/**
- * Camera Types
- *
- * Type definitions for camera stream data.
- *
- * @packageDocumentation
- */
-import type { EntityId } from "../core/types";
-/**
- * Stream format
- * Supported stream formats from Home Assistant Camera API
- */
-export type StreamFormat = "hls" | "webrtc" | "mjpeg";
-/**
- * Camera stream data
- */
-export interface CameraStream {
-    /** Stream URL */
-    url: string | null;
-    /** Loading state */
-    loading: boolean;
-    /** Error if any */
-    error: Error | null;
-    /** Last fetched timestamp */
-    lastFetched: number | null;
-    /** Stream format */
-    format: StreamFormat;
-    /** Stream expiration time (if available) */
-    expiresAt?: number | null;
-}
-/**
- * Camera stream data for an entity
- */
-export interface CameraStreamData {
-    /** Entity ID */
-    entityId: EntityId;
-    /** Stream data */
-    stream: CameraStream;
-    /** Loading state */
-    loading: boolean;
-    /** Error if any */
-    error: Error | null;
-    /** Last fetched timestamp */
-    lastFetched: number | null;
-}
-/**
- * Camera stream data for multiple entities
- */
-export interface CameraStreams {
-    /** Entity ID -> Stream data */
-    [entityId: EntityId]: CameraStreamData;
-}
-/**
- * Options for stream queries
- */
-export interface StreamQueryOptions {
-    /** Stream format (default: "hls") */
-    format?: StreamFormat;
-    /** Auto-refresh stream before expiration */
-    autoRefresh?: boolean;
-    /** Stream refresh interval in milliseconds (default: 5 minutes) */
-    refreshInterval?: number;
-}
-/**
- * Single entity stream query options
- */
-export interface EntityStreamQueryOptions {
-    /** Stream format (default: "hls") */
-    format?: StreamFormat;
-    /** Auto-refresh stream before expiration */
-    autoRefresh?: boolean;
-    /** Stream refresh interval in milliseconds (default: 5 minutes) */
-    refreshInterval?: number;
-}
-/**
- * Stream query result
- */
-export interface StreamResult {
-    /** Stream data */
-    data: CameraStreamData | null;
-    /** Loading state */
-    loading: boolean;
-    /** Error if any */
-    error: Error | null;
-}

package/dist/camera/webrtc.d.ts

@@ -1,31 +0,0 @@
-import type { EntityId } from "../core/types";
-/** Minimal RTC types for sync-layer (no DOM lib dependency) */
-type RtcConfiguration = Record<string, unknown>;
-type RtcIceCandidateInit = Record<string, unknown>;
-interface WebRtcClientConfig {
-    configuration: RtcConfiguration;
-    dataChannel?: string;
-}
-interface WebRtcSession {
-    sessionId: string | null;
-    unsubscribe: (() => Promise<void>) | null;
-}
-/**
- * Get WebRTC client configuration (STUN/TURN servers) from HA
- */
-export declare function getWebRtcClientConfig(entityId: EntityId): Promise<WebRtcClientConfig>;
-/**
- * Start WebRTC session with HA.
- * Returns a promise that resolves when the answer SDP is received.
- * ICE candidates from HA are forwarded to the provided callback.
- * Local ICE candidates should be sent via sendWebRtcCandidate().
- */
-export declare function startWebRtcSession(entityId: EntityId, sdpOffer: string, onCandidate: (candidate: RtcIceCandidateInit) => void): Promise<{
-    answer: string;
-    session: WebRtcSession;
-}>;
-/**
- * Send a local ICE candidate to HA
- */
-export declare function sendWebRtcCandidate(entityId: EntityId, sessionId: string, candidate: RtcIceCandidateInit): Promise<void>;
-export {};

package/dist/commands/service.d.ts

@@ -1,53 +0,0 @@
-/**
- * Service calls and commands
- *
- * Type-safe wrappers for Home Assistant service calls and commands.
- *
- * @packageDocumentation
- */
-import type { Domain, ServiceCall, ServiceName, WsCommandType } from "@glasshome/ha-types";
-import type { EntityId } from "../core/types";
-import type { EntityUpdateFields, ServiceTarget } from "./types";
-/**
- * Call a Home Assistant service
- */
-export declare function callService<D extends Domain, S extends ServiceName<D>>(domain: D, service: S, serviceData?: ServiceCall<D, S>, target?: ServiceTarget): Promise<void>;
-/**
- * Turn on entity or entities
- */
-export declare function turnOn(entityId: EntityId | EntityId[], serviceData?: Record<string, any>): Promise<void>;
-/**
- * Turn off entity or entities
- */
-export declare function turnOff(entityId: EntityId | EntityId[], serviceData?: Record<string, any>): Promise<void>;
-/**
- * Toggle entity or entities
- */
-export declare function toggle(entityId: EntityId | EntityId[], serviceData?: Record<string, any>): Promise<void>;
-/**
- * Update entity registry entry
- */
-export declare function updateEntity(entityId: EntityId, updates: EntityUpdateFields): Promise<any>;
-/**
- * Send a generic WebSocket command
- */
-export declare function sendCommand<T = unknown>(command: {
-    type: WsCommandType | string;
-    [key: string]: unknown;
-}): Promise<T>;
-/**
- * Execute multiple service calls in parallel
- */
-export declare function batchServiceCalls(calls: Array<{
-    domain: Domain;
-    service: ServiceName<Domain>;
-    serviceData?: ServiceCall<Domain, ServiceName<Domain>>;
-    target?: ServiceTarget;
-}>): Promise<void>;
-/**
- * Execute multiple entity updates in parallel
- */
-export declare function batchEntityUpdates(updates: Array<{
-    entityId: EntityId;
-    updates: EntityUpdateFields;
-}>): Promise<any[]>;