@glasshome/sync-layer 0.7.2 → 0.8.1

package/dist/worker/bridge-client.d.ts

@@ -1,47 +0,0 @@
-import type { CapabilityGrant } from "@glasshome/widget-contract";
-import type { SyncLayerConnection } from "../connection/types";
-import type { AuthMode, ConnState } from "./protocol";
-/**
- * Main-thread side of the HA bridge. Wraps the Worker and exposes:
- * - a SyncLayerConnection facade so the existing store/subscription/command
- *   code runs unchanged, with all HA traffic tunneled through the worker
- * - registerWidget(), which mints the per-widget MessagePort the SDK's
- *   service hooks call through (capability-checked in the worker)
- *
- * The Worker reference and its privileged channel live in this module's
- * closures only.
- */
-export interface BridgeConnectOptions {
-    url: string;
-    mode: AuthMode;
-    proxyWsPath?: string;
-    proxyTicket?: string;
-}
-export interface BridgeEvents {
-    onConnState?: (state: ConnState) => void;
-    onReadyAfterReconnect?: () => void;
-    onDenial?: (denial: {
-        widgetId: string;
-        domain: string;
-        service: string;
-        entityIds: string[];
-        message: string;
-    }) => void;
-}
-export interface HaBridge {
-    /** Resolves on socket-up; rejects with BridgeNeedsAuthError when the worker has no stored OAuth tokens. */
-    connect(opts: BridgeConnectOptions): Promise<void>;
-    disconnect(): void;
-    reconnect(): void;
-    clearTokens(): void;
-    conn: SyncLayerConnection;
-    registerWidget(widgetId: string, caps: CapabilityGrant[]): MessagePort;
-    unregisterWidget(widgetId: string): void;
-    /** Forward visibility/pageshow so the worker can drive suspend/reconnect. Returns teardown. */
-    forwardLifecycle(): () => void;
-    terminate(): void;
-}
-export declare class BridgeNeedsAuthError extends Error {
-    constructor();
-}
-export declare function createHaBridge(worker: Worker, events?: BridgeEvents): HaBridge;

package/dist/worker/enforcement.d.ts

@@ -1,53 +0,0 @@
-import { type CapabilityGrant } from "@glasshome/widget-contract";
-/**
- * Capability enforcement for widget service calls. Pure and registry-backed:
- * the worker feeds it its own mirror of the HA registries, so expansion never
- * trusts anything computed in the widget's realm.
- */
-export interface EntityFacts {
-    deviceId: string | null;
-    areaId: string | null;
-    labels: string[];
-}
-export interface DeviceFacts {
-    areaId: string | null;
-    labels: string[];
-}
-export interface ServiceCallShape {
-    domain: string;
-    service: string;
-    data?: Record<string, unknown>;
-    target?: Record<string, unknown>;
-}
-export declare class RegistryMirror {
-    readonly entities: Map<string, EntityFacts>;
-    readonly devices: Map<string, DeviceFacts>;
-    replace(entityRegistry: {
-        entity_id: string;
-        device_id: string | null;
-        area_id: string | null;
-        labels?: string[];
-    }[], deviceRegistry: {
-        id: string;
-        area_id: string | null;
-        labels?: string[];
-    }[]): void;
-    entityAreaId(entityId: string): string | null;
-    entityLabels(entityId: string): string[];
-}
-/**
- * Expand a service call to the concrete entity ids it can touch. Reads BOTH
- * `target` and the legacy id fields inside `data` — HA honors entity_id (and
- * friends) in service data, so ignoring it would let a call bypass entity
- * narrowing.
- */
-export declare function expandTargets(call: ServiceCallShape, registry: RegistryMirror): string[];
-export type EnforcementVerdict = {
-    allowed: true;
-    entityIds: string[];
-} | {
-    allowed: false;
-    entityIds: string[];
-    message: string;
-};
-export declare function enforceServiceCall(caps: readonly CapabilityGrant[], call: ServiceCallShape, registry: RegistryMirror): EnforcementVerdict;

package/dist/worker/protocol.d.ts

@@ -1,129 +0,0 @@
-import type { CapabilityGrant } from "@glasshome/widget-contract";
-/**
- * Message protocol between the main thread and the HA bridge worker.
- *
- * Two channels with different privilege:
- * - The worker's own message port (privileged): full tunnel to the HA socket.
- *   Held in closure by the bridge client; never handed to widget code.
- * - Per-widget MessagePorts: exactly one verb (call_service), validated
- *   against the widget's granted capabilities inside the worker.
- */
-export type AuthMode = {
-    kind: "token";
-    token: string;
-} | {
-    kind: "brokered";
-    mintUrl: string;
-} | {
-    kind: "oauth";
-    data?: OAuthTokenData;
-};
-/** Serializable subset of home-assistant-js-websocket AuthData. */
-export interface OAuthTokenData {
-    hassUrl: string;
-    clientId: string | null;
-    access_token: string;
-    refresh_token: string;
-    expires: number;
-    expires_in: number;
-}
-export type MainToWorker = {
-    k: "connect";
-    url: string;
-    mode: AuthMode;
-    /** Proxy WS endpoint to use instead of the HA host. A path (web, resolved
-     *  same-origin) or an absolute ws(s)/http(s) URL (native, where the worker
-     *  origin is localhost, not dash-server). */
-    proxyWsPath?: string;
-    /** Short-lived ticket authorizing the proxy WS + broker mint when a
-     *  cross-origin cookie/bearer can't ride them (native). */
-    proxyTicket?: string;
-} | {
-    k: "send";
-    id: number;
-    message: unknown;
-} | {
-    k: "sub";
-    id: number;
-    kind: "events" | "message";
-    eventType?: string;
-    message?: unknown;
-} | {
-    k: "unsub";
-    id: number;
-} | {
-    k: "visibility";
-    hidden: boolean;
-} | {
-    k: "pageshow_persisted";
-} | {
-    k: "reconnect";
-} | {
-    k: "disconnect";
-} | {
-    k: "clear_tokens";
-} | {
-    k: "register_widget";
-    widgetId: string;
-    caps: CapabilityGrant[];
-} | {
-    k: "unregister_widget";
-    widgetId: string;
-};
-export type ConnState = "connected" | "disconnected" | "reconnecting";
-export type WorkerToMain = {
-    k: "connect_result";
-    ok: boolean;
-    error?: string;
-    /** OAuth mode with no stored tokens: main thread must run interactive auth. */
-    needsAuth?: boolean;
-} | {
-    k: "conn";
-    state: ConnState;
-}
-/** Fired after a reconnect completes; main thread reloads data + resubscribes. */
- | {
-    k: "ready_after_reconnect";
-} | {
-    k: "result";
-    id: number;
-    ok: boolean;
-    result?: unknown;
-    error?: string;
-} | {
-    k: "event";
-    id: number;
-    payload: unknown;
-} | {
-    k: "sub_end";
-    id: number;
-    error?: string;
-} | {
-    k: "denial";
-    widgetId: string;
-    domain: string;
-    service: string;
-    entityIds: string[];
-    message: string;
-};
-/** Widget port: request. The only verb widget code can reach. */
-export interface WidgetServiceCall {
-    id: number;
-    domain: string;
-    service: string;
-    data?: Record<string, unknown>;
-    target?: Record<string, unknown>;
-    /** Opt in to HA's service response (return_response). Only set for services
-        that support/require it; HA errors otherwise. */
-    returnResponse?: boolean;
-}
-export type WidgetServiceResult = {
-    id: number;
-    ok: true;
-    result?: unknown;
-} | {
-    id: number;
-    ok: false;
-    code: "CAPABILITY_DENIED" | "UNAVAILABLE" | "ERROR";
-    message: string;
-};

package/dist/worker/token-store.d.ts

@@ -1,3 +0,0 @@
-import type { OAuthTokenData } from "./protocol";
-export declare function loadTokens(): Promise<OAuthTokenData | null>;
-export declare function saveTokens(data: OAuthTokenData | null): Promise<void>;