@iasiv5/dsh-skip-browser-auth 0.2.2 → 0.3.2

package/NOTICE

@@ -5,8 +5,9 @@ This package includes or adapts MIT-licensed code from DeepSeek Harness
 (@deepseek-ai/dsh-client-connection and related packages, the "Upstream
 Code"):
 
-  - lib/client.js is an unmodified copy of the official published client
-    bundle, re-identified only by its registration id;
+  - lib/client.js embeds the factory bodies of the official published client
+    bundles (one per supported DSH generation), unmodified and re-identified
+    only by its registration id;
   - src/trust-fence.ts and src/bridge.ts are ported from the official
     source;
   - src/index.ts and src/trusted-auth.ts follow the semantics of the

package/README.md

@@ -1,14 +1,14 @@
 # @iasiv5/dsh-skip-browser-auth
 
 [![npm](https://img.shields.io/npm/v/@iasiv5/dsh-skip-browser-auth?label=npm&color=cb3837)](https://www.npmjs.com/package/@iasiv5/dsh-skip-browser-auth)
-[![DSH Web](https://img.shields.io/badge/DSH_Web-0.1.2--rc.1_%7C_0.1.5--rc.1_%7C_0.1.5--rc.2_verified-blue)](#兼容版本)
+[![DSH Web](https://img.shields.io/badge/DSH_Web-0.1.2--rc.1_%7C_0.1.5--rc.1_%7C_0.1.5--rc.2_%7C_0.1.7--rc.1_%7C_0.1.7--rc.2_verified-blue)](#兼容版本)
 [![License](https://img.shields.io/github/license/iasiv5/dsh-skip-browser-auth?color=green)](./LICENSE)
 
 个人自用的 DSH Web 插件：在已验证的 DSH compatibility profile 上自动跳过 BrowserAuth，打开 Web 地址即可直接使用，**不必每次把启动 URL 里那串随机 token 抄进浏览器**。
 
-- **精确 profile 门控**：当前支持 `0.1.2-rc.1`、`0.1.5-rc.1` 与 `0.1.5-rc.2`，按 host/client 兼容代际分组；不是把所有版本塞进同一个实现。
+- **精确 profile 门控**：当前支持 `0.1.2-rc.1`、`0.1.5-rc.1`、`0.1.5-rc.2`、`0.1.7-rc.1` 与 `0.1.7-rc.2`，按 host/client 兼容代际分组；不是把所有版本塞进同一个实现。
 - **严格成对匹配**：runtime `@deepseek-ai/dsh` 与 `@deepseek-ai/dsh-client-connection` 必须组成已知版本对。混合版本、未知版本、profile 未实现或解析失败都会自动休眠。
-- **分代适配**：`0.1.2-rc.1` 使用 `legacy-web-v1`；`0.1.5-rc.1` 与 `0.1.5-rc.2` 使用 `carrier-neutral-v2`，包含 request body mode、RPC carrier 和对应浏览器 client variant 适配。
+- **分代适配**：`0.1.2-rc.1` 使用 `legacy-web-v1`；`0.1.5-rc.1` 与 `0.1.5-rc.2` 使用 `carrier-neutral-v2`，包含 request body mode、RPC carrier 和对应浏览器 client variant 适配；`0.1.7-rc.1` 与 `0.1.7-rc.2` 使用 `carrier-neutral-v3`，覆盖 0.1.7 的 `admit()`/OperatorPeer 准入、`connection/request` waterfall 与 mount-preserving BrowserAuth。
 - **不修改 DSH 本体与任何机制**：仅通过 DSH 官方插件 patch 机制替换 Connection 行；卸载或禁用插件并重启，即完全恢复官方行为。
 - **安全提醒**：跳过认证后，Web 对本机/可信网络内的访问不再有身份层，请勿把 DSH 端口暴露给不可信网络。
 
@@ -36,6 +36,7 @@ sudo systemctl restart deepseek-harness.service   # 按你的部署方式重启
 它支持的精确 compatibility profile：
 - DSH 0.1.2-rc.1：legacy-web-v1
 - DSH 0.1.5-rc.1 / 0.1.5-rc.2：carrier-neutral-v2
+- DSH 0.1.7-rc.1 / 0.1.7-rc.2：carrier-neutral-v3
 其它版本或 runtime/connection 混合版本会自动休眠，不要强行处理。
 
 1. 先执行 dsh --version 告诉我当前 DSH 版本，然后照常安装：
@@ -43,7 +44,7 @@ sudo systemctl restart deepseek-harness.service   # 按你的部署方式重启
 2. 重启 DSH Web 并轮询 http://127.0.0.1:3080 直到恢复 200
    （systemd 系统级部署：sudo systemctl restart deepseek-harness.service；
    user 级部署：systemctl --user restart dsh-web.service；端口以实际部署为准）。
-3. 若版本是 0.1.2-rc.1、0.1.5-rc.1 或 0.1.5-rc.2：
+3. 若版本是 0.1.2-rc.1、0.1.5-rc.1、0.1.5-rc.2、0.1.7-rc.1 或 0.1.7-rc.2：
    确认 journal/日志中出现固定警告
    "BrowserAuth has been skipped"，并验证浏览器直接打开 Web 地址不再要求 token。
 4. 若版本不是精确白名单版本，或 profile/依赖契约不匹配：插件应自动休眠，
@@ -66,6 +67,8 @@ sudo systemctl restart deepseek-harness.service
 | `0.1.2-rc.1` + `0.1.2-rc.1` | `legacy-web-v1` | legacy `/api` prefix + 0.1.2 client | ✅ active |
 | `0.1.5-rc.1` + `0.1.5-rc.1` | `carrier-neutral-v2` | carrier-neutral HostConnectionService + 0.1.5 client | ✅ active（代码/真实 npm fixture 已验证；真实部署仍需按清单确认） |
 | `0.1.5-rc.2` + `0.1.5-rc.2` | `carrier-neutral-v2` | 同上（rc.2 为 rc.1 的重发布：代码逐字节一致） | ✅ active（npm diff 审计 + 真实 rc.2 npm fixture 组合测试已验证；真实部署仍需按清单确认） |
+| `0.1.7-rc.1` + `0.1.7-rc.1` | `carrier-neutral-v3` | carrier-neutral-017：admit()/OperatorPeer + `connection/request` waterfall + mount-preserving BrowserAuth + 0.1.7 client | ✅ active（npm diff 审计：插件契约面与 rc.2 逐字节一致 + 真实 rc.1 npm fixture 组合测试，见 docs/COMPATIBILITY.md §5.5；真实部署仍需按清单确认） |
+| `0.1.7-rc.2` + `0.1.7-rc.2` | `carrier-neutral-v3` | 同上 | ✅ active（真实 npm fixture 组合测试 + 2026-09-26 实机 checklist 与回滚演练，见 docs/DESIGN.md） |
 | 其它版本或混合版本对 | — | 😴 自动休眠：官方行为分毫不变 | dormant |
 
 白名单匹配的是**完整版本对**，不是两个独立的 `includes()`：
@@ -75,6 +78,11 @@ runtime=0.1.2-rc.1 + connection=0.1.5-rc.1 → dormant
 runtime=0.1.5-rc.1 + connection=0.1.5-rc.1 → carrier-neutral-v2
 runtime=0.1.5-rc.1 + connection=0.1.5-rc.2 → dormant（同代际跨 patch 混合同样是事故形态）
 runtime=0.1.5-rc.2 + connection=0.1.5-rc.2 → carrier-neutral-v2
+runtime=0.1.7-rc.1 + connection=0.1.7-rc.1 → carrier-neutral-v3
+runtime=0.1.7-rc.1 + connection=0.1.7-rc.2 → dormant（同代际跨 patch 混合同样是事故形态）
+runtime=0.1.7-rc.2 + connection=0.1.7-rc.1 → dormant
+runtime=0.1.7-rc.2 + connection=0.1.7-rc.2 → carrier-neutral-v3
+runtime=0.1.7-rc.2 + connection=0.1.5-rc.2 → dormant（跨代际混合）
 ```
 
 未来的新版本如果保持同一契约，可以加入对应 profile 的精确版本对；如果发生 API、DI、route、body 或 client bundle 契约变化，必须新增 profile、host adapter 和 client variant，不能 fallback 到旧代际。详细流程见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)。
@@ -85,7 +93,8 @@ runtime=0.1.5-rc.2 + connection=0.1.5-rc.2 → carrier-neutral-v2
 - `apply()` backstop 再读取两个 manifest，验证 active profile、patch 传入的 profile id、官方 connection sibling 行的 id/name/disabled/fiber 状态；不满足时在创建服务、注册 route、输出 warning 前 fail loud。
 - `legacy-web-v1` 保留 0.1.2 的 `/api` prefix 与 buffered bridge。
 - `carrier-neutral-v2` 使用 runtime loader 取得当前 0.1.5 connection module，支持 `requestBodyMode`、exact Fetch route 和 streaming body，并将 generic `connection.rpc.handle()` 绑定到拥有 Web carrier 的 replacement context，避免 0.1.5 的 405 回归。
-- client bundle 是显式 profile dispatcher：host 通过 `webserver/index-inject` 注入 profile id，0.1.2/0.1.5 使用各自官方 factory；profile 缺失或未知时不猜测、不加载错误 variant。
+- `carrier-neutral-v3` 在 v2 契约之上复刻 0.1.7 的三处新语义：`/api` 准入改走 `admit()`（OperatorPeer 作为 RPC handler 第 4 参传入）、共享通道请求经 `connection/request` waterfall（监听插件继续可见）、BrowserAuth stub 使用 mount-preserving URL 语义（token 清理 303 `./`、启动 URL 保留 mount）。
+- client bundle 是显式 profile dispatcher：host 通过 `webserver/index-inject` 注入 profile id，0.1.2/0.1.5/0.1.7 使用各自官方 factory；profile 缺失或未知时不猜测、不加载错误 variant。
 - 激活时进程逐字输出固定警告：
 
 ```text
@@ -112,11 +121,12 @@ git diff --exit-code cordis.patch.yml
 
 测试矩阵覆盖：
 
-- 两个完整 profile pair、混合版本、未知版本和 manifest/path drift
+- 全部 active profile pair、同代际跨 patch 混合、跨代际混合、未知版本和 manifest/path drift
 - pnpm 路径段与 npm flat manifest fallback
 - legacy buffered bridge 与 carrier-neutral streaming bridge
 - 真实 0.1.5 dedicated `connection.rpc.handle()`、exact Fetch route 和 405 回归
-- 两个官方 client factory 的 materialization、profile dispatcher 和未知 profile fail-closed
+- 真实 0.1.7 `admit()`/OperatorPeer、`connection/request` waterfall、mount-preserving token 清理、同代际跨 patch 混合 dormant（rc.1 ↔ rc.2）与跨代际混合 dormant
+- 三个官方 client factory 的 materialization、profile dispatcher 和未知 profile fail-closed
 - rc.2 dormant 基线、dispose/unload、Host/Origin/Fetch Metadata trust fence
 
 完整的 GitHub API 审计、profile 数据模型、adapter seam、client 变体和未来新增代际 checklist 见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)；机制详版见 [docs/DESIGN.md](./docs/DESIGN.md)。

package/cordis.patch.yml

@@ -12,7 +12,7 @@
   disabled: !!js >-
     (() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof
     manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles =
-    [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2"].includes(profile); } catch (gateError) { return false; } })()
+    [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch (gateError) { return false; } })()
 - insert:
     - id: trusted-connection
       name: '@iasiv5/dsh-skip-browser-auth'
@@ -22,9 +22,10 @@
         trustedHosts: !!js ctx.webRuntime.trustedHosts
         compatibilityProfile: !!js >-
           (() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof
-          manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]}]; for
-          (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()
+          manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles =
+          [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()
       disabled: !!js >-
         !((() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '@deepseek-ai/dsh-client-connection') return false; const probeAllowed = ((() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function')
         return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let
-        anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2"].includes(profile); } catch (gateError) { return false; } })()); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })())
+        anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch (gateError) { return false; } })()); if (probeAllowed !== true) return false; return official.disabled
+        === true; } catch (gateError) { return false; } })())

package/lib/adapters/carrier-neutral-017.js

@@ -0,0 +1,57 @@
+import { bridge } from '../bridge.js';
+/**
+ * Host implementation for the 0.1.7 carrier-neutral connection contract.
+ *
+ * 与 carrier-neutral（0.1.5）的三处代际差异，均来自官方 0.1.7 apply 的逐行
+ * 对照（docs/COMPATIBILITY.md §5.4）：
+ * 1. `/api` 准入走新的 `admit()`（OperatorPeer 语义），不再直调
+ *    `requestRejection()`；
+ * 2. bridge 由 `webCtx.waterfall('connection/request', req, res, next)` 包裹，
+ *    监听该瀑布的插件才能继续看到每个连接请求；
+ * 3. BrowserAuth 消费是 mount-preserving（见 trusted-auth 的
+ *    `mount-preserving` 语义，由 profile 选择，本 adapter 不重复实现）。
+ */
+export const HOST_ADAPTER_ID = 'carrier-neutral-017';
+export function createCarrierNeutral017Runtime(input) {
+    const connection = new input.module.HostConnectionService(input.ctx, input.trustedHosts, input.auth);
+    const fetchHandler = connection.createSharedFetchHandler(input.module.API_PATH);
+    // admit() 是 0.1.7 代际的定义性契约，先于 requestBodyMode 检查：更早代际的
+    // 模块（如 pinned 0.1.2）在这里以确定性的报错信息被拒绝。
+    if (typeof connection.admit !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral-017 profile requires the 0.1.7 admit() connection seam');
+    }
+    if (typeof fetchHandler.requestBodyMode !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral-017 profile requires a requestBodyMode-aware connection handler');
+    }
+    const waterfall = input.ctx.waterfall;
+    if (typeof waterfall !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral-017 profile requires a waterfall-capable carrier context');
+    }
+    // 0.1.7 keeps the 0.1.5 register() shape: the physical route mounts on
+    // `owner.webServer`, while rpc.handle() readings often come from sibling
+    // plugin contexts without webServer. Bind only this replacement instance's
+    // registrations to the adapter's webServer-owning context (the 405 fix).
+    const service = connection;
+    const originalRegister = service.register;
+    if (typeof originalRegister !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral-017 connection lacks its RPC register seam');
+    }
+    service.register = function registerWithCarrier(_owner, channel, handler) {
+        return originalRegister.call(this, input.ctx, channel, handler);
+    };
+    const admitted = connection;
+    const route = {
+        kind: 'prefix',
+        path: input.module.API_PATH,
+        handler: async (req, res) => {
+            const admission = admitted.admit(req);
+            if ('rejection' in admission) {
+                res.writeHead(admission.rejection);
+                res.end(admission.rejection === 401 ? 'unauthorized' : 'forbidden');
+                return;
+            }
+            await waterfall.call(input.ctx, 'connection/request', req, res, () => bridge(req, res, fetchHandler, input.maxRequestBodyBytes));
+        },
+    };
+    return { connection, route, fetchHandler, adapterId: HOST_ADAPTER_ID };
+}