dsh-realtime-audio-ws 0.1.3 → 0.2.1

package/lib/client/bundle.js

@@ -30,6 +30,8 @@ window.__ModuleLoader__.load({ id: "dsh-realtime-audio-ws",
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.INJECTED_KEY = exports.GLOBAL_KEY = exports.MAX_BACKLOG_SECONDS = exports.CAPTURE_BUFFER = exports.SAMPLE_RATE = exports.DEFAULT_PATH = exports.inject = exports.name = void 0;
     exports.socketUrl = socketUrl;
+    exports.pageAuthority = pageAuthority;
+    exports.withToken = withToken;
     exports.pcm16FromFloat32 = pcm16FromFloat32;
     exports.float32FromPcm16 = float32FromPcm16;
     exports.defaultDeps = defaultDeps;
@@ -52,7 +54,7 @@ window.__ModuleLoader__.load({ id: "dsh-realtime-audio-ws",
     exports.MAX_BACKLOG_SECONDS = 0.5;
     /** Global the client publishes itself on. There is no UI surface yet; this is how it is started. */
     exports.GLOBAL_KEY = '__dshRealtimeAudio';
-    /** Optional host-injected settings. A future index-injection row may set the path; the default matches. */
+    /** Optional host-injected settings, published as a `global` index-injection row before this file runs. */
     exports.INJECTED_KEY = '__DSH_REALTIME_AUDIO__';
     // ---- pure helpers --------------------------------------------------------------------------------------
     /**
@@ -62,13 +64,44 @@ window.__ModuleLoader__.load({ id: "dsh-realtime-audio-ws",
      * @param path - the route pathname.
      * @returns the URL, or undefined when this page cannot host a socket at all.
      */
-    function socketUrl(location, path) {
-        if (location === undefined || location.host === '')
+    function socketUrl(location, path, authority) {
+        const host = authority !== undefined && authority !== '' ? authority : pageAuthority(location);
+        if (host === undefined)
             return undefined;
         // An https page may not open a ws:// socket — the browser blocks it as mixed content — so the scheme has
         // to follow the page rather than being decided here.
-        const scheme = location.protocol === 'https:' ? 'wss' : 'ws';
-        return `${scheme}://${location.host}${path}`;
+        const scheme = location?.protocol === 'https:' ? 'wss' : 'ws';
+        return `${scheme}://${host}${path}`;
+    }
+    /**
+     * The authority a page can derive for itself, or undefined when it cannot derive a usable one.
+     *
+     * Only an http(s) page addresses a server. The desktop app's page is served from `dsh-app://app`, whose
+     * host is the literal string `app`: deriving a socket URL from it yields `ws://app/...`, which resolves
+     * nowhere and fails in a way that reads exactly like the host refusing the connection — a wrong answer
+     * that costs an afternoon. Returning undefined lets the caller name the real cause instead.
+     *
+     * @param location - the page's location, or undefined when there is none.
+     * @returns the authority, or undefined when this page has no usable one of its own.
+     */
+    function pageAuthority(location) {
+        if (location === undefined)
+            return undefined;
+        if (location.protocol !== 'http:' && location.protocol !== 'https:')
+            return undefined;
+        return location.host === '' ? undefined : location.host;
+    }
+    /**
+     * Attach the capability token, when the host injected one.
+     *
+     * @param url - the socket URL.
+     * @param token - the injected token, or undefined on a host that injects none.
+     * @returns the URL to open.
+     */
+    function withToken(url, token) {
+        if (token === undefined || token === '')
+            return url;
+        return `${url}?t=${encodeURIComponent(token)}`;
     }
     /**
      * Convert one captured float block to the wire's PCM16.
@@ -210,9 +243,11 @@ window.__ModuleLoader__.load({ id: "dsh-realtime-audio-ws",
         const start = async () => {
             if (current.kind === 'live')
                 return current;
-            const url = socketUrl(deps.location, deps.injected?.path ?? exports.DEFAULT_PATH);
-            if (url === undefined)
-                return fail('this page has no location to open a socket against');
+            const route = socketUrl(deps.location, deps.injected?.path ?? exports.DEFAULT_PATH, deps.injected?.authority);
+            if (route === undefined) {
+                return fail('no authority for the audio socket: this page has none of its own and the host injected none');
+            }
+            const url = withToken(route, deps.injected?.token);
             if (deps.getUserMedia === undefined)
                 return fail('this page has no microphone API');
             if (deps.createAudioContext === undefined)

package/lib/client/index.js

@@ -26,6 +26,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INJECTED_KEY = exports.GLOBAL_KEY = exports.MAX_BACKLOG_SECONDS = exports.CAPTURE_BUFFER = exports.SAMPLE_RATE = exports.DEFAULT_PATH = exports.inject = exports.name = void 0;
 exports.socketUrl = socketUrl;
+exports.pageAuthority = pageAuthority;
+exports.withToken = withToken;
 exports.pcm16FromFloat32 = pcm16FromFloat32;
 exports.float32FromPcm16 = float32FromPcm16;
 exports.defaultDeps = defaultDeps;
@@ -48,7 +50,7 @@ exports.CAPTURE_BUFFER = 1024;
 exports.MAX_BACKLOG_SECONDS = 0.5;
 /** Global the client publishes itself on. There is no UI surface yet; this is how it is started. */
 exports.GLOBAL_KEY = '__dshRealtimeAudio';
-/** Optional host-injected settings. A future index-injection row may set the path; the default matches. */
+/** Optional host-injected settings, published as a `global` index-injection row before this file runs. */
 exports.INJECTED_KEY = '__DSH_REALTIME_AUDIO__';
 // ---- pure helpers --------------------------------------------------------------------------------------
 /**
@@ -58,13 +60,44 @@ exports.INJECTED_KEY = '__DSH_REALTIME_AUDIO__';
  * @param path - the route pathname.
  * @returns the URL, or undefined when this page cannot host a socket at all.
  */
-function socketUrl(location, path) {
-    if (location === undefined || location.host === '')
+function socketUrl(location, path, authority) {
+    const host = authority !== undefined && authority !== '' ? authority : pageAuthority(location);
+    if (host === undefined)
         return undefined;
     // An https page may not open a ws:// socket — the browser blocks it as mixed content — so the scheme has
     // to follow the page rather than being decided here.
-    const scheme = location.protocol === 'https:' ? 'wss' : 'ws';
-    return `${scheme}://${location.host}${path}`;
+    const scheme = location?.protocol === 'https:' ? 'wss' : 'ws';
+    return `${scheme}://${host}${path}`;
+}
+/**
+ * The authority a page can derive for itself, or undefined when it cannot derive a usable one.
+ *
+ * Only an http(s) page addresses a server. The desktop app's page is served from `dsh-app://app`, whose
+ * host is the literal string `app`: deriving a socket URL from it yields `ws://app/...`, which resolves
+ * nowhere and fails in a way that reads exactly like the host refusing the connection — a wrong answer
+ * that costs an afternoon. Returning undefined lets the caller name the real cause instead.
+ *
+ * @param location - the page's location, or undefined when there is none.
+ * @returns the authority, or undefined when this page has no usable one of its own.
+ */
+function pageAuthority(location) {
+    if (location === undefined)
+        return undefined;
+    if (location.protocol !== 'http:' && location.protocol !== 'https:')
+        return undefined;
+    return location.host === '' ? undefined : location.host;
+}
+/**
+ * Attach the capability token, when the host injected one.
+ *
+ * @param url - the socket URL.
+ * @param token - the injected token, or undefined on a host that injects none.
+ * @returns the URL to open.
+ */
+function withToken(url, token) {
+    if (token === undefined || token === '')
+        return url;
+    return `${url}?t=${encodeURIComponent(token)}`;
 }
 /**
  * Convert one captured float block to the wire's PCM16.
@@ -206,9 +239,11 @@ function createAudioClient(deps) {
     const start = async () => {
         if (current.kind === 'live')
             return current;
-        const url = socketUrl(deps.location, deps.injected?.path ?? exports.DEFAULT_PATH);
-        if (url === undefined)
-            return fail('this page has no location to open a socket against');
+        const route = socketUrl(deps.location, deps.injected?.path ?? exports.DEFAULT_PATH, deps.injected?.authority);
+        if (route === undefined) {
+            return fail('no authority for the audio socket: this page has none of its own and the host injected none');
+        }
+        const url = withToken(route, deps.injected?.token);
         if (deps.getUserMedia === undefined)
             return fail('this page has no microphone API');
         if (deps.createAudioContext === undefined)

package/lib/diagnostics.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The diagnostics route: the journal, served as JSON over the web server's route registry.
+ *
+ * S1 story 4. It exists so a failure can be read *after* the fact without a console attached — which is
+ * the whole cost this project kept paying, an evening spent inferring a reason that was never written
+ * down anywhere.
+ *
+ * ## The access policy is the audio route's, reused rather than re-derived
+ *
+ * The host's route registry "knows no harness concepts" and its handlers own the full response, so
+ * nothing upstream answers the authentication question for us. The audio route already answers it in
+ * this package: ask the connection service, and let the process's capability token override a refusal,
+ * because the desktop app's page is served from `dsh-app://app` and is therefore cross-site to loopback
+ * — it can never carry the harness's `SameSite=Strict` cookie. This route asks in the same position with
+ * the same token: one policy, two doors. Inventing a second check here is how two schemes drift until
+ * one of them is found holding the weaker answer.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not redact on the way out. The journal redacts on **write**, so there is no unredacted value
+ * in the buffer to serve and no second step for a later edit to forget. A route that redacted at the
+ * boundary would look safer and be strictly worse: the secret would already be retained, in memory and
+ * in whatever the process dumps.
+ *
+ * @module dsh-realtime-audio-ws/diagnostics
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Journal } from 'dsh-realtime';
+/**
+ * The slice of the journal this route reads.
+ *
+ * Typed as the public surface rather than as the class: `Journal` exists as two declarations in this
+ * repository — built `lib/` and `src/` — and a class with a private member is nominally typed, so the
+ * two are not assignable to each other even though they are the same code.
+ */
+export type DiagnosticsJournal = Pick<Journal, 'snapshot' | 'size' | 'oldestSeq'>;
+/** What the route needs from the plugin that owns it. */
+export interface DiagnosticsDeps {
+    /** Absolute pathname to claim, no trailing slash — the registry's own contract. */
+    readonly path: string;
+    /** This process's capability token, the same one the audio route publishes to the page. */
+    readonly token: string;
+    /** The connection service's verdict for one request. */
+    readonly rejectionFor: (request: {
+        headers: IncomingMessage['headers'];
+    }) => 401 | 403 | undefined;
+    /** The journal to serve. */
+    readonly journal: DiagnosticsJournal;
+}
+/** A route the host's registry accepts, described structurally as this package describes the registry. */
+export interface DiagnosticsRoute {
+    readonly kind: 'exact';
+    readonly path: string;
+    readonly handler: (req: IncomingMessage, res: ServerResponse) => void;
+}
+/**
+ * Build the diagnostics route.
+ * @param deps - the path to claim, this process's token, the connection service's verdict, and the journal.
+ * @returns the route registration, ready for `webServer.register`.
+ */
+export declare function diagnosticsRoute(deps: DiagnosticsDeps): DiagnosticsRoute;
+//# sourceMappingURL=diagnostics.d.ts.map

package/lib/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAG3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;AAEjF,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;KAAE,KAAK,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAClG,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CACrC;AAED,0GAA0G;AAC1G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAA;CACtE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAmBxE"}

package/lib/diagnostics.js

@@ -0,0 +1,66 @@
+/**
+ * The diagnostics route: the journal, served as JSON over the web server's route registry.
+ *
+ * S1 story 4. It exists so a failure can be read *after* the fact without a console attached — which is
+ * the whole cost this project kept paying, an evening spent inferring a reason that was never written
+ * down anywhere.
+ *
+ * ## The access policy is the audio route's, reused rather than re-derived
+ *
+ * The host's route registry "knows no harness concepts" and its handlers own the full response, so
+ * nothing upstream answers the authentication question for us. The audio route already answers it in
+ * this package: ask the connection service, and let the process's capability token override a refusal,
+ * because the desktop app's page is served from `dsh-app://app` and is therefore cross-site to loopback
+ * — it can never carry the harness's `SameSite=Strict` cookie. This route asks in the same position with
+ * the same token: one policy, two doors. Inventing a second check here is how two schemes drift until
+ * one of them is found holding the weaker answer.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not redact on the way out. The journal redacts on **write**, so there is no unredacted value
+ * in the buffer to serve and no second step for a later edit to forget. A route that redacted at the
+ * boundary would look safer and be strictly worse: the secret would already be retained, in memory and
+ * in whatever the process dumps.
+ *
+ * @module dsh-realtime-audio-ws/diagnostics
+ */
+import { tokenFromUrl, verdictFor } from './injection.js';
+/**
+ * Build the diagnostics route.
+ * @param deps - the path to claim, this process's token, the connection service's verdict, and the journal.
+ * @returns the route registration, ready for `webServer.register`.
+ */
+export function diagnosticsRoute(deps) {
+    return {
+        kind: 'exact',
+        path: deps.path,
+        handler: (req, res) => {
+            const rejection = verdictFor(deps.rejectionFor(req), tokenFromUrl(req.url), deps.token);
+            if (rejection !== undefined) {
+                // The status carries the verdict the connection service actually gave, so a reader can tell a
+                // missing credential from a refused one rather than guessing from a generic failure.
+                send(res, rejection, { error: rejection === 401 ? 'unauthorized' : 'forbidden' });
+                return;
+            }
+            const entries = deps.journal.snapshot();
+            // `size` and `oldestSeq` travel with the entries rather than being left for the reader to infer:
+            // a truncated buffer and an idle one are the same empty-looking list otherwise, and the sequence
+            // number is the only thing that separates "nothing happened" from "the buffer rolled over".
+            send(res, 200, { size: deps.journal.size, oldestSeq: deps.journal.oldestSeq, entries });
+        },
+    };
+}
+/**
+ * Write one JSON response.
+ *
+ * `no-store` on both branches. This response is a picture of a moving buffer, and a cached one would be
+ * read as current — the same class of mistake as a journal that cannot show its own eviction.
+ * @param res - the response this handler owns.
+ * @param status - HTTP status to write.
+ * @param body - value to serialise as the JSON body.
+ */
+function send(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+//# sourceMappingURL=diagnostics.js.map

package/lib/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AA8BzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB;IACpD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACvF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,8FAA8F;gBAC9F,qFAAqF;gBACrF,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;YACvC,iGAAiG;YACjG,iGAAiG;YACjG,4FAA4F;YAC5F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;QACzF,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC"}

package/lib/index.d.ts

@@ -9,13 +9,26 @@
  * connection services exist, so a composition without a web stack gets a row that visibly waits rather
  * than one that loads and silently claims nothing. `packages/realtime-audio-ws/tests/plugin.spec.ts` proves
  * the functional path against a real socket with both services present.
+ *
+ * It claims **two** routes on that registry, and one policy authenticates both: the WebSocket upgrade
+ * that carries audio, and the JSON diagnostics route that serves the journal. See `./diagnostics.ts` for
+ * why the second reuses the first's check rather than deriving its own.
  */
 import Schema from '@deepseek-ai/schemastery';
 import type { Context } from '@deepseek-ai/cordis';
 import { type RealtimeAudioWsConfig } from './types.ts';
 export * from './types.ts';
+/**
+ * The query parameter carrying the capability token.
+ *
+ * Published with the route rather than kept internal: nothing can address the route without it, and a
+ * consumer restating the literal is a consumer that drifts. It is one string; the rest of `injection.ts`
+ * stays where it is.
+ */
+export { TOKEN_PARAM } from './injection.ts';
 export { attachAudioSocket, toBytes, type AudioSocketBridgeDeps } from './bridge.ts';
 export { createUpgradeAcceptor, rejectUpgrade, type UpgradeAcceptor } from './upgrade.ts';
+export { diagnosticsRoute, type DiagnosticsDeps, type DiagnosticsJournal, type DiagnosticsRoute } from './diagnostics.ts';
 /** Plugin name. */
 export declare const name = "realtime-audio-ws";
 export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
@@ -23,11 +36,13 @@ export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     maxFrameBytes: Schema<number, number, "defined">;
     maxConnections: Schema<number, number, "defined">;
     openSessionOnConnect: Schema<boolean, boolean, "defined">;
+    diagnosticsPath: Schema<string, string, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     path: Schema<string, string, "defined">;
     maxFrameBytes: Schema<number, number, "defined">;
     maxConnections: Schema<number, number, "defined">;
     openSessionOnConnect: Schema<boolean, boolean, "defined">;
+    diagnosticsPath: Schema<string, string, "defined">;
 }>>, "plain">;
 export declare function apply(ctx: Context, config: RealtimeAudioWsConfig): void;
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAOlD,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAA;AAEnB,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAEzF,mBAAmB;AACnB,eAAO,MAAM,IAAI,sBAAsB,CAAA;AAEvC,eAAO,MAAM,MAAM;;;;;;;;;;aAQjB,CAAA;AAqBF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAoDvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAgBlD,OAAO,EAOL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAA;AAEnB,cAAc,YAAY,CAAA;AAC1B;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEzH,mBAAmB;AACnB,eAAO,MAAM,IAAI,sBAAsB,CAAA;AAEvC,eAAO,MAAM,MAAM;;;;;;;;;;;;aASjB,CAAA;AAqCF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CA6GvE"}

package/lib/index.js

@@ -9,14 +9,29 @@
  * connection services exist, so a composition without a web stack gets a row that visibly waits rather
  * than one that loads and silently claims nothing. `packages/realtime-audio-ws/tests/plugin.spec.ts` proves
  * the functional path against a real socket with both services present.
+ *
+ * It claims **two** routes on that registry, and one policy authenticates both: the WebSocket upgrade
+ * that carries audio, and the JSON diagnostics route that serves the journal. See `./diagnostics.ts` for
+ * why the second reuses the first's check rather than deriving its own.
  */
 import Schema from '@deepseek-ai/schemastery';
 import { attachAudioSocket } from './bridge.js';
+import { diagnosticsRoute } from './diagnostics.js';
+import { createRouteToken, routeAuthority, routeInjectionRow, tokenFromUrl, verdictFor, } from './injection.js';
 import { createUpgradeAcceptor, rejectUpgrade } from './upgrade.js';
-import { DEFAULT_MAX_CONNECTIONS, DEFAULT_MAX_FRAME_BYTES, DEFAULT_OPEN_SESSION_ON_CONNECT, DEFAULT_PATH, } from './types.js';
+import { DEFAULT_DIAGNOSTICS_PATH, DEFAULT_MAX_CONNECTIONS, DEFAULT_MAX_FRAME_BYTES, DEFAULT_OPEN_SESSION_ON_CONNECT, DEFAULT_PATH, } from './types.js';
 export * from './types.js';
+/**
+ * The query parameter carrying the capability token.
+ *
+ * Published with the route rather than kept internal: nothing can address the route without it, and a
+ * consumer restating the literal is a consumer that drifts. It is one string; the rest of `injection.ts`
+ * stays where it is.
+ */
+export { TOKEN_PARAM } from './injection.js';
 export { attachAudioSocket, toBytes } from './bridge.js';
 export { createUpgradeAcceptor, rejectUpgrade } from './upgrade.js';
+export { diagnosticsRoute } from './diagnostics.js';
 /** Plugin name. */
 export const name = 'realtime-audio-ws';
 export const Config = Schema.object({
@@ -27,13 +42,37 @@ export const Config = Schema.object({
     // boot with nobody asking, which is why it is false. This one opens a session because someone connected a
     // microphone: a connection takes an explicit action, an authenticated one, and its absence is silence.
     openSessionOnConnect: Schema.boolean().default(DEFAULT_OPEN_SESSION_ON_CONNECT),
+    diagnosticsPath: Schema.string().default(DEFAULT_DIAGNOSTICS_PATH),
 });
 export function apply(ctx, config) {
-    ctx.inject(['connection', 'webServer'], (injected) => {
+    ctx.inject(['connection', 'webServer', 'realtime'], (injected) => {
         const services = injected;
         const acceptor = createUpgradeAcceptor(config.maxFrameBytes);
         const clients = new Set();
+        const token = createRouteToken();
+        const journal = injected.realtime.journal;
+        // The token travels in a URL query, and this route records request targets, so the journal has to be
+        // able to redact it before it records one. This is exactly why `addSecrets` is additive instead of a
+        // constructor argument: the plugin that mints the token is the only one that can name it, and it
+        // mints it here, after the journal already exists.
+        journal.addSecrets([token]);
+        // The injection event is declared by `@deepseek-ai/dsh-host-webserver`, which this package deliberately
+        // does not import: importing it would augment `Context` with a second declaration of `webServer` and
+        // turn the structural dependency above into a compile error. The name is cast at this one boundary.
+        const onInjection = ctx.on;
         ctx.effect(() => {
+            // The page is told where the route is and what to present. The web server gathers this table on every
+            // index render and every worker boot-payload request, so the row is built at emit time — the only
+            // moment the listening port is known for certain, since an index render follows the listen.
+            onInjection('webserver/index-inject', (table) => {
+                table.push(routeInjectionRow(config.path, routeAuthority(services.webServer.config?.host, services.webServer.listenedPort), token));
+            });
+            const unregisterDiagnostics = services.webServer.register(diagnosticsRoute({
+                path: config.diagnosticsPath,
+                token,
+                rejectionFor: (request) => services.connection.requestRejection(request),
+                journal,
+            }));
             const unregister = services.webServer.registerUpgrade({
                 path: config.path,
                 handler: (req, socket, head) => {
@@ -42,18 +81,39 @@ export function apply(ctx, config) {
                     // microphone audio in and the agent's answers out. DSH's own transport asks the connection
                     // service in exactly this position, so this route asks the same question rather than inventing a
                     // second scheme that would drift from it.
-                    const rejection = services.connection.requestRejection(req);
+                    //
+                    // The token is the one addition, and it is not a second scheme. The desktop app's page is served
+                    // from `dsh-app://app`, so its requests to loopback are cross-site and the harness's
+                    // `SameSite=Strict` cookie cannot travel; without the token that page is refused forever, however
+                    // correct the rest of the client half is.
+                    // Normalised once, at the caller's edge, so no record below repeats the check. `node:http`
+                    // always reports a target on a server request; the type admits `undefined` for client requests,
+                    // which this handler cannot see.
+                    const target = req.url ?? '';
+                    const rejection = verdictFor(services.connection.requestRejection(req), tokenFromUrl(req.url), token);
                     if (rejection !== undefined) {
+                        // The verdict only, and no target. A valid token is never rejected — it overrides the
+                        // refusal — so any target recorded here belongs to something else, and a wrong token is
+                        // still a credential. Retaining a caller's secret in order to log a refusal is a worse trade
+                        // than losing which path was probed.
+                        journal.record('socket.rejected', { verdict: String(rejection) });
                         rejectUpgrade(socket, rejection);
                         return;
                     }
                     acceptor.handleUpgrade(req, socket, head, (client) => {
                         if (clients.size >= config.maxConnections) {
                             // 1013 = try again later. Closing the newcomer leaves the existing microphone live.
+                            journal.record('socket.rejected', { verdict: '1013', reason: 'busy' });
                             client.close(1013, 'busy');
                             return;
                         }
                         clients.add(client);
+                        // The target here, because an accepted request is the one place this process's own token
+                        // travels: the app page presents it in the query precisely because it cannot carry the
+                        // cookie. The journal redacts it on write — which is what the token was added to the journal's
+                        // secrets for, and the reason that has to be additive rather than a constructor argument,
+                        // since the token does not exist until this plugin applies.
+                        journal.record('socket.accepted', { clients: String(clients.size), url: target });
                         // Ask for the session before the bridge goes in, so the first frames are written into a session
                         // that is being opened rather than dropped by the mic seam's no-session rule.
                         if (config.openSessionOnConnect)
@@ -64,6 +124,7 @@ export function apply(ctx, config) {
                             maxFrameBytes: config.maxFrameBytes,
                             onDetach: () => {
                                 clients.delete(client);
+                                journal.record('socket.closed', { clients: String(clients.size) });
                                 // The last client leaving ends the session. This also covers the transport's own disposal,
                                 // which terminates its clients — so a profile reload does not leave a session nobody holds.
                                 if (config.openSessionOnConnect && clients.size === 0)
@@ -75,6 +136,7 @@ export function apply(ctx, config) {
             });
             return async () => {
                 unregister();
+                unregisterDiagnostics();
                 for (const client of clients)
                     client.terminate();
                 clients.clear();

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAM7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACnE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,YAAY,GAGb,MAAM,YAAY,CAAA;AAEnB,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAA8B,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAA;AAEzF,mBAAmB;AACnB,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AAEvC,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3C,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAChE,cAAc,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACjE,uGAAuG;IACvG,0GAA0G;IAC1G,uGAAuG;IACvG,oBAAoB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;CAChF,CAAC,CAAA;AAqBF,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA6B;IAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,QAA+E,CAAA;QAChG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAA;QAEtC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;YACd,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC;gBACpD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;oBAC7B,iGAAiG;oBACjG,4FAA4F;oBAC5F,2FAA2F;oBAC3F,iGAAiG;oBACjG,0CAA0C;oBAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;oBAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;wBAChC,OAAM;oBACR,CAAC;oBACD,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;wBACnD,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;4BAC1C,oFAAoF;4BACpF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;4BAC1B,OAAM;wBACR,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACnB,gGAAgG;wBAChG,8EAA8E;wBAC9E,IAAI,MAAM,CAAC,oBAAoB;4BAAE,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;wBACjE,iBAAiB,CAAC,MAAM,EAAE;4BACxB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;4BAC7D,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,sBAAsB,EAAE,QAAQ,CAAC;4BACtE,aAAa,EAAE,MAAM,CAAC,aAAa;4BACnC,QAAQ,EAAE,GAAG,EAAE;gCACb,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gCACtB,2FAA2F;gCAC3F,4FAA4F;gCAC5F,IAAI,MAAM,CAAC,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;oCAAE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;4BACxF,CAAC;yBACF,CAAC,CAAA;oBACJ,CAAC,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YACF,OAAO,KAAK,IAAI,EAAE;gBAChB,UAAU,EAAE,CAAA;gBACZ,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,SAAS,EAAE,CAAA;gBAChD,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAA;YACxB,CAAC,CAAA;QACH,CAAC,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAM7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,UAAU,GAEX,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACnE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,YAAY,GAGb,MAAM,YAAY,CAAA;AAEnB,cAAc,YAAY,CAAA;AAC1B;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAA8B,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAwE,MAAM,kBAAkB,CAAA;AAEzH,mBAAmB;AACnB,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AAEvC,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3C,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAChE,cAAc,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACjE,uGAAuG;IACvG,0GAA0G;IAC1G,uGAAuG;IACvG,oBAAoB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC/E,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;CACnE,CAAC,CAAA;AAqCF,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA6B;IAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC/D,MAAM,QAAQ,GAAG,QAA+E,CAAA;QAChG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAA;QACtC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAA;QACzC,qGAAqG;QACrG,qGAAqG;QACrG,iGAAiG;QACjG,mDAAmD;QACnD,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QAC3B,wGAAwG;QACxG,qGAAqG;QACrG,oGAAoG;QACpG,MAAM,WAAW,GAAG,GAAG,CAAC,EAGZ,CAAA;QAEZ,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;YACd,sGAAsG;YACtG,kGAAkG;YAClG,4FAA4F;YAC5F,WAAW,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAC1B,MAAM,CAAC,IAAI,EACX,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,EAChF,KAAK,CACN,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACzE,IAAI,EAAE,MAAM,CAAC,eAAe;gBAC5B,KAAK;gBACL,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBACxE,OAAO;aACR,CAAC,CAAC,CAAA;YACH,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC;gBACpD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;oBAC7B,iGAAiG;oBACjG,4FAA4F;oBAC5F,2FAA2F;oBAC3F,iGAAiG;oBACjG,0CAA0C;oBAC1C,EAAE;oBACF,iGAAiG;oBACjG,qFAAqF;oBACrF,kGAAkG;oBAClG,0CAA0C;oBAC1C,2FAA2F;oBAC3F,gGAAgG;oBAChG,iCAAiC;oBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAA;oBAC5B,MAAM,SAAS,GAAG,UAAU,CAC1B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,EACzC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAA;oBACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,sFAAsF;wBACtF,wFAAwF;wBACxF,6FAA6F;wBAC7F,qCAAqC;wBACrC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;wBACjE,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;wBAChC,OAAM;oBACR,CAAC;oBACD,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;wBACnD,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;4BAC1C,oFAAoF;4BACpF,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;4BACtE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;4BAC1B,OAAM;wBACR,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACnB,yFAAyF;wBACzF,uFAAuF;wBACvF,+FAA+F;wBAC/F,0FAA0F;wBAC1F,4DAA4D;wBAC5D,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;wBACjF,gGAAgG;wBAChG,8EAA8E;wBAC9E,IAAI,MAAM,CAAC,oBAAoB;4BAAE,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;wBACjE,iBAAiB,CAAC,MAAM,EAAE;4BACxB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;4BAC7D,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,sBAAsB,EAAE,QAAQ,CAAC;4BACtE,aAAa,EAAE,MAAM,CAAC,aAAa;4BACnC,QAAQ,EAAE,GAAG,EAAE;gCACb,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gCACtB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gCAClE,2FAA2F;gCAC3F,4FAA4F;gCAC5F,IAAI,MAAM,CAAC,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;oCAAE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;4BACxF,CAAC;yBACF,CAAC,CAAA;oBACJ,CAAC,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YACF,OAAO,KAAK,IAAI,EAAE;gBAChB,UAAU,EAAE,CAAA;gBACZ,qBAAqB,EAAE,CAAA;gBACvB,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,SAAS,EAAE,CAAA;gBAChD,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAA;YACxB,CAAC,CAAA;QACH,CAAC,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/injection.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The route's page-side settings: the row the host injects, and the credential check that lets the
+ * desktop app's renderer use the route at all.
+ *
+ * Two facts decide this file's shape.
+ *
+ * The first is that the harness web server gathers a structured *injection table* on every index render
+ * and every worker boot-payload request, by emitting `webserver/index-inject`; listeners append their
+ * rows and the rows are read fresh at emit time. That is a door built for plugins, which is why this
+ * package uses it rather than a raw string transform on the HTML.
+ *
+ * The second is a consequence of being a browser face inside the desktop app. That page's origin is
+ * `dsh-app://app`, and the harness's own auth cookie is `SameSite=Strict` and bound to the loopback
+ * authority — so a request from the app page to `127.0.0.1` is cross-site and carries no cookie. The
+ * connection service would therefore refuse the app's renderer, correctly and forever, no matter how
+ * right the rest of the client half is.
+ *
+ * A capability token — generated once per process, injected only into the page the host itself serves —
+ * is the credential that can travel. It is script-readable where the cookie is not, and that is a real
+ * weakening: it is the price of the app working at all. It authorises one route, on loopback, for the
+ * life of the process, and is worthless afterwards.
+ */
+/** Global the page reads its route settings from. Duplicated in the client half, which cannot import it. */
+export declare const INJECTED_KEY = "__DSH_REALTIME_AUDIO__";
+/** Query parameter carrying the capability token on an upgrade request. */
+export declare const TOKEN_PARAM = "t";
+/** A structured index-injection row of the kind this package contributes. */
+export interface InjectedGlobalRow {
+    readonly kind: 'global';
+    readonly name: string;
+    readonly value: unknown;
+}
+/**
+ * Where the client should open its socket, or undefined when the host is not listening yet.
+ *
+ * A wildcard bind is normalised to loopback because the page is on this machine: handing a client
+ * `0.0.0.0:port` asks it to connect to a name meaning "every interface", which resolves nowhere useful.
+ * An IPv6 literal is bracketed so the authority parses as a URL rather than as a host with a port.
+ *
+ * @param host - the configured bind host, as the web server reports it.
+ * @param port - the port actually listening — the OS-assigned value when the config asked for zero.
+ * @returns the authority (`host:port`), or undefined before the server is listening.
+ */
+export declare function routeAuthority(host: string | undefined, port: number | undefined): string | undefined;
+/**
+ * One process-scoped capability token.
+ *
+ * 32 bytes, base64url, because the token travels in a URL query and base64url needs no escaping there.
+ */
+export declare function createRouteToken(): string;
+/**
+ * Read the token off an upgrade request's target.
+ *
+ * @param url - the request target as `node:http` reports it: pathname plus query.
+ * @returns the token, or undefined when absent or empty.
+ */
+export declare function tokenFromUrl(url: string | undefined): string | undefined;
+/**
+ * Compare a presented token with this process's own, in constant time.
+ *
+ * Length is compared first because `timingSafeEqual` throws on buffers of different lengths, which would
+ * turn a probe into a crash. The length is not the secret; the value is.
+ *
+ * @param provided - the token the caller presented, if any.
+ * @param expected - this process's token.
+ * @returns whether the caller may be treated as this process's own page.
+ */
+export declare function tokenMatches(provided: string | undefined, expected: string): boolean;
+/**
+ * The connection service's verdict, overridden by a valid token.
+ *
+ * DSH's own transport asks the connection service in this position, and this route asks the same question
+ * rather than inventing a second scheme that would drift from it. The token is the only addition, and it
+ * is not a second scheme: a caller that cannot carry the cookie at all — the app's renderer — may present
+ * the token the host injected into that very page instead.
+ *
+ * @param rejection - what the connection service said about this request.
+ * @param provided - the token on the request, if any.
+ * @param expected - this process's token.
+ * @returns the rejection to write, or undefined to accept the upgrade.
+ */
+export declare function verdictFor(rejection: 401 | 403 | undefined, provided: string | undefined, expected: string): 401 | 403 | undefined;
+/**
+ * The row the page reads, built at emit time.
+ *
+ * `value` is JSON-serialised by the web server, which escapes `<` so a value cannot close the script
+ * element early; an undefined `authority` is dropped by `JSON.stringify`, which is exactly the "this host
+ * injected no authority" case the client half names rather than guesses at.
+ */
+export declare function routeInjectionRow(path: string, authority: string | undefined, token: string): InjectedGlobalRow;
+//# sourceMappingURL=injection.d.ts.map

package/lib/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../src/injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,4GAA4G;AAC5G,eAAO,MAAM,YAAY,2BAA2B,CAAA;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMpF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GACf,GAAG,GAAG,GAAG,GAAG,SAAS,CAGvB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,iBAAiB,CAEnB"}