Reading scrollLeft in the layout cleanup also captures positions that fire no
scroll event, such as a restore the browser clamps to the current offset.
Refs #7049
The root entry already re-exports the wire codecs, the identity contract, the
viewer carrier, and the viewer-state vocabulary, so `./protocol` and
`./identity` were aliases of subsets that every consumer had to mirror in the
tsconfig path list. Keep `.` alone, keep the mock provider in its source module
for tests, and bundle only the root.
A package that promises authentication-adjacent types must not hand production
callers a provider that fabricates principals from its public `./identity`
entry. The mock keeps its own `./identity/mock` export, the console face drops
it, and the entrypoint tests pin both halves.
Matching a forwarded route on the pathname alone let any origin whose URL
carried `/api/present.host` or `/open-in-app/apps` reach the owner instead of
the destination it named. Resolve the request against the page base and forward
it only when the target origin is the page's own; every other request reaches
the fetch this carrier replaced.
The face layout paragraph still counted six split packages. The
liveshare-protocol split added a seventh, and this names which part of the
package stays on each leaf.
Every other row states the ctx key or an em dash; the protocol row said
'library and protocol — no ctx key' in both languages. It now uses the
same em dash as the other rows without a ctx key.
The @module tag named a viewer-states subpath the package does not export.
The vocabulary is reached through the package root, so the tag now names
that entry.
The summary claimed both packages import the package and named only
dsh-brand, while nothing imports it in this tree and cordis is a peer. It
now states the shared definitions and both dependencies without claiming
current importers. When to use it names the package root for the viewer
carrier and viewer-state vocabulary, and the Known Limitations anchor moves
ahead of its heading like the other sections.
The v1 host/worker fixtures carried no registrationToken or token, so a
legacy branch asserted them rejected and the optional-field case skipped
them. They now carry valid tokens and round-trip through their codecs. The
unknown access-mode fixture carries a token too, so its refusal is about
the mode rather than the missing identity. The unread required lists are
deleted; the optional lists now match what the parsers accept.
A 200 open whose body was not a JSON object threw from readable() before the
abort listener was armed, so the page never sent stream-cancel and the owner
held the id until its own budget expired. The unreadable-open path now
cancels the id before rethrowing; the spec pins the cancel.
LIVESHARE_CAPABILITIES was a runtime string array, so a peer could neither
check a capability name at compile time nor compare against the same union.
The tuple is now const and LiveshareCapability derives from it; the wire
values are unchanged.
parseRelayFrame parsed the wire text for the lifecycle snapshot and again
for the envelope, and unsupportedFrameRefusal repeated both parses. One
JSON.parse now feeds the snapshot check, the envelope, and the refusal
branch, so the hot path decodes each frame exactly once.
The wire parser accepted an empty tenant while the Relay's identity adapters
store a non-empty one and identityFromKey refuses an empty segment, so a
share ACL built from such an actor could never match a normalized entry.
Reject the unnormalized actor at both the Relay frame and IPC ingress.
The package carried one Host-based tsconfig that both aggregates registered, so the browser carrier
was compiled under the Host face while the wire codecs that use Buffer were compiled under the same
config. It now follows the repository's double-face template: a solution-only package root, a Host
leaf (wire codecs, identity contract, shared vocabulary, and the root barrel that re-exports the
carrier), and a browser leaf for the viewer carrier and the pure types it shares. The two repository
aggregates register the matching leaf, and the carrier stays in the Host file list because the root
barrel re-exports it for the Relay's script generation.
The tsdown comment now states the two compiler faces and why only the Host face publishes runtime
modules.
The published declarations reference Branded from @deepseek-ai/dsh-brand, so an external consumer
must be able to resolve that package from the manifest. It moves from devDependencies to
dependencies; the lockfile records the importer under dependencies.
The protocol package leaves the repository-wide coverage exemption and meets the same per-file 100%
gate as the other packages. The new specs cover the identity mock, the wire helpers and every
additive-field parser branch, both public entry points, and the carrier's forwarded-route paths; the
key parser drops an unreachable guard so its remaining branches are exercised.
An IPC share spec accepted any string as its deadline while the frame parser required a parseable
time, so a registration could carry an expiry no reader could enforce. Both parsers now apply the
same rule: a stated expiry must be a string Date.parse accepts.
The key codec now states its precondition: a caller normalizes an identity first, because an
unnormalized empty tenant renders a segment the parser cannot read back. The viewer carrier and the
viewer-state vocabulary join the file map, reached through the package root rather than their own
subpaths, and the placeholder-tenant comment is one complete rule again.
The new actor credential and share connection are untrusted wire inputs: a non-string credential and an unknown connection mode are refused, an absent connection parses as the relay default, and an absent credential keeps the Relay-asserted actor.
Additive wire evolution: an actor may carry an owner-verifiable credential (type-checked here, verified by the owner, absent keeps today's Relay assertion), and a share spec may carry a connection that defaults to relay while a Relay that owns the data path refuses direct. Capabilities actor-credential and direct-connection declare support; the recorded frames carry both fields.
TunnelShareSpec and ShareAccessStateFrame repeated the same six permission fields. They now extend one SharePermissions interface (the committed frame is the authority), with the upload switch optional in a request and required in a frame. The wire shape is unchanged, so the recorded frames replay byte for byte; the display-only and grouping fields plus the registration-token and request-id roles are documented in place.
The identity contract and its fixtures named specific providers even though the package only describes the abstract triple. The JSDocs now say a deployment's adapter implements it, and every fixture and spec uses the neutral example provider while keeping the encoding, round-trip, and empty-field cases they pin.
The v2 upgrade guide and the fork-readonly normalization were development-period artifacts that never shipped, so the protocol returns to version 1: the guide triplet is deleted with its references, the withdrawn tier is no longer named anywhere (unknown tiers are rejected generically), and the README plus the version test state version 1. The file-upload capability and its additive field stay.
The share spec gains an optional allowsFileUpload switch, the access-state frame always states it (an absent field reads as off), and the file-upload capability separates the field from the tier and fork switches. The wire version stays 2 because the change is additive; the upgrade guide says so and the recorded add-share frame names the new field.
Normalizing fork-readonly to view dropped the switch the withdrawn name implied when no allowsFork was present, so a legacy registration silently lost forking. Both parsers now set allowsFork true for that case, matching what the old name granted.
viewer-states publishes only each condition's retry decision: HTTP statuses and error codes belong to the Relay and copy keys to the client, so the mismatched accessDeniedTitle key is gone with the wire discriminator. Both parsers read the withdrawn fork-readonly tier back as view while keeping allowsFork, matching the documented treatment, and the protocol version is pinned in a test. The coverage-exclusion comment now names this package's own deferred lane instead of another package's.
The carrier matched forwarded routes by substring, so /api/present.hostile and /x/open-in-app/apps-foo were posted to the owner as if they were the read routes. Match only where the route starts a path segment and ends at the pathname or a following slash, keeping the Relay base path prefix working; add hit, subpath, prefix-neighbour and query cases.
The carrier called the captured page fetch as a plain function, so a browser fetch that checks its receiver would fail on every non-forwarded request. Call it with globalThis as the receiver, as the repository's other fetch wrappers do, and pin the receiver in a spec.
The access-mode vocabulary changed from open|approval to open|selected without a protocol version change, so a peer could declare version 1 while refusing every value the other side sends. Version 2 states the break; the retired approval name stays refused rather than reinterpreted, and an upgrade guide records the peer upgrade order.
imccyu