The ledger

Internal-secret-gated POST receiver for the openalice-stream-host daemon's 30s heartbeat. Stashes the latest payload per (user_id, host_id) so /account/streams can render a Host Health card.

Catch-all reverse proxy from openalice-app to internal persona-server. Forwards Authorization + streams multipart bodies; passthrough for status + headers. Same-origin to the Hub so CORS is moot.

Catch-all reverse proxy from openalice-app to internal openalice-radio. Forwards Authorization + passes JSON bodies through. Same-origin to the Hub so CORS is moot.

Browser-facing JWT-gated read for the stream-host heartbeat snapshot. Returns hosts for the calling user (sub claim) by reading the same in-memory store the internal POST receiver writes to.

Completes the YouTube OAuth round-trip server-side — state check, code exchange, channel snapshot, signed handoff cookie, redirect to /account/youtube?just_connected=1. Client-side /complete finishes the persona POST.

Client-side completion of the YT OAuth round-trip — reads the handoff cookie set by /callback, verifies its signature, forwards to persona /v1/me/youtube/oauth-tokens with the user's Bearer JWT.

Builds Google OAuth URL with youtube.readonly + youtube.force-ssl + youtube scopes, stashes CSRF state cookie, redirects to Google. Companion of /api/youtube/oauth/callback. Drives /account/youtube Connect button + the stream-key auto-fetch flow.