@abloatai/transaction 0.37.0

package/dist/transport/connectionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionManager.js","sourceRoot":"","sources":["../../src/transport/connectionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,YAAY,EAAoB,MAAM,mBAAmB,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AA6F7B,6EAA6E;AAE7E,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,IAAI;CACJ,CAAC;AAEX,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC;;mFAEmF;AACnF,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAE1C,6EAA6E;AAE7E,MAAM,OAAO,iBAAiB;IAC5B,kEAAkE;IAClE,KAAK,GAAoB,WAAW,CAAC;IACrC,YAAY,GAAgB,IAAI,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC;IACZ,eAAe,GAAuB,IAAI,CAAC;IAE3C,UAAU;IACF,SAAS,GAA+B,IAAI,CAAC;IAC7C,YAAY,GAAyC,IAAI,CAAC;IAC1D,aAAa,GAAyC,IAAI,CAAC;IAC3D,aAAa,GAA0C,IAAI,CAAC;IAC5D,WAAW,GAAG,CAAC,CAAC;IACxB;6EACyE;IACjE,yBAAyB,GAAG,CAAC,CAAC;IAC9B,QAAQ,GAAG,KAAK,CAAC;IACR,OAAO,CAAU;IACjB,YAAY,CAAmB;IAC/B,OAAO,CAAyB;IAChC,MAAM,CAAS;IACf,aAAa,CAAyB;IAE/C,mBAAmB,GAAwB,IAAI,CAAC;IAChD,oBAAoB,GAAwB,IAAI,CAAC;IACjD,sBAAsB,GAAwB,IAAI,CAAC;IAE3D,YAAY,UAAoC,EAAE;QAChD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACxE,CAAC;IAED,wEAAwE;IAExE,KAAK,CAAC,SAA8B;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACnD,CAAC;IAED,wEAAwE;IAExE,IAAI,CAAC,KAAsB;QACzB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YACjD,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,IAAI;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,iEAAiE;QACjE,+DAA+D;QAC/D,mEAAmE;QACnE,6CAA6C;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC3D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,wEAAwE;IAEhE,UAAU,CAAC,KAAsB,EAAE,KAAsB;QAC/D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,WAAW;gBACd,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,cAAc;wBACjB,iEAAiE;wBACjE,kEAAkE;wBAClE,QAAQ;wBACR,OAAO,SAAS,CAAC;oBACnB,KAAK,iBAAiB;wBACpB,iEAAiE;wBACjE,oEAAoE;wBACpE,qEAAqE;wBACrE,sEAAsE;wBACtE,qEAAqE;wBACrE,oEAAoE;wBACpE,sEAAsE;wBACtE,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,kBAAkB,CAAC;oBACxB,KAAK,0BAA0B;wBAC7B,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,qBAAqB;wBACxB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,aAAa;wBAChB,OAAO,iBAAiB,CAAC;oBAC3B;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,SAAS;gBACZ,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,gBAAgB,CAAC;oBACtB,KAAK,cAAc,CAAC;oBACpB,KAAK,aAAa,CAAC;oBACnB,KAAK,qBAAqB,CAAC;oBAC3B,KAAK,sBAAsB;wBACzB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,kBAAkB,CAAC;oBACxB,KAAK,0BAA0B;wBAC7B,OAAO,iBAAiB,CAAC;oBAC3B;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,iBAAiB;gBACpB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,eAAe;wBAClB,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;oBACjE,KAAK,wBAAwB;wBAC3B,sEAAsE;wBACtE,OAAO,uBAAuB,CAAC;oBACjC,KAAK,oBAAoB;wBACvB,OAAO,cAAc,CAAC;oBACxB,KAAK,cAAc;wBACjB,OAAO,qBAAqB,CAAC;oBAC/B,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,qBAAqB;gBACxB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,gBAAgB,CAAC;oBACtB,KAAK,aAAa,CAAC;oBACnB,KAAK,cAAc,CAAC;oBACpB,KAAK,iBAAiB,CAAC;oBACvB,KAAK,sBAAsB;wBACzB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,oBAAoB;gBACvB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,eAAe;wBAClB,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;oBACjE,KAAK,wBAAwB;wBAC3B,OAAO,uBAAuB,CAAC;oBACjC,KAAK,oBAAoB;wBACvB,OAAO,cAAc,CAAC;oBACxB,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,uBAAuB;gBAC1B,wEAAwE;gBACxE,gDAAgD;gBAChD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,sBAAsB;wBACzB,wDAAwD;wBACxD,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,0BAA0B;wBAC7B,oEAAoE;wBACpE,qDAAqD;wBACrD,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,kBAAkB;wBACrB,oEAAoE;wBACpE,4DAA4D;wBAC5D,OAAO,SAAS,CAAC;oBACnB,KAAK,oBAAoB;wBACvB,iEAAiE;wBACjE,iEAAiE;wBACjE,+BAA+B;wBAC/B,OAAO,cAAc,CAAC;oBACxB,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,cAAc;gBACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,mBAAmB,CAAC;oBACzB,KAAK,cAAc;wBACjB,OAAO,WAAW,CAAC;oBACrB,KAAK,kBAAkB,CAAC;oBACxB,KAAK,qBAAqB;wBACxB,OAAO,SAAS,CAAC;oBACnB,KAAK,0BAA0B,CAAC;oBAChC,KAAK,kBAAkB;wBACrB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,SAAS;gBACZ,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,iBAAiB,CAAC;oBACvB,KAAK,cAAc,CAAC;oBACpB,KAAK,qBAAqB;wBACxB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,gBAAgB,CAAC;oBACtB,KAAK,aAAa,CAAC;oBACnB,KAAK,sBAAsB;wBACzB,kEAAkE;wBAClE,oEAAoE;wBACpE,4DAA4D;wBAC5D,2CAA2C;wBAC3C,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB,KAAK,kBAAkB,CAAC;oBACxB,KAAK,0BAA0B;wBAC7B,OAAO,iBAAiB,CAAC;oBAC3B;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,cAAc;gBACjB,wEAAwE;gBACxE,mEAAmE;gBACnE,+DAA+D;gBAC/D,uEAAuE;gBACvE,iEAAiE;gBACjE,kDAAkD;gBAClD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,cAAc,CAAC;oBACpB,KAAK,aAAa,CAAC;oBACnB,KAAK,gBAAgB,CAAC;oBACtB,KAAK,sBAAsB;wBACzB,OAAO,iBAAiB,CAAC;oBAC3B,KAAK,cAAc;wBACjB,OAAO,SAAS,CAAC;oBACnB,KAAK,kBAAkB,CAAC;oBACxB,KAAK,0BAA0B;wBAC7B,OAAO,iBAAiB,CAAC;oBAC3B;wBACE,OAAO,IAAI,CAAC;gBAChB,CAAC;YAEH,KAAK,iBAAiB;gBACpB,OAAO,IAAI,CAAC,CAAC,WAAW;YAE1B;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,wEAAwE;IAEhE,YAAY,CAAC,KAAsB,EAAE,KAAsB;QACjE,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,WAAW;gBACd,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,IAAI,CAAC,yBAAyB,GAAG,CAAC,CAAC;gBACnC,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC;gBACxC,MAAM;YAER,KAAK,iBAAiB;gBACpB,oEAAoE;gBACpE,qEAAqE;gBACrE,gEAAgE;gBAChE,wEAAwE;gBACxE,wEAAwE;gBACxE,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,sEAAsE;gBACtE,6CAA6C;gBAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACrC,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC;gBAC1C,CAAC;gBACD,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/D,MAAM;YAER,KAAK,qBAAqB;gBACxB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,MAAM;YAER,KAAK,cAAc;gBACjB,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvE,MAAM;YAER,KAAK,uBAAuB;gBAC1B,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxF,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,MAAM;YAER,KAAK,cAAc;gBACjB,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,gCAAgC;gBAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC;gBACxC,IAAI,CAAC,aAAa,CAAC,UAAU,CAC3B,mFAAmF,EACnF,cAAc,EACd,OAAO,CACR,CAAC;gBACF,MAAM;YAER,KAAK,iBAAiB;gBACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC,aAAa,CAAC,UAAU,CAC3B,yCAAyC,EACzC,cAAc,EACd,SAAS,CACV,CAAC;gBACF,MAAM;QACV,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACK,oBAAoB,CAAC,MAAc;QACzC,OAAO,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;gBACvC,OAAO,EAAE,kBAAkB,MAAM,EAAE;gBACnC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC9B,uEAAuE;YACvE,qCAAqC;YACrC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,WAAW;oBACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,iBAAiB;oBACpB,uDAAuD;oBACvD,4DAA4D;oBAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1D,MAAM;gBACR,KAAK,kBAAkB;oBACrB,sEAAsE;oBACtE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;oBAC9C,MAAM;gBACR,KAAK,cAAc;oBACjB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,aAAa;oBAChB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBACpC,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,MAAM,CAAC,OAAO,CAAC;oBAC1C,KAAK,WAAW,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,yBAAyB,IAAI,+BAA+B,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+EAA+E,EAC/E,EAAE,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,CAC7C,CAAC;YACF,IAAI,CAAC,yBAAyB,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,yBAAyB,IAAI,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,WAAW;oBACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBAC5C,MAAM;gBACR,KAAK,eAAe;oBAClB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBAChD,MAAM;gBACR,KAAK,eAAe;oBAClB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACxC,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,MAAM,CAAC;oBAClC,KAAK,WAAW,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qDAAqD;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAClD,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,SAAS;oBACZ,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,eAAe;oBAClB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBAChD,MAAM;gBACR,KAAK,eAAe;oBAClB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACxC,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,wEAAwE;IAEhE,eAAe;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9C,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,QAAQ;YACR,IAAI,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gFAAgF,CACjF,CAAC;gBACF,IAAI,CAAC,aAAa,CAAC,UAAU,CAC3B,+BAA+B,EAC/B,cAAc,EACd,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa,CAAC,UAAU,CAC3B,2BAA2B,EAC3B,cAAc,EACd,OAAO,CACR,CAAC;YACF,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;QAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;QAEf,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzC,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,wEAAwE;IAEhE,qBAAqB;QAC3B,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAE1C,IAAI,CAAC,mBAAmB,GAAG,GAAG,EAAE;YAC9B,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACxC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,CAAC,oBAAoB,GAAG,GAAG,EAAE;YAC/B,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC;QAEF,IAAI,CAAC,sBAAsB,GAAG,GAAG,EAAE;YACjC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC9E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnE,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,wEAAwE;IAEhE,aAAa;QACnB,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;YACpC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAE1B,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,yDAAyD;YACzD,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,KAAK,WAAW;gBAC1B,IAAI,CAAC,KAAK,KAAK,iBAAiB;gBAChC,IAAI,CAAC,KAAK,KAAK,iBAAiB;gBAChC,IAAI,CAAC,KAAK,KAAK,uBAAuB;gBACtC,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC;YAEhC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,8DAA8D;gBAC9D,+BAA+B;gBAC/B,MAAM,aAAa,GACjB,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC;gBACvD,IAAI,IAAI,CAAC,WAAW,IAAI,8BAA8B,IAAI,aAAa,EAAE,CAAC;oBACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBACjF,IAAI,CAAC,aAAa,CAAC,UAAU,CAC3B,sBAAsB,EACtB,cAAc,EACd,OAAO,CACR,CAAC;oBACF,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;wBAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC3B,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;oBAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,aAAa;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC3B,CAAC;IAED,yEAAyE;IAEzE,IAAI,WAAW,KAAc,OAAO,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,KAAc,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;IACrG,IAAI,cAAc;QAChB,OAAO,CACL,IAAI,CAAC,KAAK,KAAK,iBAAiB;YAChC,IAAI,CAAC,KAAK,KAAK,oBAAoB;YACnC,IAAI,CAAC,KAAK,KAAK,uBAAuB;YACtC,IAAI,CAAC,KAAK,KAAK,cAAc;YAC7B,IAAI,CAAC,KAAK,KAAK,SAAS,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,KAAc,OAAO,IAAI,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC;IAE5E,IAAI,eAAe;QACjB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,EAAE;YAAE,OAAO,UAAU,CAAC;QACpC,IAAI,OAAO,GAAG,EAAE;YAAE,OAAO,GAAG,OAAO,OAAO,CAAC;QAC3C,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,GAAG,KAAK,OAAO,CAAC;QACvC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1C,CAAC;IAED,yEAAyE;IAEjE,iBAAiB;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/dist/transport/credentialLifecycle.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Keeps the short-lived access credential fresh. It owns the re-mint hook, a
+ * single-flight guard that stops concurrent triggers from minting more than
+ * once, and a browser-only proactive refresh — a timer plus an OS-wake listener
+ * — that renews the credential ahead of expiry. It reaches the rest of the
+ * client only through the small {@link CredentialLifecycleContext} interface,
+ * so the two can reference each other without an import cycle.
+ */
+import type { RecoveryClass } from '../errorCodes.js';
+import { type Logger } from '../logger.js';
+import { type CredentialProvider, type CredentialProviderResult } from '../auth/credentialResult.js';
+/**
+ * Tri-state outcome of a credential re-mint, mirroring the `getToken`
+ * contract (see {@link CredentialLifecycle.refresh}).
+ */
+export type CredentialRefreshOutcome = 'refreshed' | 'session_error' | 'network_error';
+/**
+ * What an auth-rejected transport should do after recovery has run. `'retry'`
+ * means a fresh credential is now in place — replay the request once. `'stop'`
+ * means don't replay: either the session is gone for good, the rejection is one
+ * a re-mint can't cure, or the mint failed transiently and the caller's own
+ * retry path will recover later.
+ */
+export type CredentialRecoveryOutcome = 'retry' | 'stop';
+/**
+ * What a credential refresher may resolve with. The plain-string form returns
+ * just the token. The object form also carries the mint response's `expiresAt`
+ * (an ISO string, epoch milliseconds, or a `Date`), which lets the proactive
+ * pre-roll schedule against the credential's real lifetime rather than assume
+ * the server's default expiry.
+ */
+export type CredentialRefreshResult = CredentialProviderResult;
+/** A credential re-mint hook. `Promise<string | null>` resolvers remain
+ *  assignable — the widened result type is a superset. */
+export type CredentialRefresher = CredentialProvider;
+/** The fallback pre-roll interval, and also its ceiling: 10 minutes, which sits
+ *  comfortably inside the server's 15-minute default credential lifetime. Used
+ *  as-is when the refresher reports no expiry. */
+export declare const DEFAULT_PREROLL_INTERVAL_MS: number;
+/** Floor so a very short (or already-elapsed) TTL can't hot-loop the mint. */
+export declare const MIN_PREROLL_DELAY_MS: number;
+/**
+ * Computes how long to wait before pre-rolling a credential that expires at
+ * `expiresAtMs`: about two-thirds of the remaining lifetime (a 15-minute
+ * credential yields 10 minutes), clamped to
+ * [{@link MIN_PREROLL_DELAY_MS}, {@link DEFAULT_PREROLL_INTERVAL_MS}]. An
+ * unknown expiry (`null`) falls back to the 10-minute interval. Exported for
+ * unit tests.
+ */
+export declare function computePrerollDelayMs(expiresAtMs: number | null, nowMs: number): number;
+/**
+ * The callbacks this lifecycle needs back from the surrounding client. It is
+ * deliberately minimal — three callbacks, each resolved lazily at call time,
+ * because the connection machinery behind two of them isn't constructed until
+ * the sync connection is set up.
+ */
+export interface CredentialLifecycleContext {
+    /** Push a freshly-minted access token into the shared credential source
+     *  (no-op when the deployment wired no credential source). */
+    setAuthToken(token: string): void;
+    /** Nudge the connection to re-probe using the credential now in place. */
+    nudgeReconnect(): void;
+    /** Report that the long-lived login is gone, so the connection can move to
+     *  its signed-out state. */
+    reportSessionExpired(): void;
+}
+export declare class CredentialLifecycle {
+    private readonly ctx;
+    private readonly logger;
+    /**
+     * The hook that mints a fresh short-lived access credential (the `ek_`/`rk_`
+     * key). An integrator wires it from their own token endpoint: this lifecycle
+     * decides when to refresh (a stale-credential probe or an external nudge),
+     * and the hook decides how to mint. It follows the same contract as a
+     * `getToken` function — it resolves a token string on success, `null` when
+     * the long-lived login is gone (a terminal state), and throws on a transient
+     * or offline failure. Used by {@link refresh}. When it is absent there is no
+     * silent re-mint, as with a static `apiKey` whose credential source is
+     * refreshed elsewhere.
+     */
+    private credentialRefresher;
+    /** Single-flight guard so a wake nudge + an in-flight request + a probe don't
+     *  all mint at once (the classic "token thrash → random logout" bug). */
+    private inFlightCredentialRefresh;
+    /** Tears down the proactive credential lifecycle (the refresh timer and the
+     *  OS-wake listener) installed by {@link start}; cleared when the client
+     *  disconnects. Null when no refresher is wired. */
+    private credentialLifecycleTeardown;
+    /** Epoch milliseconds at which the current credential expires, when the
+     *  refresher reports it (the object form of {@link CredentialRefreshResult}).
+     *  `null` for the string-form resolver, in which case the pre-roll uses its
+     *  fixed interval. */
+    private credentialExpiresAtMs;
+    /** Re-arms the proactive pre-roll timer (set by {@link start}). Called after
+     *  every successful mint, so a refresh triggered reactively (by a probe, an
+     *  OS wake, or the first mint) re-anchors the schedule to the fresh
+     *  credential's real expiry instead of a stale fixed delay. */
+    private prerollReschedule;
+    constructor(ctx: CredentialLifecycleContext, logger?: Logger);
+    /**
+     * Registers the re-mint hook for the access credential — a function that
+     * mints a fresh `ek_`/`rk_` key, typically the integrator's `getToken`. See
+     * {@link credentialRefresher}.
+     */
+    setRefresher(refresher: CredentialRefresher | null): void;
+    /** Seeds the first mint through the same expiry-aware path as later refreshes. */
+    accept(result: CredentialRefreshResult): boolean;
+    /**
+     * Re-mints the short-lived access credential, pushes it into the credential
+     * source, and reports a three-way outcome the connection layer acts on:
+     *   - a token string → `'refreshed'`     (the fresh key is in place; re-probe and reconnect)
+     *   - `null`         → `'session_error'` (the login itself is gone — terminal, sign out)
+     *   - a thrown error → `'network_error'` (the mint endpoint was unreachable — transient)
+     *
+     * The call is single-flight: concurrent triggers (an OS wake, an in-flight
+     * request, a probe) share one in-flight promise, so the credential is never
+     * minted twice at once. This avoids the failure where every rejected request
+     * mints a new token and the resulting thrash logs the user out.
+     *
+     * With no refresher wired, it resolves `'refreshed'` as a no-op re-probe: a
+     * static-`apiKey` client has no session to mint from and its credential
+     * source is refreshed elsewhere, so it simply re-probes with what it holds.
+     */
+    refresh(): Promise<CredentialRefreshOutcome>;
+    /**
+     * Interprets a refresh outcome and drives the connection accordingly. This is
+     * the single place the three-way outcome is acted on, shared by the proactive
+     * pre-roll, the OS-wake nudge, and the HTTP auth-recovery path, so every
+     * trigger converges on the same behavior.
+     */
+    private routeRefreshOutcome;
+    /**
+     * The shared recovery path for a request rejected on authentication, over any
+     * transport. The WebSocket probe already routes its own 401s; HTTP callers
+     * call this instead of inventing their own handling, so every path shares one
+     * single-flight mint, one outcome routing, and one taxonomy. It classifies
+     * the same recovery codes the connection probe does:
+     *   - `access_credential_expiry` — the routine case, an expired `ek_`/`rk_`:
+     *     silently re-mint through the single-flight {@link refresh} and tell the
+     *     caller to replay once on success. This never signs out on its own; the
+     *     only terminal path is the mint resolving `null`.
+     *   - `session_expiry` — the login is gone: report it (which drives sign-out)
+     *     and stop, since replaying is pointless.
+     *   - `auth_blocked`, `permission`, and everything else — re-minting would
+     *     produce the same rejected credential, so stop and leave the connection
+     *     alone.
+     */
+    recoverFromAuthRejection(recovery: RecoveryClass): Promise<CredentialRecoveryOutcome>;
+    /**
+     * Installs the credential lifecycle. It has two parts:
+     *   1. Reactive — registers `getToken` as the re-mint hook the connection
+     *      calls when a probe finds the key stale, or on a nudge.
+     *   2. Proactive — keeps the short-lived key fresh ahead of expiry with a
+     *      refresh timer inside the credential's lifetime, plus a re-mint on OS
+     *      wake. The whole proactive block is browser-gated on `typeof window`,
+     *      because a server render has no socket to keep warm and the resolver is
+     *      browser-oriented; arming it under Node would fire a relative-URL fetch
+     *      and throw. (Agents pass a static `apiKey` with no resolver, so this
+     *      method is never called for them.)
+     *
+     * Refreshing is automatic — a consumer never calls a refresh method. The call
+     * is idempotent: a second call replaces the first, and it is torn down when
+     * the client disconnects.
+     *
+     * `opts.proactiveInNode` arms the refresh timer on a windowless host as well.
+     * Set it for agent or system participants — long-lived server sockets whose
+     * `rk_`/`ek_` must renew before the server's keepalive check closes them.
+     * Node timers are `unref`ed, so a finishing script is never held alive by the
+     * pre-roll. The OS-wake listener stays browser-only regardless, since there
+     * is no `window` to listen on.
+     */
+    start(getToken: CredentialRefresher, opts?: {
+        proactiveInNode?: boolean;
+    }): void;
+    /** Tear down the proactive credential lifecycle (idempotent). */
+    stop(): void;
+}
+//# sourceMappingURL=credentialLifecycle.d.ts.map

package/dist/transport/credentialLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialLifecycle.d.ts","sourceRoot":"","sources":["../../src/transport/credentialLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,6BAA6B,CAAC;AAErC;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAE/D;0DAC0D;AAC1D,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAErD;;kDAEkD;AAClD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAE1D,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQvF;AAUD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;kEAC8D;IAC9D,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,0EAA0E;IAC1E,cAAc,IAAI,IAAI,CAAC;IACvB;gCAC4B;IAC5B,oBAAoB,IAAI,IAAI,CAAC;CAC9B;AAED,qBAAa,mBAAmB;IAoC5B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IApCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB,CAAoC;IAE/D;6EACyE;IACzE,OAAO,CAAC,yBAAyB,CAAkD;IAEnF;;wDAEoD;IACpD,OAAO,CAAC,2BAA2B,CAA6B;IAEhE;;;0BAGsB;IACtB,OAAO,CAAC,qBAAqB,CAAuB;IAEpD;;;mEAG+D;IAC/D,OAAO,CAAC,iBAAiB,CAA6B;gBAGnC,GAAG,EAAE,0BAA0B,EAC/B,MAAM,GAAE,MAAmB;IAG9C;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAIzD,kFAAkF;IAClF,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO;IAShD;;;;;;;;;;;;;;;OAeG;IACG,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkDlD;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY3F;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAqFhF,iEAAiE;IACjE,IAAI,IAAI,IAAI;CAIb"}

package/dist/transport/credentialLifecycle.js

@@ -0,0 +1,324 @@
+/**
+ * Keeps the short-lived access credential fresh. It owns the re-mint hook, a
+ * single-flight guard that stops concurrent triggers from minting more than
+ * once, and a browser-only proactive refresh — a timer plus an OS-wake listener
+ * — that renews the credential ahead of expiry. It reaches the rest of the
+ * client only through the small {@link CredentialLifecycleContext} interface,
+ * so the two can reference each other without an import cycle.
+ */
+import { noopLogger } from '../logger.js';
+import { credentialExpiry, credentialToken, } from '../auth/credentialResult.js';
+/** The fallback pre-roll interval, and also its ceiling: 10 minutes, which sits
+ *  comfortably inside the server's 15-minute default credential lifetime. Used
+ *  as-is when the refresher reports no expiry. */
+export const DEFAULT_PREROLL_INTERVAL_MS = 10 * 60 * 1000;
+/** Floor so a very short (or already-elapsed) TTL can't hot-loop the mint. */
+export const MIN_PREROLL_DELAY_MS = 30 * 1000;
+/**
+ * Computes how long to wait before pre-rolling a credential that expires at
+ * `expiresAtMs`: about two-thirds of the remaining lifetime (a 15-minute
+ * credential yields 10 minutes), clamped to
+ * [{@link MIN_PREROLL_DELAY_MS}, {@link DEFAULT_PREROLL_INTERVAL_MS}]. An
+ * unknown expiry (`null`) falls back to the 10-minute interval. Exported for
+ * unit tests.
+ */
+export function computePrerollDelayMs(expiresAtMs, nowMs) {
+    if (expiresAtMs === null || !Number.isFinite(expiresAtMs)) {
+        return DEFAULT_PREROLL_INTERVAL_MS;
+    }
+    const remaining = expiresAtMs - nowMs;
+    if (remaining <= 0)
+        return MIN_PREROLL_DELAY_MS;
+    const twoThirds = Math.floor((remaining * 2) / 3);
+    return Math.min(Math.max(twoThirds, MIN_PREROLL_DELAY_MS), DEFAULT_PREROLL_INTERVAL_MS);
+}
+/** Narrow a refresher-supplied `expiresAt` to epoch ms, or `null` when
+ *  absent/unparseable (→ fallback cadence, never a crash). */
+function normalizeExpiresAtMs(expiresAt) {
+    if (expiresAt === undefined)
+        return null;
+    const ms = Date.parse(expiresAt);
+    return Number.isFinite(ms) ? ms : null;
+}
+export class CredentialLifecycle {
+    ctx;
+    logger;
+    /**
+     * The hook that mints a fresh short-lived access credential (the `ek_`/`rk_`
+     * key). An integrator wires it from their own token endpoint: this lifecycle
+     * decides when to refresh (a stale-credential probe or an external nudge),
+     * and the hook decides how to mint. It follows the same contract as a
+     * `getToken` function — it resolves a token string on success, `null` when
+     * the long-lived login is gone (a terminal state), and throws on a transient
+     * or offline failure. Used by {@link refresh}. When it is absent there is no
+     * silent re-mint, as with a static `apiKey` whose credential source is
+     * refreshed elsewhere.
+     */
+    credentialRefresher = null;
+    /** Single-flight guard so a wake nudge + an in-flight request + a probe don't
+     *  all mint at once (the classic "token thrash → random logout" bug). */
+    inFlightCredentialRefresh = null;
+    /** Tears down the proactive credential lifecycle (the refresh timer and the
+     *  OS-wake listener) installed by {@link start}; cleared when the client
+     *  disconnects. Null when no refresher is wired. */
+    credentialLifecycleTeardown = null;
+    /** Epoch milliseconds at which the current credential expires, when the
+     *  refresher reports it (the object form of {@link CredentialRefreshResult}).
+     *  `null` for the string-form resolver, in which case the pre-roll uses its
+     *  fixed interval. */
+    credentialExpiresAtMs = null;
+    /** Re-arms the proactive pre-roll timer (set by {@link start}). Called after
+     *  every successful mint, so a refresh triggered reactively (by a probe, an
+     *  OS wake, or the first mint) re-anchors the schedule to the fresh
+     *  credential's real expiry instead of a stale fixed delay. */
+    prerollReschedule = null;
+    constructor(ctx, logger = noopLogger) {
+        this.ctx = ctx;
+        this.logger = logger;
+    }
+    /**
+     * Registers the re-mint hook for the access credential — a function that
+     * mints a fresh `ek_`/`rk_` key, typically the integrator's `getToken`. See
+     * {@link credentialRefresher}.
+     */
+    setRefresher(refresher) {
+        this.credentialRefresher = refresher;
+    }
+    /** Seeds the first mint through the same expiry-aware path as later refreshes. */
+    accept(result) {
+        const token = credentialToken(result);
+        if (!token)
+            return false;
+        this.credentialExpiresAtMs = normalizeExpiresAtMs(credentialExpiry(result));
+        this.ctx.setAuthToken(token);
+        this.prerollReschedule?.();
+        return true;
+    }
+    /**
+     * Re-mints the short-lived access credential, pushes it into the credential
+     * source, and reports a three-way outcome the connection layer acts on:
+     *   - a token string → `'refreshed'`     (the fresh key is in place; re-probe and reconnect)
+     *   - `null`         → `'session_error'` (the login itself is gone — terminal, sign out)
+     *   - a thrown error → `'network_error'` (the mint endpoint was unreachable — transient)
+     *
+     * The call is single-flight: concurrent triggers (an OS wake, an in-flight
+     * request, a probe) share one in-flight promise, so the credential is never
+     * minted twice at once. This avoids the failure where every rejected request
+     * mints a new token and the resulting thrash logs the user out.
+     *
+     * With no refresher wired, it resolves `'refreshed'` as a no-op re-probe: a
+     * static-`apiKey` client has no session to mint from and its credential
+     * source is refreshed elsewhere, so it simply re-probes with what it holds.
+     */
+    async refresh() {
+        const refresher = this.credentialRefresher;
+        if (!refresher)
+            return 'refreshed';
+        if (this.inFlightCredentialRefresh)
+            return this.inFlightCredentialRefresh;
+        const run = (async () => {
+            try {
+                const result = await refresher();
+                if (!this.accept(result)) {
+                    // null = the long-lived login is gone (the mint endpoint answered
+                    // structured session_expired). Terminal — this routes to sign-out.
+                    return 'session_error';
+                }
+                // Object-form resolvers carry the mint's actual expiry; remember it so
+                // the proactive pre-roll schedules off the real TTL (string-form
+                // resolvers leave it null → fixed fallback cadence).
+                return 'refreshed';
+            }
+            catch (error) {
+                // A throw = transient (offline / mint endpoint unreachable / 5xx). The
+                // login may be perfectly valid; never sign out for this — back off and
+                // retry. Mirrors the `getToken` throw-vs-null contract end-to-end.
+                const message = error?.message ?? String(error);
+                // A relative-URL resolver invoked on the server (Node's fetch has no
+                // origin to resolve against) throws the opaque "Failed to parse URL" or
+                // "Only absolute URLs are supported". Translate it into something
+                // actionable rather than a mystery transient blip: the proactive
+                // refresh is browser-only, so reaching here means the resolver fired
+                // from a server render or a server route.
+                if (typeof window === 'undefined' && /parse URL|absolute URLs?/i.test(message)) {
+                    this.logger.warn('credential resolver ran on the server with a relative URL — Node fetch needs an absolute URL. ' +
+                        'Refresh the Ablo client in the browser, or build an absolute URL server-side ' +
+                        "(e.g. new URL('/api/ablo-session', process.env.NEXT_PUBLIC_APP_URL)).", { error: message });
+                }
+                else {
+                    this.logger.debug('access-credential re-mint failed (transient)', { error: message });
+                }
+                return 'network_error';
+            }
+        })();
+        this.inFlightCredentialRefresh = run;
+        try {
+            return await run;
+        }
+        finally {
+            this.inFlightCredentialRefresh = null;
+        }
+    }
+    /**
+     * Interprets a refresh outcome and drives the connection accordingly. This is
+     * the single place the three-way outcome is acted on, shared by the proactive
+     * pre-roll, the OS-wake nudge, and the HTTP auth-recovery path, so every
+     * trigger converges on the same behavior.
+     */
+    routeRefreshOutcome(outcome) {
+        if (outcome === 'refreshed') {
+            // Fresh key already pushed into the credential source by `refresh`;
+            // nudge a parked connection to re-probe with it.
+            this.ctx.nudgeReconnect();
+            return 'retry';
+        }
+        if (outcome === 'session_error') {
+            // The long-lived login is gone (the mint reported session_expired). Report it;
+            // this is harmless in connection states that don't accept the event,
+            // which converge on sign-out anyway.
+            this.ctx.reportSessionExpired();
+            return 'stop';
+        }
+        // 'network_error' → transient (offline or a mint hiccup); the next proactive
+        // tick or the connection's own probe retries. Never sign out, never replay now.
+        return 'stop';
+    }
+    /**
+     * The shared recovery path for a request rejected on authentication, over any
+     * transport. The WebSocket probe already routes its own 401s; HTTP callers
+     * call this instead of inventing their own handling, so every path shares one
+     * single-flight mint, one outcome routing, and one taxonomy. It classifies
+     * the same recovery codes the connection probe does:
+     *   - `access_credential_expiry` — the routine case, an expired `ek_`/`rk_`:
+     *     silently re-mint through the single-flight {@link refresh} and tell the
+     *     caller to replay once on success. This never signs out on its own; the
+     *     only terminal path is the mint resolving `null`.
+     *   - `session_expiry` — the login is gone: report it (which drives sign-out)
+     *     and stop, since replaying is pointless.
+     *   - `auth_blocked`, `permission`, and everything else — re-minting would
+     *     produce the same rejected credential, so stop and leave the connection
+     *     alone.
+     */
+    async recoverFromAuthRejection(recovery) {
+        switch (recovery) {
+            case 'access_credential_expiry':
+                return this.routeRefreshOutcome(await this.refresh());
+            case 'session_expiry':
+                this.ctx.reportSessionExpired();
+                return 'stop';
+            default:
+                return 'stop';
+        }
+    }
+    /**
+     * Installs the credential lifecycle. It has two parts:
+     *   1. Reactive — registers `getToken` as the re-mint hook the connection
+     *      calls when a probe finds the key stale, or on a nudge.
+     *   2. Proactive — keeps the short-lived key fresh ahead of expiry with a
+     *      refresh timer inside the credential's lifetime, plus a re-mint on OS
+     *      wake. The whole proactive block is browser-gated on `typeof window`,
+     *      because a server render has no socket to keep warm and the resolver is
+     *      browser-oriented; arming it under Node would fire a relative-URL fetch
+     *      and throw. (Agents pass a static `apiKey` with no resolver, so this
+     *      method is never called for them.)
+     *
+     * Refreshing is automatic — a consumer never calls a refresh method. The call
+     * is idempotent: a second call replaces the first, and it is torn down when
+     * the client disconnects.
+     *
+     * `opts.proactiveInNode` arms the refresh timer on a windowless host as well.
+     * Set it for agent or system participants — long-lived server sockets whose
+     * `rk_`/`ek_` must renew before the server's keepalive check closes them.
+     * Node timers are `unref`ed, so a finishing script is never held alive by the
+     * pre-roll. The OS-wake listener stays browser-only regardless, since there
+     * is no `window` to listen on.
+     */
+    start(getToken, opts) {
+        this.stop();
+        this.setRefresher(getToken);
+        // Re-mint through the same single-flight path the reactive probe uses
+        // (`refresh`) rather than calling `getToken()` directly. This gives two
+        // things: the mint stays single-flight, so an OS wake, an in-flight probe,
+        // and this proactive roll share one in-flight promise instead of thrashing;
+        // and the three-way outcome is honored, so a `null` result (the login is
+        // gone) actually drives expiry instead of being dropped, which would leave a
+        // zombie session that re-mints on every tab focus.
+        const refresh = async () => {
+            // Same outcome routing as every other trigger (see routeRefreshOutcome):
+            // refreshed → nudge, session_error → report, network_error → wait for
+            // the next tick / the FSM's own probe. Never sign out for a transient.
+            this.routeRefreshOutcome(await this.refresh());
+        };
+        const teardowns = [];
+        // The proactive pre-roll arms in the browser, or under Node when the host
+        // opts in (`proactiveInNode`, for agent or system participants). The
+        // default Node posture stays reactive-only, because a server render can
+        // construct user-kind clients whose resolver is browser-oriented (a
+        // relative-URL `fetch('/api/ablo-session')`); arming a timer there fires
+        // that resolver under Node, where fetch has no origin for a relative URL and
+        // throws "Failed to parse URL" on every tick. Long-lived server
+        // participants are the opposite case: their socket must outlive the
+        // credential's lifetime, so they get the timer. The reactive re-mint hook
+        // (`setRefresher` above) stays unconditional: it only fires on a real
+        // connection probe, which can't happen during a bare server-side module
+        // evaluation.
+        if (typeof window !== 'undefined' || opts?.proactiveInNode === true) {
+            // A missed tick (throttled in the background) is recovered by the next
+            // one, or by the reactive probe. This timer is the only proactive
+            // pre-roll — it keeps the key warm ahead of expiry even while the socket
+            // sits healthy and connected, a state the connection never probes. The
+            // delay comes from the minted credential's real `expiresAt` when the
+            // refresher reports one (about two-thirds of the remaining lifetime), with
+            // the 10-minute value as both ceiling and fallback, so a deployment that
+            // mints shorter-lived keys still pre-rolls in time rather than dropping to
+            // reactive-only recovery.
+            let timer = null;
+            const scheduleNext = () => {
+                if (timer !== null)
+                    clearTimeout(timer); // idempotent re-arm
+                const delay = computePrerollDelayMs(this.credentialExpiresAtMs, Date.now());
+                timer = setTimeout(() => {
+                    // `.finally` keeps the chain alive after a transient failure; a
+                    // successful mint has already re-armed via `prerollReschedule` (the
+                    // clearTimeout above makes the double-arm a no-op).
+                    void refresh().finally(scheduleNext);
+                }, delay);
+                // Node: never keep a finishing process alive just for the pre-roll
+                // (browser timers have no unref — optional call is a no-op there).
+                timer.unref?.();
+            };
+            scheduleNext();
+            this.prerollReschedule = scheduleNext;
+            teardowns.push(() => {
+                if (timer !== null)
+                    clearTimeout(timer);
+                timer = null;
+                this.prerollReschedule = null;
+            });
+            // OS-wake, on desktop only: the Electron shell bridges `powerMonitor`
+            // 'resume' to this DOM event. It is the one event trigger this lifecycle
+            // still owns, because `visibilitychange` does not fire on wake-from-sleep
+            // and the connection's own browser listeners don't cover wake. It is
+            // browser-gated separately from the timer, since a `proactiveInNode` host
+            // has no `window` to listen on and no OS sleep to wake from. Coming back
+            // online and regaining tab visibility are handled elsewhere — the
+            // connection already re-probes through this same credential path — so
+            // listening for them here too would only fire a second, redundant mint.
+            if (typeof window !== 'undefined') {
+                const onWake = () => void refresh();
+                window.addEventListener('ablo:wake', onWake);
+                teardowns.push(() => { window.removeEventListener('ablo:wake', onWake); });
+            }
+        }
+        this.credentialLifecycleTeardown = () => {
+            for (const t of teardowns)
+                t();
+        };
+    }
+    /** Tear down the proactive credential lifecycle (idempotent). */
+    stop() {
+        this.credentialLifecycleTeardown?.();
+        this.credentialLifecycleTeardown = null;
+    }
+}
+//# sourceMappingURL=credentialLifecycle.js.map

package/dist/transport/credentialLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialLifecycle.js","sourceRoot":"","sources":["../../src/transport/credentialLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AA8BrC;;kDAEkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA0B,EAAE,KAAa;IAC7E,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,GAAG,KAAK,CAAC;IACtC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC1F,CAAC;AAED;8DAC8D;AAC9D,SAAS,oBAAoB,CAAC,SAA6B;IACzD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAmBD,MAAM,OAAO,mBAAmB;IAoCX;IACA;IApCnB;;;;;;;;;;OAUG;IACK,mBAAmB,GAA+B,IAAI,CAAC;IAE/D;6EACyE;IACjE,yBAAyB,GAA6C,IAAI,CAAC;IAEnF;;wDAEoD;IAC5C,2BAA2B,GAAwB,IAAI,CAAC;IAEhE;;;0BAGsB;IACd,qBAAqB,GAAkB,IAAI,CAAC;IAEpD;;;mEAG+D;IACvD,iBAAiB,GAAwB,IAAI,CAAC;IAEtD,YACmB,GAA+B,EAC/B,SAAiB,UAAU;QAD3B,QAAG,GAAH,GAAG,CAA4B;QAC/B,WAAM,GAAN,MAAM,CAAqB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,YAAY,CAAC,SAAqC;QAChD,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,MAA+B;QACpC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QACnC,IAAI,IAAI,CAAC,yBAAyB;YAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC;QAE1E,MAAM,GAAG,GAAG,CAAC,KAAK,IAAuC,EAAE;YACzD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,kEAAkE;oBAClE,mEAAmE;oBACnE,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,uEAAuE;gBACvE,iEAAiE;gBACjE,qDAAqD;gBACrD,OAAO,WAAW,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uEAAuE;gBACvE,uEAAuE;gBACvE,mEAAmE;gBACnE,MAAM,OAAO,GAAI,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3D,qEAAqE;gBACrE,wEAAwE;gBACxE,kEAAkE;gBAClE,iEAAiE;gBACjE,qEAAqE;gBACrE,0CAA0C;gBAC1C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gGAAgG;wBAC9F,+EAA+E;wBAC/E,uEAAuE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,yBAAyB,GAAG,GAAG,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,OAAiC;QAC3D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,oEAAoE;YACpE,iDAAiD;YACjD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,+EAA+E;YAC/E,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,6EAA6E;QAC7E,gFAAgF;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,wBAAwB,CAAC,QAAuB;QACpD,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,0BAA0B;gBAC7B,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,KAAK,gBAAgB;gBACnB,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;gBAChC,OAAO,MAAM,CAAC;YAChB;gBACE,OAAO,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,QAA6B,EAAE,IAAoC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE5B,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,mDAAmD;QACnD,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACxC,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF,MAAM,SAAS,GAAmB,EAAE,CAAC;QAErC,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,gEAAgE;QAChE,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,cAAc;QACd,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI,EAAE,CAAC;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E;YAC3E,yEAAyE;YACzE,2EAA2E;YAC3E,0BAA0B;YAC1B,IAAI,KAAK,GAAyC,IAAI,CAAC;YACvD,MAAM,YAAY,GAAG,GAAS,EAAE;gBAC9B,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB;gBAC7D,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,gEAAgE;oBAChE,oEAAoE;oBACpE,oDAAoD;oBACpD,KAAK,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,mEAAmE;gBACnE,mEAAmE;gBAClE,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,CAAC,CAAC;YACF,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC;YACtC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClB,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxC,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,2BAA2B,GAAG,GAAS,EAAE;YAC5C,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC;IAC1C,CAAC;CACF"}

package/dist/transport/heartbeat.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Application-level heartbeat for the sync WebSocket.
+ *
+ * The browser WebSocket API hides RFC 6455 protocol-level ping and pong frames
+ * from JavaScript, so the server's keepalive cannot be observed by client
+ * code. That leaves the client unable to tell a healthy idle connection apart
+ * from a "zombie" socket whose underlying TCP connection has silently broken
+ * (laptop sleep, NAT timeout, mobile handoff). To close the gap, the client
+ * sends an application-level `{ type: 'ping' }` every 30 seconds and
+ * force-closes the socket if no inbound traffic arrives within 10 seconds. Any
+ * inbound message counts as proof the connection is alive; the explicit `pong`
+ * merely guarantees that something arrives even on an otherwise idle stream.
+ */
+import { type TransportObservability } from '../observability.js';
+/**
+ * The interval between application-level pings, shared with both sides of the
+ * connection: the client pings at the same {@link PING_INTERVAL_MS} the server
+ * uses for its own keepalive, and the claim lease window is derived from the
+ * same constant.
+ */
+export declare const HEARTBEAT_INTERVAL_MS = 30000;
+export declare const HEARTBEAT_TIMEOUT_MS = 10000;
+/**
+ * The narrow slice of the socket the heartbeat depends on. Keeping it small
+ * lets the {@link HeartbeatController} work without depending on the full
+ * WebSocket transport.
+ */
+export interface HeartbeatTransport {
+    /** True only while the underlying socket is open. */
+    isSocketOpen(): boolean;
+    /** Sends the `{ type: 'ping' }` frame; throws when the socket is already dead. */
+    sendPing(): void;
+    /**
+     * Closes the socket from the client side with a private 4xxx code, so the
+     * socket's close event fires and the owner's reconnect or handshake-failure
+     * handling runs.
+     */
+    forceClose(reason: string): void;
+}
+/**
+ * Runs the application-level heartbeat for one socket. While the socket is
+ * open, it sends a `{ type: 'ping' }` frame every {@link HEARTBEAT_INTERVAL_MS}
+ * and arms a {@link HEARTBEAT_TIMEOUT_MS} watchdog. Any inbound frame clears
+ * the watchdog — the owner calls {@link HeartbeatController.clearHeartbeatTimeout}
+ * from its message handler. If the watchdog fires first, the connection is
+ * treated as a zombie and force-closed, which lets the owner's reconnect path
+ * run.
+ *
+ * The heartbeat exists because the client cannot see the protocol-level
+ * keepalive: browsers answer the server's pings automatically but never expose
+ * those frames to JavaScript. On a half-open connection (laptop wake, NAT
+ * timeout, mobile handoff) the socket can report itself open for minutes
+ * before the operating system surfaces the break, so observable application
+ * traffic is the only reliable signal.
+ */
+export declare class HeartbeatController {
+    private readonly transport;
+    private readonly observability;
+    private heartbeatTimer;
+    private heartbeatTimeoutTimer;
+    constructor(transport: HeartbeatTransport, observability?: TransportObservability);
+    start(): void;
+    stop(): void;
+    clearHeartbeatTimeout(): void;
+}
+//# sourceMappingURL=heartbeat.d.ts.map

package/dist/transport/heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/transport/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AACtD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,YAAY,IAAI,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,qBAAqB,CAA8C;gBAGxD,SAAS,EAAE,kBAAkB,EAC7B,aAAa,GAAE,sBAAgD;IAGlF,KAAK,IAAI,IAAI;IA+Bb,IAAI,IAAI,IAAI;IAQZ,qBAAqB,IAAI,IAAI;CAM9B"}