@actuallab/rpc 14.1.5 → 14.3.5

package/dist/index.js

@@ -165,12 +165,24 @@ function readVarUint(data, offset) {
   } while (shift < 35);
   return { value: value >>> 0, bytesRead };
 }
+var MIN_BINARY_ENVELOPE_SIZE = 7;
+var MIN_COMPACT_BINARY_ENVELOPE_SIZE = 10;
+function requireInBounds(data, pos, length, what) {
+  const end = pos + length;
+  if (!Number.isSafeInteger(length) || length < 0 || end > data.length)
+    throw new Error(`Invalid binary RPC message: ${what} length ${length} at ${pos} is out of bounds.`);
+  return end;
+}
 function skipHeaders(data, pos, headerCount) {
   for (let h = 0; h < headerCount; h++) {
+    if (pos >= data.length)
+      throw new Error("Invalid binary RPC message: truncated header.");
     const keyLen = data[pos++];
-    pos += keyLen;
+    pos = requireInBounds(data, pos, keyLen, "header key");
     const valLen = readVarUint(data, pos);
-    pos += valLen.bytesRead + valLen.value;
+    if (valLen.bytesRead === 0)
+      throw new Error("Invalid binary RPC message: truncated header value length.");
+    pos = requireInBounds(data, pos + valLen.bytesRead, valLen.value, "header value");
   }
   return pos;
 }
@@ -233,6 +245,8 @@ function serializeBinaryMessage(message, args, encoder = defaultBinaryEncoder) {
 }
 function deserializeBinaryMessage(data, offset, decoder = defaultBinaryDecoder) {
   const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  if (offset + MIN_BINARY_ENVELOPE_SIZE > data.length)
+    throw new Error(`Invalid binary RPC message: truncated envelope at ${offset}.`);
   let pos = offset;
   const byte0 = data[pos++];
   const callTypeId = byte0 >> 5 & 7;
@@ -241,13 +255,15 @@ function deserializeBinaryMessage(data, offset, decoder = defaultBinaryDecoder)
   pos += relId.bytesRead;
   const methodLen = readVarUint(data, pos);
   pos += methodLen.bytesRead;
-  const methodBytes = data.subarray(pos, pos + methodLen.value);
-  const method = textDecoder.decode(methodBytes);
-  pos += methodLen.value;
-  const argDataLen = view.getInt32(pos, true);
+  const methodEnd = requireInBounds(data, pos, methodLen.value, "method");
+  const method = textDecoder.decode(data.subarray(pos, methodEnd));
+  pos = methodEnd;
+  if (pos + 4 > data.length)
+    throw new Error(`Invalid binary RPC message: truncated argument data length at ${pos}.`);
+  const argDataLen = view.getUint32(pos, true);
   pos += 4;
   const args = [];
-  const argEnd = pos + argDataLen;
+  const argEnd = requireInBounds(data, pos, argDataLen, "argument data");
   if (argDataLen > 0) {
     const argSlice = data.subarray(pos, argEnd);
     for (const decoded of decoder.decodeMulti(argSlice)) {
@@ -268,12 +284,16 @@ function splitBinaryFrame(frame, decoder = defaultBinaryDecoder) {
   const results = [];
   let offset = 0;
   while (offset < frame.length) {
-    const { message, args, bytesRead } = deserializeBinaryMessage(
-      frame,
-      offset,
-      decoder
-    );
-    if (bytesRead <= 0) break;
+    let parsed;
+    try {
+      parsed = deserializeBinaryMessage(frame, offset, decoder);
+    } catch (e) {
+      warnLog?.log(`Failed to parse a binary message at offset ${offset}:`, e);
+      break;
+    }
+    const { message, args, bytesRead } = parsed;
+    if (!Number.isFinite(bytesRead) || bytesRead < MIN_BINARY_ENVELOPE_SIZE)
+      break;
     results.push({ message, args });
     offset += bytesRead;
   }
@@ -323,19 +343,23 @@ function serializeCompactBinaryMessage(message, args, registry, encoder = defaul
 }
 function deserializeCompactBinaryMessage(data, offset, registry, decoder = defaultBinaryDecoder) {
   const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  if (offset + MIN_COMPACT_BINARY_ENVELOPE_SIZE > data.length)
+    throw new Error(`Invalid compact binary RPC message: truncated envelope at ${offset}.`);
   let pos = offset;
   const byte0 = data[pos++];
   const callTypeId = byte0 >> 5 & 7;
   const headerCount = byte0 & 31;
   const relId = readVarUint(data, pos);
   pos += relId.bytesRead;
+  if (pos + 8 > data.length)
+    throw new Error(`Invalid compact binary RPC message: truncated envelope at ${offset}.`);
   const methodHash = view.getUint32(pos, true);
   pos += 4;
   const method = registry?.getName(methodHash | 0) ?? `<hash:0x${methodHash.toString(16).padStart(8, "0")}>`;
-  const argDataLen = view.getInt32(pos, true);
+  const argDataLen = view.getUint32(pos, true);
   pos += 4;
   const args = [];
-  const argEnd = pos + argDataLen;
+  const argEnd = requireInBounds(data, pos, argDataLen, "argument data");
   if (argDataLen > 0) {
     const argSlice = data.subarray(pos, argEnd);
     for (const decoded of decoder.decodeMulti(argSlice)) {
@@ -356,13 +380,16 @@ function splitCompactBinaryFrame(frame, registry, decoder = defaultBinaryDecoder
   const results = [];
   let offset = 0;
   while (offset < frame.length) {
-    const { message, args, bytesRead } = deserializeCompactBinaryMessage(
-      frame,
-      offset,
-      registry,
-      decoder
-    );
-    if (bytesRead <= 0) break;
+    let parsed;
+    try {
+      parsed = deserializeCompactBinaryMessage(frame, offset, registry, decoder);
+    } catch (e) {
+      warnLog?.log(`Failed to parse a compact binary message at offset ${offset}:`, e);
+      break;
+    }
+    const { message, args, bytesRead } = parsed;
+    if (!Number.isFinite(bytesRead) || bytesRead < MIN_COMPACT_BINARY_ENVELOPE_SIZE)
+      break;
     results.push({ message, args });
     offset += bytesRead;
   }
@@ -424,46 +451,38 @@ var RpcWebSocketConnection = class {
     ws.onmessage = (ev) => {
       if (ev.data instanceof Uint8Array || ev.data instanceof ArrayBuffer) {
         const frame = ev.data instanceof Uint8Array ? ev.data : new Uint8Array(ev.data);
+        let messages;
         try {
-          const messages = this._splitBinary(frame);
-          for (const { message, args } of messages) {
-            this.messageReceived.trigger({
-              kind: "binary",
-              message,
-              args
-            });
-          }
+          messages = this._splitBinary(frame);
         } catch (e) {
           warnLog2?.log("Failed to split binary frame:", e);
           this.error.trigger(e);
+          return;
         }
+        for (const { message, args } of messages)
+          this._dispatchBinary(message, args);
       } else if (typeof Blob !== "undefined" && ev.data instanceof Blob && this.binaryMode) {
         void ev.data.arrayBuffer().then((ab) => {
           const frame = new Uint8Array(ab);
+          let messages;
           try {
-            const messages = this._splitBinary(frame);
-            for (const { message, args } of messages) {
-              this.messageReceived.trigger({
-                kind: "binary",
-                message,
-                args
-              });
-            }
+            messages = this._splitBinary(frame);
           } catch (e) {
             warnLog2?.log("Failed to split binary blob frame:", e);
             this.error.trigger(e);
+            return;
           }
+          for (const { message, args } of messages)
+            this._dispatchBinary(message, args);
         });
       } else {
         const data = typeof ev.data === "string" ? ev.data : String(ev.data);
-        const messages = splitFrame(data);
-        for (const msg of messages) {
+        for (const msg of splitFrame(data))
           if (msg.length > 0)
-            this.messageReceived.trigger({
-              kind: "text",
-              raw: msg
-            });
-        }
+            this.messageReceived.triggerSafe(
+              { kind: "text", raw: msg },
+              (e) => warnLog2?.log("Failed to handle a text message:", e)
+            );
       }
     };
     ws.onclose = (ev) => {
@@ -502,6 +521,15 @@ var RpcWebSocketConnection = class {
     }
     return splitBinaryFrame(frame, this._decoder);
   }
+  // Containment matters here: .NET batches many RPC messages per WebSocket frame,
+  // so letting one bad message escape would drop every other message in the frame -
+  // including $sys.Ok replies, whose per-call timeouts are unbounded by default.
+  _dispatchBinary(message, args) {
+    this.messageReceived.triggerSafe(
+      { kind: "binary", message, args },
+      (e) => warnLog2?.log("Failed to handle a binary message:", e)
+    );
+  }
   close(code, reason) {
     this._ws.close(code, reason);
   }
@@ -527,6 +555,7 @@ var RpcWebSocketConnection = class {
 
 // src/rpc-message-channel-connection.ts
 import { EventHandlerSet as EventHandlerSet2 } from "@actuallab/core";
+var { warnLog: warnLog3 } = getLogs("RpcMessageChannelConnection");
 var RpcMessageChannelConnection = class {
   _port;
   _open = true;
@@ -541,7 +570,10 @@ var RpcMessageChannelConnection = class {
       const data = typeof ev.data === "string" ? ev.data : String(ev.data);
       for (const msg of splitFrame(data))
         if (msg.length > 0)
-          this.messageReceived.trigger({ kind: "text", raw: msg });
+          this.messageReceived.triggerSafe(
+            { kind: "text", raw: msg },
+            (e) => warnLog3?.log("Failed to handle a text message:", e)
+          );
     };
   }
   get isOpen() {
@@ -858,10 +890,18 @@ var RpcError = class extends Error {
   }
 };
 var REMOTE_EXCEPTION_TYPE_REF = "ActualLab.Serialization.RemoteException, ActualLab.Core";
-function toExceptionInfo(error) {
+var genericErrorFilter = () => ({
+  TypeRef: REMOTE_EXCEPTION_TYPE_REF,
+  Message: "Error: An error occurred while processing the request."
+});
+function toExceptionInfo(error, filter) {
   const name = error instanceof Error ? error.name : "Error";
   const message = error instanceof Error ? error.message : String(error);
-  return { TypeRef: REMOTE_EXCEPTION_TYPE_REF, Message: `${name}: ${message}` };
+  const info = {
+    TypeRef: REMOTE_EXCEPTION_TYPE_REF,
+    Message: `${name}: ${message}`
+  };
+  return filter === void 0 ? info : filter(error, info);
 }
 
 // src/increasing-seq-compressor.ts
@@ -955,1271 +995,1308 @@ function _readVarUint(data, offset) {
   return [value, offset];
 }
 
-// src/rpc-stream.ts
-import Denque from "denque";
-import { PromiseSource as PromiseSource4 } from "@actuallab/core";
-
-// src/rpc-object.ts
-var RpcObjectKind = { Local: 0, Remote: 1 };
+// src/base64.ts
+function base64Encode(bytes) {
+  const chunkSize = 32768;
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    binary += String.fromCharCode(
+      ...bytes.subarray(i, Math.min(bytes.length, i + chunkSize))
+    );
+  }
+  return btoa(binary);
+}
+function base64UrlEncode(bytes) {
+  return base64Encode(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64Decode(encoded) {
+  const binary = atob(encoded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
 
-// src/rpc-stream-sender.ts
-import { PromiseSource as PromiseSource3, RingBuffer } from "@actuallab/core";
-var { warnLog: warnLog3 } = getLogs("RpcSharedStream");
-var DEFAULT_ACK_PERIOD = 256;
-var DEFAULT_ACK_ADVANCE = 128;
-var RTT_WINDOW_MS = 2e4;
-var RpcStreamSender = class _RpcStreamSender {
-  static _emptyGuid = "00000000-0000-0000-0000-000000000000";
-  id;
-  kind = RpcObjectKind.Local;
-  allowReconnect;
-  isRealTime;
-  canSkipTo;
-  peer;
-  ackPeriod;
-  /**
-   * Wire-level flow-control window: the maximum index the sender may
-   * advance past the most recently acknowledged index. Mirrors .NET
-   * `RpcStream.AckAdvance`.
-   */
-  ackAdvance;
-  /**
-   * Effective local ring buffer capacity used by the pump. Set larger
-   * than `ackAdvance` to pre-buffer items beyond the in-flight window;
-   * values below `ackAdvance` are clamped up (with a warning) at
-   * construction time. Not transmitted on the wire.
-   */
-  bufferSize;
+// src/rpc-system-call-handler.ts
+var { debugLog, warnLog: warnLog4 } = getLogs("RpcSystemCallHandler");
+var RpcSystemCallHandler = class {
+  handle(message, args, peer) {
+    const method = message.Method;
+    const relatedId = message.RelatedId ?? 0;
+    debugLog?.log(`'${peer.ref}': handle ${method}#${relatedId}`);
+    switch (method) {
+      case RpcSystemCalls.ok: {
+        const call = peer.outboundCalls.get(relatedId);
+        if (call !== void 0) {
+          if (args.length > 1) {
+            peer.outboundCalls.remove(relatedId);
+            call.result.reject(polymorphicPayloadError(method, args.length, 1));
+            break;
+          }
+          call.completedStage |= RpcCallStage.ResultReady;
+          if (call.removeOnOk) {
+            peer.outboundCalls.remove(relatedId);
+          }
+          call.result.resolve(args[0]);
+        }
+        break;
+      }
+      case RpcSystemCalls.reconnect: {
+        this._handleReconnect(relatedId, args, peer);
+        break;
+      }
+      case RpcSystemCalls.error: {
+        const call = peer.outboundCalls.get(relatedId);
+        if (call !== void 0) {
+          call.completedStage |= RpcCallStage.ResultReady;
+          if (call.removeOnOk) {
+            peer.outboundCalls.remove(relatedId);
+          }
+          const errorInfo = args[0];
+          const msg = errorInfo?.Message ?? errorInfo?.message ?? "RPC error";
+          const typeName = extractTypeName(errorInfo?.TypeRef ?? errorInfo?.typeRef);
+          if (typeName === "ActualLab.Rpc.RpcRerouteException")
+            warnLog4?.log("Got RpcRerouteException from remote peer:", msg);
+          call.result.reject(new RpcError(msg, typeName));
+        }
+        break;
+      }
+      case RpcSystemCalls.cancel: {
+        const call = peer.inboundCalls.remove(relatedId);
+        call?.cancel();
+        break;
+      }
+      case RpcSystemCalls.keepAlive: {
+        peer.notifyKeepAliveReceived();
+        const keepAliveIds = args[0];
+        if (Array.isArray(keepAliveIds) && keepAliveIds.length > 0 && peer.connection !== void 0) {
+          const unknownIds = [];
+          for (const id of keepAliveIds)
+            if (peer.sharedObjects.get(id) === void 0)
+              unknownIds.push(id);
+          if (unknownIds.length > 0)
+            peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, unknownIds);
+        }
+        break;
+      }
+      case RpcSystemCalls.item: {
+        const stream = peer.remoteObjects.get(relatedId);
+        if (!stream)
+          debugLog?.log(`$sys.I: no stream for relatedId=${relatedId}`);
+        else if (args.length > 2)
+          stream.onEnd(args[0], polymorphicPayloadError(method, args.length, 2));
+        else
+          stream.onItem(args[0], args[1]);
+        break;
+      }
+      case RpcSystemCalls.batch: {
+        const stream = peer.remoteObjects.get(relatedId);
+        if (!stream)
+          debugLog?.log(`$sys.B: no stream for relatedId=${relatedId}`);
+        else if (args.length > 2)
+          stream.onEnd(args[0], polymorphicPayloadError(method, args.length, 2));
+        else if (Array.isArray(args[1]))
+          stream.onBatch(args[0], args[1]);
+        break;
+      }
+      case RpcSystemCalls.end: {
+        const stream = peer.remoteObjects.get(relatedId);
+        if (!stream) {
+          debugLog?.log(`$sys.End: no stream for relatedId=${relatedId}`);
+        } else {
+          const errorInfo = args[1];
+          const typeName = extractTypeName(errorInfo?.TypeRef ?? errorInfo?.typeRef);
+          const msg = errorInfo?.Message ?? errorInfo?.message;
+          let error = null;
+          if (typeName || msg) {
+            error = new Error(msg ?? typeName ?? "RPC stream error");
+            if (typeName)
+              error.name = typeName;
+          }
+          stream.onEnd(args[0], error);
+        }
+        break;
+      }
+      case RpcSystemCalls.ack: {
+        const sender = peer.sharedObjects.get(relatedId);
+        if (sender)
+          sender.onAck(args[0], args[1]);
+        else if (peer.connection !== void 0)
+          peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, [relatedId]);
+        break;
+      }
+      case RpcSystemCalls.ackEnd: {
+        const sender = peer.sharedObjects.get(relatedId);
+        if (sender)
+          sender.onAckEnd(args[0]);
+        else if (peer.connection !== void 0)
+          peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, [relatedId]);
+        break;
+      }
+      case RpcSystemCalls.disconnect: {
+        const ids = args[0];
+        if (Array.isArray(ids)) {
+          for (const id of ids) {
+            const remoteObj = peer.remoteObjects.get(id);
+            if (remoteObj && typeof remoteObj.disconnect === "function") {
+              remoteObj.disconnect();
+            }
+          }
+        }
+        break;
+      }
+    }
+  }
   /**
-   * If true, the source was produced by a factory `(abortSignal) => AsyncIterable<T>`
-   * and may honor the AbortSignal to exit gracefully. `disconnect()` first aborts
-   * the signal and gives the source up to `RpcStream.disconnectGracePeriodMs` ms
-   * before force-closing via `iterator.return()`.
+   * Server-side handler for the `$sys.Reconnect` call. Parses the peer's
+   * report of in-flight call IDs (grouped by stage, IncreasingSeqCompressor-
+   * encoded, base64-wrapped for JSON transport), computes the subset this
+   * peer does not recognize, and replies with a compressed byte[] of the
+   * unknown IDs wrapped in `$sys.Ok`.
    *
-   * If false, the source is a plain AsyncIterable that cannot observe the signal,
-   * so `disconnect()` force-closes immediately.
+   * @param relatedId The outbound call ID the client used for this
+   *                  `$sys.Reconnect` invocation — we send `$sys.Ok` back
+   *                  with the same `RelatedId`.
    */
-  sourceUsesAbortSignal;
-  // -- Pump state --
-  /** Next stream index that will be sent (matches .NET's `index`). */
-  _nextIndex = 0;
-  _ended = false;
-  _started = new PromiseSource3();
-  /** Highest `nextIndex` observed in an ACK so far (matches .NET's `lastAckNextIndex` idiom). */
-  _lastAckedIndex = 0;
-  _abortController = new AbortController();
-  _iterator = null;
-  // -- RTT sampling (send → matching ack round trips, windowed minimum) --
-  _pendingSendTimes = [];
-  _rttSamples = [];
-  // -- Recorder-controller metrics (Step 9.1) --
-  /** Total items skipped via real-time `canSkipTo` compaction. */
-  _skipCount = 0;
-  /** Fires after a $sys.Ack has been processed (post-compaction). The
-   *  recorder's quality controller uses this to bump a "last ACK at"
-   *  watchdog so it can distinguish "stuck" (no ACK > N s) from
-   *  "throttled" (ACKs flowing). */
-  onAckProcessed;
-  /** Fires after each item is pushed onto the local ring buffer. The
-   *  argument is the buffer count *after* the push. Together with
-   *  `onAckProcessed` (which is the only place items leave the buffer),
-   *  this gives controllers a complete picture of buffer utilization.
-   *  When `bufferedCount === bufferSize`, the source pull is paused
-   *  until the next ACK frees space. Listener errors are swallowed. */
-  onBuffered;
-  get nextIndex() {
-    return this._nextIndex;
-  }
-  get lastAckIndex() {
-    return this._lastAckedIndex;
-  }
-  get skipCount() {
-    return this._skipCount;
-  }
-  // Windowed-MIN ack round trip (ms, -1 until sampled): converges on propagation
-  // RTT — unlike a mean/EMA it is not inflated by self-induced queuing.
-  get minRttMs() {
-    const cutoffMs = Date.now() - RTT_WINDOW_MS;
-    while (this._rttSamples.length > 0 && this._rttSamples[0].atMs < cutoffMs)
-      this._rttSamples.shift();
-    if (this._rttSamples.length === 0)
-      return -1;
-    let min = this._rttSamples[0].rttMs;
-    for (const s of this._rttSamples) {
-      if (s.rttMs < min)
-        min = s.rttMs;
-    }
-    return min;
-  }
-  // -- ACK queue (analog of .NET's Channel<(long, bool)>) --
-  _acks = [];
-  _whenAckReady = null;
-  constructor(peer, ackPeriod = DEFAULT_ACK_PERIOD, ackAdvance = DEFAULT_ACK_ADVANCE, allowReconnect = true, isRealTime = false, canSkipTo = () => true, sourceUsesAbortSignal = false, bufferSize) {
-    const localId = peer.sharedObjects.nextId();
-    this.id = { hostId: peer.hub.hubId, localId };
-    this.allowReconnect = allowReconnect;
-    this.isRealTime = isRealTime;
-    this.canSkipTo = canSkipTo;
-    this.peer = peer;
-    this.ackPeriod = ackPeriod;
-    this.ackAdvance = ackAdvance;
-    this.sourceUsesAbortSignal = sourceUsesAbortSignal;
-    if (bufferSize !== void 0 && bufferSize !== 0 && bufferSize < ackAdvance)
-      warnLog3?.log(
-        `RpcStream bufferSize (${bufferSize}) is below ackAdvance (${ackAdvance}); using ackAdvance as buffer size.`
+  _handleReconnect(relatedId, args, peer) {
+    if (peer.connection === void 0) return;
+    const handshakeIndex = args[0];
+    if (typeof handshakeIndex !== "number" || handshakeIndex !== peer.ownHandshakeIndex) {
+      const got = typeof handshakeIndex === "number" ? handshakeIndex : `<${typeof handshakeIndex}>`;
+      peer.hub.systemCallSender.error(
+        peer.connection,
+        peer.serializationFormat,
+        relatedId,
+        new Error(
+          `TooLateToReconnect: own handshake index ${peer.ownHandshakeIndex} != ${got}`
+        )
       );
-    this.bufferSize = bufferSize !== void 0 && bufferSize >= ackAdvance ? bufferSize : ackAdvance;
-  }
-  /** AbortSignal that is aborted when the sender is disconnected. */
-  get abortSignal() {
-    return this._abortController.signal;
-  }
-  /** Returns the stream reference string for the $sys.Ok response. */
-  toRef() {
-    return `${this.id.hostId},${this.id.localId},${this.ackPeriod},${this.ackAdvance},${this.allowReconnect ? "1" : "0"},${this.isRealTime ? "1" : "0"}`;
-  }
-  /**
-   * Called by system call handler when $sys.Ack is received from the client.
-   *
-   * Mirrors .NET `RpcSharedStream<T>.OnAck` at
-   * src/ActualLab.Rpc/Infrastructure/RpcSharedStream.cs:68-101.
-   */
-  onAck(nextIndex, hostId) {
-    const mustReset = hostId !== "" && hostId !== _RpcStreamSender._emptyGuid;
-    if (mustReset && hostId !== this.id.hostId) {
-      this._sendDisconnect();
       return;
     }
-    if (!this._started.isCompleted) {
-      if (mustReset && nextIndex === 0)
-        this._started.resolve();
-      else {
-        this._sendDisconnect();
-        return;
+    let unknownIds = [];
+    try {
+      const stagesRaw = args[1];
+      if (stagesRaw && typeof stagesRaw === "object" && !Array.isArray(stagesRaw)) {
+        const unknownSet = /* @__PURE__ */ new Set();
+        for (const [stageKey, rawValue] of Object.entries(stagesRaw)) {
+          const bytes = _toBytes(rawValue);
+          if (bytes === null) continue;
+          const completedStage = parseInt(stageKey, 10) || 0;
+          const callIds = IncreasingSeqCompressor.deserialize(bytes);
+          for (const callId of callIds) {
+            const call = peer.inboundCalls.get(callId);
+            if (call === void 0)
+              unknownSet.add(callId);
+            else if (completedStage < 1)
+              call.resendResult();
+          }
+        }
+        unknownIds = [...unknownSet].sort((a, b) => a - b);
       }
-    } else if (this._ended) {
-      this._sendDisconnect();
-      return;
-    } else if (mustReset && !this.allowReconnect) {
-      this._sendDisconnect();
-      return;
-    }
-    this._sampleRtt(nextIndex, mustReset);
-    this._acks.push({ nextIndex, mustReset });
-    if (this._whenAckReady) {
-      this._whenAckReady.resolve();
-      this._whenAckReady = null;
+    } catch {
     }
+    const responseBytes = IncreasingSeqCompressor.serialize(unknownIds);
+    const responseValue = peer.serializationFormat.isBinary ? responseBytes : base64Encode(responseBytes);
+    peer.hub.systemCallSender.ok(peer.connection, peer.serializationFormat, relatedId, responseValue);
   }
-  // Tells the consumer this shared stream is gone, then disposes it —
-  // mirrors RpcSharedStream.SendDisconnect (RpcSharedStream.cs:284-289).
-  _sendDisconnect() {
-    const conn = this.peer.connection;
-    if (conn)
-      this.peer.hub.systemCallSender.disconnect(conn, this.peer.serializationFormat, [this.id.localId]);
-    this.disconnect();
+};
+function polymorphicPayloadError(method, got, expected) {
+  return new Error(
+    `${method}: expected ${expected} value(s), got ${got} \u2014 polymorphic payloads are not supported by the TS client`
+  );
+}
+function extractTypeName(typeRef) {
+  if (typeof typeRef === "string") {
+    if (typeRef.length === 0)
+      return void 0;
+    const commaIdx = typeRef.indexOf(",");
+    return commaIdx >= 0 ? typeRef.slice(0, commaIdx) : typeRef;
   }
-  /** Called by system call handler when $sys.AckEnd is received from the client. */
-  onAckEnd(_hostId) {
-    this.disconnect();
+  if (typeRef !== null && typeof typeRef === "object") {
+    const t = typeRef;
+    const aqn = t.AssemblyQualifiedName ?? t.assemblyQualifiedName;
+    if (typeof aqn === "string" && aqn.length > 0) {
+      const commaIdx = aqn.indexOf(",");
+      return commaIdx >= 0 ? aqn.slice(0, commaIdx) : aqn;
+    }
+    return t.TypeName ?? t.typeName;
   }
-  /**
-   * Send a single item to the client at the current `_nextIndex`.
-   *
-   * Advances `_nextIndex` unconditionally — even if the peer is disconnected
-   * the item is considered "sent" from the pump's perspective so the replay
-   * buffer indexing stays consistent. If a connection is absent, the wire
-   * message is dropped; the item will be resent from the replay buffer
-   * after a reconnect (client sends `Ack(N, mustReset=true)`).
-   */
-  sendItem(item) {
-    if (this._ended) return;
-    const conn = this.peer.connection;
-    if (conn) {
-      this.peer.hub.systemCallSender.item(
-        conn,
-        this.peer.serializationFormat,
-        this.id.localId,
-        this._nextIndex,
-        item
-      );
-      this._pendingSendTimes.push({ index: this._nextIndex, sentAtMs: Date.now() });
+  return void 0;
+}
+function _toBytes(value) {
+  if (value instanceof Uint8Array) return value;
+  if (typeof value === "string") {
+    try {
+      return base64Decode(value);
+    } catch {
+      return null;
     }
-    this._nextIndex++;
   }
-  /** Send a batch of items to the client. See {@link sendItem} for disconnect semantics. */
-  sendBatch(items) {
-    if (this._ended || items.length === 0) return;
-    const conn = this.peer.connection;
-    if (conn) {
-      this.peer.hub.systemCallSender.batch(
+  return null;
+}
+
+// src/rpc-system-call-sender.ts
+var { errorLog } = getLogs("RpcSystemCallSender");
+var RpcSystemCallSender = class _RpcSystemCallSender {
+  // Reusable envelopes — one per hot-path method.
+  _itemEnv = {
+    Method: RpcSystemCalls.item,
+    RelatedId: 0
+  };
+  _batchEnv = {
+    Method: RpcSystemCalls.batch,
+    RelatedId: 0
+  };
+  _endEnv = {
+    Method: RpcSystemCalls.end,
+    RelatedId: 0
+  };
+  _ackEnv = {
+    Method: RpcSystemCalls.ack,
+    RelatedId: 0
+  };
+  _ackEndEnv = {
+    Method: RpcSystemCalls.ackEnd,
+    RelatedId: 0
+  };
+  // Reusable arg arrays.
+  _itemArgs = [0, null];
+  _batchArgs = [0, null];
+  _endArgs = [0, { TypeRef: "", Message: "" }];
+  _ackArgs = [0, ""];
+  _ackEndArgs = [""];
+  static NO_ERROR = Object.freeze({ TypeRef: "", Message: "" });
+  registry;
+  /** Applied to every error this hub sends to a remote peer. Undefined means
+   *  pass through, i.e. the peer sees the original message — set it (e.g. to
+   *  {@link genericErrorFilter}) on a TS-hosted server, where handler errors
+   *  would otherwise disclose internal details to unauthenticated callers. */
+  errorFilter;
+  _send(conn, format, envelope, args) {
+    const wireData = format.serializeMessage(
+      envelope,
+      args,
+      conn.encoder,
+      this.registry
+    );
+    if (typeof wireData === "string") {
+      conn.send(wireData);
+    } else {
+      conn.sendBinary(wireData);
+    }
+  }
+  handshake(conn, format, peerId, hubId, index) {
+    const handshakeArg = format.isBinary ? [peerId, null, hubId, 2, index] : {
+      RemotePeerId: peerId,
+      RemoteApiVersionSet: null,
+      RemoteHubId: hubId,
+      ProtocolVersion: 2,
+      Index: index
+    };
+    this._send(conn, format, { Method: RpcSystemCalls.handshake }, [
+      handshakeArg
+    ]);
+  }
+  ok(conn, format, relatedId, result) {
+    try {
+      this._send(
         conn,
-        this.peer.serializationFormat,
-        this.id.localId,
-        this._nextIndex,
-        items
+        format,
+        { Method: RpcSystemCalls.ok, RelatedId: relatedId },
+        [result]
       );
+    } catch (e) {
+      errorLog?.log(`Failed to send Ok response for call #${relatedId}`, e);
+      this.error(conn, format, relatedId, e);
     }
-    this._nextIndex += items.length;
   }
-  /** Signal stream completion to the client. */
-  sendEnd(error) {
-    if (this._ended) return;
-    this._ended = true;
-    const conn = this.peer.connection;
-    if (!conn) return;
-    const errorInfo = error ? toExceptionInfo(error) : { TypeRef: "", Message: "" };
-    this.peer.hub.systemCallSender.end(
+  error(conn, format, relatedId, error) {
+    this._send(
       conn,
-      this.peer.serializationFormat,
-      this.id.localId,
-      this._nextIndex,
-      errorInfo
+      format,
+      { Method: RpcSystemCalls.error, RelatedId: relatedId },
+      [toExceptionInfo(error, this.errorFilter)]
     );
   }
-  /**
-   * Consume an AsyncIterable and send all items to the client.
-   *
-   * Matches .NET `RpcSharedStream<T>.OnRun` at
-   * src/ActualLab.Rpc/Infrastructure/RpcSharedStream.cs.
-   */
-  async writeFrom(source) {
-    await this._started;
-    if (this._ended) return;
-    const iterator = source[Symbol.asyncIterator]();
-    this._iterator = iterator;
-    const state = { iteratorDone: false };
-    try {
-      await this._run(iterator, state);
-    } finally {
-      if (state.iteratorDone && this._iterator === iterator) {
-        this._iterator = null;
-      }
-    }
+  cancel(conn, format, relatedId) {
+    this._send(conn, format, {
+      Method: RpcSystemCalls.cancel,
+      RelatedId: relatedId
+    });
+  }
+  keepAlive(conn, format, activeCallIds) {
+    this._send(conn, format, { Method: RpcSystemCalls.keepAlive }, [
+      activeCallIds
+    ]);
+  }
+  // Tells the remote peer the listed shared-object ids are gone on our side,
+  // so its matching remote objects (e.g. RpcStream consumers) fail fast
+  // instead of hanging. Mirrors .NET RpcSystemCallSender.Disconnect.
+  disconnect(conn, format, localIds) {
+    this._send(conn, format, { Method: RpcSystemCalls.disconnect }, [
+      localIds
+    ]);
+  }
+  item(conn, format, localId, index, item) {
+    this._itemEnv.RelatedId = localId;
+    this._itemArgs[0] = index;
+    this._itemArgs[1] = item;
+    this._send(conn, format, this._itemEnv, this._itemArgs);
+    this._itemArgs[1] = null;
+  }
+  batch(conn, format, localId, index, items) {
+    this._batchEnv.RelatedId = localId;
+    this._batchArgs[0] = index;
+    this._batchArgs[1] = items;
+    this._send(conn, format, this._batchEnv, this._batchArgs);
+    this._batchArgs[1] = null;
+  }
+  end(conn, format, localId, index, error = _RpcSystemCallSender.NO_ERROR) {
+    this._endEnv.RelatedId = localId;
+    this._endArgs[0] = index;
+    this._endArgs[1] = error;
+    this._send(conn, format, this._endEnv, this._endArgs);
+  }
+  ack(conn, format, localId, nextIndex, hostId) {
+    this._ackEnv.RelatedId = localId;
+    this._ackArgs[0] = nextIndex;
+    this._ackArgs[1] = hostId;
+    this._send(conn, format, this._ackEnv, this._ackArgs);
+  }
+  ackEnd(conn, format, localId, hostId) {
+    this._ackEndEnv.RelatedId = localId;
+    this._ackEndArgs[0] = hostId;
+    this._send(conn, format, this._ackEndEnv, this._ackEndArgs);
   }
+};
+
+// src/rpc-object.ts
+var RpcObjectKind = { Local: 0, Remote: 1 };
+
+// src/rpc-stream.ts
+import Denque from "denque";
+import { PromiseSource as PromiseSource4 } from "@actuallab/core";
+
+// src/rpc-stream-sender.ts
+import { PromiseSource as PromiseSource3, RingBuffer } from "@actuallab/core";
+var { warnLog: warnLog5 } = getLogs("RpcSharedStream");
+var DEFAULT_ACK_PERIOD = 256;
+var DEFAULT_ACK_ADVANCE = 128;
+var RTT_WINDOW_MS = 2e4;
+var MAX_PENDING_SEND_TIMES = 4096;
+var RpcStreamSender = class _RpcStreamSender {
+  static _emptyGuid = "00000000-0000-0000-0000-000000000000";
+  id;
+  kind = RpcObjectKind.Local;
+  allowReconnect;
+  isRealTime;
+  canSkipTo;
+  peer;
+  ackPeriod;
   /**
-   * ACK-driven pump. Non-real-time streams apply normal backpressure at
-   * `ackAdvance`; real-time streams may compact the already-buffered unsent
-   * suffix to the latest buffered `canSkipTo` item after the consumer ACKs.
-   * With `bufferSize > ackAdvance` the local ring buffer holds more than the
-   * in-flight window — real-time mode uses the extra space to pre-buffer.
+   * Wire-level flow-control window: the maximum index the sender may
+   * advance past the most recently acknowledged index. Mirrors .NET
+   * `RpcStream.AckAdvance`.
    */
-  /* eslint-disable @typescript-eslint/no-unnecessary-condition -- _ended changes across awaits */
-  async _run(iterator, state) {
-    const buffer = new RingBuffer(this.bufferSize + 1);
-    const isRealTime = this.isRealTime;
-    let bufferStart = 0;
-    let isFullyBuffered = false;
-    let whenMovedNext = null;
-    const pending = /* @__PURE__ */ Symbol("pending");
-    const readNext = async () => {
-      const next = whenMovedNext ?? iterator.next();
-      whenMovedNext = null;
-      return await next;
-    };
-    const tryReadReady = async () => {
-      whenMovedNext ??= iterator.next();
-      return await Promise.race([
-        whenMovedNext,
-        Promise.resolve(pending)
-      ]);
-    };
-    const fireBuffered = () => {
-      try {
-        this.onBuffered?.(buffer.count);
-      } catch {
-      }
-    };
-    const bufferNext = async (onlyIfReady, prefetchNext) => {
-      let r;
-      try {
-        r = onlyIfReady ? await tryReadReady() : await readNext();
-        if (r === pending)
-          return false;
-        whenMovedNext = null;
-        if (this._ended) return false;
-        if (r.done) {
-          buffer.pushTail(_endItem);
-          isFullyBuffered = true;
-          state.iteratorDone = true;
-        } else {
-          buffer.pushTail({ kind: "value", value: r.value });
-          if (prefetchNext)
-            whenMovedNext = iterator.next();
-        }
-        fireBuffered();
-        return true;
-      } catch (e) {
-        whenMovedNext = null;
-        state.iteratorDone = true;
-        isFullyBuffered = true;
-        buffer.pushTail({
-          kind: "error",
-          error: e instanceof Error ? e : new Error(String(e))
-        });
-        fireBuffered();
-        return true;
-      }
-    };
-    while (true) {
-      let ack = this._tryProcessAcks();
-      if (!ack) {
-        await this._waitAckReady();
-        if (this._ended) return;
-        ack = this._tryProcessAcks();
-        if (!ack) {
-          warnLog3?.log("Something is off: couldn't read an acknowledgement");
-          return;
-        }
-      }
-      this._lastAckedIndex = ack.nextIndex;
-      if (isRealTime && ack.mustReset && !isFullyBuffered) {
-        buffer.clear();
-        bufferStart = this._nextIndex;
-        while (true) {
-          if (this._ended) return;
-          let item;
-          let accepted = false;
-          try {
-            const r = await readNext();
-            if (this._ended) return;
-            if (r.done) {
-              item = _endItem;
-              isFullyBuffered = true;
-              state.iteratorDone = true;
-            } else if (this.canSkipTo(r.value)) {
-              item = { kind: "value", value: r.value };
-              accepted = true;
-            } else {
-              continue;
-            }
-          } catch (e) {
-            state.iteratorDone = true;
-            isFullyBuffered = true;
-            item = {
-              kind: "error",
-              error: e instanceof Error ? e : new Error(String(e))
-            };
-          }
-          buffer.pushTail(item);
-          fireBuffered();
-          if (accepted || isFullyBuffered) break;
-        }
-      }
-      const shift = _clamp(ack.nextIndex - bufferStart, 0, buffer.count);
-      if (shift > 0) {
-        buffer.moveHead(shift);
-        bufferStart += shift;
-      }
-      if (this._nextIndex < bufferStart) {
-        if (!this._ended)
-          this.sendEnd(new Error("Stream position unavailable."));
-        return;
-      }
-      let bufferIndex = this._nextIndex - bufferStart;
-      const maxIndex = ack.nextIndex + this.ackAdvance;
-      while (this._nextIndex < maxIndex) {
-        if (this._ended) return;
-        if (isRealTime) {
-          while (buffer.hasRemainingCapacity && !isFullyBuffered && this._acks.length === 0) {
-            if (!await bufferNext(true, true))
-              break;
-          }
-          if (bufferIndex >= buffer.count && !isFullyBuffered && buffer.hasRemainingCapacity && this._acks.length === 0) {
-            await bufferNext(false, true);
-          }
-          if (ack.nextIndex > 0) {
-            const result = _compactBufferedUnsentSuffix(
-              buffer,
-              bufferIndex,
-              this.canSkipTo
-            );
-            bufferIndex = result.newIndex;
-            if (result.skipped > 0)
-              this._skipCount += result.skipped;
-          }
-          if (this._acks.length > 0) break;
-        }
-        while (this._nextIndex < maxIndex && bufferIndex < buffer.count) {
-          const item = buffer.get(bufferIndex++);
-          if (item.kind === "value") {
-            this.sendItem(item.value);
-          } else if (item.kind === "end") {
-            if (!this._ended) this.sendEnd();
-            return;
-          } else {
-            if (!this._ended) this.sendEnd(item.error);
-            return;
-          }
-        }
-        if (this._nextIndex >= maxIndex)
-          break;
-        if (isFullyBuffered) break;
-        if (!buffer.hasRemainingCapacity) break;
-        if (!isRealTime)
-          await bufferNext(false, false);
-      }
-    }
+  ackAdvance;
+  /**
+   * Effective local ring buffer capacity used by the pump. Set larger
+   * than `ackAdvance` to pre-buffer items beyond the in-flight window;
+   * values below `ackAdvance` are clamped up (with a warning) at
+   * construction time. Not transmitted on the wire.
+   */
+  bufferSize;
+  /**
+   * If true, the source was produced by a factory `(abortSignal) => AsyncIterable<T>`
+   * and may honor the AbortSignal to exit gracefully. `disconnect()` first aborts
+   * the signal and gives the source up to `RpcStream.disconnectGracePeriodMs` ms
+   * before force-closing via `iterator.return()`.
+   *
+   * If false, the source is a plain AsyncIterable that cannot observe the signal,
+   * so `disconnect()` force-closes immediately.
+   */
+  sourceUsesAbortSignal;
+  // -- Pump state --
+  /** Next stream index that will be sent (matches .NET's `index`). */
+  _nextIndex = 0;
+  _ended = false;
+  _started = new PromiseSource3();
+  /** Highest `nextIndex` observed in an ACK so far (matches .NET's `lastAckNextIndex` idiom). */
+  _lastAckedIndex = 0;
+  _abortController = new AbortController();
+  _iterator = null;
+  // -- RTT sampling (send → matching ack round trips, windowed minimum) --
+  _pendingSendTimes = [];
+  _rttSamples = [];
+  // -- Recorder-controller metrics (Step 9.1) --
+  /** Total items skipped via real-time `canSkipTo` compaction. */
+  _skipCount = 0;
+  /** Fires after a $sys.Ack has been processed (post-compaction). The
+   *  recorder's quality controller uses this to bump a "last ACK at"
+   *  watchdog so it can distinguish "stuck" (no ACK > N s) from
+   *  "throttled" (ACKs flowing). */
+  onAckProcessed;
+  /** Fires after each item is pushed onto the local ring buffer. The
+   *  argument is the buffer count *after* the push. Together with
+   *  `onAckProcessed` (which is the only place items leave the buffer),
+   *  this gives controllers a complete picture of buffer utilization.
+   *  When `bufferedCount === bufferSize`, the source pull is paused
+   *  until the next ACK frees space. Listener errors are swallowed. */
+  onBuffered;
+  get nextIndex() {
+    return this._nextIndex;
   }
-  /* eslint-enable @typescript-eslint/no-unnecessary-condition */
-  /** Drain all queued ACKs, returning the most recent one (or null if none).
-   *  A reconnect's reset ACK may be drained in one batch with regular
-   *  consumption ACKs the client sends right after it, so `mustReset` is
-   *  OR-ed over the whole batch — the last ACK alone can't represent it. */
-  _tryProcessAcks() {
-    if (this._acks.length === 0) return null;
-    let nextIndex = 0;
-    let mustReset = false;
-    while (this._acks.length > 0) {
-      const a = this._acks.shift();
-      nextIndex = a.nextIndex;
-      mustReset ||= a.mustReset;
-      if (a.mustReset || this._nextIndex < a.nextIndex) {
-        this._nextIndex = a.nextIndex;
-      }
-    }
-    try {
-      this.onAckProcessed?.();
-    } catch {
-    }
-    return { nextIndex, mustReset };
+  get lastAckIndex() {
+    return this._lastAckedIndex;
   }
-  /** Wait for the ACK queue to have at least one entry (or `_ended`). */
-  async _waitAckReady() {
-    if (this._acks.length > 0 || this._ended) return;
-    this._whenAckReady = new PromiseSource3();
-    await this._whenAckReady;
-    this._whenAckReady = null;
+  get skipCount() {
+    return this._skipCount;
   }
-  // One RTT sample per ack: time from sending the newest acked item to the
-  // ack's arrival (a slight upper bound — includes the server's ack cadence).
-  _sampleRtt(ackNextIndex, mustReset) {
-    if (mustReset) {
-      this._pendingSendTimes.length = 0;
-      return;
-    }
-    let sentAtMs = -1;
-    while (this._pendingSendTimes.length > 0 && this._pendingSendTimes[0].index < ackNextIndex) {
-      sentAtMs = this._pendingSendTimes[0].sentAtMs;
-      this._pendingSendTimes.shift();
-    }
-    if (sentAtMs < 0)
-      return;
-    const nowMs = Date.now();
-    const cutoffMs = nowMs - RTT_WINDOW_MS;
+  // Windowed-MIN ack round trip (ms, -1 until sampled): converges on propagation
+  // RTT — unlike a mean/EMA it is not inflated by self-induced queuing.
+  get minRttMs() {
+    const cutoffMs = Date.now() - RTT_WINDOW_MS;
     while (this._rttSamples.length > 0 && this._rttSamples[0].atMs < cutoffMs)
       this._rttSamples.shift();
-    this._rttSamples.push({ atMs: nowMs, rttMs: nowMs - sentAtMs });
+    if (this._rttSamples.length === 0)
+      return -1;
+    let min = this._rttSamples[0].rttMs;
+    for (const s of this._rttSamples) {
+      if (s.rttMs < min)
+        min = s.rttMs;
+    }
+    return min;
   }
-  // -- IRpcObject --
-  reconnect() {
+  // -- Coalesced ACK state (analog of .NET's Channel<(long, bool)>) --
+  // The pump reduces any queued ACKs to the newest index plus the OR of
+  // `mustReset` anyway, so we accumulate exactly that at receipt: an ACK flood
+  // then costs O(1) memory and O(1) work instead of an unbounded array drained
+  // with repeated `shift()`.
+  /** Newest unprocessed ACK index; -1 means "nothing pending". */
+  _ackIndex = -1;
+  _ackMustReset = false;
+  /** Highest ACK index accepted so far — the monotonicity baseline a
+   *  non-reset ACK may not regress below. */
+  _maxAckIndex = 0;
+  _whenAckReady = null;
+  constructor(peer, ackPeriod = DEFAULT_ACK_PERIOD, ackAdvance = DEFAULT_ACK_ADVANCE, allowReconnect = true, isRealTime = false, canSkipTo = () => true, sourceUsesAbortSignal = false, bufferSize) {
+    const localId = peer.sharedObjects.nextId();
+    this.id = { hostId: peer.hub.hubId, localId };
+    this.allowReconnect = allowReconnect;
+    this.isRealTime = isRealTime;
+    this.canSkipTo = canSkipTo;
+    this.peer = peer;
+    this.ackPeriod = ackPeriod;
+    this.ackAdvance = ackAdvance;
+    this.sourceUsesAbortSignal = sourceUsesAbortSignal;
+    if (bufferSize !== void 0 && bufferSize !== 0 && bufferSize < ackAdvance)
+      warnLog5?.log(
+        `RpcStream bufferSize (${bufferSize}) is below ackAdvance (${ackAdvance}); using ackAdvance as buffer size.`
+      );
+    this.bufferSize = bufferSize !== void 0 && bufferSize >= ackAdvance ? bufferSize : ackAdvance;
   }
-  disconnect() {
-    if (this._ended) return;
-    this._ended = true;
-    this._abortController.abort();
+  /** AbortSignal that is aborted when the sender is disconnected. */
+  get abortSignal() {
+    return this._abortController.signal;
+  }
+  /** Returns the stream reference string for the $sys.Ok response. */
+  toRef() {
+    return `${this.id.hostId},${this.id.localId},${this.ackPeriod},${this.ackAdvance},${this.allowReconnect ? "1" : "0"},${this.isRealTime ? "1" : "0"}`;
+  }
+  /**
+   * Called by system call handler when $sys.Ack is received from the client.
+   *
+   * Mirrors .NET `RpcSharedStream<T>.OnAck` at
+   * src/ActualLab.Rpc/Infrastructure/RpcSharedStream.cs:68-101.
+   */
+  onAck(nextIndex, hostId) {
+    const mustReset = hostId !== "" && hostId !== _RpcStreamSender._emptyGuid;
+    if (mustReset && hostId !== this.id.hostId) {
+      this._sendDisconnect();
+      return;
+    }
+    if (!Number.isSafeInteger(nextIndex) || nextIndex < 0 || nextIndex > this._nextIndex) {
+      this._sendDisconnect();
+      return;
+    }
     if (!this._started.isCompleted) {
-      this._started.resolve();
+      if (mustReset && nextIndex === 0)
+        this._started.resolve();
+      else {
+        this._sendDisconnect();
+        return;
+      }
+    } else if (this._ended) {
+      this._sendDisconnect();
+      return;
+    } else if (mustReset && !this.allowReconnect) {
+      this._sendDisconnect();
+      return;
     }
+    if (!mustReset && nextIndex < this._maxAckIndex)
+      return;
+    this._maxAckIndex = nextIndex;
+    this._sampleRtt(nextIndex, mustReset);
+    this._ackIndex = nextIndex;
+    this._ackMustReset ||= mustReset;
     if (this._whenAckReady) {
       this._whenAckReady.resolve();
       this._whenAckReady = null;
     }
-    this.peer.sharedObjects.unregister(this);
-    const iterator = this._iterator;
-    if (!iterator) return;
-    if (!this.sourceUsesAbortSignal) {
-      this._iterator = null;
-      this._forceCloseIterator(iterator);
-      return;
-    }
-    setTimeout(() => {
-      if (this._iterator === iterator) {
-        this._iterator = null;
-        this._forceCloseIterator(iterator);
-      }
-    }, RpcStream.disconnectGracePeriodMs);
-  }
-  _forceCloseIterator(iterator) {
-    try {
-      const ret = iterator.return?.(void 0);
-      if (ret) void ret.catch(() => {
-      });
-    } catch {
-    }
-  }
-};
-var _endItem = { kind: "end" };
-function _clamp(value, min, max) {
-  return value < min ? min : value > max ? max : value;
-}
-function _compactBufferedUnsentSuffix(buffer, firstUnsentIndex, canSkipTo) {
-  let skipToIndex = -1;
-  for (let i = firstUnsentIndex; i < buffer.count; i++) {
-    const item = buffer.get(i);
-    if (item.kind === "value" && canSkipTo(item.value))
-      skipToIndex = i;
   }
-  if (skipToIndex <= firstUnsentIndex)
-    return { newIndex: firstUnsentIndex, skipped: 0 };
-  const cutFrom = firstUnsentIndex;
-  const cutTo = skipToIndex;
-  const items = buffer.toArray();
-  buffer.clear();
-  for (let i = 0; i < cutFrom; i++)
-    buffer.pushTail(items[i]);
-  for (let i = cutTo; i < items.length; i++)
-    buffer.pushTail(items[i]);
-  return { newIndex: firstUnsentIndex, skipped: skipToIndex - firstUnsentIndex };
-}
-
-// src/rpc-stream.ts
-var { warnLog: warnLog4 } = getLogs("RpcStream");
-var DEFAULT_ACK_PERIOD2 = 30;
-var DEFAULT_ACK_ADVANCE2 = 61;
-function parseStreamRef(value) {
-  if (typeof value === "string") {
-    const parts = value.split(",");
-    if (parts.length < 4 || parts.length > 6) return null;
-    const hostId = parts[0];
-    const localId = parseInt(parts[1], 10);
-    const ackPeriod = parseInt(parts[2], 10);
-    const ackAdvance = parseInt(parts[3], 10);
-    if (isNaN(localId) || isNaN(ackPeriod) || isNaN(ackAdvance))
-      return null;
-    const allowReconnect = parts.length < 5 || parts[4] !== "0";
-    const isRealTime = parts.length >= 6 && parts[5] === "1";
-    return { hostId, localId, ackPeriod, ackAdvance, allowReconnect, isRealTime };
+  // Tells the consumer this shared stream is gone, then disposes it —
+  // mirrors RpcSharedStream.SendDisconnect (RpcSharedStream.cs:284-289).
+  _sendDisconnect() {
+    const conn = this.peer.connection;
+    if (conn)
+      this.peer.hub.systemCallSender.disconnect(conn, this.peer.serializationFormat, [this.id.localId]);
+    this.disconnect();
   }
-  if (typeof value === "object" && value !== null) {
-    const obj = value;
-    const serializedId = obj.SerializedId;
-    if (!Array.isArray(serializedId) || serializedId.length < 2)
-      return null;
-    const rawHostId = serializedId[0];
-    const hostId = String(rawHostId);
-    const localId = Number(serializedId[1]);
-    const ackPeriod = Number(obj.AckPeriod ?? 256);
-    const ackAdvance = Number(obj.AckAdvance ?? 128);
-    const allowReconnect = obj.AllowReconnect !== false;
-    const isRealTime = obj.IsRealTime === true;
-    return { hostId, localId, ackPeriod, ackAdvance, allowReconnect, isRealTime };
+  /** Called by system call handler when $sys.AckEnd is received from the client. */
+  onAckEnd(_hostId) {
+    this.disconnect();
   }
-  return null;
-}
-var RpcStream = class _RpcStream {
   /**
-   * Grace period (ms) given to a factory-form local source to honor its
-   * AbortSignal and exit naturally before the sender force-closes the
-   * iterator via `iterator.return()`.
+   * Send a single item to the client at the current `_nextIndex`.
    *
-   * Only applies to sources provided as `(abortSignal) => AsyncIterable<T>`.
-   * Plain `AsyncIterable<T>` sources are force-closed immediately on disconnect.
-   */
-  static disconnectGracePeriodMs = 100;
-  id;
-  kind;
-  allowReconnect;
-  isRealTime;
-  canSkipTo;
-  ackPeriod;
-  ackAdvance;
-  /**
-   * Local-only ring buffer capacity hint for the sender. Undefined means
-   * "use ackAdvance as the buffer size". Not part of the wire ref.
+   * Advances `_nextIndex` unconditionally — even if the peer is disconnected
+   * the item is considered "sent" from the pump's perspective so the replay
+   * buffer indexing stays consistent. If a connection is absent, the wire
+   * message is dropped; the item will be resent from the replay buffer
+   * after a reconnect (client sends `Ack(N, mustReset=true)`).
    */
-  bufferSize;
-  // Local (origin) mode
-  localSource;
-  // Remote (target) mode
-  peer;
-  // Local-only state
-  _sender;
-  _toRefValue;
-  _whenSent;
-  // Remote-only state
-  _buffer = new Denque();
-  _nextExpectedIndex = 0;
-  _consumerWaiting = null;
-  _completed = false;
-  _completionError = null;
-  _disposed = false;
-  _started = false;
-  _iterating = false;
-  _ackSentUpTo = 0;
-  _nextConsumedIndex = 0;
-  constructor(sourceOrRef, optionsOrPeer) {
-    if (_isStreamSource(sourceOrRef)) {
-      const options = optionsOrPeer ?? {};
-      this.kind = RpcObjectKind.Local;
-      this.localSource = sourceOrRef;
-      this.id = { hostId: "", localId: 0 };
-      this.allowReconnect = options.allowReconnect ?? true;
-      this.isRealTime = options.isRealTime ?? false;
-      this.canSkipTo = options.canSkipTo ?? (() => true);
-      this.ackPeriod = options.ackPeriod ?? DEFAULT_ACK_PERIOD2;
-      this.ackAdvance = options.ackAdvance ?? DEFAULT_ACK_ADVANCE2;
-      this.bufferSize = options.bufferSize;
-    } else {
-      const ref = sourceOrRef;
-      const peer = optionsOrPeer;
-      this.kind = RpcObjectKind.Remote;
-      this.id = { hostId: ref.hostId, localId: ref.localId };
-      this.peer = peer;
-      this.allowReconnect = ref.allowReconnect;
-      this.isRealTime = ref.isRealTime;
-      this.canSkipTo = () => true;
-      this.ackPeriod = ref.ackPeriod;
-      this.ackAdvance = ref.ackAdvance;
+  sendItem(item) {
+    if (this._ended) return;
+    const conn = this.peer.connection;
+    if (conn) {
+      this.peer.hub.systemCallSender.item(
+        conn,
+        this.peer.serializationFormat,
+        this.id.localId,
+        this._nextIndex,
+        item
+      );
+      this._pendingSendTimes.push({ index: this._nextIndex, sentAtMs: Date.now() });
+      if (this._pendingSendTimes.length > MAX_PENDING_SEND_TIMES)
+        this._pendingSendTimes.splice(0, MAX_PENDING_SEND_TIMES >> 1);
     }
+    this._nextIndex++;
   }
-  /**
-   * For local streams: resolves when the sender finishes pumping (after `toRef()` was called).
-   * Rejects if the source throws. Throws if `toRef()` hasn't been called yet.
-   */
-  get whenSent() {
-    if (!this._whenSent)
-      throw new Error("toRef() must be called before awaiting whenSent.");
-    return this._whenSent;
+  /** Send a batch of items to the client. See {@link sendItem} for disconnect semantics. */
+  sendBatch(items) {
+    if (this._ended || items.length === 0) return;
+    const conn = this.peer.connection;
+    if (conn) {
+      this.peer.hub.systemCallSender.batch(
+        conn,
+        this.peer.serializationFormat,
+        this.id.localId,
+        this._nextIndex,
+        items
+      );
+    }
+    this._nextIndex += items.length;
   }
-  /** Local sender backing this stream after `toRef()` has been called.
-   *  `undefined` for remote streams or before `toRef()`. */
-  get sender() {
-    return this._sender;
+  /** Signal stream completion to the client. */
+  sendEnd(error) {
+    if (this._ended) return;
+    this._ended = true;
+    const conn = this.peer.connection;
+    if (!conn) return;
+    const errorInfo = error ? toExceptionInfo(error) : { TypeRef: "", Message: "" };
+    this.peer.hub.systemCallSender.end(
+      conn,
+      this.peer.serializationFormat,
+      this.id.localId,
+      this._nextIndex,
+      errorInfo
+    );
   }
   /**
-   * For local streams: bind to a peer, create and register an `RpcStreamSender`,
-   * start pumping items from the local source in the background, and return the
-   * stream reference.
-   *
-   * For binary peers the ref is a MessagePack-compatible object
-   * (`{ SerializedId, AckPeriod, AckAdvance, AllowReconnect }`);
-   * for text peers it is a comma-separated string.
+   * Consume an AsyncIterable and send all items to the client.
    *
-   * Can only be called once per stream.
+   * Matches .NET `RpcSharedStream<T>.OnRun` at
+   * src/ActualLab.Rpc/Infrastructure/RpcSharedStream.cs.
    */
-  toRef(peer) {
-    if (this.kind !== RpcObjectKind.Local)
-      throw new Error("toRef() is only valid for local streams.");
-    if (this._sender) {
-      if (this._sender.peer !== peer)
-        throw new Error("toRef() was already called with a different peer.");
-      return this._toRefValue;
+  async writeFrom(source) {
+    await this._started;
+    if (this._ended) return;
+    const iterator = source[Symbol.asyncIterator]();
+    this._iterator = iterator;
+    const state = { iteratorDone: false };
+    try {
+      await this._run(iterator, state);
+    } finally {
+      if (state.iteratorDone && this._iterator === iterator) {
+        this._iterator = null;
+      }
     }
-    const isFactory = typeof this.localSource === "function";
-    const sender = new RpcStreamSender(
-      peer,
-      this.ackPeriod,
-      this.ackAdvance,
-      this.allowReconnect,
-      this.isRealTime,
-      this.canSkipTo,
-      isFactory,
-      this.bufferSize
-    );
-    peer.sharedObjects.register(sender);
-    this._sender = sender;
-    const source = isFactory ? this.localSource(sender.abortSignal) : this.localSource;
-    this._whenSent = sender.writeFrom(source);
-    this._toRefValue = peer.serializationFormat.isBinary ? {
-      SerializedId: [sender.id.hostId, sender.id.localId],
-      AckPeriod: sender.ackPeriod,
-      AckAdvance: sender.ackAdvance,
-      AllowReconnect: sender.allowReconnect
-    } : sender.toRef();
-    return this._toRefValue;
   }
-  /** Called by system call handler when a single item arrives ($sys.I). */
-  onItem(index, item) {
-    if (this._disposed || this._completed) return;
-    if (index > this._nextExpectedIndex) {
-      warnLog4?.log(`item index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
-      if (!this.allowReconnect) {
-        this._complete(this._gapError(index));
-        return;
+  /**
+   * ACK-driven pump. Non-real-time streams apply normal backpressure at
+   * `ackAdvance`; real-time streams may compact the already-buffered unsent
+   * suffix to the latest buffered `canSkipTo` item after the consumer ACKs.
+   * With `bufferSize > ackAdvance` the local ring buffer holds more than the
+   * in-flight window — real-time mode uses the extra space to pre-buffer.
+   */
+  /* eslint-disable @typescript-eslint/no-unnecessary-condition -- _ended changes across awaits */
+  async _run(iterator, state) {
+    const buffer = new RingBuffer(this.bufferSize + 1);
+    const isRealTime = this.isRealTime;
+    let bufferStart = 0;
+    let isFullyBuffered = false;
+    let whenMovedNext = null;
+    const pending = /* @__PURE__ */ Symbol("pending");
+    const readNext = async () => {
+      const next = whenMovedNext ?? iterator.next();
+      whenMovedNext = null;
+      return await next;
+    };
+    const tryReadReady = async () => {
+      whenMovedNext ??= iterator.next();
+      return await Promise.race([
+        whenMovedNext,
+        Promise.resolve(pending)
+      ]);
+    };
+    const fireBuffered = () => {
+      try {
+        this.onBuffered?.(buffer.count);
+      } catch {
+      }
+    };
+    const bufferNext = async (onlyIfReady, prefetchNext) => {
+      let r;
+      try {
+        r = onlyIfReady ? await tryReadReady() : await readNext();
+        if (r === pending)
+          return false;
+        whenMovedNext = null;
+        if (this._ended) return false;
+        if (r.done) {
+          buffer.pushTail(_endItem);
+          isFullyBuffered = true;
+          state.iteratorDone = true;
+        } else {
+          buffer.pushTail({ kind: "value", value: r.value });
+          if (prefetchNext)
+            whenMovedNext = iterator.next();
+        }
+        fireBuffered();
+        return true;
+      } catch (e) {
+        whenMovedNext = null;
+        state.iteratorDone = true;
+        isFullyBuffered = true;
+        buffer.pushTail({
+          kind: "error",
+          error: e instanceof Error ? e : new Error(String(e))
+        });
+        fireBuffered();
+        return true;
       }
-      this._sendAck(this._nextExpectedIndex, true);
-      return;
-    }
-    if (index < this._nextExpectedIndex) {
-      this._maybeSendAck(Math.min(index + 1, this._nextConsumedIndex));
-      return;
-    }
-    this._buffer.push(item);
-    this._nextExpectedIndex = index + 1;
-    this._notifyConsumer();
-  }
-  /** Called by system call handler when a batch arrives ($sys.B). */
-  onBatch(index, items) {
-    if (this._disposed || this._completed) return;
-    if (index > this._nextExpectedIndex) {
-      warnLog4?.log(`batch index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
-      if (!this.allowReconnect) {
-        this._complete(this._gapError(index));
-        return;
+    };
+    while (true) {
+      let ack = this._tryProcessAcks();
+      if (!ack) {
+        await this._waitAckReady();
+        if (this._ended) return;
+        ack = this._tryProcessAcks();
+        if (!ack) {
+          warnLog5?.log("Something is off: couldn't read an acknowledgement");
+          return;
+        }
       }
-      this._sendAck(this._nextExpectedIndex, true);
-      return;
-    }
-    if (index < this._nextExpectedIndex) {
-      this._maybeSendAck(Math.min(index + items.length, this._nextConsumedIndex));
-      return;
-    }
-    for (const item of items) this._buffer.push(item);
-    this._nextExpectedIndex = index + items.length;
-    this._notifyConsumer();
-  }
-  /** Called by system call handler when the stream ends ($sys.End). */
-  onEnd(index, error) {
-    if (this._disposed || this._completed) return;
-    if (index > this._nextExpectedIndex) {
-      warnLog4?.log(`end index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
-      if (!this.allowReconnect) {
-        this._complete(this._gapError(index));
+      this._lastAckedIndex = ack.nextIndex;
+      if (isRealTime && ack.mustReset && !isFullyBuffered) {
+        buffer.clear();
+        bufferStart = this._nextIndex;
+        while (true) {
+          if (this._ended) return;
+          let item;
+          let accepted = false;
+          try {
+            const r = await readNext();
+            if (this._ended) return;
+            if (r.done) {
+              item = _endItem;
+              isFullyBuffered = true;
+              state.iteratorDone = true;
+            } else if (this.canSkipTo(r.value)) {
+              item = { kind: "value", value: r.value };
+              accepted = true;
+            } else {
+              continue;
+            }
+          } catch (e) {
+            state.iteratorDone = true;
+            isFullyBuffered = true;
+            item = {
+              kind: "error",
+              error: e instanceof Error ? e : new Error(String(e))
+            };
+          }
+          buffer.pushTail(item);
+          fireBuffered();
+          if (accepted || isFullyBuffered) break;
+        }
+      }
+      const shift = _clamp(ack.nextIndex - bufferStart, 0, buffer.count);
+      if (shift > 0) {
+        buffer.moveHead(shift);
+        bufferStart += shift;
+      }
+      if (this._nextIndex < bufferStart) {
+        if (!this._ended)
+          this.sendEnd(new Error("Stream position unavailable."));
         return;
       }
-      this._sendAck(this._nextExpectedIndex, true);
-      return;
-    }
-    if (index < this._nextExpectedIndex) {
-      this._maybeSendAck(Math.min(index, this._nextConsumedIndex));
-      return;
-    }
-    this._complete(error);
-  }
-  // -- IRpcObject --
-  reconnect() {
-    if (this.kind === RpcObjectKind.Local) return;
-    if (this.allowReconnect) {
-      this._sendAck(this._nextExpectedIndex, true);
-    } else {
-      this.disconnect();
-    }
-  }
-  disconnect() {
-    if (this.kind === RpcObjectKind.Local) {
-      this._sender?.disconnect();
-      return;
-    }
-    if (this._completed) return;
-    this._completed = true;
-    this._completionError = new Error("Peer disconnected.");
-    this._notifyConsumer();
-  }
-  // -- AsyncIterable --
-  [Symbol.asyncIterator]() {
-    if (this.kind === RpcObjectKind.Local) {
-      const source = typeof this.localSource === "function" ? this.localSource(new AbortController().signal) : this.localSource;
-      return source[Symbol.asyncIterator]();
-    }
-    if (this._iterating)
-      throw new Error("RpcStream can only be iterated once.");
-    this._iterating = true;
-    return {
-      next: async () => {
-        if (!this._started) {
-          this._started = true;
-          this.peer.remoteObjects.register(this);
-          this._sendAck(0, true);
-        }
-        this._maybeSendAck(this._nextConsumedIndex);
-        for (; ; ) {
-          if (!this._buffer.isEmpty()) {
-            const value = this._buffer.shift();
-            this._nextConsumedIndex++;
-            return { value, done: false };
+      let bufferIndex = this._nextIndex - bufferStart;
+      const maxIndex = ack.nextIndex + this.ackAdvance;
+      while (this._nextIndex < maxIndex) {
+        if (this._ended) return;
+        if (isRealTime) {
+          while (buffer.hasRemainingCapacity && !isFullyBuffered && !this._hasPendingAck) {
+            if (!await bufferNext(true, true))
+              break;
           }
-          if (this._completed) {
-            this.dispose();
-            if (this._completionError) throw this._completionError;
-            return { value: void 0, done: true };
+          if (bufferIndex >= buffer.count && !isFullyBuffered && buffer.hasRemainingCapacity && !this._hasPendingAck) {
+            await bufferNext(false, true);
           }
-          this._consumerWaiting = new PromiseSource4();
-          await this._consumerWaiting;
+          if (ack.nextIndex > 0) {
+            const result = _compactBufferedUnsentSuffix(
+              buffer,
+              bufferIndex,
+              this.canSkipTo
+            );
+            bufferIndex = result.newIndex;
+            if (result.skipped > 0)
+              this._skipCount += result.skipped;
+          }
+          if (this._hasPendingAck) break;
         }
-      },
-      return: () => {
-        if (this._started && !this._completed)
-          this._sendAckEnd();
-        this.dispose();
-        return Promise.resolve({ value: void 0, done: true });
+        while (this._nextIndex < maxIndex && bufferIndex < buffer.count) {
+          const item = buffer.get(bufferIndex++);
+          if (item.kind === "value") {
+            this.sendItem(item.value);
+          } else if (item.kind === "end") {
+            if (!this._ended) this.sendEnd();
+            return;
+          } else {
+            if (!this._ended) this.sendEnd(item.error);
+            return;
+          }
+        }
+        if (this._nextIndex >= maxIndex)
+          break;
+        if (isFullyBuffered) break;
+        if (!buffer.hasRemainingCapacity) break;
+        if (!isRealTime)
+          await bufferNext(false, false);
       }
-    };
-  }
-  dispose() {
-    if (this._disposed) return;
-    this._disposed = true;
-    this._completed = true;
-    if (this.kind === RpcObjectKind.Remote) {
-      this.peer.remoteObjects.unregister(this);
     }
-    this._notifyConsumer();
   }
-  // -- Private --
-  // Mirrors .NET RpcStream.CloseFromLock: acknowledge the end to the sender
-  // (so its RpcSharedStream is released) and unregister immediately.
-  _complete(error) {
-    if (this._completed) return;
-    this._completed = true;
-    this._completionError = error;
-    this._sendAckEnd();
-    if (this.kind === RpcObjectKind.Remote)
-      this.peer.remoteObjects.unregister(this);
-    this._notifyConsumer();
+  /* eslint-enable @typescript-eslint/no-unnecessary-condition */
+  get _hasPendingAck() {
+    return this._ackIndex >= 0;
   }
-  _gapError(index) {
-    return new Error(
-      `Stream gap at index ${index} (expected ${this._nextExpectedIndex}); reconnect not allowed`
-    );
+  /** Consume the coalesced ACK state (or null if nothing is pending).
+   *  A reconnect's reset ACK may be coalesced with the regular consumption
+   *  ACKs the client sends right after it, so `mustReset` accumulates across
+   *  the whole batch — the newest ACK alone can't represent it. */
+  _tryProcessAcks() {
+    const nextIndex = this._ackIndex;
+    if (nextIndex < 0)
+      return null;
+    const mustReset = this._ackMustReset;
+    this._ackIndex = -1;
+    this._ackMustReset = false;
+    if (mustReset || this._nextIndex < nextIndex)
+      this._nextIndex = nextIndex;
+    try {
+      this.onAckProcessed?.();
+    } catch {
+    }
+    return { nextIndex, mustReset };
   }
-  _notifyConsumer() {
-    if (this._consumerWaiting !== null) {
-      this._consumerWaiting.resolve();
-      this._consumerWaiting = null;
+  /** Wait until an ACK is pending (or `_ended`). */
+  async _waitAckReady() {
+    if (this._hasPendingAck || this._ended)
+      return;
+    this._whenAckReady = new PromiseSource3();
+    await this._whenAckReady;
+    this._whenAckReady = null;
+  }
+  // One RTT sample per ack: time from sending the newest acked item to the
+  // ack's arrival (a slight upper bound — includes the server's ack cadence).
+  _sampleRtt(ackNextIndex, mustReset) {
+    if (mustReset) {
+      this._pendingSendTimes.length = 0;
+      return;
+    }
+    let sentAtMs = -1;
+    while (this._pendingSendTimes.length > 0 && this._pendingSendTimes[0].index < ackNextIndex) {
+      sentAtMs = this._pendingSendTimes[0].sentAtMs;
+      this._pendingSendTimes.shift();
     }
+    if (sentAtMs < 0)
+      return;
+    const nowMs = Date.now();
+    const cutoffMs = nowMs - RTT_WINDOW_MS;
+    while (this._rttSamples.length > 0 && this._rttSamples[0].atMs < cutoffMs)
+      this._rttSamples.shift();
+    this._rttSamples.push({ atMs: nowMs, rttMs: nowMs - sentAtMs });
+  }
+  // -- IRpcObject --
+  reconnect() {
   }
-  _maybeSendAck(nextIndex) {
-    if (this.ackPeriod <= 0) return;
-    const threshold = this._ackSentUpTo + this.ackPeriod;
-    if (nextIndex >= threshold) {
-      this._sendAck(nextIndex, false);
+  disconnect() {
+    if (this._ended) return;
+    this._ended = true;
+    this._abortController.abort();
+    if (!this._started.isCompleted) {
+      this._started.resolve();
     }
-  }
-  static _emptyGuid = "00000000-0000-0000-0000-000000000000";
-  _sendAck(nextIndex, mustReset) {
-    this._ackSentUpTo = nextIndex;
-    const conn = this.peer.isConnected ? this.peer.connection : void 0;
-    if (conn) {
-      const hostId = mustReset ? this.id.hostId : _RpcStream._emptyGuid;
-      this.peer.hub.systemCallSender.ack(
-        conn,
-        this.peer.serializationFormat,
-        this.id.localId,
-        nextIndex,
-        hostId
-      );
+    if (this._whenAckReady) {
+      this._whenAckReady.resolve();
+      this._whenAckReady = null;
+    }
+    this.peer.sharedObjects.unregister(this);
+    const iterator = this._iterator;
+    if (!iterator) return;
+    if (!this.sourceUsesAbortSignal) {
+      this._iterator = null;
+      this._forceCloseIterator(iterator);
+      return;
     }
+    setTimeout(() => {
+      if (this._iterator === iterator) {
+        this._iterator = null;
+        this._forceCloseIterator(iterator);
+      }
+    }, RpcStream.disconnectGracePeriodMs);
   }
-  _sendAckEnd() {
-    const conn = this.peer.isConnected ? this.peer.connection : void 0;
-    if (conn) {
-      this.peer.hub.systemCallSender.ackEnd(
-        conn,
-        this.peer.serializationFormat,
-        this.id.localId,
-        this.id.hostId
-      );
+  _forceCloseIterator(iterator) {
+    try {
+      const ret = iterator.return?.(void 0);
+      if (ret) void ret.catch(() => {
+      });
+    } catch {
     }
   }
 };
-function _isStreamSource(value) {
-  if (typeof value === "function") return true;
-  return value !== null && typeof value === "object" && Symbol.asyncIterator in value;
+var _endItem = { kind: "end" };
+function _clamp(value, min, max) {
+  return value < min ? min : value > max ? max : value;
 }
-function resolveStreamRefs(value, peer) {
-  if (value === null || value === void 0) return value;
-  if (typeof value === "string") {
-    const ref = parseStreamRef(value);
-    if (ref !== null) {
-      return new RpcStream(ref, peer);
-    }
-    return value;
-  }
-  if (Array.isArray(value)) {
-    for (let i = 0; i < value.length; i++) {
-      value[i] = resolveStreamRefs(value[i], peer);
-    }
-    return value;
-  }
-  if (typeof value === "object") {
-    if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer)
-      return value;
-    for (const key of Object.keys(value)) {
-      value[key] = resolveStreamRefs(
-        value[key],
-        peer
-      );
-    }
-    return value;
+function _compactBufferedUnsentSuffix(buffer, firstUnsentIndex, canSkipTo) {
+  let skipToIndex = -1;
+  for (let i = firstUnsentIndex; i < buffer.count; i++) {
+    const item = buffer.get(i);
+    if (item.kind === "value" && canSkipTo(item.value))
+      skipToIndex = i;
   }
-  return value;
+  if (skipToIndex <= firstUnsentIndex)
+    return { newIndex: firstUnsentIndex, skipped: 0 };
+  const cutFrom = firstUnsentIndex;
+  const cutTo = skipToIndex;
+  const items = buffer.toArray();
+  buffer.clear();
+  for (let i = 0; i < cutFrom; i++)
+    buffer.pushTail(items[i]);
+  for (let i = cutTo; i < items.length; i++)
+    buffer.pushTail(items[i]);
+  return { newIndex: firstUnsentIndex, skipped: skipToIndex - firstUnsentIndex };
 }
 
-// src/base64.ts
-function base64Encode(bytes) {
-  const chunkSize = 32768;
-  let binary = "";
-  for (let i = 0; i < bytes.length; i += chunkSize) {
-    binary += String.fromCharCode(
-      ...bytes.subarray(i, Math.min(bytes.length, i + chunkSize))
-    );
+// src/rpc-stream.ts
+var { warnLog: warnLog6 } = getLogs("RpcStream");
+var DEFAULT_ACK_PERIOD2 = 30;
+var DEFAULT_ACK_ADVANCE2 = 61;
+function parseStreamRef(value) {
+  if (typeof value === "string") {
+    const parts = value.split(",");
+    if (parts.length < 4 || parts.length > 6) return null;
+    const hostId = parts[0];
+    const localId = parseInt(parts[1], 10);
+    const ackPeriod = parseInt(parts[2], 10);
+    const ackAdvance = parseInt(parts[3], 10);
+    if (isNaN(localId) || isNaN(ackPeriod) || isNaN(ackAdvance))
+      return null;
+    const allowReconnect = parts.length < 5 || parts[4] !== "0";
+    const isRealTime = parts.length >= 6 && parts[5] === "1";
+    return { hostId, localId, ackPeriod, ackAdvance, allowReconnect, isRealTime };
   }
-  return btoa(binary);
-}
-function base64Decode(encoded) {
-  const binary = atob(encoded);
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
-  return out;
-}
-
-// src/rpc-system-call-handler.ts
-var { debugLog, warnLog: warnLog5 } = getLogs("RpcSystemCallHandler");
-var RpcSystemCallHandler = class {
-  handle(message, args, peer) {
-    const method = message.Method;
-    const relatedId = message.RelatedId ?? 0;
-    debugLog?.log(`'${peer.ref}': handle ${method}#${relatedId}`);
-    switch (method) {
-      case RpcSystemCalls.ok: {
-        const call = peer.outboundCalls.get(relatedId);
-        if (call !== void 0) {
-          if (args.length > 1) {
-            peer.outboundCalls.remove(relatedId);
-            call.result.reject(polymorphicPayloadError(method, args.length, 1));
-            break;
-          }
-          call.completedStage |= RpcCallStage.ResultReady;
-          if (call.removeOnOk) {
-            peer.outboundCalls.remove(relatedId);
-          }
-          call.result.resolve(args[0]);
-        }
-        break;
-      }
-      case RpcSystemCalls.reconnect: {
-        this._handleReconnect(relatedId, args, peer);
-        break;
-      }
-      case RpcSystemCalls.error: {
-        const call = peer.outboundCalls.get(relatedId);
-        if (call !== void 0) {
-          call.completedStage |= RpcCallStage.ResultReady;
-          if (call.removeOnOk) {
-            peer.outboundCalls.remove(relatedId);
-          }
-          const errorInfo = args[0];
-          const msg = errorInfo?.Message ?? errorInfo?.message ?? "RPC error";
-          const typeName = extractTypeName(errorInfo?.TypeRef ?? errorInfo?.typeRef);
-          if (typeName === "ActualLab.Rpc.RpcRerouteException")
-            warnLog5?.log("Got RpcRerouteException from remote peer:", msg);
-          call.result.reject(new RpcError(msg, typeName));
-        }
-        break;
-      }
-      case RpcSystemCalls.cancel: {
-        const call = peer.inboundCalls.remove(relatedId);
-        call?.cancel();
-        break;
-      }
-      case RpcSystemCalls.keepAlive: {
-        peer.notifyKeepAliveReceived();
-        const keepAliveIds = args[0];
-        if (Array.isArray(keepAliveIds) && keepAliveIds.length > 0 && peer.connection !== void 0) {
-          const unknownIds = [];
-          for (const id of keepAliveIds)
-            if (peer.sharedObjects.get(id) === void 0)
-              unknownIds.push(id);
-          if (unknownIds.length > 0)
-            peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, unknownIds);
-        }
-        break;
-      }
-      case RpcSystemCalls.item: {
-        const stream = peer.remoteObjects.get(relatedId);
-        if (!stream)
-          debugLog?.log(`$sys.I: no stream for relatedId=${relatedId}`);
-        else if (args.length > 2)
-          stream.onEnd(args[0], polymorphicPayloadError(method, args.length, 2));
-        else
-          stream.onItem(
-            args[0],
-            resolveStreamRefs(args[1], peer)
-          );
-        break;
-      }
-      case RpcSystemCalls.batch: {
-        const stream = peer.remoteObjects.get(relatedId);
-        if (!stream)
-          debugLog?.log(`$sys.B: no stream for relatedId=${relatedId}`);
-        else if (args.length > 2)
-          stream.onEnd(args[0], polymorphicPayloadError(method, args.length, 2));
-        else if (Array.isArray(args[1])) {
-          const items = args[1];
-          for (let i = 0; i < items.length; i++)
-            items[i] = resolveStreamRefs(items[i], peer);
-          stream.onBatch(args[0], items);
-        }
-        break;
-      }
-      case RpcSystemCalls.end: {
-        const stream = peer.remoteObjects.get(relatedId);
-        if (!stream) {
-          debugLog?.log(`$sys.End: no stream for relatedId=${relatedId}`);
-        } else {
-          const errorInfo = args[1];
-          const typeName = extractTypeName(errorInfo?.TypeRef ?? errorInfo?.typeRef);
-          const msg = errorInfo?.Message ?? errorInfo?.message;
-          let error = null;
-          if (typeName || msg) {
-            error = new Error(msg ?? typeName ?? "RPC stream error");
-            if (typeName)
-              error.name = typeName;
-          }
-          stream.onEnd(args[0], error);
-        }
-        break;
-      }
-      case RpcSystemCalls.ack: {
-        const sender = peer.sharedObjects.get(relatedId);
-        if (sender)
-          sender.onAck(args[0], args[1]);
-        else if (peer.connection !== void 0)
-          peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, [relatedId]);
-        break;
-      }
-      case RpcSystemCalls.ackEnd: {
-        const sender = peer.sharedObjects.get(relatedId);
-        if (sender)
-          sender.onAckEnd(args[0]);
-        else if (peer.connection !== void 0)
-          peer.hub.systemCallSender.disconnect(peer.connection, peer.serializationFormat, [relatedId]);
-        break;
-      }
-      case RpcSystemCalls.disconnect: {
-        const ids = args[0];
-        if (Array.isArray(ids)) {
-          for (const id of ids) {
-            const remoteObj = peer.remoteObjects.get(id);
-            if (remoteObj && typeof remoteObj.disconnect === "function") {
-              remoteObj.disconnect();
-            }
-            const sharedObj = peer.sharedObjects.get(id);
-            if (sharedObj && typeof sharedObj.disconnect === "function") {
-              sharedObj.disconnect();
-            }
-          }
-        }
-        break;
-      }
+  if (typeof value === "object" && value !== null) {
+    const obj = value;
+    const serializedId = obj.SerializedId;
+    if (!Array.isArray(serializedId) || serializedId.length < 2)
+      return null;
+    const rawHostId = serializedId[0];
+    const hostId = String(rawHostId);
+    const localId = Number(serializedId[1]);
+    const ackPeriod = Number(obj.AckPeriod ?? 256);
+    const ackAdvance = Number(obj.AckAdvance ?? 128);
+    const allowReconnect = obj.AllowReconnect !== false;
+    const isRealTime = obj.IsRealTime === true;
+    return { hostId, localId, ackPeriod, ackAdvance, allowReconnect, isRealTime };
+  }
+  return null;
+}
+var RpcStream = class _RpcStream {
+  /**
+   * Grace period (ms) given to a factory-form local source to honor its
+   * AbortSignal and exit naturally before the sender force-closes the
+   * iterator via `iterator.return()`.
+   *
+   * Only applies to sources provided as `(abortSignal) => AsyncIterable<T>`.
+   * Plain `AsyncIterable<T>` sources are force-closed immediately on disconnect.
+   */
+  static disconnectGracePeriodMs = 100;
+  id;
+  kind;
+  allowReconnect;
+  isRealTime;
+  canSkipTo;
+  ackPeriod;
+  ackAdvance;
+  /**
+   * Local-only ring buffer capacity hint for the sender. Undefined means
+   * "use ackAdvance as the buffer size". Not part of the wire ref.
+   */
+  bufferSize;
+  // Local (origin) mode
+  localSource;
+  // Remote (target) mode
+  peer;
+  // Local-only state
+  _sender;
+  _toRefValue;
+  _whenSent;
+  // Remote-only state
+  _buffer = new Denque();
+  _nextExpectedIndex = 0;
+  _consumerWaiting = null;
+  _completed = false;
+  _completionError = null;
+  _disposed = false;
+  _started = false;
+  _iterating = false;
+  _ackSentUpTo = 0;
+  _nextConsumedIndex = 0;
+  constructor(sourceOrRef, optionsOrPeer) {
+    if (_isStreamSource(sourceOrRef)) {
+      const options = optionsOrPeer ?? {};
+      this.kind = RpcObjectKind.Local;
+      this.localSource = sourceOrRef;
+      this.id = { hostId: "", localId: 0 };
+      this.allowReconnect = options.allowReconnect ?? true;
+      this.isRealTime = options.isRealTime ?? false;
+      this.canSkipTo = options.canSkipTo ?? (() => true);
+      this.ackPeriod = options.ackPeriod ?? DEFAULT_ACK_PERIOD2;
+      this.ackAdvance = options.ackAdvance ?? DEFAULT_ACK_ADVANCE2;
+      this.bufferSize = options.bufferSize;
+    } else {
+      const ref = sourceOrRef;
+      const peer = optionsOrPeer;
+      this.kind = RpcObjectKind.Remote;
+      this.id = { hostId: ref.hostId, localId: ref.localId };
+      this.peer = peer;
+      this.allowReconnect = ref.allowReconnect;
+      this.isRealTime = ref.isRealTime;
+      this.canSkipTo = () => true;
+      this.ackPeriod = ref.ackPeriod;
+      this.ackAdvance = ref.ackAdvance;
     }
   }
   /**
-   * Server-side handler for the `$sys.Reconnect` call. Parses the peer's
-   * report of in-flight call IDs (grouped by stage, IncreasingSeqCompressor-
-   * encoded, base64-wrapped for JSON transport), computes the subset this
-   * peer does not recognize, and replies with a compressed byte[] of the
-   * unknown IDs wrapped in `$sys.Ok`.
+   * For local streams: resolves when the sender finishes pumping (after `toRef()` was called).
+   * Rejects if the source throws. Throws if `toRef()` hasn't been called yet.
+   */
+  get whenSent() {
+    if (!this._whenSent)
+      throw new Error("toRef() must be called before awaiting whenSent.");
+    return this._whenSent;
+  }
+  /** Local sender backing this stream after `toRef()` has been called.
+   *  `undefined` for remote streams or before `toRef()`. */
+  get sender() {
+    return this._sender;
+  }
+  /**
+   * For local streams: bind to a peer, create and register an `RpcStreamSender`,
+   * start pumping items from the local source in the background, and return the
+   * stream reference.
    *
-   * @param relatedId The outbound call ID the client used for this
-   *                  `$sys.Reconnect` invocation — we send `$sys.Ok` back
-   *                  with the same `RelatedId`.
+   * For binary peers the ref is a MessagePack-compatible object
+   * (`{ SerializedId, AckPeriod, AckAdvance, AllowReconnect }`);
+   * for text peers it is a comma-separated string.
+   *
+   * Can only be called once per stream.
    */
-  _handleReconnect(relatedId, args, peer) {
-    if (peer.connection === void 0) return;
-    const handshakeIndex = args[0];
-    if (typeof handshakeIndex === "number" && handshakeIndex !== peer.ownHandshakeIndex) {
-      peer.hub.systemCallSender.error(
-        peer.connection,
-        peer.serializationFormat,
-        relatedId,
-        new Error(
-          `TooLateToReconnect: own handshake index ${peer.ownHandshakeIndex} != ${handshakeIndex}`
-        )
-      );
+  toRef(peer) {
+    if (this.kind !== RpcObjectKind.Local)
+      throw new Error("toRef() is only valid for local streams.");
+    if (this._sender) {
+      if (this._sender.peer !== peer)
+        throw new Error("toRef() was already called with a different peer.");
+      return this._toRefValue;
+    }
+    const isFactory = typeof this.localSource === "function";
+    const sender = new RpcStreamSender(
+      peer,
+      this.ackPeriod,
+      this.ackAdvance,
+      this.allowReconnect,
+      this.isRealTime,
+      this.canSkipTo,
+      isFactory,
+      this.bufferSize
+    );
+    peer.sharedObjects.register(sender);
+    this._sender = sender;
+    const source = isFactory ? this.localSource(sender.abortSignal) : this.localSource;
+    this._whenSent = sender.writeFrom(source);
+    this._toRefValue = peer.serializationFormat.isBinary ? {
+      SerializedId: [sender.id.hostId, sender.id.localId],
+      AckPeriod: sender.ackPeriod,
+      AckAdvance: sender.ackAdvance,
+      AllowReconnect: sender.allowReconnect
+    } : sender.toRef();
+    return this._toRefValue;
+  }
+  /** Called by system call handler when a single item arrives ($sys.I). */
+  onItem(index, item) {
+    if (this._disposed || this._completed) return;
+    if (!_isValidIndex(index)) {
+      this._failProtocol(`invalid $sys.I index: ${String(index)}`);
       return;
     }
-    let unknownIds = [];
-    try {
-      const stagesRaw = args[1];
-      if (stagesRaw && typeof stagesRaw === "object" && !Array.isArray(stagesRaw)) {
-        const unknownSet = /* @__PURE__ */ new Set();
-        for (const [stageKey, rawValue] of Object.entries(stagesRaw)) {
-          const bytes = _toBytes(rawValue);
-          if (bytes === null) continue;
-          const completedStage = parseInt(stageKey, 10) || 0;
-          const callIds = IncreasingSeqCompressor.deserialize(bytes);
-          for (const callId of callIds) {
-            const call = peer.inboundCalls.get(callId);
-            if (call === void 0)
-              unknownSet.add(callId);
-            else if (completedStage < 1)
-              call.resendResult();
-          }
-        }
-        unknownIds = [...unknownSet].sort((a, b) => a - b);
+    if (index > this._nextExpectedIndex) {
+      warnLog6?.log(`item index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
+      if (!this.allowReconnect) {
+        this._complete(this._gapError(index));
+        return;
       }
-    } catch {
+      this._sendAck(this._nextExpectedIndex, true);
+      return;
     }
-    const responseBytes = IncreasingSeqCompressor.serialize(unknownIds);
-    const responseValue = peer.serializationFormat.isBinary ? responseBytes : base64Encode(responseBytes);
-    peer.hub.systemCallSender.ok(peer.connection, peer.serializationFormat, relatedId, responseValue);
+    if (index < this._nextExpectedIndex) {
+      this._maybeSendAck(Math.min(index + 1, this._nextConsumedIndex));
+      return;
+    }
+    if (this._isBeyondAckWindow(index + 1)) {
+      this._failProtocol(this._ackWindowError(index + 1));
+      return;
+    }
+    this._buffer.push(item);
+    this._nextExpectedIndex = index + 1;
+    this._notifyConsumer();
   }
-};
-function polymorphicPayloadError(method, got, expected) {
-  return new Error(
-    `${method}: expected ${expected} value(s), got ${got} \u2014 polymorphic payloads are not supported by the TS client`
-  );
-}
-function extractTypeName(typeRef) {
-  if (typeof typeRef === "string") {
-    if (typeRef.length === 0)
-      return void 0;
-    const commaIdx = typeRef.indexOf(",");
-    return commaIdx >= 0 ? typeRef.slice(0, commaIdx) : typeRef;
+  /** Called by system call handler when a batch arrives ($sys.B). */
+  onBatch(index, items) {
+    if (this._disposed || this._completed) return;
+    if (!_isValidIndex(index) || !_isValidIndex(items.length)) {
+      this._failProtocol(`invalid $sys.B index/length: ${String(index)}/${String(items.length)}`);
+      return;
+    }
+    if (index > this._nextExpectedIndex) {
+      warnLog6?.log(`batch index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
+      if (!this.allowReconnect) {
+        this._complete(this._gapError(index));
+        return;
+      }
+      this._sendAck(this._nextExpectedIndex, true);
+      return;
+    }
+    if (index < this._nextExpectedIndex) {
+      this._maybeSendAck(Math.min(index + items.length, this._nextConsumedIndex));
+      return;
+    }
+    if (this._isBeyondAckWindow(index + items.length)) {
+      this._failProtocol(this._ackWindowError(index + items.length));
+      return;
+    }
+    for (const item of items) this._buffer.push(item);
+    this._nextExpectedIndex = index + items.length;
+    this._notifyConsumer();
   }
-  if (typeRef !== null && typeof typeRef === "object") {
-    const t = typeRef;
-    const aqn = t.AssemblyQualifiedName ?? t.assemblyQualifiedName;
-    if (typeof aqn === "string" && aqn.length > 0) {
-      const commaIdx = aqn.indexOf(",");
-      return commaIdx >= 0 ? aqn.slice(0, commaIdx) : aqn;
+  /** Called by system call handler when the stream ends ($sys.End). */
+  onEnd(index, error) {
+    if (this._disposed || this._completed) return;
+    if (!_isValidIndex(index)) {
+      this._failProtocol(`invalid $sys.End index: ${String(index)}`);
+      return;
     }
-    return t.TypeName ?? t.typeName;
+    if (index > this._nextExpectedIndex) {
+      warnLog6?.log(`end index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
+      if (!this.allowReconnect) {
+        this._complete(this._gapError(index));
+        return;
+      }
+      this._sendAck(this._nextExpectedIndex, true);
+      return;
+    }
+    if (index < this._nextExpectedIndex) {
+      this._maybeSendAck(Math.min(index, this._nextConsumedIndex));
+      return;
+    }
+    this._complete(error);
   }
-  return void 0;
-}
-function _toBytes(value) {
-  if (value instanceof Uint8Array) return value;
-  if (typeof value === "string") {
-    try {
-      return base64Decode(value);
-    } catch {
-      return null;
+  // -- IRpcObject --
+  reconnect() {
+    if (this.kind === RpcObjectKind.Local) return;
+    if (this.allowReconnect) {
+      this._sendAck(this._nextExpectedIndex, true);
+    } else {
+      this.disconnect();
     }
   }
-  return null;
-}
-
-// src/rpc-system-call-sender.ts
-var { errorLog } = getLogs("RpcSystemCallSender");
-var RpcSystemCallSender = class _RpcSystemCallSender {
-  // Reusable envelopes — one per hot-path method.
-  _itemEnv = {
-    Method: RpcSystemCalls.item,
-    RelatedId: 0
-  };
-  _batchEnv = {
-    Method: RpcSystemCalls.batch,
-    RelatedId: 0
-  };
-  _endEnv = {
-    Method: RpcSystemCalls.end,
-    RelatedId: 0
-  };
-  _ackEnv = {
-    Method: RpcSystemCalls.ack,
-    RelatedId: 0
-  };
-  _ackEndEnv = {
-    Method: RpcSystemCalls.ackEnd,
-    RelatedId: 0
-  };
-  // Reusable arg arrays.
-  _itemArgs = [0, null];
-  _batchArgs = [0, null];
-  _endArgs = [0, { TypeRef: "", Message: "" }];
-  _ackArgs = [0, ""];
-  _ackEndArgs = [""];
-  static NO_ERROR = Object.freeze({ TypeRef: "", Message: "" });
-  registry;
-  _send(conn, format, envelope, args) {
-    const wireData = format.serializeMessage(
-      envelope,
-      args,
-      conn.encoder,
-      this.registry
-    );
-    if (typeof wireData === "string") {
-      conn.send(wireData);
-    } else {
-      conn.sendBinary(wireData);
+  disconnect() {
+    if (this.kind === RpcObjectKind.Local) {
+      this._sender?.disconnect();
+      return;
     }
+    if (this._completed) return;
+    this._completed = true;
+    this._completionError = new Error("Peer disconnected.");
+    this._notifyConsumer();
   }
-  handshake(conn, format, peerId, hubId, index) {
-    const handshakeArg = format.isBinary ? [peerId, null, hubId, 2, index] : {
-      RemotePeerId: peerId,
-      RemoteApiVersionSet: null,
-      RemoteHubId: hubId,
-      ProtocolVersion: 2,
-      Index: index
+  // -- AsyncIterable --
+  [Symbol.asyncIterator]() {
+    if (this.kind === RpcObjectKind.Local) {
+      const source = typeof this.localSource === "function" ? this.localSource(new AbortController().signal) : this.localSource;
+      return source[Symbol.asyncIterator]();
+    }
+    if (this._iterating)
+      throw new Error("RpcStream can only be iterated once.");
+    this._iterating = true;
+    return {
+      next: async () => {
+        if (!this._started) {
+          this._started = true;
+          this.peer.remoteObjects.register(this);
+          this._sendAck(0, true);
+        }
+        this._maybeSendAck(this._nextConsumedIndex);
+        for (; ; ) {
+          if (!this._buffer.isEmpty()) {
+            const value = this._buffer.shift();
+            this._nextConsumedIndex++;
+            return { value, done: false };
+          }
+          if (this._completed) {
+            this.dispose();
+            if (this._completionError) throw this._completionError;
+            return { value: void 0, done: true };
+          }
+          this._consumerWaiting = new PromiseSource4();
+          await this._consumerWaiting;
+        }
+      },
+      return: () => {
+        if (this._started && !this._completed)
+          this._sendAckEnd();
+        this.dispose();
+        return Promise.resolve({ value: void 0, done: true });
+      }
     };
-    this._send(conn, format, { Method: RpcSystemCalls.handshake }, [
-      handshakeArg
-    ]);
   }
-  ok(conn, format, relatedId, result) {
-    try {
-      this._send(
-        conn,
-        format,
-        { Method: RpcSystemCalls.ok, RelatedId: relatedId },
-        [result]
-      );
-    } catch (e) {
-      errorLog?.log(`Failed to send Ok response for call #${relatedId}`, e);
-      this.error(conn, format, relatedId, e);
+  dispose() {
+    if (this._disposed) return;
+    this._disposed = true;
+    this._completed = true;
+    if (this.kind === RpcObjectKind.Remote) {
+      this.peer.remoteObjects.unregister(this);
     }
+    this._notifyConsumer();
   }
-  error(conn, format, relatedId, error) {
-    this._send(
-      conn,
-      format,
-      { Method: RpcSystemCalls.error, RelatedId: relatedId },
-      [toExceptionInfo(error)]
-    );
+  // -- Private --
+  // Mirrors .NET RpcStream.CloseFromLock: acknowledge the end to the sender
+  // (so its RpcSharedStream is released) and unregister immediately.
+  _complete(error) {
+    if (this._completed) return;
+    this._completed = true;
+    this._completionError = error;
+    this._sendAckEnd();
+    if (this.kind === RpcObjectKind.Remote)
+      this.peer.remoteObjects.unregister(this);
+    this._notifyConsumer();
   }
-  cancel(conn, format, relatedId) {
-    this._send(conn, format, {
-      Method: RpcSystemCalls.cancel,
-      RelatedId: relatedId
-    });
+  // Terminates the stream the way the non-reconnectable gap path does: the
+  // consumer sees the error and the sender gets $sys.AckEnd, so nothing is
+  // left pumping into a stream we no longer read.
+  _failProtocol(message) {
+    warnLog6?.log(`localId=${this.id.localId}: ${message}`);
+    this._complete(new Error(message));
   }
-  keepAlive(conn, format, activeCallIds) {
-    this._send(conn, format, { Method: RpcSystemCalls.keepAlive }, [
-      activeCallIds
-    ]);
+  // The remote advertised `ackAdvance` as the furthest it may run ahead of our
+  // last acknowledged index. The sending side is the only place that window
+  // was ever enforced, which left a flooding remote free to grow our buffer
+  // without bound (I6) — so we enforce our half of the contract here.
+  _isBeyondAckWindow(nextExpectedIndex) {
+    return this.ackAdvance > 0 && nextExpectedIndex > this._ackSentUpTo + this.ackAdvance;
   }
-  // Tells the remote peer the listed shared-object ids are gone on our side,
-  // so its matching remote objects (e.g. RpcStream consumers) fail fast
-  // instead of hanging. Mirrors .NET RpcSystemCallSender.Disconnect.
-  disconnect(conn, format, localIds) {
-    this._send(conn, format, { Method: RpcSystemCalls.disconnect }, [
-      localIds
-    ]);
+  _ackWindowError(nextExpectedIndex) {
+    return `Stream ran past its ack window: reached ${nextExpectedIndex}, acked ${this._ackSentUpTo}, ackAdvance ${this.ackAdvance}`;
   }
-  item(conn, format, localId, index, item) {
-    this._itemEnv.RelatedId = localId;
-    this._itemArgs[0] = index;
-    this._itemArgs[1] = item;
-    this._send(conn, format, this._itemEnv, this._itemArgs);
-    this._itemArgs[1] = null;
+  _gapError(index) {
+    return new Error(
+      `Stream gap at index ${index} (expected ${this._nextExpectedIndex}); reconnect not allowed`
+    );
   }
-  batch(conn, format, localId, index, items) {
-    this._batchEnv.RelatedId = localId;
-    this._batchArgs[0] = index;
-    this._batchArgs[1] = items;
-    this._send(conn, format, this._batchEnv, this._batchArgs);
-    this._batchArgs[1] = null;
+  _notifyConsumer() {
+    if (this._consumerWaiting !== null) {
+      this._consumerWaiting.resolve();
+      this._consumerWaiting = null;
+    }
   }
-  end(conn, format, localId, index, error = _RpcSystemCallSender.NO_ERROR) {
-    this._endEnv.RelatedId = localId;
-    this._endArgs[0] = index;
-    this._endArgs[1] = error;
-    this._send(conn, format, this._endEnv, this._endArgs);
+  _maybeSendAck(nextIndex) {
+    if (this.ackPeriod <= 0) return;
+    const threshold = this._ackSentUpTo + this.ackPeriod;
+    if (nextIndex >= threshold) {
+      this._sendAck(nextIndex, false);
+    }
   }
-  ack(conn, format, localId, nextIndex, hostId) {
-    this._ackEnv.RelatedId = localId;
-    this._ackArgs[0] = nextIndex;
-    this._ackArgs[1] = hostId;
-    this._send(conn, format, this._ackEnv, this._ackArgs);
+  static _emptyGuid = "00000000-0000-0000-0000-000000000000";
+  _sendAck(nextIndex, mustReset) {
+    this._ackSentUpTo = nextIndex;
+    const conn = this.peer.isConnected ? this.peer.connection : void 0;
+    if (conn) {
+      const hostId = mustReset ? this.id.hostId : _RpcStream._emptyGuid;
+      this.peer.hub.systemCallSender.ack(
+        conn,
+        this.peer.serializationFormat,
+        this.id.localId,
+        nextIndex,
+        hostId
+      );
+    }
   }
-  ackEnd(conn, format, localId, hostId) {
-    this._ackEndEnv.RelatedId = localId;
-    this._ackEndArgs[0] = hostId;
-    this._send(conn, format, this._ackEndEnv, this._ackEndArgs);
+  _sendAckEnd() {
+    const conn = this.peer.isConnected ? this.peer.connection : void 0;
+    if (conn) {
+      this.peer.hub.systemCallSender.ackEnd(
+        conn,
+        this.peer.serializationFormat,
+        this.id.localId,
+        this.id.hostId
+      );
+    }
   }
 };
+function _isValidIndex(index) {
+  return Number.isSafeInteger(index) && index >= 0;
+}
+function _isStreamSource(value) {
+  if (typeof value === "function") return true;
+  return value !== null && typeof value === "object" && Symbol.asyncIterator in value;
+}
+function toRpcStream(value, peer) {
+  const ref = parseStreamRef(value);
+  if (ref === null)
+    return null;
+  return new RpcStream(ref, peer);
+}
 
 // src/rpc-remote-object-tracker.ts
 var RpcRemoteObjectTracker = class {
@@ -2451,33 +2528,68 @@ function isMemoryPackKey(key) {
   return key.startsWith("mempack");
 }
 
+// src/reconnect-proof.ts
+var textEncoder2 = new TextEncoder();
+function isReconnectProofSupported() {
+  return typeof crypto !== "undefined" && crypto.subtle !== void 0;
+}
+async function computeReconnectProof(secret, clientId, counterText) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    textEncoder2.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    textEncoder2.encode(`${clientId}
+${counterText}`)
+  );
+  return base64UrlEncode(new Uint8Array(signature));
+}
+
 // src/rpc-peer.ts
 function yieldToEventLoop() {
   return new Promise((resolve) => setTimeout(resolve, 0));
 }
 var RPC_CLOSE_CODE_UNSUPPORTED_FORMAT = 4001;
-var { debugLog: debugLog2, infoLog, warnLog: warnLog6, errorLog: errorLog2 } = getLogs("RpcPeer");
-var defaultConnectionUrlResolver = (peer) => {
+var { debugLog: debugLog2, infoLog, warnLog: warnLog7, errorLog: errorLog2 } = getLogs("RpcPeer");
+var defaultConnectionUrlResolver = async (peer) => {
   const formatKey = peer.serializationFormat.key;
+  const proof = await peer.computeReconnectProof();
   try {
     const url = new URL(peer.ref);
     url.searchParams.set("clientId", peer.clientId);
     url.searchParams.set("f", formatKey);
+    if (proof !== void 0) {
+      url.searchParams.set("c", proof.counter);
+      url.searchParams.set("p", proof.proof);
+    }
     return url.toString();
   } catch {
     const sep = peer.ref.includes("?") ? "&" : "?";
-    return peer.ref + sep + `clientId=${peer.clientId}&f=${formatKey}`;
+    let url = peer.ref + sep + `clientId=${peer.clientId}&f=${formatKey}`;
+    if (proof !== void 0)
+      url += `&c=${proof.counter}&p=${proof.proof}`;
+    return url;
   }
 };
+var RedactedParameterNames = ["session", "clientId", "p"];
 var sanitizeUrl = (url) => {
   try {
     const parsed = new URL(url);
-    if (!parsed.searchParams.has("session"))
-      return url;
-    parsed.searchParams.set("session", "<redacted>");
-    return parsed.toString();
+    let isRedacted = false;
+    for (const name of RedactedParameterNames) {
+      if (!parsed.searchParams.has(name))
+        continue;
+      parsed.searchParams.set(name, "<redacted>");
+      isRedacted = true;
+    }
+    return isRedacted ? parsed.toString() : url;
   } catch {
-    return url.replace(/([?&]session=)[^&]*/i, "$1<redacted>");
+    return url.replace(/([?&](?:session|clientId|p)=)[^&]*/gi, "$1<redacted>");
   }
 };
 function parseFormatFromUrl(url) {
@@ -2726,21 +2838,26 @@ var RpcPeer = class {
   /** Override in subclasses to handle the remote peer's handshake response. */
   _onHandshakeReceived(_handshake) {
   }
+  // The try covers dispatch too, not just deserialization: a handler that throws
+  // here would otherwise escape into the transport's onmessage - dropping every
+  // remaining message of the frame, or killing a Node process outright.
   _handleMessage(received) {
-    let message;
-    let args;
     try {
-      if (received.kind === "binary") {
-        message = received.message;
-        args = received.args;
-      } else {
-        const parsed = deserializeMessage(received.raw);
-        message = parsed.message;
-        args = parsed.args;
-      }
+      this._processMessage(received);
     } catch (e) {
       errorLog2?.log(`'${this.ref}': Failed to process inbound message:`, received, e);
-      return;
+    }
+  }
+  _processMessage(received) {
+    let message;
+    let args;
+    if (received.kind === "binary") {
+      message = received.message;
+      args = received.args;
+    } else {
+      const parsed = deserializeMessage(received.raw);
+      message = parsed.message;
+      args = parsed.args;
     }
     const method = message.Method ?? "";
     debugLog2?.log(`'${this.ref}': <- ${method}#${message.RelatedId ?? 0}`);
@@ -2752,12 +2869,14 @@ var RpcPeer = class {
           RemotePeerId: raw[0],
           RemoteHubId: raw[2],
           ProtocolVersion: raw[3],
-          Index: raw[4]
+          Index: raw[4],
+          Secret: raw[5]
         } : {
           RemotePeerId: obj.RemotePeerId ?? obj.remotePeerId,
           RemoteHubId: obj.RemoteHubId ?? obj.remoteHubId,
           ProtocolVersion: obj.ProtocolVersion ?? obj.protocolVersion,
-          Index: obj.Index ?? obj.index
+          Index: obj.Index ?? obj.index,
+          Secret: obj.Secret ?? obj.secret
         };
         this._onHandshakeReceived(handshake);
       }
@@ -2871,7 +2990,7 @@ var RpcPeer = class {
     this._keepAliveWatchdog = setTimeout(() => {
       this._keepAliveWatchdog = void 0;
       if (this._connection === void 0) return;
-      warnLog6?.log(
+      warnLog7?.log(
         `'${this.ref}': no keep-alive for ${this.keepAliveTimeoutMs}ms \u2014 force-closing connection`
       );
       this._connection.close();
@@ -2919,6 +3038,16 @@ var RpcClientPeer = class extends RpcPeer {
   _lastRemotePeerId;
   _pendingHandshake;
   _reconnectsAt = 0;
+  /** Server-issued reconnect secret, from the most recent handshake that
+   *  carried one. In-memory only — never localStorage/sessionStorage/cookie.
+   *  A tab reload mints a new `clientId`, so a persisted secret would be
+   *  useless anyway. */
+  _reconnectSecret;
+  /** Incremented once per *connect attempt*, in `computeReconnectProof()`. A
+   *  failed attempt still burns its value: the server may have advanced its
+   *  own counter at the gate before the connection died, and reusing the
+   *  value would then be rejected forever. */
+  _reconnectCounter = 0;
   /** Base64url-encoded peer ID — matches .NET's RpcClientPeer.ClientId (Guid.ToBase64Url). */
   clientId;
   /** Builds the WebSocket URL for this peer. Replace to customize URL construction. */
@@ -2999,6 +3128,28 @@ var RpcClientPeer = class extends RpcPeer {
   start() {
     void this.run();
   }
+  /** Builds the `c` / `p` connect-URL parameters proving possession of the
+   *  server-issued reconnect secret, or `undefined` when there is no secret
+   *  yet or WebCrypto is unavailable. Consumes one counter value per proof
+   *  produced, so call it exactly once per connect attempt. */
+  async computeReconnectProof() {
+    const secret = this._reconnectSecret;
+    if (secret === void 0)
+      return void 0;
+    if (!isReconnectProofSupported()) {
+      warnReconnectProofUnavailable(this.ref, "crypto.subtle is unavailable (insecure context?)");
+      return void 0;
+    }
+    const counter = (this._reconnectCounter + 1).toString();
+    try {
+      const proof = await computeReconnectProof(secret, this.clientId, counter);
+      this._reconnectCounter++;
+      return { counter, proof };
+    } catch (e) {
+      warnReconnectProofUnavailable(this.ref, `HMAC-SHA256 failed: ${String(e)}`);
+      return void 0;
+    }
+  }
   /** The reconnect loop itself. Exposed as `protected` so subclasses (and
    *  `start()`) can drive it; public callers should use {@link start}. */
   run() {
@@ -3012,7 +3163,7 @@ var RpcClientPeer = class extends RpcPeer {
         this._setConnectionState(1 /* Connecting */);
         const retryDelay = this.hub.reconnectDelayer.getDelay(this._tryIndex, this._stopController.signal);
         if (retryDelay.isLimitExceeded) {
-          warnLog6?.log(`'${this.ref}': Reconnect limit exceeded - shutting down`);
+          warnLog7?.log(`'${this.ref}': Reconnect limit exceeded - shutting down`);
           this._disposed = true;
           break;
         }
@@ -3061,7 +3212,7 @@ var RpcClientPeer = class extends RpcPeer {
             );
           } catch (e) {
             if (e instanceof TimeoutError) {
-              warnLog6?.log(`'${this.ref}': Connect timed out after ${connectTimeoutMs}ms`);
+              warnLog7?.log(`'${this.ref}': Connect timed out after ${connectTimeoutMs}ms`);
               conn.close();
             }
             throw e;
@@ -3076,7 +3227,7 @@ var RpcClientPeer = class extends RpcPeer {
               ++this._ownHandshakeIndex
             );
           } catch (e) {
-            warnLog6?.log(`'${this.ref}': Failed to send handshake`, e);
+            warnLog7?.log(`'${this.ref}': Failed to send handshake`, e);
             throw e;
           }
           const handshakeTimeoutMs = this.handshakeTimeoutMs;
@@ -3089,7 +3240,7 @@ var RpcClientPeer = class extends RpcPeer {
             );
           } catch (e) {
             if (e instanceof TimeoutError) {
-              warnLog6?.log(`'${this.ref}': Handshake timed out after ${handshakeTimeoutMs}ms`);
+              warnLog7?.log(`'${this.ref}': Handshake timed out after ${handshakeTimeoutMs}ms`);
               conn.close();
             }
             throw e;
@@ -3097,6 +3248,8 @@ var RpcClientPeer = class extends RpcPeer {
             this._pendingHandshake = void 0;
           }
           this._remoteHandshakeIndex = remoteHandshake.Index ?? 0;
+          if (remoteHandshake.Secret)
+            this._reconnectSecret = remoteHandshake.Secret;
           const isPeerChanged = this._detectPeerChange(remoteHandshake);
           infoLog?.log(`'${this.ref}': Handshake succeeded, peerChanged=${isPeerChanged}`);
           this._setConnectionState(3 /* Connected */);
@@ -3109,7 +3262,7 @@ var RpcClientPeer = class extends RpcPeer {
         this._setConnectionState(0 /* Disconnected */);
         if (this._disposed) break;
         if (lastCloseCode === RPC_CLOSE_CODE_UNSUPPORTED_FORMAT) {
-          warnLog6?.log(`'${this.ref}': Unsupported serialization format - shutting down`);
+          warnLog7?.log(`'${this.ref}': Unsupported serialization format - shutting down`);
           this.unsupportedFormat.trigger({ reason: lastCloseReason });
           this._disposed = true;
           break;
@@ -3355,8 +3508,16 @@ function guidToBase64Url(uuid) {
   bytes[7] = parseInt(hex.slice(12, 14), 16);
   for (let i = 8; i < 16; i++)
     bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  const binary = String.fromCharCode(...bytes);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return base64UrlEncode(bytes);
+}
+var isReconnectProofUnavailableWarned = false;
+function warnReconnectProofUnavailable(ref, reason) {
+  if (isReconnectProofUnavailableWarned)
+    return;
+  isReconnectProofUnavailableWarned = true;
+  warnLog7?.log(
+    `'${ref}': ${reason} - connecting without a reconnect proof. This fails if the server requires one (RequireReconnectProof).`
+  );
 }
 function _toBytes2(value) {
   if (value instanceof Uint8Array) return value;
@@ -3435,7 +3596,7 @@ var RpcClientPeerReconnectDelayer = class extends RetryDelayer {
 };
 
 // src/rpc-service-host.ts
-var { warnLog: warnLog7 } = getLogs("RpcServiceHost");
+var { warnLog: warnLog8 } = getLogs("RpcServiceHost");
 var RpcServiceHost = class {
   _methods = /* @__PURE__ */ new Map();
   register(def, impl, receiver = impl) {
@@ -3452,7 +3613,7 @@ var RpcServiceHost = class {
   async dispatch(wireMethod, args, context) {
     const entry = this._methods.get(wireMethod);
     if (entry === void 0) {
-      warnLog7?.log(`Method not found: ${wireMethod}`);
+      warnLog8?.log(`Method not found: ${wireMethod}`);
       throw new Error(`Method not found: ${wireMethod}`);
     }
     if (context !== void 0 && entry.def.callTypeId !== 0) {
@@ -3960,7 +4121,7 @@ function hashLongWithSeed(input, length, seed) {
   }
   return hashLong(input, length, secret, secret.length);
 }
-var textEncoder2 = new TextEncoder();
+var textEncoder3 = new TextEncoder();
 function xxh3_64(input, seed = 0n) {
   const len = input.length;
   if (len <= XXH3_MIDSIZE_MAX) {
@@ -3969,10 +4130,10 @@ function xxh3_64(input, seed = 0n) {
   return hashLongWithSeed(input, len, u64(seed));
 }
 function xxh3_64str(input, seed = 0n) {
-  return xxh3_64(textEncoder2.encode(input), seed);
+  return xxh3_64(textEncoder3.encode(input), seed);
 }
 function computeMethodHash(methodName) {
-  const utf8 = textEncoder2.encode(methodName);
+  const utf8 = textEncoder3.encode(methodName);
   const prefixValue = Math.imul(67211, utf8.length) >>> 0;
   const prefixed = new Uint8Array(4 + utf8.length);
   prefixed[0] = prefixValue & 255;
@@ -3985,7 +4146,7 @@ function computeMethodHash(methodName) {
 }
 
 // src/rpc-method-registry.ts
-var { warnLog: warnLog8 } = getLogs("RpcMethodRegistry");
+var { warnLog: warnLog9 } = getLogs("RpcMethodRegistry");
 var RpcMethodRegistry = class {
   _nameToHash = /* @__PURE__ */ new Map();
   _hashToName = /* @__PURE__ */ new Map();
@@ -3995,7 +4156,7 @@ var RpcMethodRegistry = class {
     const hash = computeMethodHash(methodName);
     const existing = this._hashToName.get(hash);
     if (existing !== void 0 && existing !== methodName) {
-      warnLog8?.log(`hash collision: "${methodName}" and "${existing}" both hash to ${hash}`);
+      warnLog9?.log(`hash collision: "${methodName}" and "${existing}" both hash to ${hash}`);
       return;
     }
     this._nameToHash.set(methodName, hash);
@@ -4028,7 +4189,7 @@ var RpcMethodRegistry = class {
 };
 
 // src/rpc-hub.ts
-var { warnLog: warnLog9 } = getLogs("RpcHub");
+var { warnLog: warnLog10 } = getLogs("RpcHub");
 var RpcHub = class {
   hubId;
   peers = /* @__PURE__ */ new Map();
@@ -4093,7 +4254,7 @@ var RpcHub = class {
     if (peer !== void 0) {
       peer.close();
       this.peers.delete(ref);
-      warnLog9?.log(`'${ref}': peer is removed from RpcHub`);
+      warnLog10?.log(`'${ref}': peer is removed from RpcHub`);
     }
   }
   /** Get or create a peer by ref. If the peer does not exist:
@@ -4211,12 +4372,12 @@ var RpcHub = class {
         const callArgs = args.slice(0, methodDef.argCount);
         const outboundCall = peer.call(wireName, callArgs);
         const result = await outboundCall.result;
-        const ref = parseStreamRef(result);
-        if (!ref)
+        const stream = toRpcStream(result, peer);
+        if (!stream)
           throw new Error(
             `Expected stream reference, got: ${JSON.stringify(result)}`
           );
-        return new RpcStream(ref, peer);
+        return stream;
       };
     }
     const callOptions = methodDef.callTypeId !== 0 || mode !== RpcRemoteExecutionMode.Default || methodDef.timeouts !== void 0 ? { callTypeId: methodDef.callTypeId, remoteExecutionMode: mode, timeouts: methodDef.timeouts } : void 0;
@@ -4225,8 +4386,7 @@ var RpcHub = class {
         throw new Error("Outbound call failed: not connected and AwaitForConnection is not set.");
       const callArgs = args.slice(0, methodDef.argCount);
       const outboundCall = peer.call(wireName, callArgs, callOptions);
-      const result = await outboundCall.result;
-      return resolveStreamRefs(result, peer);
+      return await outboundCall.result;
     };
   }
   // Private methods
@@ -4583,6 +4743,7 @@ export {
   RpcWebSocketConnection,
   WebSocketState,
   computeMethodHash,
+  computeReconnectProof,
   createBinaryEncoder,
   createMessageChannelPair,
   createRpcClient,
@@ -4593,15 +4754,16 @@ export {
   deserializeBinaryMessage,
   deserializeCompactBinaryMessage,
   deserializeMessage,
+  genericErrorFilter,
   getLogs,
   getMethodsMeta,
   getServiceMeta,
   getStateDescription,
   isConnected,
+  isReconnectProofSupported,
   likelyConnected,
   parseStreamRef,
   readPolymorphismMarker,
-  resolveStreamRefs,
   rpcMethod,
   rpcService,
   serializeBinaryFrame,
@@ -4613,6 +4775,7 @@ export {
   splitCompactBinaryFrame,
   splitFrame,
   toExceptionInfo,
+  toRpcStream,
   wireMethodName,
   xxh3_64,
   xxh3_64str