@alpic-ai/sdk 0.0.0-dev.ge2abcc8 → 0.0.0-dev.ge4c0895

package/dist/auth/index.d.ts

@@ -1,7 +1,15 @@
 import { type LoginOptions } from "./login.js";
 import { type Credentials } from "./store.js";
 export type { Credentials, LoginOptions };
+export type AuthEvents = {
+    authenticated: {
+        sub: string;
+    };
+};
 export declare class AlpicAuth {
+    private readonly events;
+    on<K extends keyof AuthEvents>(event: K, listener: (payload: AuthEvents[K]) => void): void;
+    off<K extends keyof AuthEvents>(event: K, listener: (payload: AuthEvents[K]) => void): void;
     getValidAccessToken(): Promise<Credentials | null>;
     isAuthenticated(): Promise<boolean>;
     getToken(): Promise<string | undefined>;

package/dist/auth/index.js

@@ -1,7 +1,15 @@
+import { TypedEventEmitter } from "../lib/emitter.js";
 import { oauthLogin } from "./login.js";
 import { getOAuthClient } from "./oauth-client.js";
 import { globalStore } from "./store.js";
 export class AlpicAuth {
+    events = new TypedEventEmitter();
+    on(event, listener) {
+        this.events.on(event, listener);
+    }
+    off(event, listener) {
+        this.events.off(event, listener);
+    }
     async getValidAccessToken() {
         return getOAuthClient().getValidAccessToken();
     }
@@ -12,7 +20,9 @@ export class AlpicAuth {
         return process.env.ALPIC_API_KEY ?? (await getOAuthClient().getValidAccessToken())?.access_token;
     }
     async login(opts) {
-        return oauthLogin(opts);
+        const result = await oauthLogin(opts);
+        this.events.emit("authenticated", { sub: result.sub });
+        return result;
     }
     async logout() {
         globalStore.clearCredentials();

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAoB,WAAW,EAAE,MAAM,YAAY,CAAC;AAI3D,MAAM,OAAO,SAAS;IACpB,KAAK,CAAC,mBAAmB;QACvB,OAAO,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,SAAS,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,YAAY,CAAC;IACnG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,WAAW,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAoB,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ3D,MAAM,OAAO,SAAS;IACH,MAAM,GAAG,IAAI,iBAAiB,EAAc,CAAC;IAE9D,EAAE,CAA6B,KAAQ,EAAE,QAA0C;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAA6B,KAAQ,EAAE,QAA0C;QAClF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,OAAO,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,SAAS,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,YAAY,CAAC;IACnG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,WAAW,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;CACF"}

package/dist/client.d.ts

@@ -1,14 +1,9 @@
 import { type AlpicApi } from "./api/client.js";
 import { AlpicAuth } from "./auth/index.js";
-import { createTunnel, type TunnelHandle } from "./tunnel/tunnel.js";
-export type AlpicClientOptions = {
-    apiBaseUrl?: string;
-    configDir?: string;
-};
+import { Tunnel } from "./tunnel/tunnel.js";
 export declare class AlpicClient {
     readonly auth: AlpicAuth;
     readonly api: AlpicApi;
-    readonly tunnel: ReturnType<typeof createTunnel>;
-    constructor(opts?: AlpicClientOptions);
+    readonly tunnel: Tunnel;
+    constructor();
 }
-export type { TunnelHandle };

package/dist/client.js

@@ -1,37 +1,20 @@
 import { createApiClient } from "./api/client.js";
 import { AlpicAuth } from "./auth/index.js";
 import { env } from "./env.js";
-import { createTunnel } from "./tunnel/tunnel.js";
+import { Tunnel } from "./tunnel/tunnel.js";
 export class AlpicClient {
     auth;
     api;
     tunnel;
-    constructor(opts) {
-        if (opts?.configDir) {
-            // Pilot: globalStore is a module singleton initialized at import time, so
-            // this only takes effect if set before the first SDK import. Instance-scoped
-            // config is a tracked follow-up.
-            process.env.ALPIC_GLOBAL_CONFIG_DIR = opts.configDir;
-        }
-        const apiBaseUrl = opts?.apiBaseUrl ?? env.ALPIC_API_BASE_URL;
+    constructor() {
         this.auth = new AlpicAuth();
         this.api = createApiClient({
-            apiBaseUrl,
+            apiBaseUrl: env.ALPIC_API_BASE_URL,
             getToken: () => this.auth.getToken(),
         });
-        this.tunnel = createTunnel({
+        this.tunnel = new Tunnel({
             api: this.api,
-            ensureToken: async ({ autoLogin = true, onLoginUrl }) => {
-                let token = await this.auth.getValidAccessToken();
-                if (!token && autoLogin) {
-                    await this.auth.login({ onLoginUrl });
-                    token = await this.auth.getValidAccessToken();
-                }
-                if (!token) {
-                    throw new Error("Not authenticated. Run `alpic login` first.");
-                }
-                return token.access_token;
-            },
+            getAccessToken: async () => (await this.auth.getValidAccessToken())?.access_token,
         });
     }
 }

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAOrE,MAAM,OAAO,WAAW;IACb,IAAI,CAAY;IAChB,GAAG,CAAW;IACd,MAAM,CAAkC;IAEjD,YAAY,IAAyB;QACnC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;YACpB,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,GAAG,CAAC,kBAAkB,CAAC;QAE9D,IAAI,CAAC,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC;YACzB,UAAU;YACV,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;gBACtD,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAClD,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;oBACtC,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAChD,CAAC;gBACD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,KAAK,CAAC,YAAY,CAAC;YAC5B,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,OAAO,WAAW;IACb,IAAI,CAAY;IAChB,GAAG,CAAW;IACd,MAAM,CAAS;IAExB;QACE,IAAI,CAAC,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC;YACzB,UAAU,EAAE,GAAG,CAAC,kBAAkB;YAClC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,YAAY;SAClF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,8 +1,7 @@
 export type { AlpicApi } from "./api/client.js";
-export type { Credentials, LoginOptions } from "./auth/index.js";
+export type { AuthEvents, Credentials, LoginOptions } from "./auth/index.js";
 export { AlpicAuth } from "./auth/index.js";
 export { getOAuthClient } from "./auth/oauth-client.js";
 export { GlobalStore, globalStore } from "./auth/store.js";
-export type { AlpicClientOptions, TunnelHandle } from "./client.js";
 export { AlpicClient } from "./client.js";
-export type { OpenTunnelOptions, TunnelRequest } from "./tunnel/tunnel.js";
+export type { OpenTunnelOptions, TunnelCloseInfo, TunnelHandle, TunnelRequest } from "./tunnel/tunnel.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/emitter.d.ts

@@ -0,0 +1,7 @@
+export type Listener<T> = (payload: T) => void;
+export declare class TypedEventEmitter<EventMap extends Record<string, unknown>> {
+    private readonly listeners;
+    on<K extends keyof EventMap>(event: K, listener: Listener<EventMap[K]>): void;
+    off<K extends keyof EventMap>(event: K, listener: Listener<EventMap[K]>): void;
+    emit<K extends keyof EventMap>(event: K, payload: EventMap[K]): void;
+}

package/dist/lib/emitter.js

@@ -0,0 +1,29 @@
+// Minimal typed emitter for SDK lifecycle hooks. Unlike node's EventEmitter it
+// never throws on an unlistened "error" event, and swallows listener errors so
+// observability can never break the operation that emitted the event.
+export class TypedEventEmitter {
+    listeners = new Map();
+    on(event, listener) {
+        const set = this.listeners.get(event) ?? new Set();
+        set.add(listener);
+        this.listeners.set(event, set);
+    }
+    off(event, listener) {
+        this.listeners.get(event)?.delete(listener);
+    }
+    emit(event, payload) {
+        const set = this.listeners.get(event);
+        if (!set) {
+            return;
+        }
+        for (const listener of set) {
+            try {
+                listener(payload);
+            }
+            catch {
+                // Listener errors must never break the emitting operation.
+            }
+        }
+    }
+}
+//# sourceMappingURL=emitter.js.map

package/dist/lib/emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../../src/lib/emitter.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,OAAO,iBAAiB;IACX,SAAS,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE/E,EAAE,CAA2B,KAAQ,EAAE,QAA+B;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAqB,CAAC;QACtE,GAAG,CAAC,GAAG,CAAC,QAA6B,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,GAAG,CAA2B,KAAQ,EAAE,QAA+B;QACrE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,QAA6B,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAA2B,KAAQ,EAAE,OAAoB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACF,QAAkC,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/tunnel/tunnel.d.ts

@@ -3,20 +3,24 @@ export type TunnelRequest = {
     method: string;
     path: string;
 };
+export type TunnelCloseInfo = {
+    displaced?: boolean;
+};
 export type TunnelHandle = {
     readonly url: string;
     on(event: "request", listener: (req: TunnelRequest) => void): void;
     on(event: "error", listener: (err: Error) => void): void;
-    on(event: "close", listener: () => void): void;
+    on(event: "close", listener: (info?: TunnelCloseInfo) => void): void;
     close(): void;
 };
 export type OpenTunnelOptions = {
     port: number;
-    autoLogin?: boolean;
-    onLoginUrl?: (url: string) => void;
 };
 type PipenetSocket = {
     on(event: string, listener: (...args: unknown[]) => void): void;
+    tunnelCluster?: {
+        on(event: string, listener: (...args: unknown[]) => void): void;
+    };
     close(): void;
 };
 type Pipenet = (opts: {
@@ -27,14 +31,14 @@ type Pipenet = (opts: {
     keepAliveDelayMs: number;
     offlineTimeoutMs: number;
 }) => Promise<PipenetSocket>;
-export declare function createTunnel(deps: {
+export type TunnelDeps = {
     api: AlpicApi;
-    ensureToken: (opts: {
-        autoLogin?: boolean;
-        onLoginUrl?: (url: string) => void;
-    }) => Promise<string>;
+    getAccessToken: () => Promise<string | undefined>;
     pipenet?: Pipenet;
-}): {
-    open(opts: OpenTunnelOptions): Promise<TunnelHandle>;
 };
+export declare class Tunnel {
+    private readonly deps;
+    constructor(deps: TunnelDeps);
+    open(opts: OpenTunnelOptions): Promise<TunnelHandle>;
+}
 export {};

package/dist/tunnel/tunnel.js

@@ -1,50 +1,136 @@
-import { pipenet as defaultPipenet } from "../vendor/pipenet.js";
 const CONNECT_TIMEOUT_MS = 10_000;
 const KEEPALIVE_DELAY_MS = 30_000;
 const OFFLINE_TIMEOUT_MS = 30_000;
-export function createTunnel(deps) {
-    const pipenet = deps.pipenet ?? defaultPipenet;
-    return {
-        async open(opts) {
-            const accessToken = await deps.ensureToken({
-                autoLogin: opts.autoLogin,
-                onLoginUrl: opts.onLoginUrl,
-            });
-            const ticket = await deps.api.tunnels.getTicket.v1(undefined, {
-                context: {
-                    request: { headers: { Authorization: `Bearer ${accessToken}` } },
-                },
-            });
-            const proto = ticket.tunnelHost.startsWith("localhost") ? "http" : "https";
-            let timeoutId;
-            const socket = await Promise.race([
-                pipenet({
-                    port: opts.port,
-                    host: `${proto}://${ticket.tunnelHost}`,
-                    subdomain: ticket.subdomain,
-                    headers: { Authorization: `Bearer ${ticket.ticket}` },
-                    keepAliveDelayMs: KEEPALIVE_DELAY_MS,
-                    offlineTimeoutMs: OFFLINE_TIMEOUT_MS,
-                }).then((socket) => {
-                    clearTimeout(timeoutId);
-                    return socket;
-                }),
-                new Promise((_, reject) => {
-                    timeoutId = setTimeout(() => reject(new Error("Failed to connect to tunnel server")), CONNECT_TIMEOUT_MS);
-                    timeoutId.unref?.();
-                }),
-            ]);
-            const url = `${proto}://${ticket.subdomain}.${ticket.tunnelHost}`;
-            return {
-                url,
-                on(event, listener) {
-                    socket.on(event, listener);
-                },
-                close() {
-                    socket.close();
-                },
-            };
-        },
-    };
+// Takeover detection thresholds — see the "dead" listener in open().
+const FLAP_WINDOW_MS = 5_000;
+const FLAP_MIN_SPAN_MS = 2_000;
+const FLAP_THRESHOLD = 15;
+export class Tunnel {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async open(opts) {
+        // Load the patched pipenet bundle lazily so non-tunnel consumers (every
+        // `alpic` command, the skybridge dev server) don't pay its ~500KB load
+        // cost at startup — only when a tunnel is actually opened.
+        const pipenet = this.deps.pipenet ?? (await import("../vendor/pipenet.js")).pipenet;
+        // Tunnels require a user OAuth token; callers authenticate before opening.
+        const accessToken = await this.deps.getAccessToken();
+        if (!accessToken) {
+            throw new Error("Not authenticated. Run `alpic login` first.");
+        }
+        const ticket = await this.deps.api.tunnels.getTicket.v1(undefined, {
+            context: {
+                request: { headers: { Authorization: `Bearer ${accessToken}` } },
+            },
+        });
+        // ALPIC_TUNNEL_HOST points a real ticket at a locally-run tunnel server. It's a dev
+        // override for a local (plain-HTTP) server, so default to http regardless of the host;
+        // pass an explicit https:// to force TLS.
+        const hostOverride = process.env.ALPIC_TUNNEL_HOST;
+        let tunnelHost;
+        let proto;
+        if (hostOverride) {
+            proto = hostOverride.startsWith("https://") ? "https" : "http";
+            tunnelHost = hostOverride.replace(/^https?:\/\//, "");
+        }
+        else {
+            tunnelHost = ticket.tunnelHost;
+            proto = tunnelHost.startsWith("localhost") ? "http" : "https";
+        }
+        let timeoutId;
+        const socket = await Promise.race([
+            pipenet({
+                port: opts.port,
+                host: `${proto}://${tunnelHost}`,
+                subdomain: ticket.subdomain,
+                headers: { Authorization: `Bearer ${ticket.ticket}` },
+                keepAliveDelayMs: KEEPALIVE_DELAY_MS,
+                offlineTimeoutMs: OFFLINE_TIMEOUT_MS,
+            }).then((socket) => {
+                clearTimeout(timeoutId);
+                return socket;
+            }),
+            new Promise((_, reject) => {
+                timeoutId = setTimeout(() => reject(new Error("Failed to connect to tunnel server")), CONNECT_TIMEOUT_MS);
+                timeoutId.unref?.();
+            }),
+        ]);
+        const url = `${proto}://${ticket.subdomain}.${tunnelHost}`;
+        const requestListeners = new Set();
+        const errorListeners = new Set();
+        const closeListeners = new Set();
+        let lastRequestAt = 0;
+        let displaced = false;
+        let closed = false;
+        socket.on("request", (req) => {
+            lastRequestAt = Date.now();
+            for (const listener of requestListeners) {
+                listener(req);
+            }
+        });
+        socket.on("error", (err) => {
+            for (const listener of errorListeners) {
+                listener(err);
+            }
+        });
+        socket.on("close", () => {
+            closed = true;
+            const info = displaced ? { displaced: true } : undefined;
+            for (const listener of closeListeners) {
+                listener(info);
+            }
+        });
+        // Detect being displaced by a newer tunnel. When another tunnel takes over this
+        // account's subdomain, the server closes our tunnel and rejects our reconnections
+        // (they target a session id that no longer exists), so each one connects and is
+        // dropped within milliseconds. pipenet's offlineTimeoutMs never fires for this — it
+        // only triggers when the server is unreachable entirely (failed connects emit no
+        // "dead"). A "dead" with a prior "open" means a socket reached the server and was
+        // dropped, so a sustained storm of them is the takeover signature.
+        //
+        // Normal serving also churns sockets: with the server's small keep-alive pool, most
+        // concurrent requests get their socket destroyed right after serving, emitting a
+        // "dead" each. A heavy page load can fire 15+ in a few seconds and look identical to
+        // a takeover. The discriminator: a real takeover routes all traffic to the new
+        // tunnel, so we serve zero requests during the storm. Ignore it while requests flow.
+        let drops = [];
+        socket.tunnelCluster?.on("dead", () => {
+            if (displaced || closed) {
+                return;
+            }
+            const now = Date.now();
+            if (now - lastRequestAt < FLAP_WINDOW_MS) {
+                drops = [];
+                return;
+            }
+            drops.push(now);
+            drops = drops.filter((at) => now - at < FLAP_WINDOW_MS);
+            const oldest = drops[0] ?? now;
+            if (drops.length >= FLAP_THRESHOLD && now - oldest >= FLAP_MIN_SPAN_MS) {
+                displaced = true;
+                socket.close();
+            }
+        });
+        return {
+            url,
+            on(event, listener) {
+                if (event === "request") {
+                    requestListeners.add(listener);
+                }
+                else if (event === "error") {
+                    errorListeners.add(listener);
+                }
+                else {
+                    closeListeners.add(listener);
+                }
+            },
+            close() {
+                closed = true;
+                socket.close();
+            },
+        };
+    }
 }
 //# sourceMappingURL=tunnel.js.map

package/dist/tunnel/tunnel.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../src/tunnel/tunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAgClC,MAAM,UAAU,YAAY,CAAC,IAI5B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,cAAqC,CAAC;IAEvE,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAuB;YAChC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;gBACzC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE;gBAC5D,OAAO,EAAE;oBACP,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;iBACjE;aACF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAE3E,IAAI,SAAoD,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,OAAO,CAAC;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,GAAG,KAAK,MAAM,MAAM,CAAC,UAAU,EAAE;oBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE;oBACrD,gBAAgB,EAAE,kBAAkB;oBACpC,gBAAgB,EAAE,kBAAkB;iBACrC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACjB,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;oBAC1G,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;gBACtB,CAAC,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAElE,OAAO;gBACL,GAAG;gBACH,EAAE,CAAC,KAAK,EAAE,QAAQ;oBAChB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,QAAwC,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK;oBACH,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../src/tunnel/tunnel.ts"],"names":[],"mappings":"AAEA,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,qEAAqE;AACrE,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,cAAc,GAAG,EAAE,CAAC;AAuC1B,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI,CAAC,IAAuB;QAChC,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAK,CAAC,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAA8B,CAAC;QAE5G,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE;YACjE,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;aACjE;SACF,CAAC,CAAC;QAEH,oFAAoF;QACpF,uFAAuF;QACvF,0CAA0C;QAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACnD,IAAI,UAAkB,CAAC;QACvB,IAAI,KAAa,CAAC;QAClB,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/D,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC/B,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAChE,CAAC;QAED,IAAI,SAAoD,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,OAAO,CAAC;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,GAAG,KAAK,MAAM,UAAU,EAAE;gBAChC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE;gBACrD,gBAAgB,EAAE,kBAAkB;gBACpC,gBAAgB,EAAE,kBAAkB;aACrC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACjB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;YACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC1G,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,CAAC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAE3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAC;QAEnE,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,CAAC,GAAoB,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAY,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,gFAAgF;QAChF,kFAAkF;QAClF,gFAAgF;QAChF,oFAAoF;QACpF,iFAAiF;QACjF,kFAAkF;QAClF,mEAAmE;QACnE,EAAE;QACF,oFAAoF;QACpF,iFAAiF;QACjF,qFAAqF;QACrF,+EAA+E;QAC/E,qFAAqF;QACrF,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACpC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBACzC,KAAK,GAAG,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,cAAc,IAAI,GAAG,GAAG,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACvE,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,GAAG;YACH,EAAE,CAAC,KAAK,EAAE,QAAQ;gBAChB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,gBAAgB,CAAC,GAAG,CAAC,QAAwC,CAAC,CAAC;gBACjE,CAAC;qBAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC7B,cAAc,CAAC,GAAG,CAAC,QAAgC,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,cAAc,CAAC,GAAG,CAAC,QAA4C,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YACD,KAAK;gBACH,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/vendor/pipenet.js

@@ -16571,18 +16571,18 @@ var {
   create
 } = axios_default;
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/Tunnel.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/Tunnel.js
 var import_debug2 = __toESM(require_src(), 1);
 import { EventEmitter as EventEmitter3 } from "events";
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/TunnelCluster.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/TunnelCluster.js
 var import_debug = __toESM(require_src(), 1);
 import { EventEmitter as EventEmitter2 } from "events";
 import fs from "fs";
 import net from "net";
 import tls from "tls";
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/HeaderHostTransformer.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/HeaderHostTransformer.js
 import { Transform } from "stream";
 var HeaderHostTransformer = class extends Transform {
   host;
@@ -16600,7 +16600,7 @@ var HeaderHostTransformer = class extends Transform {
   }
 };
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/TunnelCluster.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/TunnelCluster.js
 var log = (0, import_debug.default)("pipenet:client");
 var TunnelCluster = class extends EventEmitter2 {
   opts;
@@ -16708,7 +16708,7 @@ var TunnelCluster = class extends EventEmitter2 {
   }
 };
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/Tunnel.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/Tunnel.js
 var log2 = (0, import_debug2.default)("pipenet:client");
 var Tunnel = class extends EventEmitter3 {
   cachedUrl;
@@ -16856,7 +16856,7 @@ var Tunnel = class extends EventEmitter3 {
   }
 };
 
-// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=283f0d16759aba9c68cd55bb0821c977833a401969b0ecf9492a6618e019f6c1/node_modules/pipenet/dist/pipenet.js
+// ../../node_modules/.pnpm/pipenet@1.4.0_patch_hash=24bd89f8b5bea6a63243b7a7d4ad888dcf7049e36eac19b10006403b29758c35/node_modules/pipenet/dist/pipenet.js
 function pipenet(arg1, arg2, arg3) {
   const options = typeof arg1 === "object" ? arg1 : { ...arg2, port: arg1 };
   const callback = typeof arg1 === "object" ? arg2 : arg3;