@auth-craft/client 0.2.1 → 0.3.1

package/README.md

@@ -126,6 +126,11 @@ interface AuthCraftClientConfig {
    * 'system' = admin, 'tenant' = tenant-scoped, omit/'customer' = default.
    */
   context?: 'customer' | 'tenant' | 'system'
+  /**
+   * Skip the boot-time refresh for visitors who never logged in (default false).
+   * See "Skipping the pointless boot refresh" below.
+   */
+  sessionHint?: boolean
   /**
    * Subscribe to session state changes (login, logout, refresh, expiry).
    * Fires after `init()`. Bridge it into app state or trigger auto-logout
@@ -135,6 +140,47 @@ interface AuthCraftClientConfig {
 }
 ```
 
+### Skipping the pointless boot refresh
+
+The refresh token is an httpOnly cookie the worker cannot read, so after every
+reload the worker has no idea whether a session exists — the only way to find out
+is to try `POST /auth/refresh`. For someone who never logged in, that attempt can
+never succeed, yet it is paid on **every** page load, and the app has to wait for
+it to fail before it can render "logged out".
+
+`sessionHint: true` makes the worker remember the answer:
+
+```ts
+const client = createAuthCraftClient({
+  baseUrl: 'https://auth.example.com',
+  strategy: 'cookie-auth',
+  allowedDomains: ['auth.example.com'],
+  sessionHint: true,    // don't try refresh if nobody ever logged in here
+})
+```
+
+- **login succeeds** → the hint is written (IndexedDB; the worker has no
+  `localStorage`).
+- **logout**, or a refresh the server rejects → the hint is cleared.
+- **next reload with no hint** → auth-requiring calls resolve immediately as
+  `NOT_AUTHENTICATED` with **zero HTTP requests**. Public calls (login, register,
+  password reset, …) are unaffected.
+
+The hint is one non-secret bit and is never trusted for authorization — it can
+only skip a request that was going to fail anyway. It self-corrects in both
+directions: a rejected refresh clears it, and a login or logout in another tab is
+broadcast to every open tab (via `BroadcastChannel`), so a tab that booted
+"anonymous" starts attempting refresh again without a reload. If IndexedDB is
+unavailable or faulting, the hint **fails open** — the client simply behaves as it
+does today.
+
+The storage key is derived from `context`, so a customer login on the same origin
+never implies a `tenant` or `system` session.
+
+> Handle `NOT_AUTHENTICATED` as "show the login screen". If your app currently
+> distinguishes "refresh failed" from "never logged in", both now arrive as the
+> same error code — the difference is only that the second costs no request.
+
 ### Transport: worker vs inline
 
 By default the client runs its token/refresh loop in a **Web Worker**, so the

package/dist/core/core.d.ts

@@ -49,6 +49,19 @@ export interface ClientCoreConfig {
     transport?: 'worker' | 'inline';
     /** Auth scope → `X-Auth-Context` header. */
     context?: 'customer' | 'tenant' | 'system';
+    /**
+     * Skip the boot-time `POST /auth/refresh` for visitors who never logged in.
+     *
+     * Off by default. When `true`, the worker remembers (in IndexedDB) that a
+     * session was established here and, on a later reload, fails auth-requiring
+     * calls fast with NOT_AUTHENTICATED instead of spending a refresh that cannot
+     * succeed. The hint is cleared whenever the server reports no session and is
+     * synced across tabs, so it only ever skips a request that would have failed.
+     *
+     * The storage key is derived from `context`, so a customer login on the same
+     * origin never implies a tenant or system session.
+     */
+    sessionHint?: boolean;
     /** Session state changes (login/logout/refresh/expiry). Fires after init(). */
     onAuthStateChanged?: (state: TransportAuthResult) => void;
 }

package/dist/core/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,IAAI,mBAAmB,EACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,GAAG,WAAW,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAChC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3C,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC3D;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAAiC;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAE1C,YAAY,MAAM,EAAE,gBAAgB,EAEnC;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAyB1B;IAED;;;OAGG;IACH,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAIxE;IAED;;;OAGG;IACH,IAAI,GAAG,IAAI,YAAY,CAqBtB;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7B;IAED,2EAA2E;IAC3E,YAAY,IAAI,gBAAgB,CAG/B;IAED,OAAO,IAAI,IAAI,CAGd;CACF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAIpF;AAED,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,IAAI,mBAAmB,EACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,GAAG,WAAW,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAChC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC3D;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAAiC;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAE1C,YAAY,MAAM,EAAE,gBAAgB,EAEnC;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CA6B1B;IAED;;;OAGG;IACH,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAIxE;IAED;;;OAGG;IACH,IAAI,GAAG,IAAI,YAAY,CAqBtB;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7B;IAED,2EAA2E;IAC3E,YAAY,IAAI,gBAAgB,CAG/B;IAED,OAAO,IAAI,IAAI,CAGd;CACF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAIpF;AAED,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/core.js

@@ -43,6 +43,10 @@ export class ClientCore {
             ...(headers ? { defaultHeaders: headers } : {}),
             ...(this.config.workerFactory ? { workerFactory: this.config.workerFactory } : {}),
             ...(this.config.transport ? { transport: this.config.transport } : {}),
+            // Per-scope key: each auth context tracks its own session independently.
+            ...(this.config.sessionHint
+                ? { sessionHint: { enabled: true, key: `sessionHint:${this.config.context ?? 'customer'}` } }
+                : {}),
         });
         await this.fg.whenReady();
         if (this.config.onAuthStateChanged) {

package/dist/core/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EACL,YAAY,GAIb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAuB,MAAM,YAAY,CAAC;AAkC9D,MAAM,OAAO,UAAU;IACb,EAAE,GAA4B,IAAI,CAAC;IAC1B,MAAM,CAAmB;IAE1C,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU;YACvD,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAEjC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC;YACrB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC;YACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAqC,QAAW;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,IAAI,GAAG;QACL,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,CAAyB,EAAkD,EAAE;YACzF,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClB,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,OAAO;YACL,GAAG,EAAE,CAAc,GAAW,EAAE,OAA+B,EAAE,EAAE,CACjE,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CAClF,EAAE,CAAC,QAAQ,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,GAAG,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACjF,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,KAAK,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACnF,EAAE,CAAC,QAAQ,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACpF,EAAE,CAAC,QAAQ,CAAI,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,2EAA2E;IAC3E,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB;IAC7D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EACL,YAAY,GAIb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAuB,MAAM,YAAY,CAAC;AA+C9D,MAAM,OAAO,UAAU;IACb,EAAE,GAA4B,IAAI,CAAC;IAC1B,MAAM,CAAmB;IAE1C,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU;YACvD,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAEjC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC;YACrB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC;YACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,yEAAyE;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,EAAE,EAAE,EAAE;gBAC7F,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAqC,QAAW;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,IAAI,GAAG;QACL,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,CAAyB,EAAkD,EAAE;YACzF,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClB,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,OAAO;YACL,GAAG,EAAE,CAAc,GAAW,EAAE,OAA+B,EAAE,EAAE,CACjE,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CAClF,EAAE,CAAC,QAAQ,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,GAAG,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACjF,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,KAAK,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACnF,EAAE,CAAC,QAAQ,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACpF,EAAE,CAAC,QAAQ,CAAI,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,2EAA2E;IAC3E,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB;IAC7D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/transport/client.d.ts

@@ -16,6 +16,10 @@ export declare class FetchGuardClient {
     private isReady;
     private requestQueue;
     private activeRequests;
+    /** Ids posted to the worker that still hold a concurrency slot */
+    private readonly inFlight;
+    /** Round-trip timers (queue wait + worker), keyed by message id */
+    private readonly requestTimers;
     private readonly maxConcurrent;
     private readonly maxQueueSize;
     private readonly setupTimeout;
@@ -112,6 +116,20 @@ export declare class FetchGuardClient {
      * Cancel a pending request by ID
      */
     cancel(id: string): void;
+    /**
+     * Round-trip timeout fired: abort the worker's fetch (if it was sent),
+     * free the slot and settle the caller with REQUEST_TIMEOUT.
+     */
+    private timeoutRequest;
+    private armRequestTimer;
+    private clearRequestTimer;
+    /**
+     * End a message's life — the single exit for every path (answer, error,
+     * cancel, timeout, send failure). Clears its timer, drops it from the queue
+     * if not sent yet, gives back its concurrency slot exactly once, and removes
+     * its bookkeeping. Returns the pending entry if the caller still waits.
+     */
+    private finish;
     /**
      * Convenience methods
      */
@@ -219,7 +237,10 @@ export declare class FetchGuardClient {
     }>>;
     /**
      * Send message through queue system
-     * All messages go through queue for sequential processing
+     * All messages go through queue for sequential processing.
+     * Resolves once the message is posted to the worker (or dropped from the
+     * queue by finish()); the answer arrives via handleWorkerMessage. Timeouts
+     * are the caller's (armRequestTimer), not the queue's.
      * @param transferables - Optional Transferable objects for zero-copy postMessage
      */
     private sendMessageQueued;

package/dist/transport/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/transport/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAOvD,OAAO,KAAK,EACV,UAAU,EAGV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAsCpB;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAK;IAGtB,OAAO,CAAC,eAAe,CAMnB;IACJ,yCAAyC;IACzC,OAAO,CAAC,WAAW,CAA6B;IAChD,uCAAuC;IACvC,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAC,CAAa;IAClC,OAAO,CAAC,WAAW,CAAC,CAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe;IACvC,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2E;IAEzG,YAAY,OAAO,EAAE,iBAAiB,EA2BrC;IAED;;OAEG;YACW,gBAAgB;IAmD9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8H3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAezB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAmD5F;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,uBAAuB;IA4ErC;;;OAGG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,cAAc;IAqBtB;;;;OAIG;IACH,WAAW,CACT,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B,GAClC;QACD,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,IAAI,CAAC;KACpB,CAiEA;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAoBvB;IAED;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAEnH;IAEK,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAEK,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAEK,MAAM,CACV,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAEhC;IAEK,KAAK,CACT,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAED;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,CAAC,EACd,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,EACnD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CA0BpB;IAED;;;;;;OAMG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAkB/F;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAanG;IAED;;;;OAIG;IACG,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAGtF;IAED;;;OAGG;IACG,YAAY,CAAC,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAEzE;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAC1G,SAAS,GAAE,OAAc,GACxB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAM7B;IAED;;OAEG;IACH,KAAK,IAAI,OAAO,CAEf;IAED;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAM/B;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAYxC;IAED;;OAEG;IACH,kBAAkB,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI,CAG9D;IAED,+BAA+B;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAkBnD;IAED;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAsCzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAiCpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;OAEG;IACH,OAAO,IAAI,IAAI,CAWd;CACF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAEzE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/transport/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAOvD,OAAO,KAAK,EACV,UAAU,EAGV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAwCpB;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAK;IAGtB,OAAO,CAAC,eAAe,CAMnB;IACJ,yCAAyC;IACzC,OAAO,CAAC,WAAW,CAA6B;IAChD,uCAAuC;IACvC,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,cAAc,CAAK;IAC3B,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoD;IAClF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,YAAY,CAAC,CAAa;IAClC,OAAO,CAAC,WAAW,CAAC,CAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe;IACvC,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2E;IAEzG,YAAY,OAAO,EAAE,iBAAiB,EA2BrC;IAED;;OAEG;YACW,gBAAgB;IAoD9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsG3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAmD5F;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,uBAAuB;IA4ErC;;;OAGG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,cAAc;IAqBtB;;;;OAIG;IACH,WAAW,CACT,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B,GAClC;QACD,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,IAAI,CAAC;KACpB,CAmEA;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAiBvB;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAQzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IA0Bd;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAEnH;IAEK,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAEK,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAEK,MAAM,CACV,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAEhC;IAEK,KAAK,CACT,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAwBhC;IAED;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,CAAC,EACd,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,EACnD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,MAAM,CAAM,GAC3D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CA0BpB;IAED;;;;;;OAMG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAe/F;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAanG;IAED;;;;OAIG;IACG,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAGtF;IAED;;;OAGG;IACG,YAAY,CAAC,SAAS,GAAE,OAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAEzE;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAC1G,SAAS,GAAE,OAAc,GACxB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAM7B;IAED;;OAEG;IACH,KAAK,IAAI,OAAO,CAEf;IAED;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAM/B;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAYxC;IAED;;OAEG;IACH,kBAAkB,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI,CAG9D;IAED,+BAA+B;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAenD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAsBzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAkCpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;OAEG;IACH,OAAO,IAAI,IAAI,CAmBd;CACF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAEzE"}

package/dist/transport/client.js

@@ -11,8 +11,10 @@ const DEFAULT_MAX_CONCURRENT = 6;
 const DEFAULT_MAX_QUEUE_SIZE = 1000;
 /** Default setup timeout (ms) */
 const DEFAULT_SETUP_TIMEOUT = 10000;
-/** Default request timeout (ms) */
-const DEFAULT_REQUEST_TIMEOUT = 30000;
+/** Round-trip timeout for AUTH_CALL messages (ms) */
+const AUTH_CALL_TIMEOUT = 15000;
+/** Round-trip timeout for PING messages (ms) */
+const PING_TIMEOUT = 5000;
 /**
  * FetchGuard Client - main interface cho việc gọi API thông qua Web Worker
  */
@@ -31,6 +33,10 @@ export class FetchGuardClient {
     isReady = false;
     requestQueue = [];
     activeRequests = 0;
+    /** Ids posted to the worker that still hold a concurrency slot */
+    inFlight = new Set();
+    /** Round-trip timers (queue wait + worker), keyed by message id */
+    requestTimers = new Map();
     maxConcurrent;
     maxQueueSize;
     setupTimeout;
@@ -48,7 +54,7 @@ export class FetchGuardClient {
         this.maxConcurrent = options.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
         this.maxQueueSize = options.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
         this.setupTimeout = options.setupTimeout ?? DEFAULT_SETUP_TIMEOUT;
-        this.requestTimeout = options.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT;
+        this.requestTimeout = options.requestTimeout;
         this.debug = options.debug;
         this.retry = options.retry;
         this.dedupe = options.dedupe;
@@ -79,6 +85,7 @@ export class FetchGuardClient {
             allowedDomains: options.allowedDomains || [],
             refreshEarlyMs: options.refreshEarlyMs ?? DEFAULT_REFRESH_EARLY_MS,
             defaultHeaders: options.defaultHeaders || {},
+            ...(options.sessionHint ? { sessionHint: options.sessionHint } : {}),
         };
         // Serialize provider config based on type
         let providerConfig = null;
@@ -126,15 +133,11 @@ export class FetchGuardClient {
         if (type === MSG.FETCH_RESULT) {
             // FETCH_RESULT contains FetchEnvelope (raw HTTP response)
             // Worker doesn't judge HTTP status - client receives envelope as-is
-            const request = this.pendingRequests.get(id);
-            if (!request)
+            // A late answer (after cancel/timeout) only gives back its slot
+            const entry = this.finish(id);
+            if (!entry)
                 return;
-            const url = this.requestUrls.get(id);
-            const timing = this.requestTimings.get(id);
-            this.pendingRequests.delete(id);
-            this.requestUrls.delete(id);
-            this.requestTimings.delete(id);
-            this.onRequestComplete();
+            const { request, url, timing } = entry;
             // Calculate metrics
             const metrics = this.calculateMetrics(timing);
             // Debug hook: onResponse
@@ -146,15 +149,10 @@ export class FetchGuardClient {
         }
         if (type === MSG.FETCH_ERROR) {
             // Network/timeout/cancel errors (no HTTP response)
-            const request = this.pendingRequests.get(id);
-            if (!request)
+            const entry = this.finish(id);
+            if (!entry)
                 return;
-            const url = this.requestUrls.get(id);
-            const timing = this.requestTimings.get(id);
-            this.pendingRequests.delete(id);
-            this.requestUrls.delete(id);
-            this.requestTimings.delete(id);
-            this.onRequestComplete();
+            const { request, url, timing } = entry;
             const errorMessage = String(payload?.error || 'Network error');
             // Calculate metrics
             const metrics = this.calculateMetrics(timing);
@@ -166,12 +164,10 @@ export class FetchGuardClient {
             return;
         }
         if (type === MSG.ERROR) {
-            const request = this.pendingRequests.get(id);
-            if (!request)
+            const entry = this.finish(id);
+            if (!entry)
                 return;
-            this.pendingRequests.delete(id);
-            this.onRequestComplete();
-            request.resolve(err(payload.errors, payload.meta));
+            entry.request.resolve(err(payload.errors, payload.meta));
             return;
         }
         if (type === MSG.SETUP_ERROR) {
@@ -199,12 +195,7 @@ export class FetchGuardClient {
             return;
         }
         if (type === MSG.PONG) {
-            const request = this.pendingRequests.get(id);
-            if (request) {
-                this.pendingRequests.delete(id);
-                this.onRequestComplete();
-                request.resolve(ok({ timestamp: payload?.timestamp }));
-            }
+            this.finish(id)?.request.resolve(ok({ timestamp: payload?.timestamp }));
             return;
         }
         if (type === MSG.AUTH_STATE_CHANGED) {
@@ -213,12 +204,7 @@ export class FetchGuardClient {
             return;
         }
         if (type === MSG.AUTH_CALL_RESULT) {
-            const request = this.pendingRequests.get(id);
-            if (request) {
-                this.pendingRequests.delete(id);
-                this.onRequestComplete();
-                request.resolve(ok(payload)); // payload is AuthResult
-            }
+            this.finish(id)?.request.resolve(ok(payload)); // payload is AuthResult
             return;
         }
         if (type === MSG.TOKEN_REFRESHED) {
@@ -234,8 +220,10 @@ export class FetchGuardClient {
         console.error('Worker error:', error);
         // Debug hook: onWorkerError
         this.debug?.onWorkerError?.(error);
-        // Reject all pending requests
-        for (const [_id, request] of this.pendingRequests) {
+        // Reject all pending requests (in-flight ones keep their slot until the
+        // worker answers or never — late answers release it in finish())
+        for (const [id, request] of this.pendingRequests) {
+            this.clearRequestTimer(id);
             request.reject(new Error(`Worker error: ${error.message}`));
         }
         this.pendingRequests.clear();
@@ -492,6 +480,7 @@ export class FetchGuardClient {
      */
     fetchWithId(url, options = {}) {
         const id = this.generateMessageId();
+        const { timeout, ...sendOptions } = options;
         // The Promise is resolved/rejected via pendingRequests (worker callback).
         // The executor stays synchronous (no async); the serialize-and-send work
         // runs separately and routes failures through the same reject path.
@@ -507,16 +496,19 @@ export class FetchGuardClient {
             // Debug hook: onRequest
             this.debug?.onRequest?.(url, options);
         });
+        // Round-trip timeout, if any: covers serialization, queue wait and the
+        // worker's fetch. Default is none — large uploads are legitimately slow.
+        this.armRequestTimer(id, timeout ?? this.requestTimeout);
         // Serialize (FormData/Headers) then send — async, but kept out of the
         // Promise executor (noAsyncPromiseExecutor). Failures reject via the
         // pending request registered above.
         void (async () => {
             try {
-                const serializedOptions = { ...options };
+                const serializedOptions = { ...sendOptions };
                 let transferables;
                 // Serialize FormData body before sending to worker
-                if (options.body && isFormData(options.body)) {
-                    const { data, transferables: formDataTransferables } = await serializeFormData(options.body);
+                if (sendOptions.body && isFormData(sendOptions.body)) {
+                    const { data, transferables: formDataTransferables } = await serializeFormData(sendOptions.body);
                     // SerializedFormData will be deserialized back to FormData in worker
                     serializedOptions.body = data;
                     // ArrayBuffers for zero-copy transfer
@@ -525,24 +517,21 @@ export class FetchGuardClient {
                     }
                 }
                 // Serialize Headers object to plain object (Headers cannot be cloned)
-                if (options.headers instanceof Headers) {
+                if (sendOptions.headers instanceof Headers) {
                     const plainHeaders = {};
-                    options.headers.forEach((value, key) => {
+                    sendOptions.headers.forEach((value, key) => {
                         plainHeaders[key] = value;
                     });
                     serializedOptions.headers = plainHeaders;
                 }
+                // Cancelled or timed out while serializing: don't send it at all
+                if (!this.pendingRequests.has(id))
+                    return;
                 const message = { id, type: MSG.FETCH, payload: { url, options: serializedOptions } };
-                await this.sendMessageQueued(message, 30000, transferables);
+                await this.sendMessageQueued(message, transferables);
             }
             catch (error) {
-                const request = this.pendingRequests.get(id);
-                if (request) {
-                    this.pendingRequests.delete(id);
-                    this.requestUrls.delete(id);
-                    this.requestTimings.delete(id);
-                    request.reject(error instanceof Error ? error : new Error(String(error)));
-                }
+                this.finish(id)?.request.reject(error instanceof Error ? error : new Error(String(error)));
             }
         })();
         const cancel = () => this.cancel(id);
@@ -552,23 +541,70 @@ export class FetchGuardClient {
      * Cancel a pending request by ID
      */
     cancel(id) {
-        const request = this.pendingRequests.get(id);
-        if (request) {
-            const url = this.requestUrls.get(id);
-            const timing = this.requestTimings.get(id);
-            this.pendingRequests.delete(id);
-            this.requestUrls.delete(id);
-            this.requestTimings.delete(id);
+        const sent = this.inFlight.has(id);
+        const entry = this.finish(id);
+        if (!entry)
+            return;
+        // Still queued: finish() dropped it from the queue, nothing to abort
+        if (sent)
             this.worker.postMessage({ id, type: MSG.CANCEL });
-            // Calculate metrics
-            const metrics = this.calculateMetrics(timing);
-            // Debug hook: onError for cancelled request
-            if (this.debug?.onError && url) {
-                this.debug.onError(url, { code: 'REQUEST_CANCELLED', message: 'Request cancelled' }, metrics);
-            }
-            request.reject(new Error('Request cancelled'));
+        // Debug hook: onError for cancelled request
+        if (this.debug?.onError && entry.url) {
+            this.debug.onError(entry.url, { code: 'REQUEST_CANCELLED', message: 'Request cancelled' }, this.calculateMetrics(entry.timing));
+        }
+        entry.request.resolve(err(RequestErrors.Cancelled()));
+    }
+    /**
+     * Round-trip timeout fired: abort the worker's fetch (if it was sent),
+     * free the slot and settle the caller with REQUEST_TIMEOUT.
+     */
+    timeoutRequest(id) {
+        const sent = this.inFlight.has(id);
+        const entry = this.finish(id);
+        if (sent)
+            this.worker.postMessage({ id, type: MSG.CANCEL });
+        if (!entry)
+            return;
+        if (this.debug?.onError && entry.url) {
+            this.debug.onError(entry.url, { code: 'REQUEST_TIMEOUT', message: 'Request timed out' }, this.calculateMetrics(entry.timing));
+        }
+        entry.request.resolve(err(RequestErrors.Timeout()));
+    }
+    armRequestTimer(id, timeoutMs) {
+        if (timeoutMs === undefined || timeoutMs <= 0)
+            return;
+        this.requestTimers.set(id, setTimeout(() => this.timeoutRequest(id), timeoutMs));
+    }
+    clearRequestTimer(id) {
+        const timer = this.requestTimers.get(id);
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            this.requestTimers.delete(id);
         }
     }
+    /**
+     * End a message's life — the single exit for every path (answer, error,
+     * cancel, timeout, send failure). Clears its timer, drops it from the queue
+     * if not sent yet, gives back its concurrency slot exactly once, and removes
+     * its bookkeeping. Returns the pending entry if the caller still waits.
+     */
+    finish(id) {
+        this.clearRequestTimer(id);
+        const index = this.requestQueue.findIndex((item) => item.id === id);
+        if (index !== -1) {
+            const [item] = this.requestQueue.splice(index, 1);
+            item?.resolve();
+        }
+        if (this.inFlight.delete(id))
+            this.onRequestComplete();
+        const request = this.pendingRequests.get(id);
+        const url = this.requestUrls.get(id);
+        const timing = this.requestTimings.get(id);
+        this.pendingRequests.delete(id);
+        this.requestUrls.delete(id);
+        this.requestTimings.delete(id);
+        return request ? { request, url, timing } : undefined;
+    }
     /**
      * Convenience methods
      */
@@ -701,12 +737,9 @@ export class FetchGuardClient {
                 resolve: (r) => resolve(r),
                 reject: (e) => reject(e),
             });
-            this.sendMessageQueued(message, 15000).catch((error) => {
-                const request = this.pendingRequests.get(id);
-                if (request) {
-                    this.pendingRequests.delete(id);
-                    request.reject(error);
-                }
+            this.armRequestTimer(id, AUTH_CALL_TIMEOUT);
+            this.sendMessageQueued(message).catch((error) => {
+                this.finish(id)?.request.reject(error);
             });
         });
     }
@@ -831,44 +864,33 @@ export class FetchGuardClient {
                 resolve: (r) => resolve(r),
                 reject: (e) => reject(e),
             });
-            this.sendMessageQueued(message, 5000).catch((error) => {
-                const request = this.pendingRequests.get(id);
-                if (request) {
-                    this.pendingRequests.delete(id);
-                    request.reject(error);
-                }
+            this.armRequestTimer(id, PING_TIMEOUT);
+            this.sendMessageQueued(message).catch((error) => {
+                this.finish(id)?.request.reject(error);
             });
         });
     }
     /**
      * Send message through queue system
-     * All messages go through queue for sequential processing
+     * All messages go through queue for sequential processing.
+     * Resolves once the message is posted to the worker (or dropped from the
+     * queue by finish()); the answer arrives via handleWorkerMessage. Timeouts
+     * are the caller's (armRequestTimer), not the queue's.
      * @param transferables - Optional Transferable objects for zero-copy postMessage
      */
-    sendMessageQueued(message, timeoutMs = this.requestTimeout, transferables) {
+    sendMessageQueued(message, transferables) {
         return new Promise((resolve, reject) => {
             // Check queue size limit to prevent memory leak
             if (this.requestQueue.length >= this.maxQueueSize) {
                 reject(err(RequestErrors.QueueFull({ size: this.requestQueue.length, maxSize: this.maxQueueSize })));
                 return;
             }
-            const timeout = setTimeout(() => {
-                const index = this.requestQueue.findIndex((item) => item.id === message.id);
-                if (index !== -1) {
-                    this.requestQueue.splice(index, 1);
-                }
-                this.pendingRequests.delete(message.id);
-                this.requestUrls.delete(message.id);
-                this.requestTimings.delete(message.id);
-                reject(err(RequestErrors.Timeout()));
-            }, timeoutMs);
             const queueItem = {
                 id: message.id,
                 message,
                 transferables,
-                resolve: resolve,
+                resolve,
                 reject,
-                timeout,
             };
             this.requestQueue.push(queueItem);
             this.processQueue();
@@ -890,6 +912,7 @@ export class FetchGuardClient {
             if (!item)
                 continue;
             this.activeRequests++;
+            this.inFlight.add(item.id);
             // Update timing: mark when request is actually sent to worker
             const timing = this.requestTimings.get(item.id);
             if (timing) {
@@ -903,12 +926,12 @@ export class FetchGuardClient {
                 else {
                     this.worker.postMessage(item.message);
                 }
-                // Note: activeRequests is decremented when response is received
-                // in handleWorkerMessage, not here
+                // Note: the slot is given back by finish() (answer, cancel, timeout)
+                item.resolve();
             }
             catch (error) {
+                this.inFlight.delete(item.id);
                 this.activeRequests--;
-                clearTimeout(item.timeout);
                 item.reject(error instanceof Error ? error : new Error(String(error)));
                 // Continue processing queue after error
                 this.processQueue();
@@ -928,14 +951,22 @@ export class FetchGuardClient {
      */
     destroy() {
         this.worker.terminate();
+        for (const timer of this.requestTimers.values())
+            clearTimeout(timer);
+        this.requestTimers.clear();
+        const queue = this.requestQueue;
+        this.requestQueue = [];
+        for (const item of queue)
+            item.resolve();
+        // Settle every waiting caller — the worker is gone, no answer will come
+        for (const request of this.pendingRequests.values()) {
+            request.reject(new Error('Client destroyed'));
+        }
         this.pendingRequests.clear();
         this.requestUrls.clear();
         this.requestTimings.clear();
-        for (const item of this.requestQueue) {
-            clearTimeout(item.timeout);
-            item.reject(new Error('Client destroyed'));
-        }
-        this.requestQueue = [];
+        this.inFlight.clear();
+        this.activeRequests = 0;
     }
 }
 /**