@cjhyy/code-shell-web 0.9.25 → 0.9.27

package/dist/index.d.ts

@@ -21,6 +21,8 @@ export * from "./lib/pairing.js";
 export * from "./lib/deviceCredential.js";
 export * from "./lib/mobileAttachments.js";
 export * from "./lib/uiLanguage.js";
+export * from "./link-authorization.js";
+export * from "./link-authorization-view.js";
 export { mobile } from "./i18n/mobile.js";
 export { translate, t, webMessages, type WebTranslationKey, type WebTranslateParams, } from "./i18n/translate.js";
 export { isEnvironmentDescriptor, projectReferenceKey } from "./lib/environment.js";

package/dist/index.js

@@ -24,6 +24,8 @@ export * from "./lib/pairing.js";
 export * from "./lib/deviceCredential.js";
 export * from "./lib/mobileAttachments.js";
 export * from "./lib/uiLanguage.js";
+export * from "./link-authorization.js";
+export * from "./link-authorization-view.js";
 // ── i18n: mobile namespace dict + zh-fallback translate ─────────────────────
 export { mobile } from "./i18n/mobile.js";
 export { translate, t, webMessages, } from "./i18n/translate.js";

package/dist/lib/streamReducer.js

@@ -54,6 +54,7 @@ function runStateForReason(reason) {
         case "model_error":
         case "image_error":
         case "replay_incomplete":
+        case "unverified_write":
             return "error";
         // "completed", "max_turns", "goal_budget_exhausted", "stop_hook_prevented",
         // "hook_stopped", and any future/unknown terminal reason: a normal stop.

package/dist/link-authorization-view.d.ts

@@ -0,0 +1,48 @@
+import React from "react";
+import type { LinkAuthorization, LinkAuthorizationResponse } from "@cjhyy/code-shell-link";
+export interface LinkAuthorizationLabels {
+    openPage: string;
+    waitingBrowser: string;
+    deviceInstruction: string;
+    copy: string;
+    submit: string;
+    verifyCode: string;
+    secondFactor: string;
+    detectSession: string;
+    bindSession: string;
+    loginSession: string;
+    notInstalled: string;
+    notAuthenticated: string;
+    authenticated: string;
+    processing: string;
+    connected: string;
+    cancelled: string;
+    failed: string;
+    expired: string;
+    unsupported: string;
+    invalidUrl: string;
+    scan: string;
+    confirmOnPhone: string;
+    qrExpired: string;
+    refreshQr: string;
+    qrError: string;
+    qrAlt: string;
+    confirm: string;
+    resourcesTruncated: string;
+    expiresAt: string;
+    rejected: string;
+    cliUnavailable: string;
+}
+export interface LinkAuthorizationStepViewProps {
+    authorization: LinkAuthorization;
+    busy?: boolean;
+    onRespond: (response: LinkAuthorizationResponse) => void;
+    /** The host decides how to open an already validated URL. */
+    onOpenUrl: (url: string) => void;
+    /** Native remote authorization already has its own controlled window. */
+    canOpenUrl?: boolean;
+    onCopy?: (value: string) => void;
+    labels?: Partial<LinkAuthorizationLabels>;
+}
+/** Fixed React controls only: provider metadata never supplies HTML or handlers. */
+export declare function LinkAuthorizationStepView(props: LinkAuthorizationStepViewProps): React.JSX.Element;

package/dist/link-authorization-view.js

@@ -0,0 +1,178 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import React from "react";
+import QRCode from "qrcode";
+import { getLinkAuthorizationStep, safeLinkAuthorizationUrl } from "./link-authorization.js";
+const DEFAULT_LABELS = {
+    openPage: "打开授权页面",
+    waitingBrowser: "在服务商页面完成授权，返回后会自动确认连接。",
+    deviceInstruction: "在授权页面输入此验证码：",
+    copy: "复制验证码",
+    submit: "验证并保存",
+    verifyCode: "输入服务商提供的验证码",
+    secondFactor: "完成服务商要求的追加验证",
+    detectSession: "检查登录状态",
+    bindSession: "使用这个账号",
+    loginSession: "登录账号",
+    notInstalled: "此环境尚未安装对应 CLI。",
+    notAuthenticated: "请先在当前环境登录对应 CLI，再检查状态。",
+    authenticated: "已登录",
+    processing: "正在确认并保存连接…",
+    connected: "连接已保存。",
+    cancelled: "授权已取消。",
+    failed: "授权未完成，请重新连接。",
+    expired: "授权已过期，请重新连接。",
+    unsupported: "当前客户端不支持这个授权步骤，请更新客户端。",
+    invalidUrl: "授权地址无效，请检查服务配置。",
+    scan: "使用服务商的手机应用扫描二维码。",
+    confirmOnPhone: "已扫码，请在手机上确认。",
+    qrExpired: "二维码已过期。",
+    refreshQr: "刷新二维码",
+    qrError: "无法显示二维码，请重试。",
+    qrAlt: "服务商授权二维码",
+    confirm: "确认授权",
+    resourcesTruncated: "此列表仅显示部分资源，请缩小选择范围后继续。",
+    expiresAt: "有效期至",
+    rejected: "服务商未接受此凭据，请检查后重试。",
+    cliUnavailable: "此环境没有可用的 CLI 登录，请检查登录状态或选择其他方式。",
+};
+/** Fixed React controls only: provider metadata never supplies HTML or handlers. */
+export function LinkAuthorizationStepView(props) {
+    const labels = { ...DEFAULT_LABELS, ...props.labels };
+    const step = getLinkAuthorizationStep(props.authorization);
+    const [fields, setFields] = React.useState({});
+    const [selection, setSelection] = React.useState({});
+    const [qrImage, setQrImage] = React.useState();
+    const [qrError, setQrError] = React.useState(false);
+    const [now, setNow] = React.useState(Date.now());
+    const deadline = Math.min(props.authorization.expiresAt ? Date.parse(props.authorization.expiresAt) : Infinity, step ? Date.parse(step.expiresAt) : Infinity);
+    const qrDeadline = step?.kind === "qr-code" && step.qr ? Date.parse(step.qr.challengeExpiresAt) : Infinity;
+    const qrPayload = step?.kind === "qr-code" && step.phase !== "expired" ? step.qr?.payload : undefined;
+    React.useEffect(() => {
+        setFields({});
+        setSelection({});
+    }, [props.authorization.id, step?.id]);
+    React.useEffect(() => {
+        setNow(Date.now());
+        const timers = [deadline, qrDeadline]
+            .filter((expires) => Number.isFinite(expires) && expires > Date.now())
+            .map((expires) => setTimeout(() => setNow(Date.now()), expires - Date.now() + 1));
+        return () => {
+            for (const timer of timers)
+                clearTimeout(timer);
+        };
+    }, [deadline, qrDeadline]);
+    React.useEffect(() => {
+        let active = true;
+        setQrImage(undefined);
+        setQrError(false);
+        if (!qrPayload || qrPayload.length > 4_096 || qrDeadline <= Date.now()) {
+            if (qrPayload && qrPayload.length > 4_096)
+                setQrError(true);
+            return;
+        }
+        // Render the literal challenge locally. Never fetch or navigate QR content.
+        void QRCode.toDataURL(qrPayload, { width: 220, margin: 2, errorCorrectionLevel: "M" })
+            .then((value) => {
+            if (active)
+                setQrImage(value);
+        })
+            .catch(() => {
+            if (active)
+                setQrError(true);
+        });
+        return () => {
+            active = false;
+        };
+    }, [qrPayload, qrDeadline]);
+    if (props.authorization.state !== "pending") {
+        const message = props.authorization.state === "connected"
+            ? props.authorization.connection
+                ? labels.connected
+                : labels.processing
+            : props.authorization.state === "cancelled"
+                ? labels.cancelled
+                : props.authorization.errorCode === "authorization_expired"
+                    ? labels.expired
+                    : labels.failed;
+        return (_jsx("p", { className: "link-authorization-status", role: "status", children: message }));
+    }
+    if (!step)
+        return _jsx("p", { role: "alert", children: labels.unsupported });
+    if (!Number.isFinite(deadline) || deadline <= now)
+        return (_jsx("p", { className: "link-authorization-status", role: "status", children: labels.expired }));
+    const disabled = Boolean(props.busy);
+    const respond = (operation, input) => props.onRespond({ stepId: step.id, operation, ...(input ? { input } : {}) });
+    const openButton = (value) => {
+        if (props.canOpenUrl === false)
+            return null;
+        const url = safeLinkAuthorizationUrl(value);
+        return url ? (_jsxs("button", { type: "button", disabled: disabled, onClick: () => props.onOpenUrl(url), children: [labels.openPage, " \u2197"] })) : (_jsx("p", { role: "alert", children: labels.invalidUrl }));
+    };
+    const expires = (_jsxs("p", { className: "link-authorization-expires", children: [labels.expiresAt, " ", new Date(deadline).toLocaleTimeString()] }));
+    const error = props.authorization.errorCode ? (_jsx("p", { className: "link-authorization-error", role: "alert", children: props.authorization.errorCode === "provider_rejected"
+            ? labels.rejected
+            : props.authorization.errorCode === "cli_unavailable"
+                ? labels.cliUnavailable
+                : labels.failed })) : null;
+    const content = () => {
+        switch (step.kind) {
+            case "redirect":
+                return (_jsxs("div", { className: "link-authorization-step", role: "status", children: [_jsx("p", { children: labels.waitingBrowser }), openButton(step.authorizationUrl), expires] }));
+            case "device-code":
+                return (_jsxs("div", { className: "link-authorization-step link-authorization-device", children: [_jsx("p", { children: labels.deviceInstruction }), _jsx("strong", { className: "link-authorization-code", children: step.userCode }), _jsxs("div", { className: "link-authorization-actions", children: [props.onCopy && (_jsx("button", { type: "button", onClick: () => props.onCopy?.(step.userCode), children: labels.copy })), openButton(step.verificationUriComplete ?? step.verificationUri)] }), expires] }));
+            case "qr-code": {
+                const challengeExpired = step.phase === "expired" || qrDeadline <= now;
+                return (_jsxs("div", { className: "link-authorization-step link-authorization-qr", children: [_jsx("p", { role: "status", children: challengeExpired
+                                ? labels.qrExpired
+                                : step.phase === "awaiting-confirmation"
+                                    ? labels.confirmOnPhone
+                                    : labels.scan }), !challengeExpired && qrImage && (_jsx("img", { width: 220, height: 220, src: qrImage, alt: labels.qrAlt })), !challengeExpired && qrError && _jsx("p", { role: "alert", children: labels.qrError }), !challengeExpired &&
+                            step.qr?.instructions.map((instruction, index) => _jsx("p", { children: instruction }, index)), step.canRefresh && (_jsx("button", { type: "button", disabled: disabled, onClick: () => respond("refresh-qr"), children: labels.refreshQr })), expires] }));
+            }
+            case "credential-input":
+                return (_jsxs("form", { className: "link-authorization-step link-authorization-fields", onSubmit: (event) => {
+                        event.preventDefault();
+                        if (disabled)
+                            return;
+                        const input = {};
+                        for (const field of step.fields)
+                            input[field.id] = fields[field.id] ?? "";
+                        // Secrets are one-shot UI input. An uncertain response is reconciled with GET.
+                        setFields({});
+                        respond("submit", input);
+                    }, children: [step.purpose !== "credential" && (_jsx("p", { children: step.purpose === "verification-code" ? labels.verifyCode : labels.secondFactor })), step.fields.map((field) => (_jsxs("label", { children: [field.label, _jsx("input", { name: field.id, type: field.secret ? "password" : "text", autoComplete: "off", spellCheck: false, value: fields[field.id] ?? "", placeholder: field.placeholder, maxLength: Math.min(field.maxLength ?? 16_384, 16_384), required: field.required, disabled: disabled, onChange: (event) => setFields((current) => ({ ...current, [field.id]: event.target.value })) })] }, field.id))), _jsx("button", { type: "submit", disabled: disabled || step.fields.some((field) => field.required && !fields[field.id]?.trim()), children: labels.submit }), expires] }));
+            case "local-session":
+                return (_jsxs("div", { className: "link-authorization-step", children: [_jsx("p", { role: "status", children: step.session.authenticated
+                                ? `${labels.authenticated}${step.session.account ? `：${step.session.account}` : ""}`
+                                : step.session.installed
+                                    ? labels.notAuthenticated
+                                    : labels.notInstalled }), step.session.message && _jsx("p", { children: step.session.message }), _jsxs("div", { className: "link-authorization-actions", children: [_jsx("button", { type: "button", disabled: disabled, onClick: () => respond("detect-session"), children: labels.detectSession }), !step.session.authenticated && step.session.canLogin && (_jsx("button", { type: "button", disabled: disabled, onClick: () => respond("login-session"), children: labels.loginSession })), step.session.authenticated && (_jsx("button", { type: "button", disabled: disabled, onClick: () => respond("bind-session"), children: labels.bindSession }))] }), expires] }));
+            case "consent": {
+                const permissionIds = selection.permissions ??
+                    step.permissions.filter((item) => item.required).map((item) => item.id);
+                const toggle = (key, id, checked, current) => setSelection((previous) => ({
+                    ...previous,
+                    [key]: checked
+                        ? [...new Set([...current, id])]
+                        : current.filter((value) => value !== id),
+                }));
+                const invalid = step.resourceGroups.some((group) => {
+                    const size = (selection[group.id] ?? []).length;
+                    return (size < (group.minSelected ?? 0) ||
+                        size > (group.maxSelected ?? Infinity) ||
+                        group.truncated);
+                });
+                return (_jsxs("form", { className: "link-authorization-step link-authorization-consent", onSubmit: (event) => {
+                        event.preventDefault();
+                        if (!disabled && !invalid)
+                            respond("confirm", { ...selection, permissions: permissionIds });
+                    }, children: [_jsx("p", { children: _jsx("strong", { children: step.account.label }) }), _jsx("div", { children: step.permissions.map((permission) => (_jsxs("label", { children: [_jsx("input", { type: "checkbox", checked: permission.required || permissionIds.includes(permission.id), disabled: disabled || permission.required, onChange: (event) => toggle("permissions", permission.id, event.target.checked, permissionIds) }), permission.label, permission.description && _jsx("small", { children: permission.description })] }, permission.id))) }), step.resourceGroups.map((group) => (_jsxs("fieldset", { children: [_jsx("legend", { children: group.label }), group.items.map((item) => (_jsxs("label", { children: [_jsx("input", { type: "checkbox", checked: (selection[group.id] ?? []).includes(item.id), disabled: disabled, onChange: (event) => toggle(group.id, item.id, event.target.checked, selection[group.id] ?? []) }), item.label, item.description && _jsx("small", { children: item.description })] }, item.id))), group.truncated && _jsx("p", { children: labels.resourcesTruncated })] }, group.id))), _jsx("button", { type: "submit", disabled: disabled || invalid, children: labels.confirm }), expires] }));
+            }
+            case "processing":
+                return (_jsx("p", { className: "link-authorization-status", role: "status", children: labels.processing }));
+            default:
+                return _jsx("p", { role: "alert", children: labels.unsupported });
+        }
+    };
+    return (_jsxs(_Fragment, { children: [error, content()] }));
+}

package/dist/link-authorization.d.ts

@@ -0,0 +1,51 @@
+import type { LinkAuthMode, LinkAuthorization, LinkAuthorizationResponse, LinkAuthorizationStep, LinkConnectionInput, LinkProviderView } from "@cjhyy/code-shell-link";
+export interface LinkAuthorizationTransport {
+    begin(input: LinkConnectionInput, authModeId: string): Promise<LinkAuthorization>;
+    status(id: string): Promise<LinkAuthorization>;
+    respond(id: string, response: LinkAuthorizationResponse): Promise<LinkAuthorization>;
+    cancel(id: string): Promise<LinkAuthorization | void>;
+}
+export interface LinkAuthorizationControllerSnapshot {
+    authorization?: LinkAuthorization;
+    busy: boolean;
+    /** Transport errors do not imply that the Host rejected the authorization. */
+    error?: Error;
+}
+/** Presentation URLs cannot contain credentials or executable protocols. */
+export declare function safeLinkAuthorizationUrl(value?: string): string | undefined;
+export declare function selectPreferredLinkAuthMode(provider: Pick<LinkProviderView, "authModes">, methodId?: string): LinkAuthMode | undefined;
+/** Adapt only the two legacy wire shapes. Unknown new steps remain unsupported. */
+export declare function getLinkAuthorizationStep(authorization: LinkAuthorization): LinkAuthorizationStep | undefined;
+/**
+ * Browser-safe lifecycle shared by Desktop and Web. The Host owns credentials,
+ * challenge progression and persistence; this controller owns one UI attempt.
+ */
+export declare class LinkAuthorizationController {
+    private readonly transport;
+    private readonly options;
+    private value;
+    private readonly listeners;
+    private timer?;
+    private generation;
+    private disposed;
+    private binding?;
+    constructor(transport: LinkAuthorizationTransport, options?: {
+        pollIntervalMs?: number;
+        retryIntervalMs?: number;
+    });
+    getSnapshot: () => LinkAuthorizationControllerSnapshot;
+    subscribe: (listener: () => void) => (() => void);
+    private publish;
+    private stop;
+    private current;
+    private deadline;
+    private accept;
+    private schedule;
+    private poll;
+    begin(input: LinkConnectionInput, authModeId: string): Promise<LinkAuthorization | undefined>;
+    respond(response: LinkAuthorizationResponse): Promise<LinkAuthorization | undefined>;
+    cancel(): Promise<void>;
+    clearError(): void;
+    reset(): void;
+    dispose(): void;
+}

package/dist/link-authorization.js

@@ -0,0 +1,273 @@
+/** Presentation URLs cannot contain credentials or executable protocols. */
+export function safeLinkAuthorizationUrl(value) {
+    try {
+        const url = new URL(value ?? "");
+        const transport = url.protocol === "https:" ||
+            (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
+        return transport && !url.username && !url.password ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function selectPreferredLinkAuthMode(provider, methodId) {
+    const modes = provider.authModes?.filter((mode) => mode.available && (!methodId || mode.methodId === methodId));
+    return modes?.find((mode) => mode.preferred) ?? modes?.[0];
+}
+/** Adapt only the two legacy wire shapes. Unknown new steps remain unsupported. */
+export function getLinkAuthorizationStep(authorization) {
+    if (authorization.state !== "pending")
+        return undefined;
+    if (authorization.step)
+        return authorization.step;
+    if (authorization.redirect)
+        return {
+            id: authorization.id,
+            kind: "redirect",
+            ...authorization.redirect,
+        };
+    if (authorization.prompt)
+        return { id: authorization.id, kind: "device-code", ...authorization.prompt };
+    return undefined;
+}
+const SUPPORTED_STEPS = new Set([
+    "redirect",
+    "device-code",
+    "qr-code",
+    "credential-input",
+    "local-session",
+    "consent",
+    "processing",
+]);
+function assertAuthorization(value, expectedId) {
+    if (typeof value.id !== "string" || !value.id || (expectedId && value.id !== expectedId))
+        throw new Error("授权响应与当前连接不匹配。");
+    if (!["pending", "connected", "failed", "cancelled"].includes(value.state))
+        throw new Error("无法识别授权状态，请更新客户端。");
+    if (value.state === "connected" && !value.connection)
+        throw new Error("服务尚未确认连接已保存，请刷新后重试。");
+    if (value.state === "connected" &&
+        (value.connection?.providerId !== value.providerId ||
+            (value.methodId && value.connection.methodId !== value.methodId)))
+        throw new Error("保存的连接与当前授权不匹配。");
+    const step = getLinkAuthorizationStep(value);
+    if (value.state === "pending" && (!step || !SUPPORTED_STEPS.has(step.kind)))
+        throw new Error("当前客户端不支持这个授权步骤，请更新客户端。");
+    if (step && (!step.id || !Number.isFinite(Date.parse(step.expiresAt))))
+        throw new Error("授权步骤缺少有效期限，请重新连接。");
+    if (value.expiresAt &&
+        (!Number.isFinite(Date.parse(value.expiresAt)) ||
+            (step && Date.parse(step.expiresAt) > Date.parse(value.expiresAt))))
+        throw new Error("授权任务的有效期限无效，请重新连接。");
+}
+/**
+ * Browser-safe lifecycle shared by Desktop and Web. The Host owns credentials,
+ * challenge progression and persistence; this controller owns one UI attempt.
+ */
+export class LinkAuthorizationController {
+    transport;
+    options;
+    value = { busy: false };
+    listeners = new Set();
+    timer;
+    generation = 0;
+    disposed = false;
+    binding;
+    constructor(transport, options = {}) {
+        this.transport = transport;
+        this.options = options;
+    }
+    getSnapshot = () => this.value;
+    subscribe = (listener) => {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    };
+    publish(next) {
+        if (this.disposed)
+            return;
+        this.value = next;
+        for (const listener of this.listeners)
+            listener();
+    }
+    stop() {
+        clearTimeout(this.timer);
+        return ++this.generation;
+    }
+    current(generation) {
+        return !this.disposed && generation === this.generation;
+    }
+    deadline(authorization) {
+        const step = getLinkAuthorizationStep(authorization);
+        return Math.min(authorization.expiresAt ? Date.parse(authorization.expiresAt) : Infinity, step ? Date.parse(step.expiresAt) : Infinity);
+    }
+    accept(value, generation, expectedId) {
+        if (!this.current(generation))
+            return;
+        assertAuthorization(value, expectedId);
+        if (this.binding &&
+            (value.providerId !== this.binding.providerId ||
+                (value.methodId && value.methodId !== this.binding.methodId)))
+            throw new Error("授权响应与当前服务不匹配。");
+        this.publish({ authorization: value, busy: false });
+        if (value.state === "pending")
+            this.schedule(generation);
+    }
+    schedule(generation, delay = this.options.pollIntervalMs ?? 2_000) {
+        const authorization = this.value.authorization;
+        if (!this.current(generation) || authorization?.state !== "pending")
+            return;
+        const remaining = this.deadline(authorization) - Date.now();
+        if (remaining <= 0) {
+            this.stop();
+            this.publish({
+                busy: false,
+                authorization: {
+                    ...authorization,
+                    state: "failed",
+                    step: undefined,
+                    prompt: undefined,
+                    redirect: undefined,
+                    errorCode: "authorization_expired",
+                },
+            });
+            void this.transport.cancel(authorization.id).catch(() => { });
+            return;
+        }
+        const step = getLinkAuthorizationStep(authorization);
+        // Input and consent are advanced by explicit responses, never by a GET.
+        const needsInput = step && ["credential-input", "local-session", "consent"].includes(step.kind);
+        this.timer = setTimeout(() => {
+            if (needsInput)
+                this.schedule(generation);
+            else
+                void this.poll(generation);
+        }, Math.min(delay, remaining));
+    }
+    async poll(generation) {
+        const authorization = this.value.authorization;
+        if (!this.current(generation) || authorization?.state !== "pending")
+            return;
+        if (this.deadline(authorization) <= Date.now()) {
+            this.schedule(generation);
+            return;
+        }
+        try {
+            const next = await this.transport.status(authorization.id);
+            this.accept(next, generation, authorization.id);
+        }
+        catch (cause) {
+            if (!this.current(generation))
+                return;
+            this.publish({ ...this.value, busy: false, error: asError(cause) });
+            const status = cause?.status;
+            if (status !== 401 && status !== 404)
+                this.schedule(generation, this.options.retryIntervalMs ?? 4_000);
+        }
+    }
+    async begin(input, authModeId) {
+        if (this.disposed || this.value.busy || this.value.authorization?.state === "pending")
+            return;
+        const generation = this.stop();
+        this.binding = input;
+        this.publish({ busy: true });
+        try {
+            const value = await this.transport.begin(input, authModeId);
+            if (!this.current(generation)) {
+                if (value.state === "pending")
+                    void this.transport.cancel(value.id).catch(() => { });
+                return;
+            }
+            try {
+                this.accept(value, generation);
+            }
+            catch (cause) {
+                if (value.state === "pending")
+                    void this.transport.cancel(value.id).catch(() => { });
+                throw cause;
+            }
+            return value;
+        }
+        catch (cause) {
+            if (this.current(generation))
+                this.publish({ busy: false, error: asError(cause) });
+        }
+    }
+    async respond(response) {
+        const authorization = this.value.authorization;
+        const step = authorization && getLinkAuthorizationStep(authorization);
+        if (this.disposed ||
+            this.value.busy ||
+            authorization?.state !== "pending" ||
+            !step ||
+            step.id !== response.stepId)
+            return;
+        if (this.deadline(authorization) <= Date.now()) {
+            this.schedule(this.generation);
+            return;
+        }
+        const generation = this.stop();
+        this.publish({ authorization, busy: true });
+        try {
+            const value = await this.transport.respond(authorization.id, response);
+            this.accept(value, generation, authorization.id);
+            return this.current(generation) ? value : undefined;
+        }
+        catch (cause) {
+            if (this.current(generation)) {
+                this.publish({ authorization, busy: false, error: asError(cause) });
+                // An uncertain write must be reconciled by a read, never replayed.
+                this.timer = setTimeout(() => void this.poll(generation), this.options.retryIntervalMs ?? 4_000);
+            }
+        }
+    }
+    async cancel() {
+        const authorization = this.value.authorization;
+        const generation = this.stop();
+        if (authorization?.state !== "pending") {
+            this.publish({ busy: false });
+            return;
+        }
+        this.publish({ authorization, busy: true });
+        try {
+            const result = await this.transport.cancel(authorization.id);
+            if (!this.current(generation))
+                return;
+            this.publish({
+                busy: false,
+                authorization: result ?? {
+                    ...authorization,
+                    state: "cancelled",
+                    step: undefined,
+                    prompt: undefined,
+                    redirect: undefined,
+                },
+            });
+        }
+        catch (cause) {
+            if (this.current(generation)) {
+                this.publish({ authorization, busy: false, error: asError(cause) });
+                this.schedule(generation, this.options.retryIntervalMs ?? 4_000);
+            }
+        }
+    }
+    clearError() {
+        this.publish({ ...this.value, error: undefined });
+    }
+    reset() {
+        if (this.value.busy || this.value.authorization?.state === "pending")
+            return;
+        this.stop();
+        this.publish({ busy: false });
+    }
+    dispose() {
+        const authorization = this.value.authorization;
+        this.stop();
+        this.disposed = true;
+        this.listeners.clear();
+        if (authorization?.state === "pending")
+            void this.transport.cancel(authorization.id).catch(() => { });
+    }
+}
+function asError(cause) {
+    return cause instanceof Error ? cause : new Error("连接操作失败，请重试。");
+}