@coventia/softphone 0.1.0 → 0.2.1

package/dist/zadarma/index.cjs

@@ -421,6 +421,14 @@ var SipCallEngine = class {
   #uaInFlight = null;
   #domain = "";
   #activeCall = null;
+  /**
+   * The consult leg from `startConsult` (SPEC §5.6), if one is live on this UA right now.
+   *
+   * Tracked separately from `#activeCall` so `#maybeTeardownUA` can tell "both legs are actually gone"
+   * apart from "the main leg ended, but a consult is still up" — see that method's own comment for the
+   * bug this exists to prevent.
+   */
+  #consultCall = null;
   /** The chosen microphone, or `null` for the browser default. Read fresh by every new leg's
    *  `mediaConstraints`, and pushed live to `#activeCall` by `setInputDevice`. */
   #inputDeviceId = null;
@@ -539,9 +547,7 @@ var SipCallEngine = class {
     const ms = this.provider.quirks?.noInviteTeardownMs;
     if (!ms) return;
     this.#clearNoInviteTimer();
-    this.#noInviteTimer = setTimeout(() => {
-      if (!this.#activeCall) this.#teardownUA();
-    }, ms);
+    this.#noInviteTimer = setTimeout(() => this.#maybeTeardownUA(), ms);
   }
   /**
    * Rebuild the incoming-signal channel with fresh credentials, after a registration failure.
@@ -663,6 +669,7 @@ var SipCallEngine = class {
     }
     this.#ua = null;
     this.#activeCall = null;
+    this.#consultCall = null;
   }
   /** Place a call once the UA is registered (its 200 OK for REGISTER has arrived). */
   /**
@@ -705,7 +712,7 @@ var SipCallEngine = class {
         const code = missed ? "call/missed" : CALL_END_CODES[event.reason];
         if (code) this.#reportError(code, event.cause);
         if (this.#activeCall === call) this.#activeCall = null;
-        if (this.provider.registrationMode === "on-demand") this.#teardownUA();
+        this.#maybeTeardownUA();
       }
     });
     return call;
@@ -716,12 +723,38 @@ var SipCallEngine = class {
       mediaConstraints: buildAudioConstraints(this.#inputDeviceId),
       pcConfig: PC_CONFIG
     });
-    return new SipEngineCall(consultSession, {
+    const consultCall = new SipEngineCall(consultSession, {
       id: nextCallId(),
       buildTarget: (x) => this.#buildTarget(x),
       placeConsult: () => Promise.reject(new Error("cannot consult from a consult leg")),
       iceGatheringCapMs: this.provider.quirks?.iceGatheringCapMs ?? DEFAULT_ICE_CAP_MS
     });
+    this.#consultCall = consultCall;
+    consultCall.onEvent((event) => {
+      if (event.type === "ended") {
+        if (this.#consultCall === consultCall) this.#consultCall = null;
+        this.#maybeTeardownUA();
+      }
+    });
+    return consultCall;
+  }
+  /**
+   * On-demand registration (SPEC §3.3): the UA is disposable once NOTHING is left on it — but "the
+   * main leg ended" (or "no INVITE followed this push") is not the same fact as "nothing is left."
+   * `completeTransfer()` (SPEC §5.6) ends the main leg via a REFER…Replaces BYE *while the consult leg
+   * is still what the PBX needs to bridge the caller onto* — tearing the UA down (and with it, EVERY
+   * session on it, via `terminateSessions`) the instant the main leg's `ended` fires killed that
+   * consult leg out from under the transfer before the bridge could use it, and the caller was simply
+   * gone. Two real call sites hit this independently (found live, 2026-08-04): the main leg's own
+   * `ended` handler, and `#armNoInviteTeardown`'s 5s timer — the latter re-arms on EVERY push,
+   * including unrelated "answered" pushes Zadarma sends around other account activity, so it can fire
+   * minutes after a transfer with no `#activeCall` and no idea a consult leg is mid-handoff. Both now
+   * route through here rather than checking `#activeCall` alone.
+   */
+  #maybeTeardownUA() {
+    if (this.provider.registrationMode !== "on-demand") return;
+    if (this.#activeCall || this.#consultCall) return;
+    this.#teardownUA();
   }
   #startRejectGuard() {
     const ms = this.provider.quirks?.rejectGuardMs;
@@ -756,6 +789,8 @@ async function loadJsSipFactory() {
 // src/transports/providers/zadarma.ts
 var PING = { localMs: 3e4, globalMs: 6e4 };
 var KEY_REFRESH_BUFFER_MS = 2 * 60 * 60 * 1e3;
+var REBUILD_CONNECT_TIMEOUT_MS = 1e4;
+var REBUILD_RETRY_MS = 3e4;
 var ZADARMA_QUIRKS = {
   // Zadarma's registrar REFUSES to register a WebRTC client with any other User-Agent — a clean 401
   // after a valid digest challenge, indistinguishable from a wrong password (§3.1). The old CRM
@@ -783,6 +818,12 @@ var ZadarmaPushSignal = class {
   #connected = false;
   #pingTimers = [];
   #refreshTimer;
+  /** The replacement socket of a rebuild in flight, not yet current. */
+  #candidate = null;
+  /** Abandons the rebuild in flight (closing its candidate). */
+  #abortRebuild = null;
+  #rebuilding = false;
+  #retryTimer;
   #unwatchBackground;
   #closed = false;
   #listeners = /* @__PURE__ */ new Set();
@@ -798,20 +839,35 @@ var ZadarmaPushSignal = class {
     if (this.#closed) return;
     const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
     this.#socket = socket;
+    this.#attach(socket);
+    this.#armRefresh(keyExpiresAt);
+  }
+  /**
+   * Wires one socket's events. `this.#socket` is read when an event FIRES, not when it is wired: a socket that
+   * has been replaced must stop driving connectivity (our own `close()` of it emits `disconnect`, which would
+   * otherwise flip the state to offline right after a perfectly healthy swap). `update` is the exception — it is
+   * forwarded from any socket not yet closed, because a push seen twice is harmless (the engine ignores a
+   * repeated signal mid-call and reuses a UA that already exists) while one seen by neither is a missed call.
+   *
+   * With `hooks`, the socket is a rebuild's candidate: its first `connect` or failure goes to the rebuild instead
+   * of changing the connection state (it is not current yet).
+   */
+  #attach(socket, hooks) {
     socket.on("connect", () => {
+      if (hooks && socket === this.#candidate) return hooks.onConnect();
+      if (socket !== this.#socket) return;
       this.#setConnected(true);
       this.#startPings(socket);
     });
     socket.on("update", () => this.#emit());
-    socket.on("disconnect", () => {
+    const lost = () => {
+      if (hooks && socket === this.#candidate) return hooks.onFailure();
+      if (socket !== this.#socket) return;
       this.#stopPings();
       this.#setConnected(false);
-    });
-    socket.on("connect_error", () => {
-      this.#stopPings();
-      this.#setConnected(false);
-    });
-    this.#armRefresh(keyExpiresAt);
+    };
+    socket.on("disconnect", lost);
+    socket.on("connect_error", lost);
   }
   /**
    * Presence pings — **the reason an idle tab keeps receiving calls**.
@@ -850,22 +906,92 @@ var ZadarmaPushSignal = class {
     if (!Number.isFinite(ms) || ms <= 0) return;
     this.#refreshTimer = setTimeout(() => void this.#reopen(), ms);
   }
+  /**
+   * Replaces the push socket with a fresh one — MAKE-BEFORE-BREAK (presence-client-reporting.md §4.1, T8).
+   *
+   * Why it must happen at all: Zadarma's gateway decides the extension is alive from the raw Engine.IO ping, which
+   * a hidden tab's throttled timers silently stop sending, so while the tab is hidden the socket is rebuilt every
+   * 20 s (`push-socket-reliability.md` §5.3), and once before the key expires. Why it must not leave a gap: the
+   * old close-then-reopen reported `connected = false` for the ~0.5 s in between, which took the softphone
+   * `offline`, tore down the presence socket and left Zadarma with no socket to push an incoming call to.
+   *
+   * Now the OLD socket stays up and stays current until the NEW one has actually connected; only then do we swap,
+   * move the pings and close the old one. A healthy rebuild never changes `connected`. A failed one — the key fetch
+   * throws, the socket errors, or it has not connected within `REBUILD_CONNECT_TIMEOUT_MS` — keeps the old socket
+   * and retries, instead of leaving the tab disconnected. Zadarma does not evict the older of two sockets for one
+   * sip (multi-tab-leader-election.md §1), so the overlap is safe.
+   */
   async #reopen() {
-    if (this.#closed) return;
-    this.#stopPings();
-    this.#socket?.close();
-    this.#socket = null;
-    this.#setConnected(false);
+    if (this.#closed || this.#rebuilding) return;
+    if (!this.#socket) {
+      try {
+        await this.#open();
+      } catch {
+      }
+      return;
+    }
+    this.#rebuilding = true;
     try {
-      await this.#open();
+      const { key, sip, keyExpiresAt } = await this.deps.fetchKey();
+      if (this.#closed) return;
+      const swapped = await new Promise((resolve) => {
+        const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
+        this.#candidate = socket;
+        let settled = false;
+        const finish = (ok) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          this.#abortRebuild = null;
+          if (ok && socket.connected) {
+            this.#swapIn(socket, keyExpiresAt);
+          } else {
+            this.#candidate = null;
+            socket.close();
+          }
+          resolve(ok && socket.connected);
+        };
+        const timer = setTimeout(() => finish(false), REBUILD_CONNECT_TIMEOUT_MS);
+        this.#abortRebuild = () => finish(false);
+        this.#attach(socket, { onConnect: () => finish(true), onFailure: () => finish(false) });
+      });
+      if (!swapped) this.#armRetry();
     } catch {
+      this.#armRetry();
+    } finally {
+      this.#rebuilding = false;
     }
   }
+  /**
+   * The moment of the swap — synchronous, called from the candidate's own `connect` event so nothing can run
+   * between "the new socket is up" and "it is the current one". Order matters: `#socket` moves first, so the old
+   * socket's `disconnect` (our own `close()` of it, just below) is ignored by `#attach`.
+   */
+  #swapIn(socket, keyExpiresAt) {
+    const previous = this.#socket;
+    this.#socket = socket;
+    this.#candidate = null;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = void 0;
+    this.#stopPings();
+    this.#startPings(socket);
+    this.#setConnected(true);
+    previous?.close();
+    this.#armRefresh(keyExpiresAt);
+  }
+  #armRetry() {
+    if (this.#closed) return;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = setTimeout(() => void this.#reopen(), REBUILD_RETRY_MS);
+  }
   disconnect() {
     this.#closed = true;
     this.#stopPings();
     clearTimeout(this.#refreshTimer);
     this.#refreshTimer = void 0;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = void 0;
+    this.#abortRebuild?.();
     this.#unwatchBackground?.();
     this.#unwatchBackground = void 0;
     this.#socket?.close();