@cratis/chronicle 6.9.1 → 6.11.0

package/connection/ChronicleConnection.ts

@@ -1,7 +1,8 @@
 // Copyright (c) Cratis. All rights reserved.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
-import type { Channel, ChannelCredentials, ChannelOptions } from '@grpc/grpc-js';
+import { status, type Channel, type ChannelCredentials, type ChannelOptions } from '@grpc/grpc-js';
+import { diag } from '@opentelemetry/api';
 import {
     ConnectionServiceDefinition,
     ConstraintsDefinition,
@@ -9,6 +10,7 @@ import {
     EventSequencesDefinition,
     EventStoresDefinition,
     EventTypesDefinition,
+    ExternalServicesDefinition,
     FailedPartitionsDefinition,
     IdentitiesDefinition,
     JobsDefinition,
@@ -28,10 +30,9 @@ import {
 import { ComplianceDefinition } from '../compliance/ComplianceContracts.js';
 import { createChannel, createClientFactory } from 'nice-grpc';
 import type { ClientMiddleware } from 'nice-grpc-common';
-import { Metadata } from 'nice-grpc-common';
+import { ClientError, Metadata } from 'nice-grpc-common';
 import { EventStoreSubscriptionsDefinition } from '../eventStoreSubscriptions/contracts.js';
-import { ExternalServicesDefinition } from '../externalServices/ExternalServicesContracts.js';
-import { AuthenticationMode, ChronicleConnectionString } from './ChronicleConnectionString.js';
+import { ChronicleConnectionString, type ChronicleServerAddress } from './ChronicleConnectionString.js';
 import { ChronicleServerAddressResolver } from './ChronicleServerAddressResolver.js';
 import { ChronicleServices } from './ChronicleServices.js';
 import { CompatibilityPreflight } from './CompatibilityPreflight.js';
@@ -94,7 +95,7 @@ export class ChronicleConnection implements ChronicleServices {
     private _connections!: ConnectionServiceClient;
     private _compatibility!: CompatibilityPreflight;
     private readonly _connectionString: ChronicleConnectionString;
-    private readonly _tokenProvider: ITokenProvider;
+    private readonly _tokenProviders = new Map<string, ITokenProvider>();
     private readonly _addressResolver: ChronicleServerAddressResolver;
     private readonly _loadBalancerStrategy: ILoadBalancerStrategy;
     private _isConnected = false;
@@ -111,7 +112,10 @@ export class ChronicleConnection implements ChronicleServices {
             this._connectionString = ChronicleConnectionString.Default;
         }
 
-        this._tokenProvider = this.createTokenProvider();
+        if (!this._connectionString.apiKey && (!!this._connectionString.username !== !!this._connectionString.password)) {
+            throw new Error('Connection string must contain both username and password, or neither');
+        }
+
         this._addressResolver = new ChronicleServerAddressResolver();
         this._loadBalancerStrategy = createLoadBalancerStrategy(this._connectionString.loadBalancer, this._connectionString.skipTlsValidation);
 
@@ -273,11 +277,12 @@ export class ChronicleConnection implements ChronicleServices {
         const candidates = await this._addressResolver.resolve(this._connectionString);
         const selected = await this._loadBalancerStrategy.select(candidates);
         const serverAddress = formatServerAddress(selected);
+        const tokenProvider = this.createTokenProvider(selected);
         const credentials = this._options.credentials ?? this._connectionString.createCredentials();
 
         this._channel = createChannel(serverAddress, credentials, channelOptions);
 
-        const factory = createClientFactory().use(this.createAuthMiddleware());
+        const factory = createClientFactory().use(this.createAuthMiddleware(tokenProvider));
         this._connections = factory.create(ConnectionServiceDefinition, this._channel);
         this._compatibility = new CompatibilityPreflight(this._connections, this._options.connectTimeout ?? 10_000);
         const eventSequenceFactory = factory.use(this._compatibility.middleware());
@@ -307,33 +312,29 @@ export class ChronicleConnection implements ChronicleServices {
         };
     }
 
-    private createTokenProvider(): ITokenProvider {
+    private createTokenProvider(selected: ChronicleServerAddress): ITokenProvider {
         const hasUsername = !!this._connectionString.username;
-        const hasPassword = !!this._connectionString.password;
         const hasApiKey = !!this._connectionString.apiKey;
 
         if (hasApiKey) {
             return new NoOpTokenProvider();
         }
 
-        if (hasUsername !== hasPassword) {
-            throw new Error('Connection string must contain both username and password, or neither');
-        }
-
-        if (hasUsername && hasPassword) {
-            return this.createOAuthTokenProvider(this._connectionString.username!, this._connectionString.password!);
+        if (hasUsername) {
+            return this.createOAuthTokenProvider(selected, this._connectionString.username!, this._connectionString.password!);
         }
 
         return this.createOAuthTokenProvider(
+            selected,
             ChronicleConnectionString.DEVELOPMENT_CLIENT,
             ChronicleConnectionString.DEVELOPMENT_CLIENT_SECRET
         );
     }
 
-    private createOAuthTokenProvider(username: string, password: string): ITokenProvider {
-        // Chronicle serves the authentication endpoint on the same port as the rest of the
-        // Kernel, so the authority defaults to the connection string's server address.
-        const serverPort = this._connectionString.serverAddress.port;
+    private createOAuthTokenProvider(selected: ChronicleServerAddress, username: string, password: string): ITokenProvider {
+        // Chronicle serves authentication on the selected kernel's port unless an explicit
+        // authority overrides it. Cache providers by endpoint across channel resets.
+        const serverPort = selected.port;
         let authorityHost: string;
         let authorityPort: number;
 
@@ -342,37 +343,95 @@ export class ChronicleConnection implements ChronicleServices {
             authorityHost = authority.hostname;
             authorityPort = authority.port ? parseInt(authority.port, 10) : serverPort;
         } else {
-            authorityHost = this._connectionString.serverAddress.host;
+            authorityHost = selected.host;
             authorityPort = serverPort;
         }
 
         const scheme = this._connectionString.disableTls ? 'http' : 'https';
-        return new OAuthTokenProvider(
-            `${scheme}://${authorityHost}:${authorityPort}/connect/token`,
-            username,
-            password,
-            this._connectionString.skipTlsValidation
-        );
+        const endpoint = `${scheme}://${authorityHost.includes(':') && !authorityHost.startsWith('[') ? `[${authorityHost}]` : authorityHost}:${authorityPort}/connect/token`;
+        let provider = this._tokenProviders.get(endpoint);
+        if (!provider) {
+            provider = new OAuthTokenProvider(endpoint, username, password, this._connectionString.skipTlsValidation);
+            this._tokenProviders.set(endpoint, provider);
+        }
+        return provider;
     }
 
-    private createAuthMiddleware(): ClientMiddleware {
-        const tokenProvider = this._tokenProvider;
+    private createAuthMiddleware(tokenProvider: ITokenProvider): ClientMiddleware {
         const connectionString = this._connectionString;
+        const logger = diag.createComponentLogger({ namespace: '@cratis/chronicle/ChronicleConnection' });
+        const loggedFailures = new WeakSet<Error>();
 
         return async function* authMiddleware(call, options) {
-            const token = await tokenProvider.getAccessToken();
+            let token: string | undefined;
+            let tokenFailure: Error | undefined;
+            try {
+                token = await acquireTokenUnlessAborted(() => tokenProvider.getAccessToken(), options.signal);
+            } catch (error) {
+                if (options.signal?.aborted) throw options.signal.reason;
+                tokenFailure = error instanceof Error ? error : new Error(String(error));
+                if (!loggedFailures.has(tokenFailure)) {
+                    loggedFailures.add(tokenFailure);
+                    logger.warn('Failed to obtain OAuth2 token; sending RPC without authorization', { error: tokenFailure.message });
+                }
+            }
+            if (!token) tokenFailure ??= tokenProvider.lastTokenFailure;
 
             if (token) {
                 const metadata = options.metadata ? Metadata(options.metadata) : Metadata();
                 metadata.set('authorization', `Bearer ${token}`);
                 options.metadata = metadata;
-            } else if (connectionString.authenticationMode === AuthenticationMode.ApiKey && connectionString.apiKey) {
+            } else if (connectionString.apiKey) {
                 const metadata = options.metadata ? Metadata(options.metadata) : Metadata();
                 metadata.set('api-key', connectionString.apiKey);
                 options.metadata = metadata;
             }
 
-            return yield* call.next(call.request, options);
+            if (options.signal?.aborted) throw options.signal.reason;
+            try {
+                return yield* call.next(call.request, options);
+            } catch (error) {
+                if ((error as { code?: number })?.code !== status.UNAUTHENTICATED) throw error;
+                if (token && !call.responseStream && !call.requestStream) {
+                    try {
+                        const refreshed = await acquireTokenUnlessAborted(() => tokenProvider.refresh(), options.signal);
+                        if (refreshed) {
+                            const metadata = options.metadata ? Metadata(options.metadata) : Metadata();
+                            metadata.set('authorization', `Bearer ${refreshed}`);
+                            return yield* call.next(call.request, { ...options, metadata });
+                        }
+                    } catch (refreshError) {
+                        if (options.signal?.aborted) throw options.signal.reason;
+                        tokenFailure = refreshError instanceof Error ? refreshError : new Error(String(refreshError));
+                    }
+                    tokenFailure ??= tokenProvider.lastTokenFailure;
+                }
+                if (tokenFailure) {
+                    const original = error as ClientError;
+                    const wrapped = new ClientError(original.path, original.code, `${tokenFailure.message}; Chronicle rejected the unauthenticated RPC`);
+                    Object.defineProperty(wrapped, 'cause', { value: original });
+                    Object.defineProperty(wrapped, 'tokenFailure', { value: tokenFailure });
+                    throw wrapped;
+                }
+                throw error;
+            }
         };
     }
 }
+
+/** Stops waiting for a token on cancellation without canceling the shared token request. */
+async function acquireTokenUnlessAborted(acquire: () => Promise<string | undefined>, signal?: AbortSignal): Promise<string | undefined> {
+    if (signal?.aborted) throw signal.reason;
+    if (!signal) return acquire();
+
+    let onAbort!: () => void;
+    const aborted = new Promise<never>((_, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+    try {
+        return await Promise.race([acquire(), aborted]);
+    } finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}

package/connection/ChronicleServices.ts

@@ -7,6 +7,7 @@ import type {
     EventSequencesClient,
     EventStoresClient,
     EventTypesClient,
+    ExternalServicesClient,
     FailedPartitionsClient,
     IdentitiesClient,
     JobsClient,
@@ -24,7 +25,6 @@ import type {
 } from '@cratis/chronicle.contracts';
 import type { ComplianceClient } from '../compliance/ComplianceContracts.js';
 import type { EventStoreSubscriptionsClient } from '../eventStoreSubscriptions/contracts.js';
-import type { ExternalServicesClient } from '../externalServices/ExternalServicesContracts.js';
 
 /**
  * Represents all Chronicle gRPC services.

package/connection/CompatibilityPreflight.ts

@@ -5,9 +5,9 @@ import { createRequire } from 'node:module';
 import { chronicleDescriptorSet, type ConnectionServiceClient } from '@cratis/chronicle.contracts';
 import { ClientError, Status, type ClientMiddleware } from 'nice-grpc-common';
 import { IncompatibleChronicleServer } from './IncompatibleChronicleServer.js';
+import { clientVersion } from './clientVersion.js';
 
 const require = createRequire(import.meta.url);
-const clientVersion = (require('@cratis/chronicle/package.json') as { version: string }).version;
 const protocolVersion = (require('@cratis/chronicle.contracts/package.json') as { version: string }).version;
 
 /** Verifies the installed wire contract before a channel can perform event-sequence operations. */

package/connection/RejectedChronicleCredentials.ts

@@ -0,0 +1,10 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+/** Authentication failed permanently because the token endpoint rejected the credentials. */
+export class RejectedChronicleCredentials extends Error {
+    constructor(message: string, options?: ErrorOptions) {
+        super(message, options);
+        this.name = 'RejectedChronicleCredentials';
+    }
+}

package/connection/TokenProvider.spec.ts

@@ -98,19 +98,18 @@ describe('OAuthTokenProvider', () => {
     });
 
     describe('when no token can be fetched', () => {
-        it('should return undefined instead of rejecting', async () => {
+        it('should report the endpoint and cause', async () => {
             const { provider } = createProvider([new Error('unavailable')]);
 
-            // The RPC proceeds and fails with the server's auth rejection — that is
-            // the session machinery's problem, not the token provider's.
-            expect(await provider.getAccessToken()).toBeUndefined();
+            await expect(provider.getAccessToken()).rejects.toThrow('https://localhost:35000/connect/token: unavailable');
         });
 
         it('should throttle further fetch attempts', async () => {
             const { provider, fetchToken } = createProvider([new Error('unavailable')]);
 
+            await expect(provider.getAccessToken()).rejects.toThrow('unavailable');
             expect(await provider.getAccessToken()).toBeUndefined();
-            expect(await provider.getAccessToken()).toBeUndefined();
+            expect(provider.lastTokenFailure?.message).toContain('unavailable');
 
             // The second request arrives well inside the retry delay — one attempt,
             // not one per RPC (the session answers a keepalive every second).
@@ -121,7 +120,7 @@ describe('OAuthTokenProvider', () => {
             vi.useFakeTimers();
             const { provider, fetchToken } = createProvider([new Error('unavailable'), token('token-1', longLifetime)]);
 
-            expect(await provider.getAccessToken()).toBeUndefined();
+            await expect(provider.getAccessToken()).rejects.toThrow('unavailable');
             vi.advanceTimersByTime(5000);
 
             expect(await provider.getAccessToken()).toBe('token-1');

package/connection/TokenProvider.ts

@@ -1,8 +1,7 @@
 // Copyright (c) Cratis. All rights reserved.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
-import { diag } from '@opentelemetry/api';
-import { fetchOAuthAccessToken, type OAuthTokenResponse } from './fetchOAuthAccessToken.js';
+import { fetchOAuthAccessToken, OAuthTokenHttpError, type OAuthTokenResponse } from './fetchOAuthAccessToken.js';
 
 // Refresh once the token has less than this long left before it expires.
 const TOKEN_REFRESH_MARGIN_MS = 60_000;
@@ -19,12 +18,12 @@ export interface ITokenProvider {
     /**
      * Gets the current access token.
      *
-     * Never rejects — when no token can be obtained the result is undefined, the RPC
-     * proceeds without authorization and fails with the server's rejection, which the
-     * session machinery recovers from.
-     * @returns Promise resolving to the access token or undefined if not available.
+     * A failed fetch rejects with the token endpoint and cause; throttled calls return undefined.
+     * @returns Promise resolving to the access token or undefined when no token is available.
      */
     getAccessToken(): Promise<string | undefined>;
+    /** Most recent token failure when no token could be obtained. */
+    readonly lastTokenFailure?: Error;
 
     /**
      * Refreshes the access token by clearing cached tokens and obtaining a new one.
@@ -58,15 +57,16 @@ export class NoOpTokenProvider implements ITokenProvider {
  * auth endpoint does not turn every RPC into a fetch attempt.
  */
 export class OAuthTokenProvider implements ITokenProvider {
-    private readonly _logger = diag.createComponentLogger({
-        namespace: '@cratis/chronicle/OAuthTokenProvider'
-    });
-
     private _accessToken?: string;
     private _expiresAt = 0;
     private _lastFailedFetch?: number;
+    private _lastFetchError?: Error;
     private _refreshPromise?: Promise<string | undefined>;
 
+    get lastTokenFailure(): Error | undefined {
+        return this._lastFetchError;
+    }
+
     /**
      * Creates a new {@link OAuthTokenProvider}.
      * @param tokenEndpoint - The OAuth2 token endpoint to request tokens from.
@@ -76,12 +76,12 @@ export class OAuthTokenProvider implements ITokenProvider {
      * @param _fetchToken - Test-only seam replacing the OAuth2 token request.
      */
     constructor(
-        tokenEndpoint: string,
+        private readonly _tokenEndpoint: string,
         clientId: string,
         clientSecret: string,
         skipTlsValidation: boolean = true,
         private readonly _fetchToken: () => Promise<OAuthTokenResponse> = () =>
-            fetchOAuthAccessToken(tokenEndpoint, clientId, clientSecret, skipTlsValidation)
+            fetchOAuthAccessToken(this._tokenEndpoint, clientId, clientSecret, skipTlsValidation)
     ) {}
 
     async getAccessToken(): Promise<string | undefined> {
@@ -94,7 +94,9 @@ export class OAuthTokenProvider implements ITokenProvider {
         }
 
         if (this.isThrottled()) {
-            return this.cachedTokenWhileValid();
+            const cached = this.cachedTokenWhileValid();
+            if (cached) return cached;
+            return undefined;
         }
 
         this._refreshPromise = this.fetchAndCacheAccessToken();
@@ -109,6 +111,7 @@ export class OAuthTokenProvider implements ITokenProvider {
         this._accessToken = undefined;
         this._expiresAt = 0;
         this._lastFailedFetch = undefined;
+        this._lastFetchError = undefined;
         return this.getAccessToken();
     }
 
@@ -117,6 +120,11 @@ export class OAuthTokenProvider implements ITokenProvider {
     }
 
     private isThrottled(): boolean {
+        // Authentication rejections must be checked on each new connection attempt: the
+        // kernel may still be registering bootstrap clients during startup.
+        const failure = this._lastFetchError?.cause;
+        if (failure instanceof OAuthTokenHttpError && [400, 401].includes(failure.statusCode) &&
+            ['invalid_client', 'unauthorized_client', 'invalid_grant'].includes(failure.errorCode ?? '')) return false;
         return this._lastFailedFetch !== undefined && Date.now() - this._lastFailedFetch < FAILED_FETCH_RETRY_DELAY_MS;
     }
 
@@ -130,13 +138,14 @@ export class OAuthTokenProvider implements ITokenProvider {
             this._accessToken = response.access_token;
             this._expiresAt = Date.now() + this.lifetimeSecondsFrom(response) * 1000;
             this._lastFailedFetch = undefined;
+            this._lastFetchError = undefined;
             return this._accessToken;
         } catch (error) {
-            this._logger.warn('Failed to fetch OAuth2 token', {
-                error: error instanceof Error ? error.message : String(error)
-            });
             this._lastFailedFetch = Date.now();
-            return this.cachedTokenWhileValid();
+            this._lastFetchError = new Error(`Failed to obtain OAuth2 token from ${this._tokenEndpoint}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+            const cached = this.cachedTokenWhileValid();
+            if (cached) return cached;
+            throw this._lastFetchError;
         }
     }
 

package/connection/clientVersion.spec.ts

@@ -0,0 +1,27 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { createRequire } from 'node:module';
+import { describe, expect, it, vi } from 'vitest';
+import { ChronicleClient } from '../ChronicleClient.js';
+import { ChronicleOptions } from '../ChronicleOptions.js';
+import { KernelKeepAlive } from './KernelKeepAlive.js';
+import { clientVersion } from './clientVersion.js';
+
+const require = createRequire(import.meta.url);
+
+describe('Chronicle client version', () => {
+    it('uses the installed package version for kernel keep-alive', async () => {
+        const expected = (require('@cratis/chronicle/package.json') as { version: string }).version;
+        const start = vi.spyOn(KernelKeepAlive.prototype, 'start').mockResolvedValue(undefined);
+        const client = new ChronicleClient(ChronicleOptions.fromConnectionString('chronicle://localhost:35000', { discoveryPatterns: [] }));
+        try {
+            await (client as unknown as { startKernelKeepAlive(): Promise<void> }).startKernelKeepAlive();
+            expect(clientVersion).toBe(expected);
+            expect(start.mock.calls[0][0].ClientVersion).toBe(expected);
+        } finally {
+            client.dispose();
+            start.mockRestore();
+        }
+    });
+});

package/connection/clientVersion.ts

@@ -0,0 +1,9 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+/** Version of the installed Chronicle client package. */
+export const clientVersion = (require('@cratis/chronicle/package.json') as { version: string }).version;

package/connection/describeRequestError.spec.ts

@@ -0,0 +1,22 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { describe, expect, it } from 'vitest';
+import { describeRequestError } from './fetchOAuthAccessToken.js';
+
+describe('when describing a token request error', () => {
+    it('should include the inner errors of an aggregate error with an empty message', () => {
+        const refused = Object.assign(new Error('connect ECONNREFUSED 127.0.0.1:35999'), { code: 'ECONNREFUSED' });
+        const refusedIpv6 = Object.assign(new Error('connect ECONNREFUSED ::1:35999'), { code: 'ECONNREFUSED' });
+        const error = Object.assign(new AggregateError([refusedIpv6, refused], ''), { code: 'ECONNREFUSED' });
+        expect(describeRequestError(error)).toBe('connect ECONNREFUSED ::1:35999; connect ECONNREFUSED 127.0.0.1:35999');
+    });
+
+    it('should keep the message of an ordinary error', () => {
+        expect(describeRequestError(new Error('socket hang up'))).toBe('socket hang up');
+    });
+
+    it('should name the code when there is no message', () => {
+        expect(describeRequestError(Object.assign(new Error(''), { code: 'ETIMEDOUT' }))).toBe('ETIMEDOUT');
+    });
+});

package/connection/fetchOAuthAccessToken.ts

@@ -7,6 +7,21 @@ import * as https from 'https';
 /**
  * The shape of a successful OAuth2 token response.
  */
+export class OAuthTokenHttpError extends Error {
+    readonly errorCode?: string;
+
+    constructor(readonly statusCode: number, body: string) {
+        super(`Token request failed with status ${statusCode}: ${body}`);
+        this.name = 'OAuthTokenHttpError';
+        try {
+            const parsed = JSON.parse(body) as { error?: unknown };
+            if (parsed && typeof parsed.error === 'string') this.errorCode = parsed.error;
+        } catch {
+            // A proxy may return HTML or plain text instead of an OAuth error response.
+        }
+    }
+}
+
 export interface OAuthTokenResponse {
     access_token: string;
 
@@ -58,7 +73,7 @@ export function fetchOAuthAccessToken(
 
             response.on('end', () => {
                 if (response.statusCode !== 200) {
-                    reject(new Error(`Token request failed with status ${response.statusCode}: ${data}`));
+                    reject(new OAuthTokenHttpError(response.statusCode ?? 0, data));
                     return;
                 }
 
@@ -77,10 +92,26 @@ export function fetchOAuthAccessToken(
         });
 
         request.on('error', error => {
-            reject(new Error(`Token request failed: ${error.message}`));
+            reject(new Error(`Token request failed: ${describeRequestError(error)}`, { cause: error }));
         });
 
         request.write(body);
         request.end();
     });
 }
+
+/**
+ * Describes a request error. Connecting to a host that resolves to several addresses, such as
+ * localhost, fails with an AggregateError whose own message is empty.
+ * @param error - The request error.
+ * @returns A description that names the failure.
+ */
+export function describeRequestError(error: Error): string {
+    const code = (error as NodeJS.ErrnoException).code;
+    const inner = error instanceof AggregateError
+        ? error.errors.map(item => item instanceof Error ? item.message : String(item)).filter(Boolean).join('; ')
+        : '';
+    return [error.message, inner, code && !error.message.includes(code) && !inner.includes(code) ? code : '']
+        .filter(Boolean)
+        .join(' ') || 'unknown error';
+}

package/dist/ChronicleClient.d.ts

@@ -32,6 +32,7 @@ export declare class ChronicleClient implements IChronicleClient {
     private _keepAliveAbortController?;
     private _healthCheckInFlight;
     private _connectionFailure?;
+    private _consecutiveCredentialRejections;
     /**
      * Creates a new {@link ChronicleClient} using the provided options.
      * @param options - The options to configure the client, including the connection string.
@@ -53,6 +54,8 @@ export declare class ChronicleClient implements IChronicleClient {
      */
     private backOff;
     private withReconnect;
+    private terminalConnectionError;
+    private hasOAuthCredentialRejection;
     private shouldReconnect;
     private toErrorMessage;
     private startConnectionWatchdog;

package/dist/ChronicleClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChronicleClient.d.ts","sourceRoot":"","sources":["../ChronicleClient.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAK/C;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,gBAAgB;IAyBxC,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAxB9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAU;IAE/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAErB;IAEH,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAC5C,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,yBAAyB,CAAC,CAAkB;IACpD,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,kBAAkB,CAAC,CAAQ;IAEnC;;;OAGG;IACH,YAAqB,OAAO,EAAE,gBAAgB,EA8C7C;IAED,kBAAkB;IACZ,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwDrH;IAED,kBAAkB;IACZ,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAwBhD;IAED,kBAAkB;IAClB,OAAO,IAAI,IAAI,CAoBd;YAEa,gBAAgB;YA0ChB,eAAe;YAuBf,SAAS;IAiDvB;;;;OAIG;YACW,OAAO;YAcP,aAAa;IAa3B,OAAO,CAAC,eAAe;IAyBvB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,uBAAuB;YAQjB,cAAc;YAkBd,oBAAoB;IAqClC,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,0BAA0B;YAQpB,yBAAyB;CAmB1C"}
+{"version":3,"file":"ChronicleClient.d.ts","sourceRoot":"","sources":["../ChronicleClient.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAUzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAK/C;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,gBAAgB;IA0BxC,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAzB9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAU;IAE/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAErB;IAEH,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAC5C,OAAO,CAAC,mBAAmB,CAAC,CAAgB;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,yBAAyB,CAAC,CAAkB;IACpD,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,kBAAkB,CAAC,CAAQ;IACnC,OAAO,CAAC,gCAAgC,CAAK;IAE7C;;;OAGG;IACH,YAAqB,OAAO,EAAE,gBAAgB,EA8C7C;IAED,kBAAkB;IACZ,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwDrH;IAED,kBAAkB;IACZ,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAwBhD;IAED,kBAAkB;IAClB,OAAO,IAAI,IAAI,CAqBd;YAEa,gBAAgB;YA4ChB,eAAe;YAuBf,SAAS;IAmDvB;;;;OAIG;YACW,OAAO;YAcP,aAAa;IAyB3B,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,2BAA2B;IAOnC,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,uBAAuB;YAQjB,cAAc;YAkBd,oBAAoB;IAmClC,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,0BAA0B;YAQpB,yBAAyB;CAmB1C"}