@dokebi/sse 0.4.3 → 0.4.4

package/AI.md

@@ -94,7 +94,7 @@ export default defineApp({
 
 ## 4. Connection lifetime
 
-- Response: 200 `text/event-stream; charset=utf-8`, `Cache-Control: no-cache, no-transform`, `X-Accel-Buffering: no`, `Connection: keep-alive`. The first lines are `retry: <retryMs>` and `event: dokebi-open` (data `{"retryMs":…}`). The Fastify response is hijacked and written directly, so no compression hook applies (dokebi-web does not compress).
+- Response: 200 `text/event-stream; charset=utf-8`, `Cache-Control: no-cache, no-transform`, `X-Accel-Buffering: no`; no `Connection` of its own, so Node answers the request's (a proxy that sends `Connection: close` upstream gets the socket closed after the stream, never reused). The first lines are `retry: <retryMs>` and `event: dokebi-open` (data `{"retryMs":…}`). The Fastify response is hijacked and written directly, so no compression hook applies (dokebi-web does not compress).
 - Refusals: another origin (not listed) 403 `ORIGIN_FORBIDDEN`; before start or while stopping 503 (dokebi-web `STARTING`, `DRAINING`; this plugin `CLOSING`); full 503 `CAPACITY` (`Retry-After: 5`); no authentication 401; an `authorization.valid()` that throws 500 `AUTHORIZATION_FAILED` (error `SSE_AUTHORIZATION_FAILED`); the session save before the stream failed 500 `COMMIT_FAILED` (below). EventSource cannot see these statuses (the client below tells them apart with a probe). For a listed foreign origin (`origins`) the 401, 503 and 500 refusals carry the same CORS headers as the stream, so a page of that origin (and the client's probe) can read them; another origin's 403 carries none.
 - Cookies (D-0089): the stream hijacks the Fastify reply, so **no onSend hook runs**. Just before it writes the head (after origin, capacity, `authenticate` and the probe), the stream runs the before-hijack steps that plugins register for the work they otherwise do in onSend — the @dokebi/session save (or rolling refresh) and the @dokebi/auth cookies (a remember-me restore by a `required` guard rotates the token) — and waits for them, at most `beforeStreamTimeoutMs` (5 s). Then every `Set-Cookie` on the reply (those steps, a hook, a guard) is written with the stream head; browsers apply it on the SSE 200. A step that fails or times out refuses the stream: 500 `{ error: 'COMMIT_FAILED' }`, error `SSE_COMMIT_FAILED` (the full cause). After the head the request's session is final (a change throws `CLOSED`). The steps are matched by name only (`Symbol.for('dokebi.web.beforeHijack')` on the Fastify instance): this package imports neither plugin. (The `dokebiProbe` answer below is a normal reply and runs onSend instead.)
 - `?dokebiProbe=1`: checks only origin, capacity and authentication and answers 204 (no stream is opened). The browser client uses it to find out why a connection failed.

package/dist/plugin.js

@@ -109,7 +109,7 @@ class SseRuntime {
 /** Factory input: `{ app, options? }`. Options default to `app.config['dokebi-sse']`. */
 export const createPlugin = definePlugin({
     name: 'dokebi-sse',
-    version: '0.4.3',
+    version: '0.4.4',
     core: '^0.4.2',
     // The declaration (not parseOptions) so core logs OPTION_DEPRECATED for old keys (bus, closeTimeoutMs).
     options: declaration,

package/dist/wire.d.ts

@@ -13,5 +13,4 @@ export declare const HEADERS: Readonly<{
     'content-type': "text/event-stream; charset=utf-8";
     'cache-control': "no-cache, no-transform";
     'x-accel-buffering': "no";
-    connection: "keep-alive";
 }>;

package/dist/wire.js

@@ -40,5 +40,7 @@ export const HEADERS = Object.freeze({
     'cache-control': 'no-cache, no-transform',
     // nginx: do not buffer this response.
     'x-accel-buffering': 'no',
-    connection: 'keep-alive',
+    // No `connection`: Node answers the request's own (keep-alive, or close when the proxy asked to
+    // close). A forced keep-alive kept a socket the proxy had closed for itself, and the request it
+    // sent next on it was refused by Node's parser with a bare 400 (HPE_CLOSED_CONNECTION).
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/sse",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Server-sent events for @dokebi/web: authenticated streams, rooms, cross-worker fan-out over @dokebi/event-bus, and a browser client",
   "keywords": [
     "dokebi",
@@ -68,12 +68,12 @@
     }
   },
   "devDependencies": {
-    "@dokebi/cluster": "0.4.1",
-    "@dokebi/config": "0.4.4",
+    "@dokebi/cluster": "0.4.2",
+    "@dokebi/config": "0.4.5",
     "@dokebi/event-bus": "0.4.2",
     "@dokebi/health": "0.4.1",
     "@dokebi/nats": "0.4.1",
-    "@dokebi/web": "0.4.3",
+    "@dokebi/web": "0.4.4",
     "react": "19.3.0",
     "react-test-renderer": "19.3.0",
     "vite": "8.3.4",