@dokebi/sse 0.4.3 → 0.4.5

package/AI.md

@@ -94,7 +94,7 @@ export default defineApp({
 
 ## 4. Connection lifetime
 
-- Response: 200 `text/event-stream; charset=utf-8`, `Cache-Control: no-cache, no-transform`, `X-Accel-Buffering: no`, `Connection: keep-alive`. The first lines are `retry: <retryMs>` and `event: dokebi-open` (data `{"retryMs":…}`). The Fastify response is hijacked and written directly, so no compression hook applies (dokebi-web does not compress).
+- Response: 200 `text/event-stream; charset=utf-8`, `Cache-Control: no-cache, no-transform`, `X-Accel-Buffering: no`; no `Connection` of its own, so Node answers the request's (a proxy that sends `Connection: close` upstream gets the socket closed after the stream, never reused). The first lines are `retry: <retryMs>` and `event: dokebi-open` (data `{"retryMs":…}`). The Fastify response is hijacked and written directly, so no compression hook applies (dokebi-web does not compress).
 - Refusals: another origin (not listed) 403 `ORIGIN_FORBIDDEN`; before start or while stopping 503 (dokebi-web `STARTING`, `DRAINING`; this plugin `CLOSING`); full 503 `CAPACITY` (`Retry-After: 5`); no authentication 401; an `authorization.valid()` that throws 500 `AUTHORIZATION_FAILED` (error `SSE_AUTHORIZATION_FAILED`); the session save before the stream failed 500 `COMMIT_FAILED` (below). EventSource cannot see these statuses (the client below tells them apart with a probe). For a listed foreign origin (`origins`) the 401, 503 and 500 refusals carry the same CORS headers as the stream, so a page of that origin (and the client's probe) can read them; another origin's 403 carries none.
 - Cookies (D-0089): the stream hijacks the Fastify reply, so **no onSend hook runs**. Just before it writes the head (after origin, capacity, `authenticate` and the probe), the stream runs the before-hijack steps that plugins register for the work they otherwise do in onSend — the @dokebi/session save (or rolling refresh) and the @dokebi/auth cookies (a remember-me restore by a `required` guard rotates the token) — and waits for them, at most `beforeStreamTimeoutMs` (5 s). Then every `Set-Cookie` on the reply (those steps, a hook, a guard) is written with the stream head; browsers apply it on the SSE 200. A step that fails or times out refuses the stream: 500 `{ error: 'COMMIT_FAILED' }`, error `SSE_COMMIT_FAILED` (the full cause). After the head the request's session is final (a change throws `CLOSED`). The steps are matched by name only (`Symbol.for('dokebi.web.beforeHijack')` on the Fastify instance): this package imports neither plugin. (The `dokebiProbe` answer below is a normal reply and runs onSend instead.)
 - `?dokebiProbe=1`: checks only origin, capacity and authentication and answers 204 (no stream is opened). The browser client uses it to find out why a connection failed.
@@ -135,7 +135,7 @@ events.close(); events.reconnect();
 
 ## 5a. Seal hosts (D-0062)
 
-On streams of a seal host (@dokebi/app `domains.<host>.seal: true`) or of a `seal: true` web route, **the data of every event** (including `dokebi-open`, `dokebi-reload` and `dokebi-restart`) is sealed with that stream's path (`E:<ts>:<b64>`, dokebi-web `sealOf`). Event names and ids stay plain. Plain streams share one buffer; only sealed streams seal per receiver. A failed seal ends that stream (`SEAL_ENCODE_FAILED`; never sent in plain text). Browser: `connectEvents({ ..., seal: currentSealBridge() })` (`@dokebi/seal/http`; undefined on plain pages, so the same code works). With a bridge, plain data is refused as `SEAL_FAILED`; without one, sealed data is refused as `SEAL_BRIDGE_MISSING` (neither reaches the handler).
+On streams of a seal host (@dokebi/app `domains.<host>.seal: true`) or of a `seal: true` web route, **the data of every event** (including `dokebi-open`, `dokebi-reload` and `dokebi-restart`) is sealed with that stream's path (`E:<ts>:<b64>`, dokebi-web `sealOf`). Event names and ids stay plain. Plain streams share one buffer; only sealed streams seal per receiver. A failed seal ends that stream (`SEAL_ENCODE_FAILED`; never sent in plain text); when it is the first frame (`dokebi-open`, `dokebi-reload`) that cannot be sealed, the request is refused with 500 `SEAL_FAILED` before the stream head. Browser: `connectEvents({ ..., seal: currentSealBridge() })` (`@dokebi/seal/http`; undefined on plain pages, so the same code works). With a bridge, plain data is refused as `SEAL_FAILED`; without one, sealed data is refused as `SEAL_BRIDGE_MISSING` (neither reaches the handler).
 
 ## 6. Several workers and servers
 

package/dist/gateway.js

@@ -341,6 +341,18 @@ export class Gateway {
         // D-0062: a stream of a seal host seals the data of every event, its first ones included.
         const seal = this.web.sealOf(request);
         const data = (json) => (seal ? seal.encode(json) : json);
+        // The first frame is made before the reply is hijacked: a seal that fails here still has a
+        // reply to refuse with. Made after the head (audit R9-g11-2), the exception left a hijacked
+        // response that was never ended: no stream entry, no ping, nothing drain could end.
+        const first = (event, value) => {
+            try {
+                return frame(undefined, event, data(JSON.stringify(value)));
+            }
+            catch (error) {
+                this.#throttle.log('error', 'SSE first frame seal failed; stream refused', 'SEAL_ENCODE_FAILED', error, { path: route.path, routeId: registered.id });
+                return undefined;
+            }
+        };
         if (route.version !== undefined) {
             const sent = single(query.dokebiVersion) ?? single(request.headers['x-dokebi-version']);
             if (sent !== route.version) {
@@ -349,12 +361,18 @@ export class Gateway {
                     expected: route.version,
                     received: typeof sent === 'string' ? sent.slice(0, 64) : null,
                 });
+                const reload = first(RELOAD_EVENT, { version: route.version });
+                if (reload === undefined)
+                    return refuse(500, { error: 'SEAL_FAILED' });
                 reply.hijack();
                 res.writeHead(200, headers);
-                res.end(`retry: ${this.options.reloadRetryMs}\n${frame(undefined, RELOAD_EVENT, data(JSON.stringify({ version: route.version })))}`);
+                res.end(`retry: ${this.options.reloadRetryMs}\n${reload}`);
                 return;
             }
         }
+        const opening = first(OPEN_EVENT, { retryMs: this.options.retryMs });
+        if (opening === undefined)
+            return refuse(500, { error: 'SEAL_FAILED' });
         const header = single(request.headers['last-event-id']);
         const asked = header ?? single(query.lastEventId);
         const lastEventId = typeof asked === 'string' && asked.length <= MAX_TEXT && isLine(asked) ? asked : undefined;
@@ -366,7 +384,7 @@ export class Gateway {
         res.writeHead(200, headers);
         // The reconnect hint first, and the same value as data for clients that manage reconnects
         // themselves (EventSource does not expose `retry:`).
-        res.write(`retry: ${this.options.retryMs}\n${frame(undefined, OPEN_EVENT, data(JSON.stringify({ retryMs: this.options.retryMs })))}`);
+        res.write(`retry: ${this.options.retryMs}\n${opening}`);
         const entry = this.#add(res, identity, route, rooms, lastEventId, seal);
         res.once('close', () => this.#closed(entry));
         if (identity.authorization) {

package/dist/plugin.js

@@ -109,7 +109,7 @@ class SseRuntime {
 /** Factory input: `{ app, options? }`. Options default to `app.config['dokebi-sse']`. */
 export const createPlugin = definePlugin({
     name: 'dokebi-sse',
-    version: '0.4.3',
+    version: '0.4.5',
     core: '^0.4.2',
     // The declaration (not parseOptions) so core logs OPTION_DEPRECATED for old keys (bus, closeTimeoutMs).
     options: declaration,

package/dist/wire.d.ts

@@ -13,5 +13,4 @@ export declare const HEADERS: Readonly<{
     'content-type': "text/event-stream; charset=utf-8";
     'cache-control': "no-cache, no-transform";
     'x-accel-buffering': "no";
-    connection: "keep-alive";
 }>;

package/dist/wire.js

@@ -40,5 +40,7 @@ export const HEADERS = Object.freeze({
     'cache-control': 'no-cache, no-transform',
     // nginx: do not buffer this response.
     'x-accel-buffering': 'no',
-    connection: 'keep-alive',
+    // No `connection`: Node answers the request's own (keep-alive, or close when the proxy asked to
+    // close). A forced keep-alive kept a socket the proxy had closed for itself, and the request it
+    // sent next on it was refused by Node's parser with a bare 400 (HPE_CLOSED_CONNECTION).
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/sse",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Server-sent events for @dokebi/web: authenticated streams, rooms, cross-worker fan-out over @dokebi/event-bus, and a browser client",
   "keywords": [
     "dokebi",
@@ -68,12 +68,12 @@
     }
   },
   "devDependencies": {
-    "@dokebi/cluster": "0.4.1",
-    "@dokebi/config": "0.4.4",
-    "@dokebi/event-bus": "0.4.2",
+    "@dokebi/cluster": "0.4.2",
+    "@dokebi/config": "0.4.6",
+    "@dokebi/event-bus": "0.4.3",
     "@dokebi/health": "0.4.1",
-    "@dokebi/nats": "0.4.1",
-    "@dokebi/web": "0.4.3",
+    "@dokebi/nats": "0.4.2",
+    "@dokebi/web": "0.4.7",
     "react": "19.3.0",
     "react-test-renderer": "19.3.0",
     "vite": "8.3.4",