@gravity-rail/sdk 0.36.0 → 0.40.0

package/dist/realtime.d.cts

@@ -1,5 +1,5 @@
-import { R as RealtimeSessionBase, a as ChannelListener, U as Unsubscribe, b as RealtimeAuthSession, A as AccountRealtimeSession, O as OperatorSessionState, c as OperatorCallPhase, C as ChannelEvent } from './types-0c6_NGU4.cjs';
-export { d as ACCOUNT_ACTIVITY_CHANNEL, e as ACCOUNT_PRESENCE_CHANNEL, f as ACTIVITY_CHANNEL, g as ACTIVITY_MEMBER_CHANNEL, h as ActivityChannelName, i as ActivityInvalidationEvent, P as PRESENCE_CHANNEL, j as isActiveCallPhase, k as isActivityInvalidation } from './types-0c6_NGU4.cjs';
+import { R as RealtimeSessionBase, a as ChannelListener, U as Unsubscribe, b as RealtimeAuthSession, A as AccountRealtimeSession, O as OperatorSessionState, c as OperatorCallPhase, C as ChannelEvent } from './types-DlfADjPR.cjs';
+export { d as ACCOUNT_ACTIVITY_CHANNEL, e as ACCOUNT_PRESENCE_CHANNEL, f as ACTIVITY_CHANNEL, g as ACTIVITY_MEMBER_CHANNEL, h as ActivityChannelName, i as ActivityInvalidationEvent, P as PRESENCE_CHANNEL, j as RealtimeLoginTokenProvider, k as isActiveCallPhase, l as isActivityInvalidation } from './types-DlfADjPR.cjs';
 
 /**
  * The realtime socket state machine, shared by both mounts.
@@ -47,9 +47,9 @@ declare abstract class RealtimeSocketClient<TSession extends RealtimeSessionBase
     /**
      * Whether replacing `previous` with `next` invalidates the open socket.
      *
-     * The token always does; the rest is mount-specific — a workspace client
-     * changing workspace is a different socket, and an account client has no
-     * such axis.
+     * A different login-token provider always does — it stands for a different
+     * identity; the rest is mount-specific — a workspace client changing
+     * workspace is a different socket, and an account client has no such axis.
      */
     protected sessionRequiresReconnect(previous: TSession | null, next: TSession): boolean;
     protected resolveSession(): TSession | null;
@@ -93,13 +93,29 @@ declare abstract class RealtimeSocketClient<TSession extends RealtimeSessionBase
     /** The last failure the socket gave up on, or null. See {@link SocketState.lastError}. */
     getLastError(): string | null;
     protected ensureConnection(): void;
+    /**
+     * Mint this attempt's login token, then open the socket with it.
+     *
+     * A fresh token per attempt, reconnects included: a browser's token is
+     * single-use and expires in seconds, so a token from an earlier attempt is
+     * already spent.
+     */
+    private openSocket;
+    /**
+     * End an attempt that never opened a socket. No `onclose` will run for it,
+     * so the retry decision is made here, on the normal backoff.
+     */
+    private releaseUnopenedAttempt;
+    /** Decide whether a connection that just ended (or never opened) retries. */
+    private afterConnectionEnded;
     protected closeConnection(): void;
 }
 
 /**
  * Unified workspace WebSocket client for real-time events.
  *
- * Mirrors `/api/v2/w/{wid}/ws/realtime`: login with OAuth access token,
+ * Mirrors `/api/v2/w/{wid}/ws/realtime`: log in with a token from the session's
+ * `getLoginToken` provider (fresh per connect attempt),
  * subscribe to channels, receive AGUI events.
  *
  * The socket state machine — login, heartbeat, reconnect, subscribe retry —
@@ -136,7 +152,7 @@ declare function isWorkspaceSocketConnected(): boolean;
  * Account WebSocket client — one socket per tab, rooted at the Account.
  *
  * Mirrors `/api/v2/ws/realtime`. No workspace in the URL and none in the
- * session: the token is the whole identity, and what the socket may see comes
+ * session: the login token is the whole identity, and what the socket may see comes
  * from the server's grant map, refreshed there.
  *
  * See `docs/projects/active/account-socket.md`. The point is not a second
@@ -148,7 +164,7 @@ declare function isWorkspaceSocketConnected(): boolean;
  * deleted at cutover rather than lived alongside.
  *
  * ```ts
- * const client = new AccountRealtimeClient({ apiUrl, accessToken });
+ * const client = new AccountRealtimeClient({ apiUrl, getLoginToken });
  * client.subscribe(workspaceChannel(wid, 'activity'), onInvalidate);
  * client.subscribe(ACCOUNT_ACTIVITY_CHANNEL, onInvalidate);
  * ```
@@ -188,6 +204,13 @@ declare function subscribeAccountChannel(channel: string, listener: ChannelListe
 declare function onAccountSocketConnection(listener: (connected: boolean) => void): () => void;
 declare function isAccountSocketConnected(): boolean;
 
+/**
+ * How long one connect attempt waits for its login token. A provider that
+ * never settles (a hung mint request) must not hold the attempt open forever:
+ * past this the attempt fails like any other and the caller's backoff applies.
+ */
+declare const LOGIN_TOKEN_TIMEOUT_MS = 10000;
+
 /**
  * Human operator session WebSocket client.
  *
@@ -220,6 +243,8 @@ declare class OperatorSessionClient {
     private heartbeatTimer;
     private sessionCloseNotified;
     private intentionalDisconnect;
+    /** Bumped by every connect and disconnect; a stale connect stops at its next await. */
+    private connectGeneration;
     constructor(handlers?: OperatorSessionHandlers);
     getSessionState(): OperatorSessionState;
     getCallPhase(): OperatorCallPhase;
@@ -269,4 +294,4 @@ declare class OperatorSessionClient {
     disconnect(): Promise<void>;
 }
 
-export { AccountRealtimeClient, AccountRealtimeSession, ChannelEvent, ChannelListener, OperatorCallPhase, OperatorSessionClient, type OperatorSessionHandlers, OperatorSessionState, type ProtocolInitMessage, RealtimeAuthSession, RealtimeSessionBase, RealtimeSocketClient, Unsubscribe, WorkspaceRealtimeClient, buildAccountWsUrl, buildWorkspaceWsUrl, initAccountSocket, initWorkspaceSocket, isAccountSocketConnected, isWorkspaceSocketConnected, onAccountSocketConnection, onWorkspaceSocketConnection, subscribeAccountChannel, subscribeWorkspaceChannel, workspaceChannel };
+export { AccountRealtimeClient, AccountRealtimeSession, ChannelEvent, ChannelListener, LOGIN_TOKEN_TIMEOUT_MS, OperatorCallPhase, OperatorSessionClient, type OperatorSessionHandlers, OperatorSessionState, type ProtocolInitMessage, RealtimeAuthSession, RealtimeSessionBase, RealtimeSocketClient, Unsubscribe, WorkspaceRealtimeClient, buildAccountWsUrl, buildWorkspaceWsUrl, initAccountSocket, initWorkspaceSocket, isAccountSocketConnected, isWorkspaceSocketConnected, onAccountSocketConnection, onWorkspaceSocketConnection, subscribeAccountChannel, subscribeWorkspaceChannel, workspaceChannel };

package/dist/realtime.d.ts

@@ -1,5 +1,5 @@
-import { R as RealtimeSessionBase, a as ChannelListener, U as Unsubscribe, b as RealtimeAuthSession, A as AccountRealtimeSession, O as OperatorSessionState, c as OperatorCallPhase, C as ChannelEvent } from './types-0c6_NGU4.js';
-export { d as ACCOUNT_ACTIVITY_CHANNEL, e as ACCOUNT_PRESENCE_CHANNEL, f as ACTIVITY_CHANNEL, g as ACTIVITY_MEMBER_CHANNEL, h as ActivityChannelName, i as ActivityInvalidationEvent, P as PRESENCE_CHANNEL, j as isActiveCallPhase, k as isActivityInvalidation } from './types-0c6_NGU4.js';
+import { R as RealtimeSessionBase, a as ChannelListener, U as Unsubscribe, b as RealtimeAuthSession, A as AccountRealtimeSession, O as OperatorSessionState, c as OperatorCallPhase, C as ChannelEvent } from './types-DlfADjPR.js';
+export { d as ACCOUNT_ACTIVITY_CHANNEL, e as ACCOUNT_PRESENCE_CHANNEL, f as ACTIVITY_CHANNEL, g as ACTIVITY_MEMBER_CHANNEL, h as ActivityChannelName, i as ActivityInvalidationEvent, P as PRESENCE_CHANNEL, j as RealtimeLoginTokenProvider, k as isActiveCallPhase, l as isActivityInvalidation } from './types-DlfADjPR.js';
 
 /**
  * The realtime socket state machine, shared by both mounts.
@@ -47,9 +47,9 @@ declare abstract class RealtimeSocketClient<TSession extends RealtimeSessionBase
     /**
      * Whether replacing `previous` with `next` invalidates the open socket.
      *
-     * The token always does; the rest is mount-specific — a workspace client
-     * changing workspace is a different socket, and an account client has no
-     * such axis.
+     * A different login-token provider always does — it stands for a different
+     * identity; the rest is mount-specific — a workspace client changing
+     * workspace is a different socket, and an account client has no such axis.
      */
     protected sessionRequiresReconnect(previous: TSession | null, next: TSession): boolean;
     protected resolveSession(): TSession | null;
@@ -93,13 +93,29 @@ declare abstract class RealtimeSocketClient<TSession extends RealtimeSessionBase
     /** The last failure the socket gave up on, or null. See {@link SocketState.lastError}. */
     getLastError(): string | null;
     protected ensureConnection(): void;
+    /**
+     * Mint this attempt's login token, then open the socket with it.
+     *
+     * A fresh token per attempt, reconnects included: a browser's token is
+     * single-use and expires in seconds, so a token from an earlier attempt is
+     * already spent.
+     */
+    private openSocket;
+    /**
+     * End an attempt that never opened a socket. No `onclose` will run for it,
+     * so the retry decision is made here, on the normal backoff.
+     */
+    private releaseUnopenedAttempt;
+    /** Decide whether a connection that just ended (or never opened) retries. */
+    private afterConnectionEnded;
     protected closeConnection(): void;
 }
 
 /**
  * Unified workspace WebSocket client for real-time events.
  *
- * Mirrors `/api/v2/w/{wid}/ws/realtime`: login with OAuth access token,
+ * Mirrors `/api/v2/w/{wid}/ws/realtime`: log in with a token from the session's
+ * `getLoginToken` provider (fresh per connect attempt),
  * subscribe to channels, receive AGUI events.
  *
  * The socket state machine — login, heartbeat, reconnect, subscribe retry —
@@ -136,7 +152,7 @@ declare function isWorkspaceSocketConnected(): boolean;
  * Account WebSocket client — one socket per tab, rooted at the Account.
  *
  * Mirrors `/api/v2/ws/realtime`. No workspace in the URL and none in the
- * session: the token is the whole identity, and what the socket may see comes
+ * session: the login token is the whole identity, and what the socket may see comes
  * from the server's grant map, refreshed there.
  *
  * See `docs/projects/active/account-socket.md`. The point is not a second
@@ -148,7 +164,7 @@ declare function isWorkspaceSocketConnected(): boolean;
  * deleted at cutover rather than lived alongside.
  *
  * ```ts
- * const client = new AccountRealtimeClient({ apiUrl, accessToken });
+ * const client = new AccountRealtimeClient({ apiUrl, getLoginToken });
  * client.subscribe(workspaceChannel(wid, 'activity'), onInvalidate);
  * client.subscribe(ACCOUNT_ACTIVITY_CHANNEL, onInvalidate);
  * ```
@@ -188,6 +204,13 @@ declare function subscribeAccountChannel(channel: string, listener: ChannelListe
 declare function onAccountSocketConnection(listener: (connected: boolean) => void): () => void;
 declare function isAccountSocketConnected(): boolean;
 
+/**
+ * How long one connect attempt waits for its login token. A provider that
+ * never settles (a hung mint request) must not hold the attempt open forever:
+ * past this the attempt fails like any other and the caller's backoff applies.
+ */
+declare const LOGIN_TOKEN_TIMEOUT_MS = 10000;
+
 /**
  * Human operator session WebSocket client.
  *
@@ -220,6 +243,8 @@ declare class OperatorSessionClient {
     private heartbeatTimer;
     private sessionCloseNotified;
     private intentionalDisconnect;
+    /** Bumped by every connect and disconnect; a stale connect stops at its next await. */
+    private connectGeneration;
     constructor(handlers?: OperatorSessionHandlers);
     getSessionState(): OperatorSessionState;
     getCallPhase(): OperatorCallPhase;
@@ -269,4 +294,4 @@ declare class OperatorSessionClient {
     disconnect(): Promise<void>;
 }
 
-export { AccountRealtimeClient, AccountRealtimeSession, ChannelEvent, ChannelListener, OperatorCallPhase, OperatorSessionClient, type OperatorSessionHandlers, OperatorSessionState, type ProtocolInitMessage, RealtimeAuthSession, RealtimeSessionBase, RealtimeSocketClient, Unsubscribe, WorkspaceRealtimeClient, buildAccountWsUrl, buildWorkspaceWsUrl, initAccountSocket, initWorkspaceSocket, isAccountSocketConnected, isWorkspaceSocketConnected, onAccountSocketConnection, onWorkspaceSocketConnection, subscribeAccountChannel, subscribeWorkspaceChannel, workspaceChannel };
+export { AccountRealtimeClient, AccountRealtimeSession, ChannelEvent, ChannelListener, LOGIN_TOKEN_TIMEOUT_MS, OperatorCallPhase, OperatorSessionClient, type OperatorSessionHandlers, OperatorSessionState, type ProtocolInitMessage, RealtimeAuthSession, RealtimeSessionBase, RealtimeSocketClient, Unsubscribe, WorkspaceRealtimeClient, buildAccountWsUrl, buildWorkspaceWsUrl, initAccountSocket, initWorkspaceSocket, isAccountSocketConnected, isWorkspaceSocketConnected, onAccountSocketConnection, onWorkspaceSocketConnection, subscribeAccountChannel, subscribeWorkspaceChannel, workspaceChannel };

package/dist/realtime.js

@@ -22,6 +22,25 @@ function isActivityInvalidation(event) {
   return scope === "workspace" || scope === "member" || scope === "account";
 }
 
+// src/realtime/login-token.ts
+var LOGIN_TOKEN_TIMEOUT_MS = 1e4;
+async function mintLoginToken(provider) {
+  let timer;
+  try {
+    const token = await Promise.race([
+      provider(),
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), LOGIN_TOKEN_TIMEOUT_MS);
+      })
+    ]);
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+
 // src/realtime/socket-client.ts
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var RECONNECT_DELAY_MS = 3e3;
@@ -44,7 +63,8 @@ function createSocketState() {
     reconnectTimer: null,
     heartbeatTimer: null,
     closeTimer: null,
-    intentionalClose: false
+    intentionalClose: false,
+    connectGeneration: 0
   };
 }
 var RealtimeSocketClient = class {
@@ -65,12 +85,12 @@ var RealtimeSocketClient = class {
   /**
    * Whether replacing `previous` with `next` invalidates the open socket.
    *
-   * The token always does; the rest is mount-specific — a workspace client
-   * changing workspace is a different socket, and an account client has no
-   * such axis.
+   * A different login-token provider always does — it stands for a different
+   * identity; the rest is mount-specific — a workspace client changing
+   * workspace is a different socket, and an account client has no such axis.
    */
   sessionRequiresReconnect(previous, next) {
-    return previous?.accessToken !== next.accessToken || previous?.apiUrl !== next.apiUrl;
+    return previous?.getLoginToken !== next.getLoginToken || previous?.apiUrl !== next.apiUrl;
   }
   resolveSession() {
     return this.session ?? this.getSessionFn?.() ?? null;
@@ -135,7 +155,7 @@ var RealtimeSocketClient = class {
   setSession(session) {
     const changed = this.sessionRequiresReconnect(this.session, session);
     this.session = session;
-    if (changed && this.state.ws) {
+    if (changed && (this.state.ws || this.state.connecting)) {
       this.closeConnection();
     }
     if (this.state.listeners.size > 0) {
@@ -234,10 +254,33 @@ var RealtimeSocketClient = class {
     this.clearCloseTimer();
     this.state.connecting = true;
     this.state.intentionalClose = false;
+    const generation = ++this.state.connectGeneration;
     this.notifyConnectionListeners();
-    const ws = new WebSocket(this.buildUrl(session));
+    void this.openSocket(session, generation);
+  }
+  /**
+   * Mint this attempt's login token, then open the socket with it.
+   *
+   * A fresh token per attempt, reconnects included: a browser's token is
+   * single-use and expires in seconds, so a token from an earlier attempt is
+   * already spent.
+   */
+  async openSocket(session, generation) {
+    const token = await mintLoginToken(session.getLoginToken);
+    if (generation !== this.state.connectGeneration) return;
+    if (!token) {
+      this.releaseUnopenedAttempt();
+      return;
+    }
+    let ws;
+    try {
+      ws = new WebSocket(this.buildUrl(session));
+    } catch {
+      this.releaseUnopenedAttempt();
+      return;
+    }
     ws.onopen = () => {
-      ws.send(JSON.stringify({ type: "login", token: session.accessToken }));
+      ws.send(JSON.stringify({ type: "login", token }));
     };
     ws.onmessage = (event) => {
       if (this.state.ws !== null && this.state.ws !== ws) return;
@@ -331,24 +374,37 @@ var RealtimeSocketClient = class {
         clearInterval(this.state.heartbeatTimer);
         this.state.heartbeatTimer = null;
       }
-      const willRetry = !this.state.intentionalClose && this.state.listeners.size > 0 && this.state.reconnectAttempts < MAX_RECONNECT_ATTEMPTS;
-      if (!willRetry && !this.state.intentionalClose && this.state.listeners.size > 0) {
-        this.state.lastError = "Realtime connection lost";
-      }
-      this.notifyConnectionListeners();
-      if (willRetry) {
-        this.state.reconnectAttempts += 1;
-        this.state.reconnectTimer = setTimeout(() => {
-          this.ensureConnection();
-        }, RECONNECT_DELAY_MS * this.state.reconnectAttempts);
-      }
+      this.afterConnectionEnded();
     };
     ws.onerror = () => {
     };
     this.state.ws = ws;
   }
+  /**
+   * End an attempt that never opened a socket. No `onclose` will run for it,
+   * so the retry decision is made here, on the normal backoff.
+   */
+  releaseUnopenedAttempt() {
+    this.state.connecting = false;
+    this.afterConnectionEnded();
+  }
+  /** Decide whether a connection that just ended (or never opened) retries. */
+  afterConnectionEnded() {
+    const willRetry = !this.state.intentionalClose && this.state.listeners.size > 0 && this.state.reconnectAttempts < MAX_RECONNECT_ATTEMPTS;
+    if (!willRetry && !this.state.intentionalClose && this.state.listeners.size > 0) {
+      this.state.lastError = "Realtime connection lost";
+    }
+    this.notifyConnectionListeners();
+    if (willRetry) {
+      this.state.reconnectAttempts += 1;
+      this.state.reconnectTimer = setTimeout(() => {
+        this.ensureConnection();
+      }, RECONNECT_DELAY_MS * this.state.reconnectAttempts);
+    }
+  }
   closeConnection() {
     this.state.intentionalClose = true;
+    this.state.connectGeneration += 1;
     this.clearCloseTimer();
     if (this.state.reconnectTimer) {
       clearTimeout(this.state.reconnectTimer);
@@ -490,6 +546,8 @@ var OperatorSessionClient = class {
   heartbeatTimer = null;
   sessionCloseNotified = false;
   intentionalDisconnect = false;
+  /** Bumped by every connect and disconnect; a stale connect stops at its next await. */
+  connectGeneration = 0;
   getSessionState() {
     return this.sessionState;
   }
@@ -514,17 +572,27 @@ var OperatorSessionClient = class {
       throw new Error("Operator session WebSocket is not available in this environment");
     }
     await this.disconnect();
+    const generation = ++this.connectGeneration;
     this.sessionCloseNotified = false;
     this.setSessionState("connecting");
     this.setCallPhase("connecting");
     const isSsl = session.apiUrl.startsWith("https");
     const host = session.apiUrl.replace(/^https?:\/\//, "");
     const wsUrl = `${isSsl ? "wss" : "ws"}://${host}/api/v2/w/${session.workspaceUuid}/operator/chats/${chatId}/session-ws`;
+    const token = await mintLoginToken(session.getLoginToken);
+    if (generation !== this.connectGeneration) {
+      throw new Error("Operator session connect superseded");
+    }
+    if (!token) {
+      this.setSessionState("error");
+      this.setCallPhase("idle");
+      throw new Error("Realtime login token unavailable");
+    }
     await new Promise((resolve, reject) => {
       const ws = new WebSocket(wsUrl);
       this.ws = ws;
       ws.onopen = () => {
-        ws.send(JSON.stringify({ type: "login", token: session.accessToken }));
+        ws.send(JSON.stringify({ type: "login", token }));
       };
       ws.onmessage = (event) => {
         try {
@@ -825,6 +893,7 @@ var OperatorSessionClient = class {
     this.nextPlaybackTime = 0;
   }
   async disconnect() {
+    this.connectGeneration += 1;
     this.intentionalDisconnect = true;
     if (this.callPhase === "dialing" || this.callPhase === "live" || this.callPhase === "onHold") {
       this.hangUp();
@@ -853,6 +922,7 @@ export {
   ACTIVITY_CHANNEL,
   ACTIVITY_MEMBER_CHANNEL,
   AccountRealtimeClient,
+  LOGIN_TOKEN_TIMEOUT_MS,
   OperatorSessionClient,
   PRESENCE_CHANNEL,
   RealtimeSocketClient,